{ "Event": { "published": true, "date": "2023-10-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-01", "timestamp": 1696204981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "db423e0b-9181-4011-add3-ec01e126ed06", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f379a8-6059-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696164587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164587, "uuid": "bbaddf9b-16f8-47d2-924b-7874de93d842", "comment": "Malware payload (Tofsee)", "value": "27ad29d39afbf68d4b7e7a1f1e4239ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164587, "uuid": "e2100090-fd60-4a66-ab63-ba8727d241d8", "comment": "Malware payload (Tofsee)", "value": "001432c76312f051520101ffc64f4efc57d8a2ef008c21805531aec6faad2f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164587, "uuid": "b4762a9b-2932-4506-82ec-1dea065d23f8", "comment": "Malware payload (Tofsee)", "value": "cff815518134141c655f50e834464f875a92717b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164587, "uuid": "296edf98-1c05-4763-a7f5-48cc9f08a510", "comment": "Malware payload (Tofsee)", "value": "3ef09e569c9c9d53a3e84e7838ec1c352097efc44c7a159a9db39d7f7ab4ce4d78e11b93e9dbae75b4a0b383eb39ebc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164587, "uuid": "807112fa-9da0-48b3-9ee9-2f1797e06a52", "value": "T17714CE2135F0C03DD3A786788D75BA98693FB8725770859F2314276F5E302E18B6A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164587, "uuid": "af79a78c-4fc5-4724-93c7-c3f5184e9b1d", "value": "93d103d7b72d447eca6f713c27a7a3a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164587, "uuid": "32efc594-79e4-4c9c-b1f9-e1c5cdb1f662", "value": "3072:Aq+XiRT0U9Vr40wP80E3ktFx9jR3yFxdXEqCCCCG6D+5vOfje:Aiz9Vc0UnjtFvR3Jq5bDUOfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696164587, "uuid": "2f950add-3fe1-4d57-a07c-a29790dcbe1a", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696164587, "uuid": "7ef64b3b-b23c-44e4-a440-53389d0604d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164587, "uuid": "a37ee771-93f7-4d01-97b9-d77d1e159a7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f4fafd-602f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146555, "uuid": "a49ea03e-2805-465b-9015-56fdd35ef093", "comment": "Malware payload (Mirai)", "value": "56e8f7ef19a045f2b949f850e288cd37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146555, "uuid": "dd6b2464-b9c7-4079-8cb1-14d4dba39f84", "comment": "Malware payload (Mirai)", "value": "00a88074e74a836c25376b8366bc0ea099cde2a3abfbad41b016d10879e99bd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146555, "uuid": "0af73ac7-8c3a-40ea-bd2b-d32c954c4150", "comment": "Malware payload (Mirai)", "value": "ee1604bf302ea922a1461a02b879c9beb5795a6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146555, "uuid": "0ec5d87c-e5b8-498f-89dc-ad9be8549af4", "comment": "Malware payload (Mirai)", "value": "22548eb1e7db952b01d204b069b43c9865e715e739e6a6845bbe82e5d42196b2320fb82e75821005541d25d9302fff61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146555, "uuid": "15eabdb0-88d1-495d-917e-c36e7ffaa4c6", "value": "T186D2E1026641FEE1C5B00232E9668A9B72253D75D0D170FB9B3C0DF8B6E9A1D47F8943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146555, "uuid": "a4abf725-eea8-4335-b75e-3571881e0a99", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXge9q3UEL7g:WRwynNIOQQ1KMwDL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146555, "uuid": "dfe30a3c-71b9-4b33-bdbc-37fc4f7d8d08", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146555, "uuid": "2831f426-c4e4-4d80-8546-ec80c21d0ba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146555, "uuid": "4543178e-ab71-4bd6-a450-0e655b00a497", "value": "56e8f7ef19a045f2b949f850e288cd37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fafe4e7-6058-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696164236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164236, "uuid": "50441069-8ce3-4649-bed5-a3f3068c5ead", "comment": "Malware payload (RedLineStealer)", "value": "907ed8bbbc6db8a422da71edde01bcef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164236, "uuid": "f9ef0fc4-8745-4bca-99be-d1ecfadb081c", "comment": "Malware payload (RedLineStealer)", "value": "07418be432445fe82c8f7240b5bf36743db92d0b8a92db761bc7267ef1823d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164236, "uuid": "f31dd904-cb06-499c-a648-6870d62ec85a", "comment": "Malware payload (RedLineStealer)", "value": "a311bd5760402358fe54e24e94cb65b6da18e247", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164236, "uuid": "3abcce53-f137-4c97-89fc-3acdb73e7faf", "comment": "Malware payload (RedLineStealer)", "value": "fd161042ce1fcd90458019ee93081c2b3a563e033cd33a91e297760f0b50a2ad581bb1e7fd68e1bccc848b971d21cc77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164236, "uuid": "95fe4a08-3697-46a6-a111-6dbf12f1da75", "value": "T1BB74F16136B0C031E9B7C9756535EE94AE7FB8636AB0855F3350163E1E302D0AB7A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164236, "uuid": "ac6a8535-c48b-4069-9d68-05f18eadb064", "value": "93d103d7b72d447eca6f713c27a7a3a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164236, "uuid": "8e2104a7-e689-422a-8697-7b70550674ad", "value": "6144:gaO9+BF2vAQ9efhzM/SYpj4xr8e668Pf3880c8c:gaORI2wtYrpj4u28X38rcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696164236, "uuid": "e76c3575-e197-4d40-aff5-36f199673d55", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696164236, "uuid": "1d949fae-eb66-4058-b2fa-272f8cc77d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164236, "uuid": "dacde8e6-d501-456d-8766-da62ca4d5a2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee36957-6069-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696171805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171805, "uuid": "36d3985a-0f10-4771-b234-0935c6f32aa8", "comment": "Malware payload (Mirai)", "value": "95e813075034c19d4059daf502745ab9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171805, "uuid": "fd64a48e-761d-491d-996d-446b53966b87", "comment": "Malware payload (Mirai)", "value": "0774ac44c906a4612d13aef5ea11620de133ea8806f55c28a1752a211010f9b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171805, "uuid": "98b81a59-526a-4bf3-be6c-0e2d5e784525", "comment": "Malware payload (Mirai)", "value": "d755eba05bc3a68b73051c612f79f5a81f968650", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171805, "uuid": "f941f677-feaf-481c-882a-2b54d28a8808", "comment": "Malware payload (Mirai)", "value": "d92212eb47aa5aeec6069f8e31692b1d6f536ecd31952f27953996ec085d15972347501c2988704a1ade34ba7d209439", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171805, "uuid": "4a95db18-73a1-4554-a2d8-d73fb7c04a78", "value": "T18533F145B004B522C7703637F83611D3BF491BFAD2E23437092943A8E8E84A37AF6C92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171805, "uuid": "71b10fc2-81fa-4030-a4a2-f7496f6e09f0", "value": "768:BMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrRUaj9q3UELbOs82:BM84ISRX63dZQbS5rzZmaiLIVmWji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171805, "uuid": "573fdc35-9166-40a4-82d4-681f8394b2a1", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171805, "uuid": "5ef30eda-7ffd-468f-bb07-6ca28d207877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171805, "uuid": "55acfb87-0aba-4b01-b5d2-75737bf55ced", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5094b352-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146253, "uuid": "a5e42be0-9c35-4d0d-8c91-7a73c2620d1a", "comment": "Malware payload (Mirai)", "value": "a88476b0fbc30e9a46a459a65466eea7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146253, "uuid": "c79584a1-1431-43b5-86f0-46365bab5e04", "comment": "Malware payload (Mirai)", "value": "07d000cd41af12cda5ca57be106cf6c1f3fc8a4251c8f1fae7797800d6905a71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146253, "uuid": "8253e116-208f-4518-bfc7-330e6f51218b", "comment": "Malware payload (Mirai)", "value": "ee471065e2ad84ccc1e60e5b9062a1f38e66ecbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146253, "uuid": "af1e0617-d87e-4287-bfec-be6c513007c0", "comment": "Malware payload (Mirai)", "value": "8a2ae639a1aa4c95734dfb03fc23d4db5a0c2a10b09645123d706d5365ac308c20e26cf3f9537d063f73186248a193ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146253, "uuid": "80f54ba2-5367-449d-9d32-66daa51b84e7", "value": "T151D2E04972D793FA8CCAD5BD371F102630BEB5B672A1A327B206C8574776280E681E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146253, "uuid": "4eb84eda-d0bb-45ff-b726-db0f572cd4ac", "value": "768:7lxKd294CxEnsU96IHE4RlY99uGwnzk9a:ed29tnUFHEw0Gzk9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146253, "uuid": "a14ee784-832f-4691-b587-9eca17fc2332", "value": 29680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146253, "uuid": "be1dc666-7947-4a23-beb9-9c63ffd60999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146253, "uuid": "c2cf9f1d-6720-41bc-ba2b-4cc6f517604c", "value": "a88476b0fbc30e9a46a459a65466eea7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5d5ec3-603e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696153091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696153091, "uuid": "c516c445-2cbc-4ed7-b940-907842771222", "comment": "Malware payload (Stealc)", "value": "ca3f920f586bc08104b6c36cbf993667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696153091, "uuid": "8d993f7d-4bc2-4bf6-b0ad-6106f385cb4e", "comment": "Malware payload (Stealc)", "value": "07f743e4eed0f2153b18bc67b807e5b87e529c7c1cc85fa046a01f9367c95894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696153091, "uuid": "4a955aac-7208-4415-a996-0629bcd513e9", "comment": "Malware payload (Stealc)", "value": "ba82df67b2d43770c5429dae9b1a7a8a592ac5d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696153091, "uuid": "13268150-00b2-4788-874b-4f69445b0d9d", "comment": "Malware payload (Stealc)", "value": "b2d0def02e7280bbf92f82dc67fa3684ab83d3ed3a7756b197b0082544f5e381769bc73a21836eebf1aea93a7c702f6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696153091, "uuid": "d41785f4-7462-4afd-b1ad-61e91ebfd9b0", "value": "T1E014CF2135B0D072F1FB86748C3CE6946E7B7862A7B4815F23142FAF1EB06D15A66393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696153091, "uuid": "e3ea3197-dc0c-47d7-b4b2-77a2df8b2a3f", "value": "976fbfc3365265809568e7f20eed3693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696153091, "uuid": "2267a377-1acd-42e1-ad0e-9e1d844b35b5", "value": "3072:cNo6RYUq9NmvCFO+Ns3cBESVLn7qb72luALCl5/l1rJlt3Y:EUKCFOlcNCbMWDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696153091, "uuid": "66b98231-61d9-430d-bcee-36b07ac44d66", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696153091, "uuid": "a73ae6e2-1310-4095-81e6-dca316456d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696153091, "uuid": "25b47ab2-1e50-466a-8830-da5d3db246dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fae7fd9-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177658, "uuid": "ed02b98c-285e-444a-9d9a-22fa06f33d0d", "comment": "Malware payload (Mirai)", "value": "a9d977540a7ad8862616d6b76d55c1df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177658, "uuid": "d69708d8-92e8-4850-9f1b-8293cb71d1b2", "comment": "Malware payload (Mirai)", "value": "08487f0a2b84fc2cc29f6b7bf7dbd6540a3571779be9b815362b967e2e482e25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177658, "uuid": "53ee858f-5633-4e81-b291-63163d4a8581", "comment": "Malware payload (Mirai)", "value": "5d0d7e1163b6686ec7fb291ed16a56025e4e07d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177658, "uuid": "bcc93118-c253-45cd-afec-9aba23683231", "comment": "Malware payload (Mirai)", "value": "bc800965a191caf700ba198ad52da007d325c1778b2c8b3c76d54b6dc3f351dc880a7893005010327ba41e8d04019423", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177658, "uuid": "b4091095-7187-491d-a951-af3077d5c5b7", "value": "T1F7533A12771D0E17D5A32D703A3F63D083FAE99120E4BA88695F8B568A34E3516C2FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177658, "uuid": "b7162d8e-d45a-4491-9f65-dec362a22a7c", "value": "1536:ue+cVrXyCbKAFstrZ99PmI6G4bH6cAAw3:0cFz9Q1mIZ4OX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177658, "uuid": "96207091-bd26-475d-805e-66fd28d09c52", "value": 65312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177658, "uuid": "11633a82-a877-47c4-9815-8d2892005e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177658, "uuid": "7fbac3a9-2d74-4f4c-b2de-3d00109506f0", "value": "a9d977540a7ad8862616d6b76d55c1df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb916516-6083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1696183047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696183047, "uuid": "0ef8af78-4775-4753-b458-57fa2028a3bf", "comment": "Malware payload (DarkGate)", "value": "a2fb0b0d34d71073cd037e872d40ea14", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696183047, "uuid": "3ce73b48-3cdf-4f69-a976-708b8f90d587", "comment": "Malware payload (DarkGate)", "value": "091b7c16791cf976e684fe22ee18a4099a4e26ec75fa145b85dd14603b466b00", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696183047, "uuid": "fafec9ff-a105-4103-868b-683973883168", "comment": "Malware payload (DarkGate)", "value": "788991d33e18394c2cc858b3aef456a7074b0fba", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696183047, "uuid": "e91103ae-50e5-4f77-b2be-413008b223cf", "comment": "Malware payload (DarkGate)", "value": "06882bb2c30e1e8470fda806745c167af31bb473379f2bca1654fc0e1f9d769d51da4b92993dcf3a970509fe4ef4b11e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696183047, "uuid": "447ea27a-f722-4e2b-9009-7ee0f915a29d", "value": "T11B33275BF39311FAC167C17446A7A372B670BC114131AFAED790FB342E25E94AA1D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696183047, "uuid": "0103cd9f-95d4-40c1-8ad3-c4300d08a199", "value": "eb3f1099640d7d708a3042408447c005", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696183047, "uuid": "631c526c-5024-457e-adfd-9f1b507cfc0c", "value": "1536:5UK23Jsm6Nh5wF3s8KjrtN/5TqRGiNwmU2x0XZY:bCsNh5wF3s8KXHRTviNnApY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696183047, "uuid": "805d09e4-7852-4f22-b781-0efc738358bc", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696183047, "uuid": "fdd8862b-5b64-4358-ace4-6f33d43b6ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696183047, "uuid": "b2edd5e1-6502-42a6-9ca1-957dd3e5478c", "value": "a2fb0b0d34d71073cd037e872d40ea14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74af8312-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1696194846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194846, "uuid": "d78cbec2-315e-40e6-9e94-fb49c42496ba", "comment": "Malware payload (RemcosRAT)", "value": "af833c8bae12203ce03858314816a871", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194846, "uuid": "fe8397ac-41f0-482c-a50b-255a51f920e8", "comment": "Malware payload (RemcosRAT)", "value": "0951a4a0aa2cfa91d5477895e6302d68fcddd490691787e63261e7bf9982e5cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194846, "uuid": "ed579424-a089-4faf-991e-1de4a81f6004", "comment": "Malware payload (RemcosRAT)", "value": "5e4789f84607d5a28c3074d91a6e13f7bb55ba45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194846, "uuid": "6cbb45d5-e6c4-421a-8257-1370ab8da69c", "comment": "Malware payload (RemcosRAT)", "value": "92abc760849117a47e5f8d080d39ba268ad092b857fc4759d0fb9fd79c3ce0a861cef7d392c05f65828c18a90b71a6f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194846, "uuid": "a81b2628-c5e8-4e0c-bae8-0af11b3a5ec8", "value": "T1EB455BE4938C14B3D05B3ABDCC0A7AA42776FD68DD1A45C61E996D4B3AB2D603D3081F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194846, "uuid": "2d729687-cb96-4c5c-84b9-47451839e882", "value": "5c1642c1b0f0030a3f6d28c8df4788c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194846, "uuid": "390973bd-38af-4d64-ad73-8e077e507cd8", "value": "24576:RHGmldG2kHXUt8ka/P7hl932X1Cd7DjtneA:RHcte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194846, "uuid": "3a919d3f-1bbd-4629-b43b-a7d9759cad86", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194846, "uuid": "db8fef6c-4b30-4229-96ab-f2bb215fb489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194846, "uuid": "8bd1cdd6-55e3-478a-97f4-b3a5d9b0ddb6", "value": "af833c8bae12203ce03858314816a871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bbf2d0-60a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696197720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197720, "uuid": "9999b37d-c204-4f2d-ba11-7b1fc87da16b", "comment": "Malware payload", "value": "1bf4dbe76deae2e6416db783a9bad915", "object_relation": "md5", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197720, "uuid": "b1ad75db-6f3f-4587-9cc8-8ea6fd8b6008", "comment": "Malware payload", "value": "0b6f8da61154ca8327aaf5a57e126d430855843f50ca4d3b230012bc1f8f3c7b", "object_relation": "sha256", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197720, "uuid": "b840053e-b647-43e5-9cfa-a85fc901d37d", "comment": "Malware payload", "value": "bc3049af79c79d8c47661cd2afe900e5f498c70b", "object_relation": "sha1", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197720, "uuid": "bdbf7574-fe28-4202-856f-daf70b02cd8d", "comment": "Malware payload", "value": "11fe4a3a8039a2fd929d6918cc87adbf18d8a894ba277aa5ae57e467904cb96a11af19046aa2d193eca80866724efbc8", "object_relation": "sha3-384", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197720, "uuid": "cefce53d-6228-42f8-9b06-2c9a011b3fb7", "value": "T161763350F77A3199A9D4B4789390C938BD0AF2D5E64D8050FFA4B3A44C58EBECB0EB15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197720, "uuid": "d5d066a8-b26e-4ec3-b848-ef0474dc145a", "value": "196608:3J9A1Iha3LBU/kZ+NhPubg2032B2RQqzmYa9QKeqUgier:3JWAa7Bl0NhPB3K2Rdha9QKTUgiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696197720, "uuid": "e214c2dd-88dd-4923-ab00-760a370bcb2e", "value": 7359982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696197720, "uuid": "99c34649-a7b5-43f6-9ce6-b86e0a72e4f0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197720, "uuid": "36d11119-5327-47ba-8247-8667cecedda2", "value": "Activate_Install_pass-2023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7feb4dc6-6027-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696143326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143326, "uuid": "917a440e-e6ca-4633-a56b-eb02819b7565", "comment": "Malware payload (Mirai)", "value": "09ba376a44fc8b8e4e85b05c2c1bb6f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143326, "uuid": "997decf8-c690-4e6b-bd54-87bdf341d167", "comment": "Malware payload (Mirai)", "value": "0d2dfc6940410b8231218462e5436f2d4da48242a5804e0c550f6211903ded69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143326, "uuid": "eb9add75-72a8-48b2-8108-a8eb1adce7ef", "comment": "Malware payload (Mirai)", "value": "722f4b5ebe5ccfe1c416753da245ff83c66a19ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143326, "uuid": "9b92e801-f4c4-4085-b3c8-3c1d3df84f5e", "comment": "Malware payload (Mirai)", "value": "9e7db6d980a193049aa1d18cf3526ce8bf9783d48d041ce7701eb4d2717813f1bb0c8a9794d30fc39428cd875580773c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143326, "uuid": "d04ad9b1-4ffc-4465-95df-c618e66b91bf", "value": "T15BB2E1D9D6FB27C3C291C335D07C9A5DA6721BC10386451A6109B24EA3E760E8BFB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143326, "uuid": "c149f4b2-38ed-4c15-9ec0-020113cd453b", "value": "384:MVDKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLa:w/QOC0Yhn6ROHWFlAcwNEFCnNBxcVcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696143326, "uuid": "15248453-475b-4aa8-81ae-91ad4c6d903d", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696143326, "uuid": "23632634-e0d9-48ba-aff9-8f753e0f11fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143326, "uuid": "e99427d1-d41f-4c45-bba2-08c5d334292c", "value": "09ba376a44fc8b8e4e85b05c2c1bb6f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e3beb4-603c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696152429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696152429, "uuid": "ee764364-16a1-4773-a51c-37cb67df8848", "comment": "Malware payload (CoinMiner)", "value": "5176b4896078f18d236677597fa6ce1e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696152429, "uuid": "f34526d2-0fae-479b-b7a2-9e583605289b", "comment": "Malware payload (CoinMiner)", "value": "10988c7fbd4f94110d10d6962cad868080052c4a31e4f46f30f4367d2c0f18b7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696152429, "uuid": "e468c1e3-2c88-40fd-aaa1-f923f57dd34d", "comment": "Malware payload (CoinMiner)", "value": "22fa22464c018346d5ca684039ceb96722b4489c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696152429, "uuid": "4c0cd7b1-b05b-4111-b4bd-3af4a9701b9b", "comment": "Malware payload (CoinMiner)", "value": "df0e1207d437a8d62595550b62e5d0b452488273cee04f02a15f2368e46408d79ce13b7e9f2e40684e2b7baf4f2f16ff", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696152429, "uuid": "c9ffc44f-2d80-4994-9e97-cab872eb8014", "value": "T14D14BF213AF0C072E2BF85759475DA946D3BB862EB71814F23C4166F1F307825B6A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696152429, "uuid": "5a33c01c-a70d-421a-b74b-3eb0ed0bbb26", "value": "976fbfc3365265809568e7f20eed3693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696152429, "uuid": "158f3c4d-a007-473a-8261-6477a17e79f9", "value": "3072:oNRzRkE1SRyfv0i4A2nMR+p8arrnxOjFt5KTgl5/go263Y:01xrR+3RGtoUg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696152429, "uuid": "b92ed5ae-3cdc-4874-9e19-480e313dd5aa", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696152429, "uuid": "7a564229-7158-4b28-9eb4-c87d52887d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696152429, "uuid": "0c0288ae-928f-4ebe-bdb9-ad809e7714b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4864b491-606e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696173727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696173727, "uuid": "3d8559b2-7809-4a30-9e91-95deafa2fe01", "comment": "Malware payload (AgentTesla)", "value": "9d0c9590c48657e5c9bf9f171ac1020e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696173727, "uuid": "3397010f-7450-49c6-9235-e9f32f3e7cd0", "comment": "Malware payload (AgentTesla)", "value": "1107173a14a684d6a70fe7c80ce21aea6f4e06fc8426cb691a7a137ceed7f741", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696173727, "uuid": "439e2d4e-8f5d-497d-ba7c-d803ac028284", "comment": "Malware payload (AgentTesla)", "value": "3f111284bb46c14e8ee5fe5c2176d9fb25349ff4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696173727, "uuid": "56719837-c181-4d01-8319-59f2a9423ca1", "comment": "Malware payload (AgentTesla)", "value": "96d98fbeac86ee6e67f4fc7bcd444d38b89d8f20653a3c30f2a3819e8408bd56fe5b09a96f5aff78a1e7265334b0d709", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696173727, "uuid": "692f5afb-a3d5-4a3f-be7b-6b338ce39056", "value": "T152E423EC716B0A6D931BA8B739B327510F7A611F46A64399B1340F957308C871BC8F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696173727, "uuid": "b9439936-fb5a-4de9-9ab1-ed979328a4d1", "value": "12288:BfOqmq2Mp8YK1V35rqpmelhHuAaHI5CG0QC6GKwsZ8QPPcSHupzZ23p:BfObVMqBB5upfmfqZjWzyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696173727, "uuid": "fb986ab3-ba39-4e16-b26e-8a2552997490", "value": 668513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696173727, "uuid": "fce89990-d0a0-4768-bd6f-3c1d1d9b3f95", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696173727, "uuid": "465f1f4c-e4c9-4df8-87e2-8fbd614c8d27", "value": "Order_HR WJO-29-09_1.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfd7be1-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163589, "uuid": "d8cc9f45-8f75-442c-89da-03796c051e3a", "comment": "Malware payload", "value": "1b3b0122faf7d04ae844c65fba9f12ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163589, "uuid": "a7e16f9f-41f4-4bc0-baeb-151fc40a353a", "comment": "Malware payload", "value": "11f71cb72ed16bc09144f6ea57eb0bd55659c902303a04cfd9a416706265e4d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163589, "uuid": "2e541bc5-d9b7-4357-b050-cfc826099f7f", "comment": "Malware payload", "value": "a6dd836f985283aed6cdf36fccc29530d84731dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163589, "uuid": "239593df-64da-4143-a6dc-1ab5f137fac7", "comment": "Malware payload", "value": "7c490848572803029ddebb4290d62d77626374cb4ad1f9641f989824230fb58e77784b91daf9b28f66a7f651fd0dd648", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163589, "uuid": "fef78129-48e3-49fe-ba2a-ce5c63a831ca", "value": "T16885DF21F7928F67F133C7348962AB76CA13FC216B6240577E22778E9C776E089C4256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163589, "uuid": "07608fa4-d141-43aa-a378-d00ad9308eb8", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163589, "uuid": "da9ed5a2-1194-47c4-855a-b392d9c1b76e", "value": "24576:VbXdf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLYcefTC8KCfFAcfd:Vd+s8KuqGaX0ToIBAUZLY3TlzfGcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163589, "uuid": "d7c5548a-1df0-495f-88cb-fdef65318054", "value": 1807027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163589, "uuid": "70952c78-f4c9-418c-8190-0f69eff9f8ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163589, "uuid": "45218c97-0007-4a10-a02a-5f8126fe96d1", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.32365.27294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812eb12a-60a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696197874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197874, "uuid": "19afae03-8369-4372-a9b7-96f4b7cf497e", "comment": "Malware payload", "value": "3c81bd32e1e874566249cfa1a3a860f7", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197874, "uuid": "f33b3b5d-2c23-4084-8acd-e28d97fa3025", "comment": "Malware payload", "value": "126bb2ee20046a47fac475e871a673d3bd213c130a13c93fb8327af85a03a6dd", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197874, "uuid": "6f1ecd65-e671-4b22-af8a-01796ee0bb37", "comment": "Malware payload", "value": "bd51c4f93ba202e0589a146334321976ddb2acef", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197874, "uuid": "66bde7de-ff6c-48fc-9da4-8d8ad6bbaad5", "comment": "Malware payload", "value": "bfbc4d663f10762b765a8e51adb17802260435a912f337fa3836ca82c50ca8161efb90616f10d43ae998bae6a5572c9c", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197874, "uuid": "8be4e00b-d914-4e14-b4b0-a9271aaad2a9", "value": "T180B4232BD8F7455329CF51B2AC96C757C23805B672A66DFB9B31AFCDE402523800A79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197874, "uuid": "1eb077cb-9299-4fb9-a5ed-897fa85dcd3f", "value": "12288:WDkDQrCFhtWPc4bHJftTdSKICwM/tb1KKTV8eol5w:WDRrshtWP3jJftTdodat5K48BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696197874, "uuid": "3c6b18e0-ff86-44c7-bc76-714c7deb18cd", "value": 506471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696197874, "uuid": "6a3cb197-9424-4cfb-9640-11923c1a2f93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197874, "uuid": "7ae01b8d-81e8-43df-99c7-e33370674d97", "value": "App_Password_123.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579491ec-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177618, "uuid": "0de7fa1c-381c-4555-918e-707b83982d87", "comment": "Malware payload (Mirai)", "value": "64b6309075bb442f5920be33e5a653f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177618, "uuid": "c91cd92d-f042-4e10-a959-ac8fc1b334eb", "comment": "Malware payload (Mirai)", "value": "130ba74fd70f38dc388faef7f3a701773e78618e9b8e609d73a4dec4c73e457d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177618, "uuid": "7dfbb810-6fb7-44e7-8d79-ba4663494f94", "comment": "Malware payload (Mirai)", "value": "57fa6392bd6741c9c9b5ae929f67ab7fd8c88d98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177618, "uuid": "b74c7124-3e01-49b0-9a6e-d517c52a3198", "comment": "Malware payload (Mirai)", "value": "d5bbcd177331bd53889a78a41aa114da2a1ebb74611e5f6c116c92aa17648148bd9a2407b786885b431a510fcc8451a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177618, "uuid": "53467c55-d1ed-4c82-ac8f-3cc4346c2d4e", "value": "T1B1438D37FC2B5D54D44846B0A0764EBB0B52B04882171EBE19BAEBA5506BCBCF1053FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177618, "uuid": "588eb219-86fa-4440-a9a8-3d2c07d167db", "value": "1536:vGGAiw3E2QEqOVu/lxZdKP/sAKBd+CzgZUVjW3ZW3ZW3m:tAiw3E2QOV4zEPSBd++VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177618, "uuid": "528267c2-0c60-4eff-b6ec-88b64f20cf17", "value": 59604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177618, "uuid": "ef27c2b2-c8aa-4088-a234-f412b13bcd6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177618, "uuid": "90b70c2d-96d9-40c8-9d25-963af582fd47", "value": "64b6309075bb442f5920be33e5a653f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765a132b-603a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696151470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151470, "uuid": "6804c85f-8589-4952-ad8e-2f00efd5ecfe", "comment": "Malware payload (Smoke Loader)", "value": "439ac39a9e5c0a8c2ea78a2f7d6ca78a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151470, "uuid": "37c2814b-3db3-4cc3-9baf-802f538491e3", "comment": "Malware payload (Smoke Loader)", "value": "13dca1d18ac5888b9284efa2797c89acfbba831e42bbd6f575ef9220fcde4968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151470, "uuid": "010f542e-48bf-46fa-8f3b-309eaf3be25a", "comment": "Malware payload (Smoke Loader)", "value": "32bb1924440f17ac99c70150e779cdd315320e0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151470, "uuid": "b977a1b6-363a-4a15-b834-2af1a87a8b16", "comment": "Malware payload (Smoke Loader)", "value": "90d04767bca7644d04d6298338c59d4d536a8a8e679f5e92e468a18254b3bf710e1f3f64b631d82bcc3888c620fd7548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151470, "uuid": "b06f09d9-5175-4f1f-823e-793cb350b32e", "value": "T18714BFA136F1C072E6FB46388971E6946DFBB86367B1C14F335422AF1E306D19A66313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151470, "uuid": "94f0e84f-a84c-4794-9666-5acddb501acb", "value": "976fbfc3365265809568e7f20eed3693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151470, "uuid": "bec8cc9a-20ca-47a5-ac91-63b9ce8bef77", "value": "3072:dNdFRwxL1XsxRqUyaSCD8dYPbmqFm7iyl5/943Y:ExoRqUyaSC4uS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696151470, "uuid": "8f00ecef-09e1-4df4-99eb-e59aad1434e8", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696151470, "uuid": "e2e8e1eb-8bb8-483b-acd8-f40afbb083de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151470, "uuid": "1f01ba38-1a9c-4053-b1e0-0d24921a3d20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5642b98-6069-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696171789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171789, "uuid": "6662b79c-b5de-4aed-a9ee-890c87a82597", "comment": "Malware payload (Mirai)", "value": "6f517fd449d3cd64bef19334a372adbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171789, "uuid": "684b23c7-9483-4b4c-85b7-d6d7ca64b3a0", "comment": "Malware payload (Mirai)", "value": "151c1db29b0f53b36e5bad57cc76acbc4dd6e16501f9055539b8b1455f887c11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171789, "uuid": "eb3fed26-5d5c-4b6e-bd5b-e072138f7cfd", "comment": "Malware payload (Mirai)", "value": "2e9c4fe3711ad32ac5452a4b111f3f869143d1ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171789, "uuid": "e4ab9092-0f63-4773-b77f-97058d95b7e3", "comment": "Malware payload (Mirai)", "value": "9e037348f78fd04b03c1379535e31faed4e5629d65fc579789802e68ce201e821eecb4bb60f3bdf91beb69a4e92a6219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171789, "uuid": "8b90a8dd-9da6-4794-ac6f-763b78cd1cb3", "value": "T145D2F1B59FBB460FF48A233C5E9EDCD921AC78651FB9464A06401B623138AD1E7DCCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171789, "uuid": "85319100-1d3b-4ee9-b0e7-4c17b92afd39", "value": "768:xN8fWlfoQmQAXV7E/QciiRcLprDKQJazq+:jMNXFl76N4PBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171789, "uuid": "b6d29747-d6dd-40ff-92e5-23fd610f4807", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171789, "uuid": "0489eeb9-8124-4913-a61d-299dfe28628a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171789, "uuid": "832a0094-3b97-44cf-9924-46a4459d5a6c", "value": "6f517fd449d3cd64bef19334a372adbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fd17c3-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146240, "uuid": "26c8d6ac-fd26-4ef7-b519-72679c8cf3bb", "comment": "Malware payload (Mirai)", "value": "22b8c8396925c5aede524b91b2d65134", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146240, "uuid": "22c1241e-8b14-4484-a10b-9af1f7dd4097", "comment": "Malware payload (Mirai)", "value": "156c5a6b16f47cbf49e392ac0fca3298e9297909c7ec384d0f5508be8834f178", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146240, "uuid": "1146c9a1-72b1-45ec-82be-305bafd95f61", "comment": "Malware payload (Mirai)", "value": "4ec10bef1b3a1c1720b4b05e9a0092e31d77872e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146240, "uuid": "fce350f8-855d-4885-9fe1-c636110bf132", "comment": "Malware payload (Mirai)", "value": "8f09dcc2283528d73b4fd7f7397622e4b8e7f91891f45f67eadcd01029db6e565f32fcd7f616b9f07e23b6a83d7e1e76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146240, "uuid": "c16dde40-4f05-4a4a-b431-5f9767f765b2", "value": "T1EFE2F1E393B2E063DEBC5AF2F53EC2C6927D4B9CD1B630A31A0555583A570535A3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146240, "uuid": "b39d936f-dd00-419d-8fbf-843a3aed70c4", "value": "768:VoiWiO031vpAPbrVWZK3XVGxm9XayY3UQwpI+:Vorm1vpALgUJav+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146240, "uuid": "56fb1a34-e15c-427b-ab3f-fdf9e994de7f", "value": 33164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146240, "uuid": "69c4cc86-7412-42fe-b9cd-febf329b168b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146240, "uuid": "e6ff8ef4-273e-469e-9139-7895f115a79d", "value": "22b8c8396925c5aede524b91b2d65134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bbc8fb-602c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696145624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696145624, "uuid": "2bca35da-7d6c-4ffe-b852-1b6b5af87bb0", "comment": "Malware payload", "value": "fab8a5386fcbd88d6dbf18910a809d45", "object_relation": "md5", "Tag": [ { "name": "5-252-178-48", "colour": "#05445B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ponraj-com", "colour": "#09C08F", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696145624, "uuid": "99250f27-8b97-4288-9d83-a58671061239", "comment": "Malware payload", "value": "17a225f29d266a241915590a9556c66e923e48473836ca69b6a28f21db7a19c2", "object_relation": "sha256", "Tag": [ { "name": "5-252-178-48", "colour": "#05445B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ponraj-com", "colour": "#09C08F", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696145624, "uuid": "d1846adc-d92a-4deb-842b-ca8f95c5ddd1", "comment": "Malware payload", "value": "643a8b256145800ec708637c67e34df140cd3ace", "object_relation": "sha1", "Tag": [ { "name": "5-252-178-48", "colour": "#05445B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ponraj-com", "colour": "#09C08F", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696145624, "uuid": "770473ff-28c1-40a9-a2e7-6956d6da7761", "comment": "Malware payload", "value": "be502c470e7b613209869504816176ebb6385108bb2fca2fe65c68b2e9aaa6462acb03cf23fb6dbc1959f75f325161ad", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-178-48", "colour": "#05445B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ponraj-com", "colour": "#09C08F", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696145624, "uuid": "6b5ba34d-6318-46d4-b093-9392405b54be", "value": "T132D05B190FC28759481590F69F7E578EC4544519BFC917298E24099E052485A76A6315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696145624, "uuid": "9d2cbe61-61f3-4cf8-8169-9cb550b9ea33", "value": "6:CxBR2hn23f99oRfFlIw8UlLAHbKx4qmJB1hn23fyuvn:cnW23QfF0C0vqmJJ2agn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696145624, "uuid": "b3aadb66-691c-4ee9-8e4c-398beef75b46", "value": 248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696145624, "uuid": "789e2e26-46d6-4cb9-b36f-99097015933c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696145624, "uuid": "cde2d233-a002-472e-9ef7-2d1508c6d199", "value": "sett.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7e4563-6070-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696174512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174512, "uuid": "5afc29de-e65a-4d35-8f45-736382f9fd36", "comment": "Malware payload (Mirai)", "value": "cf5e75c64d7593f7b86f20d05afa2b68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174512, "uuid": "9125d67f-ecce-46e2-a225-03daa72d9bd8", "comment": "Malware payload (Mirai)", "value": "17b62edc514a0315b9b9f294e7240553dda617c8ac180cf9c02f0ca2850c8230", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174512, "uuid": "9ba830e6-1a23-4adb-adda-0138b488a956", "comment": "Malware payload (Mirai)", "value": "78a2e799e4f4f142a8e7f6f47ac4bb5c86e9f34d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174512, "uuid": "b94dfe2a-a1fd-4330-b233-9ddedfcce49e", "comment": "Malware payload (Mirai)", "value": "92e57d3f255ea5551984cbed7a4585715670a8589325a41cfb3c4f4e82e49811fa883e90eafd080297384001c43f02c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174512, "uuid": "a8e2f44f-6c52-4d9f-9a91-844de171a0f4", "value": "T1DC83E606BB540FBBDC5BCD370AF8170135CC561A22A97B363574E828F59B25B4AF3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174512, "uuid": "388f684b-3f0d-4095-bb25-32c3a2b2766a", "value": "1536:KlXBafRq6VMZ4R3Xw99bZeOUSM5lcZ8C5:KlR4R203XwLbm08C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696174512, "uuid": "7fd701a6-7326-4e43-9835-d6425feb4d43", "value": 87812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696174512, "uuid": "d23cd313-2754-4b6d-8c69-7679c8a0a295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174512, "uuid": "027676a2-0f4a-4fee-b002-4547b264991d", "value": "cf5e75c64d7593f7b86f20d05afa2b68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b91e3a7-60ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696200764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200764, "uuid": "1fd19ba3-40a7-4dde-848c-ee639ab741cc", "comment": "Malware payload (AsyncRAT)", "value": "3b4469af11899c9676e137118e8f0750", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200764, "uuid": "ad52f53f-08c4-4133-9095-2398a051d52a", "comment": "Malware payload (AsyncRAT)", "value": "195fd15af94949ac8e9ea733823fbc8d71bdc08af2f8564c4c0ace271574a906", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200764, "uuid": "8f698f26-74a5-4d05-b2b8-e8ee774f6abe", "comment": "Malware payload (AsyncRAT)", "value": "c2f4a5e6ae74fc94b4502b74c8ea9d32546cf1a6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200764, "uuid": "45d066e3-e869-4a58-9cfc-2bfb3cc8f720", "comment": "Malware payload (AsyncRAT)", "value": "82954342cf2664645e2b141c361859c92dd7d5174b57940a1332f5b32b0704e353ecf22adc9613d5b7133c1dda578d3a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200764, "uuid": "79764d8d-5edb-4c9e-8359-7618eb6b0b67", "value": "T1D063F8053BE9812AF3BE8F7469F6618506F9F4AF6902D54E0CC451DE0532B829941FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200764, "uuid": "2f5003a9-e3e9-423f-bc19-78789fe93abb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200764, "uuid": "03f25ae4-06a1-4231-88a8-0c85004e8d50", "value": "1536:f2wukvF1ak9gcKu5UYFTwoqxGvJj5bbRlm3OjAeE8xdNrmTGdx:f2dkvF1ak9Ku5UYFTwJURj5bbROOjrrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696200764, "uuid": "e533af5d-81a5-470c-83b9-e258f310f397", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696200764, "uuid": "f441bb7c-4fb2-493d-b13f-23ed6a270b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200764, "uuid": "62f52c4f-a364-45f9-8808-1bb9080120b6", "value": "trobs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cbf084-605c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696166178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166178, "uuid": "470665d3-e22c-4c07-b07d-3eb8f853653c", "comment": "Malware payload (Mirai)", "value": "bd3a4a9b07f488391f89f5f9e3c719f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166178, "uuid": "9604bfe4-8c3e-424d-a7b7-0da6c29a9460", "comment": "Malware payload (Mirai)", "value": "1a0ef7ca9fb971ece9b8f741fb4987146502e3b77a8b47bb380f4e11cdb6219d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166178, "uuid": "8c602432-efca-4642-896b-f52ef55b86b4", "comment": "Malware payload (Mirai)", "value": "b2aa86e32aa88971629e5322eb38e1babb7d3b6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166178, "uuid": "1715c5b5-63be-421d-bb67-378c190aa801", "comment": "Malware payload (Mirai)", "value": "60a479d8403aff4c135ef6d6ba954464f87aa247954764fa05234ce57cbc59001ee8d42bfba7c523515b8dfd156843e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166178, "uuid": "d4026497-7673-43ff-aa8e-31583aa07b6b", "value": "T120332A91BCD19A12C5D453BBFA6E41CC332523A8E1EF32079D226F507BDA82F0E67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166178, "uuid": "3101f5d2-d5d5-4f8e-936a-64f73ff1b70d", "value": "768:xBocdWzUNhTntV1OwkpaUqImiiIyyp/kbwzRgBVRs6zQ+m4rVShrKK65Nv2kTDCc:8cKohTnvAyyNZ6zQN4r8h+N9Gl3vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166178, "uuid": "234a6e82-f66e-4989-a5e2-e16a04beefa2", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166178, "uuid": "3d0234a3-fcc4-42f4-bc53-b989ba0c4de1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166178, "uuid": "21f43105-2d2f-416f-9e97-1db482ae3514", "value": "bd3a4a9b07f488391f89f5f9e3c719f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e783df90-5ffe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696125890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696125890, "uuid": "73777b48-0ace-492f-b9e6-7df55e6568fa", "comment": "Malware payload", "value": "d13c66cdb5333d047cb1830536147e10", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696125890, "uuid": "aa129e7a-f2a9-43eb-bf3c-46d428dfd024", "comment": "Malware payload", "value": "1b40adeb96e1a73e51ff035ae28b26dfe9e4376f49bf57d3d19d44a8bbf91746", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696125890, "uuid": "5f3e3046-93ef-4e9d-8cc6-faa6c29c3b20", "comment": "Malware payload", "value": "c62a9f77ad0e4249e9ad0eaf7a8e82b5fce0836e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696125890, "uuid": "e00fd543-29cc-4be3-b592-9b831c1b803b", "comment": "Malware payload", "value": "f40069a6a23f8a8e1de53f51f9f6221d53bc885a6c1b292cab524c73f4e955089a26bccb37cda710a08cf81658f52942", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696125890, "uuid": "abd8427d-0008-4da5-92a3-332ebd791ec1", "value": "T15D2733A3584A5ED9C0317435157E6389A871CB2E3EE3AB621404DAABC6F3565CDCCFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696125890, "uuid": "1b071d7e-e0bd-43cf-8b10-c741fe20b05e", "value": "393216:hSKZsJA35z7A79L+eoT1mbgafiubczZPbrT9i/zVN2I+TXjtsKpPbNiRSKcs3Ja:hSvJA35z7c5k5mbBffc9Phi/zVN2IkTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696125890, "uuid": "b5ff5959-b5eb-4f48-891b-dbb860487325", "value": 21497852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696125890, "uuid": "b8fa8de0-6f5c-4621-b454-833603845f6e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696125890, "uuid": "821d32dd-3fb6-4077-80e0-d339341c0a8a", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca92022-6069-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696171801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171801, "uuid": "0543927e-fb56-4148-91d5-7bff301d436b", "comment": "Malware payload (Mirai)", "value": "9efceda50202ae74baa9e4c7b7de1860", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171801, "uuid": "efe2f85d-d3b5-4338-b307-1a847cc208a1", "comment": "Malware payload (Mirai)", "value": "1ba7db4e6f79fb6510b3f2eadc34b6ce48bba1816ed19fc7e06239eb7a6a5cec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171801, "uuid": "fa3cf8b8-ae2c-46fb-a8c2-3bdd97fdc03d", "comment": "Malware payload (Mirai)", "value": "fee30e3463bb230b9090bcec78376af3e28eae55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171801, "uuid": "7b4c415e-6c46-46cd-8162-f0e7bf3356e9", "comment": "Malware payload (Mirai)", "value": "4501b01a35654e63631a13acbd8a56edd75f15dbf5ae22f8d1d3228fb8f6dea37b5c798f5cb9180423d9ba5e7366da4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171801, "uuid": "dfb811a5-5d96-473f-a5e2-4333305709d8", "value": "T19EF2E0224327D532CEA5DABB9D3181E4292B47B0F5BF706867A0C68E5CC1F02D5FE146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171801, "uuid": "fec2c6ac-739a-4358-9dd4-341d0d3876c8", "value": "768:VYVgAxkU1RHz5poClGL1aMnXha7WBNoWhSxHjUt9q3UELCD:VYyAxdRH9zILLBBrodjUALI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171801, "uuid": "54f69508-32a8-456e-877b-3dd381a6f784", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171801, "uuid": "79909167-c49a-4055-8927-66f448eff475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171801, "uuid": "5c423a3e-566e-4947-832e-67ed57c83bec", "value": "9efceda50202ae74baa9e4c7b7de1860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3485be3-60ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696200186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200186, "uuid": "f78e799b-58a1-4f9f-9f97-8765c86dfea9", "comment": "Malware payload", "value": "c6330e532aff9199552337b72d8dda5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200186, "uuid": "ff18d2e0-f098-488c-bf4e-562847c36c53", "comment": "Malware payload", "value": "1c621bb2c14b8272cb91ee2565fc4ed4ea13b59118ea97b40fdb3b93ca4dda1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200186, "uuid": "2c8da8ef-54da-4987-b1e9-8606e5c0cbf7", "comment": "Malware payload", "value": "b8fc1b4094a4b13c32886960cb4a1fd0b664aacb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200186, "uuid": "38694b1b-9fe1-447e-af59-d2d806d82dcd", "comment": "Malware payload", "value": "1174ac3d426e36177628ca72fde4c525d17ada9ded91b544dce640263934b0a2a142c0a4d46c1b0a06021641dc39c5ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200186, "uuid": "e0b604fa-10f2-49d3-9a5b-07c6c65e2e74", "value": "T152059D16B9F584F1D525B431087B9735EAF2ED110E228B93A358FE2D2C762619E3B037", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200186, "uuid": "714ffb3b-ed44-40f7-90b9-5d1a48838822", "value": "386af1bae362dfbd5a54321c9b661f39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200186, "uuid": "a693eb98-dc2d-405d-a526-ad3946d63e58", "value": "6144:6aCabwy4VPKRBx5gMgc3c8wYTR3s25YkKcNI9gkVinz5mhgzANg++HlXkCFnYWX:6Ib9JXFgc3c9DKcxVinTzAUlUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696200186, "uuid": "33e77836-e071-4c96-8293-4e44283a5d7e", "value": 866908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696200186, "uuid": "3a1d44a0-4ab2-4645-b519-ac430d7bd7e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200186, "uuid": "eba564d2-0147-445f-97e9-296dcd12cb22", "value": "SecuriteInfo.com.Win32.Trojan.PSE.10S0A6W.18385.26790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32babb59-6035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696149209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149209, "uuid": "ba4a8ca6-1a15-4bb9-bb0c-0025df400085", "comment": "Malware payload (Mirai)", "value": "68bafe5bdc09f45a225f900d4ee05958", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149209, "uuid": "3c0e8a5e-b79f-4acc-8ea4-6fbdd3c99f8d", "comment": "Malware payload (Mirai)", "value": "1d44d013bbd2c31e549a3a0fe521be14bd70071581cdaf399e2777eecfa81b1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149209, "uuid": "89a6ae7e-c615-445a-b24b-9894535578dd", "comment": "Malware payload (Mirai)", "value": "bab102d58bc9f4a2d1c565ff0c246fe7df08551e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149209, "uuid": "fd7f96b0-9bf0-4147-bced-4b6f04d99e30", "comment": "Malware payload (Mirai)", "value": "56e628b343368054c2e38684e5d2f4180c646a1476571f82309bda2fb534fdef62a8efa341786a187dc12fa7e89ca931", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149209, "uuid": "0ea06021-f22d-4941-ac86-05e629a54cd3", "value": "T1EC336B36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149209, "uuid": "abdc1bf5-bc8e-41bd-8bd2-febfd922be3f", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696149209, "uuid": "fd8d3214-816b-4da8-b378-c7adc82004c0", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696149209, "uuid": "a6cc1dd3-24ef-4aff-b443-d8faba6fc49f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149209, "uuid": "e0c01f24-cfda-4ec4-be23-37af7dfbd550", "value": "68bafe5bdc09f45a225f900d4ee05958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d23cf8c-60b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696204256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696204256, "uuid": "9a2623e4-1a9d-4657-a6b8-7b103d61fa75", "comment": "Malware payload (Mirai)", "value": "ca732733cd816e60655c82bce09bc715", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696204256, "uuid": "12025007-d363-41de-b735-563adf7770aa", "comment": "Malware payload (Mirai)", "value": "1e15d7cd0b4682a86620b3046548bdf3f39c969324a85755216c2a526d784c0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696204256, "uuid": "a2c168ac-af10-428f-86d1-e38bd65e1158", "comment": "Malware payload (Mirai)", "value": "f9095595b1d8b9c1c649b1ec0b602e7a478e8f20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696204256, "uuid": "6cc3874d-a54e-4dbf-800c-80f204c18813", "comment": "Malware payload (Mirai)", "value": "fe1db43ff4ca931870d95070a963f356590bdaa6a1f3dabcc5dd913213bd2eb3d3916139a4bdcd6294fa22b699de4107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696204256, "uuid": "dd17ef2d-5e79-4439-8029-bc37ffcc92e0", "value": "T1DD03F1FFA1AFD8B7C13B8277012A5AD8D692314E54DF1A9F26DD367F8C32854BA00111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696204256, "uuid": "fd6b6331-4937-4de0-90b9-0b3a63f205c0", "value": "768:+V83oR9qpYxfVwuWbiYTu1t0LVv/XdYpZGfnp7DQ+VuvO8bx07L:+VRRgpmGiV0LdF7hDQUuvOqOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696204256, "uuid": "49dbe5a8-acab-4eac-8b70-75346b794464", "value": 40684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696204256, "uuid": "0f458ebb-463d-431e-9412-15aa1239d68c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696204256, "uuid": "e5861e01-3ba8-45a9-a8d8-679c3f0dec11", "value": "SecuriteInfo.com.Linux.Siggen.9999.17717.874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a521d9-60ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696200190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200190, "uuid": "5011a1be-8c64-440f-a162-3ed68949766c", "comment": "Malware payload", "value": "36b954b90c5cbb961b0de9c5078cfb03", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200190, "uuid": "20f62cec-3c6b-4a35-bfa9-dc32ce157cb4", "comment": "Malware payload", "value": "1f3b62abe34b7e99a064a41ee96f876feaf471a88c2418b1051149033fd9b92a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200190, "uuid": "656fb059-f050-4649-82a8-d6dbd75ccd97", "comment": "Malware payload", "value": "e9c44aca544245896f3f4368558b6ea9a92d6d61", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200190, "uuid": "cced5f82-f332-45e8-80fc-ff45db3e903c", "comment": "Malware payload", "value": "672bc5d6841a51677e00c8114406427f770d3e3b835c326b6ae530fef8a3bd479a027afb317baae3bdfbcf9f953384b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200190, "uuid": "1d2be25f-11c1-4ffb-ac75-a3a9338b2999", "value": "T133D5E8D013F9449BE262D5360D60A5FAD9470477FF9AE106B0EEF5D8AB23DA0C4C83A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200190, "uuid": "864cbbed-e2f3-472a-87ee-e51e11d863c5", "value": "920a3fe414aab1f466b1576473191691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200190, "uuid": "21768181-ddd3-4d61-81c0-0965d4c6e140", "value": "24576:ieECgck/0MGbt8jPa1XKs5gWLVATOdbj/YZt6opq/RCyI:ieECtk/0MmGjPaQWhAYj/YmppCyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696200190, "uuid": "901df149-bab8-4c40-bd82-181d94f2a429", "value": 2899551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696200190, "uuid": "71402808-ee44-4390-ba23-3a6b19b068c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200190, "uuid": "8f06541c-1d8b-4891-ba58-da788af39317", "value": "SecuriteInfo.com.Variant.Razy.877914.30745.14562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d5c631-6035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696149194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149194, "uuid": "593d1b4a-3b68-49bd-a3e5-4c87a7d050f4", "comment": "Malware payload (Mirai)", "value": "778e183b50ea40bb0de6670af5d499e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149194, "uuid": "51c96896-3cf3-41e6-89ca-82ace13e34da", "comment": "Malware payload (Mirai)", "value": "204020d2f8293e545af87c76fda901dfc3c6f01ee8c47551f7bc4c4f924bdb9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149194, "uuid": "181a4281-07b0-4826-ae23-45af2f4bc6e0", "comment": "Malware payload (Mirai)", "value": "11a414b3e2a59d0fedbd7473246f91cd06d11309", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149194, "uuid": "ee1955ec-d57b-4209-a74e-4dac5fa64973", "comment": "Malware payload (Mirai)", "value": "9fb63fae5300dee5e3b56cc3942ef49f62e57c3b3dd282d04388ff693ca2fa47bbbc93d70d9080e5fa6851dc046609c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149194, "uuid": "13303d59-21be-4ee6-a0ea-15147b1b0c71", "value": "T166A2D025D345AEF8DFAF9CD453C2C2C276E547C7278AC8E240EEAF01250A446B788C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149194, "uuid": "907e3a7d-6a46-4735-906c-e78e43e25d1f", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5z3M4uVcqgw05VxJL:mRxsSVsMD6xiJJE5zRWNy4uVcqgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696149194, "uuid": "3a5ba9dd-2c89-49b8-981a-bf248e89dc18", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696149194, "uuid": "36a206f4-3ae7-4bfc-9147-4004e0660685", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149194, "uuid": "1944b3f2-5035-473b-91c6-89e6709f3539", "value": "778e183b50ea40bb0de6670af5d499e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ac7d0a-6076-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696177215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177215, "uuid": "4ab25240-1bb5-43c5-ad01-4f126b83ca58", "comment": "Malware payload (IRATA)", "value": "5a7abcf4410f973e04c291a45490c1f9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177215, "uuid": "10274afa-f902-4db3-adfb-bc16f5a6db4d", "comment": "Malware payload (IRATA)", "value": "20ab2fd5eaf5c0a332e024373e30a2dd16819a6a1edc36953906c40dc9afdb6a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177215, "uuid": "e8da693c-3de4-48e6-8d3e-1a13284bc977", "comment": "Malware payload (IRATA)", "value": "d851ca4be9482e8ee538ac97579b18a06e0ddc17", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177215, "uuid": "7d7315e8-8e72-475b-905a-10d619d18f00", "comment": "Malware payload (IRATA)", "value": "1b33b7f64eb0dd8e7b1afcabaf948e70f39948ed4127093c3d99ea7e153ff7241dd0694a97162955ce4047dc88dccbe7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177215, "uuid": "7ca78b36-475b-4494-bd3f-c9df8fc0b47a", "value": "T1B7C52393F626A81BC836D13111861739650B4E19CE47B799392873FE38BBEE84FC46D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177215, "uuid": "8c1ce22d-45a6-4af2-9dbb-67ed1af53579", "value": "49152:dtqqGYSPX6NO/ahrKMf0eXjX7s6O8TsLVvr7nfxRpp8NKRNTu6RiS:OqGfPX6NXE8jXTnTsLh7vppKKRNqBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177215, "uuid": "986d022f-1fbb-449e-a957-825a28771abe", "value": 2740678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177215, "uuid": "46ee70c8-8630-4340-abb0-20e50891f98e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177215, "uuid": "2ceeeafa-9577-433f-8697-eaef1b91b46a", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f5da13-5ff6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696122336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122336, "uuid": "12c6804a-e18a-4a6b-9e7c-692a4c9c6742", "comment": "Malware payload (Smoke Loader)", "value": "c4ffe0ca666bd8ed2fdc7113d84e0424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122336, "uuid": "ad40329c-d04c-43f6-90ce-b946868bc585", "comment": "Malware payload (Smoke Loader)", "value": "214f0eb7e4c38be352f97de7b9138442dd3e1cdc35a374d7d4bc03437b368dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122336, "uuid": "34b71179-8dba-4ece-992f-cebe626a3e3a", "comment": "Malware payload (Smoke Loader)", "value": "9947410e96b9e3ec92a3f3eaea8e112fa2471660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122336, "uuid": "557a1ddd-b47c-4a60-af44-9e619438e4ff", "comment": "Malware payload (Smoke Loader)", "value": "fab1b1f3f87aa5086bf60e2954286b076b2e7f449a887d9f044a28b88761a78ceac2e5742adb01526577479517ad18b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122336, "uuid": "a885c8b0-b5fa-413d-949d-d08ea6c556dd", "value": "T1CF14CF213AF0CC33E7A786714875DA946A37B8626B6581DF231532AF1D307D19B6B323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122336, "uuid": "e05d12e4-cbb4-440f-af33-0cf5dffcaa8a", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122336, "uuid": "4fcd8c77-3230-424f-8afc-75cb0cc3b4a0", "value": "3072:YUpRqLce8JTIcXzuAeznmGEXnowIhZrShS5/eI23Y:yF8J8ca5LwIhZeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696122336, "uuid": "7d9b2b38-0573-49fe-b48a-6fbc85c461bd", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696122336, "uuid": "340e204c-6916-484b-b75a-0656630f6acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122336, "uuid": "8967deab-c735-4f9d-8fad-af441260aa9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4033448-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163599, "uuid": "c083c7a4-d1c4-47bd-8780-43df70f3f862", "comment": "Malware payload", "value": "350e6baa37cebcc22c684ee5dfcd711b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163599, "uuid": "7f334ae7-1d90-4cf4-b06f-bde885796598", "comment": "Malware payload", "value": "21e8fb2caa57a40c0cc9ad8bbbc4f4fdc77424280d69fb081decdf1ba7d9b19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163599, "uuid": "8862740a-47ee-4b84-b84d-cfccd141e083", "comment": "Malware payload", "value": "9554d8c89327de9e6de1d27d4bd90e7216aafb11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163599, "uuid": "cc5074b5-a375-43c1-a74f-aa9cabb9a1ed", "comment": "Malware payload", "value": "11f0bc572d424c78c70faa7c24a8123324184326fa9e72953676b691da30bc930da4cfd4adf6b508e6121e48aa2dee2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163599, "uuid": "f4996419-8096-467c-a89d-2b0dd19d1da8", "value": "T1B6A5F111B6C088F1E533813849F1AA7AA93E78014765E6DF17E8076F8E779C05E33B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163599, "uuid": "eec5c600-bb31-4e12-84ef-a3485de09bc9", "value": "a0e8c678a7ecf48ef0a1685034f77bf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163599, "uuid": "de02fd66-2836-4aaa-8001-2d298c607d6a", "value": "49152:EHmM8W2tMjSUVjlTW9d1mHVNUc0ZBDOuz1NWQ3:EX8W2aZjlTWwVqcSBDOqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163599, "uuid": "f9e1e2c2-d441-4c2e-ab23-c269dd68a5b2", "value": 2154496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163599, "uuid": "d3fdee97-49a8-43dd-8d39-7007e249c27e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163599, "uuid": "c0f3c226-2694-4576-8fb1-5f666d6574fd", "value": "SecuriteInfo.com.PUA_FINNYMEDE.11621.23291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271b2482-6028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696143606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143606, "uuid": "df2f2622-9c2e-4c59-8844-813ff50fb275", "comment": "Malware payload (Mirai)", "value": "f613c730ad5a0decb0e23b2161bb200d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143606, "uuid": "ab284f5f-f150-4d62-9d3e-39650d1678da", "comment": "Malware payload (Mirai)", "value": "22bdf20ee05e5053519827d235b2d0d4130e691fbdeccf0a6314a363345ea776", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143606, "uuid": "b2d58f1b-8a42-4681-943f-faee18199807", "comment": "Malware payload (Mirai)", "value": "6d44b699e58530ee0b001304286191442d5f8b7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143606, "uuid": "538c3b61-b926-4d93-8eb0-3b877d61cd96", "comment": "Malware payload (Mirai)", "value": "4e76527f561a89f9cad7d0519331a64852a8d50c7e27fc5baaec52dd2fcc49bc7c01f10f02237aef7e38139c2edec1f6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143606, "uuid": "6627588a-25e0-4957-b6e0-53d4e3381739", "value": "T1AA33026217AD6AE2A1F04777FC32FC15A2AC16D49CE730D62CF06A1973C58024EF6785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143606, "uuid": "1c8b583f-2470-4175-a022-9104d344b367", "value": "1536:49O/ZMAXIxNUk0+bfPqF1aBexo4opKZbm:49O/ZNKyK3qFUFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696143606, "uuid": "f997de72-80ea-481e-a661-213ecf87774d", "value": 52656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696143606, "uuid": "2abda1cf-9699-41f1-ae36-a2b513af74a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143606, "uuid": "8bd7c4c1-a9a6-48e6-94f3-0c867ca294d2", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814e5e14-604e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696160078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696160078, "uuid": "26de038f-4ae8-41b7-bb15-86ae85b3cf2f", "comment": "Malware payload (RedLineStealer)", "value": "2f5a9fe38d66759435144779d31d475b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696160078, "uuid": "1379ebf8-951c-4dfc-8415-75f4a827eb78", "comment": "Malware payload (RedLineStealer)", "value": "2318f5ddf39a7576e33513557c3af1498e841cef7b36acc53e80ddd700ac0d62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696160078, "uuid": "55a02c17-9d7c-4376-8b5c-1f8ccf14f930", "comment": "Malware payload (RedLineStealer)", "value": "224d09a9bc9c17350fbe8aa9c8c3f90f44338f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696160078, "uuid": "64621603-bcab-406c-aa21-490842443992", "comment": "Malware payload (RedLineStealer)", "value": "ef0375eb274ccfdcf5c18f6b9954fb6960fc6780e12dc2506bb86c1c8a8b1dcf516cd01a5f8b28a9353be6539753489b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696160078, "uuid": "3ed783a0-bc87-4f12-b3a9-dd34d908c259", "value": "T190657D337B8481B2DEF121BDF2ECBD24416DB0B0472E89C7D7D95AFA86105D26A31686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696160078, "uuid": "760bfa32-ea16-4f52-a1b7-000756712c96", "value": "b77966559e48caa7890a2432200a2b65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696160078, "uuid": "028b7490-8226-4381-8507-8ed13e5c08e8", "value": "24576:UbkDJXy9Dz+HJv1jIUnygszPbE3MqFnp3o:UP9Dz+Hhl1nMI3MqFnp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696160078, "uuid": "50f185fb-8f0b-4e7f-8c05-d47bb54a0939", "value": 1450912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696160078, "uuid": "2b8620cd-c236-4cb8-ad2a-9ac97a89ad96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696160078, "uuid": "f9f7b4e0-5f82-4d37-a99e-f83d7a35911f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834e6293-6037-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696150203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150203, "uuid": "645d0ebd-7467-4f45-bb77-08149ce39985", "comment": "Malware payload (Mirai)", "value": "b3b8c42941104c75e54396b1a4bb67ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150203, "uuid": "dd53d046-f8a8-44b8-bd86-329447890a7c", "comment": "Malware payload (Mirai)", "value": "23566c041522572dcb5399ecd6747e9455644530a1dd0dbefc189aa922d6c0a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150203, "uuid": "9161ad76-bf9b-4165-b110-738e331e7e02", "comment": "Malware payload (Mirai)", "value": "0109971a8ba0ae6376a4e4b478d1ed2fa0ff38dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150203, "uuid": "d3de8de8-0199-40ef-bb8d-1440ca1323dc", "comment": "Malware payload (Mirai)", "value": "64251e8555e945339a25caa060c7ace6c19eb373e7493438e3afef3c7eeffcb4d18d3f1c13791fd12548f09fe5eb32e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150203, "uuid": "627b5989-28e4-4870-9abd-788096dc8e35", "value": "T15C536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150203, "uuid": "4078e2f7-8197-4d5c-8038-d309dec06939", "value": "1536:Z7qARubgzY/bEJygRcpv80LDHhklv4JQC9DSW:NP+eY/bEJW1XBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696150203, "uuid": "00263d88-6138-4d48-b22a-7eb427eae6a9", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696150203, "uuid": "3ac7bb32-83c5-4457-9a67-a3960a6c5107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150203, "uuid": "e9f59ffa-a982-4eba-b09a-f976de539e90", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e77efa9-6089-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696185414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696185414, "uuid": "1bf293c8-147f-4d37-bbcb-f404a895c1cc", "comment": "Malware payload (RedLineStealer)", "value": "bb90fe907918989dc2ac8ad1e5fb19d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696185414, "uuid": "c718af9e-b735-404b-8f7e-902afc7f040a", "comment": "Malware payload (RedLineStealer)", "value": "24c23bed0ed730113f6de3210bd2537fa63d950dafdd5363447437ce0498519b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696185414, "uuid": "6b4443e0-cb9e-4037-82f0-b7856b5a4945", "comment": "Malware payload (RedLineStealer)", "value": "93ac6919a64da6de930f21960506ccabcb6fba6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696185414, "uuid": "04ecf2f1-d7c8-4b30-be9f-63fe9e4d4a3e", "comment": "Malware payload (RedLineStealer)", "value": "a565b85b9b098b387ca1705b51c245a6a84eb3cd0d55888cbf121d366470029635235beeb887aabb5e558f1521e310b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696185414, "uuid": "a3b07920-dae1-4766-aaff-fc9bc0f498bb", "value": "T1D4B40215A7DD4873DC7117B058F703931F397DA1997893AF2B86A94B0D726C8A43232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696185414, "uuid": "01e42927-ef25-4097-9194-003d3b75e1e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696185414, "uuid": "0fe43657-8db9-4e86-86bc-5c7538456647", "value": "6144:K7y+bnr+Dp0yN90QEOrCiW7Km0Bf2Df/4MTyJVQm7UWc8mvocXeXV0Y3HcwwYU:lMrby90yLW+wfAbHU/NW0YXc0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696185414, "uuid": "1c520e2b-6faf-4a84-bbb3-76c8a19cfc01", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696185414, "uuid": "af438645-23b8-4a66-a3a5-76c8495723d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696185414, "uuid": "57c59981-71ad-408f-9803-c9cd7e5f2e31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600d98bb-6068-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696171189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171189, "uuid": "4804dfed-3ef3-44b0-81ad-b8d83eb1e767", "comment": "Malware payload", "value": "61669412a4d48a93b5d590d15ff56ee9", "object_relation": "md5", "Tag": [ { "name": "107-175-113-216", "colour": "#B1834D", "exportable": true, "hide_tag": false }, { "name": "dataconfig", "colour": "#CD014E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171189, "uuid": "69b2b07d-0655-40fb-82cc-faeb54b3f942", "comment": "Malware payload", "value": "2577c9f9e493c24a2138797a908bdd5ecea63f71aaa95560a6f36c2e4dae8315", "object_relation": "sha256", "Tag": [ { "name": "107-175-113-216", "colour": "#B1834D", "exportable": true, "hide_tag": false }, { "name": "dataconfig", "colour": "#CD014E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171189, "uuid": "56639b7c-8886-4cf3-bf49-51ee593c45d1", "comment": "Malware payload", "value": "bf16136a8965f3ffd4a96f53bc63a803c4416011", "object_relation": "sha1", "Tag": [ { "name": "107-175-113-216", "colour": "#B1834D", "exportable": true, "hide_tag": false }, { "name": "dataconfig", "colour": "#CD014E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171189, "uuid": "53576675-6c60-4cad-96b0-8b961c7b1729", "comment": "Malware payload", "value": "b8692fcb3ffd7b498e3d57e30d4eae6197aff2ae664fadd0783644e9801f9516a5f021af821b10ccad878cbea77ad281", "object_relation": "sha3-384", "Tag": [ { "name": "107-175-113-216", "colour": "#B1834D", "exportable": true, "hide_tag": false }, { "name": "dataconfig", "colour": "#CD014E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171189, "uuid": "85f15358-1fa1-4601-a4ba-65c950184bcf", "value": "T1A35423614D98BF743542A321DEEDDCF690C2E121001B794A9FCEB9B8844BF86C679CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171189, "uuid": "071af753-27ce-4a8b-81db-e98f062c6429", "value": "6144:hOg429djujhIxZn01fvxqAgqhBgr5/S6Qrad0NrINYNtjiBs7573cOOo/8/Jmfmp:Mg59dKjh201f5qnsytSby0NsGwKvOZ/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171189, "uuid": "47a03c0a-dd73-4f84-a98c-afd1d8466ed1", "value": 304136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171189, "uuid": "c24c8ba1-aa4e-45a5-ba0e-cf4d417d8114", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171189, "uuid": "47080b8f-1f25-4f57-8894-fca0299bf9e7", "value": "Czlsl.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696b3699-6034-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1696148871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148871, "uuid": "01dae2d0-4c01-42da-a235-b9e1436dfb1a", "comment": "Malware payload (Loki)", "value": "9d5e7753334bb508fb29a34122099524", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148871, "uuid": "13e14f50-cb90-40e5-b299-4ca98c1073a7", "comment": "Malware payload (Loki)", "value": "25c2e758d1a58b0ffa3398e9a248358bfa1c36bb745884e65a59282cd5049315", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148871, "uuid": "5f93bb8f-eec6-436d-9121-fd709187af28", "comment": "Malware payload (Loki)", "value": "599919b61762c6786803f04a716c8c31c21482dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148871, "uuid": "204a6b34-aa97-45bc-a278-64baf92d4fcc", "comment": "Malware payload (Loki)", "value": "1e3a5f1458c4c3e794f33ff16e795326befbfdc312a9589dc57f01f7a4e3129572dc89aa3753473970f19e10893b4c8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148871, "uuid": "c8505865-c156-4d45-b38f-0af90ea7d6a0", "value": "T1F1C40102ABA515C1E67A62B699B5117143F76A50D93ACF2C09CC60CD0FFF660BA48F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148871, "uuid": "99770e2a-59bd-4b55-a727-e1c0b21aa06d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148871, "uuid": "3511ba38-b413-4e13-9f8b-c4164a654992", "value": "12288:vclAckjxvdy88bpTsTUONRyHJqt2SU0hY7//w8NSbr4PF:2k9lEtTs4yREYPCV4r4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696148871, "uuid": "01ffc6f6-511b-4cb2-ad74-920c309dca53", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696148871, "uuid": "f4398977-ef26-418c-a1ff-61cfc5c977d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148871, "uuid": "a59467e5-63f4-4671-8f60-8d30d124a746", "value": "9d5e7753334bb508fb29a34122099524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d3e8a6-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696194825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194825, "uuid": "915b0050-fc6a-4df5-87b0-b4a6131da13e", "comment": "Malware payload (RedLineStealer)", "value": "4d25c72bdf763200e19d17cc139a7d6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194825, "uuid": "5e7b90db-6f84-44d6-a8e6-494ed0153f9a", "comment": "Malware payload (RedLineStealer)", "value": "25d6add713b138be086e33a389fc1042e5d246077ecf01b224cb442bf12bc6eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194825, "uuid": "9f9e673e-210c-4b1f-bcda-eeadb1ff1280", "comment": "Malware payload (RedLineStealer)", "value": "b1fa6aeeb3208bfac80e043b26136fc41f5e3077", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194825, "uuid": "a053533c-f845-4b99-8887-84c39150e20d", "comment": "Malware payload (RedLineStealer)", "value": "deef68271a04b2b6c9b9dbae63b1083f8afe9f12dbd1c1b5149137553bcee5e365ab62aa5e7ba974c8842f3f367db1ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194825, "uuid": "d804c69b-cfc6-40c3-836b-f6b1645f1809", "value": "T16C051212AADC4467DCF62B74ADF707832735BD914D6882A7278A9D5D0873381BA3073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194825, "uuid": "c2ea5174-45ca-46bd-bde1-f58369b1e95e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194825, "uuid": "063489c4-a05a-4ce5-8111-1a1c3be78243", "value": "12288:1MrFy90Z9j4L7cT+3I0CckO3Hmvx0PaZuVV0zq5CtNKt4SL/ZUAF93Q3Pi:EycgQcDXcqd0zq5Ctgt4SDZUI93Q3Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194825, "uuid": "48399019-a082-4b96-8a15-218e91c583ed", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194825, "uuid": "41dadfcd-0b05-450e-ad4a-acb95b5bb6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194825, "uuid": "e21ebb54-7c10-45be-a0c7-94005a10d18e", "value": "4d25c72bdf763200e19d17cc139a7d6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6da398e-60a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696198071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198071, "uuid": "591305aa-135a-4882-9005-0d78282e0d65", "comment": "Malware payload", "value": "4cd714b3aeffba82a02f136c91be24e6", "object_relation": "md5", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198071, "uuid": "19b3718c-f2c0-4185-bd21-d557dbe00f87", "comment": "Malware payload", "value": "27809eff3c2909cdc7b3df6fb1568c041a031a049bc2e08a5c6ce5e348610305", "object_relation": "sha256", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198071, "uuid": "a63a827a-2552-436a-9dae-3a0186fc583c", "comment": "Malware payload", "value": "fe2e169166b6dd683b71b93e83f5dbdc1a103d29", "object_relation": "sha1", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198071, "uuid": "c81a6c5a-a5ab-42ef-9f53-02b866793b41", "comment": "Malware payload", "value": "8932a5704a8c400cb95c47bb557206c192fe13b8d5b91d943a35681d4861d9049243caed2e7814900d9d602cc052ff3b", "object_relation": "sha3-384", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198071, "uuid": "2d02300f-1418-4302-aae8-cda45362686f", "value": "T179A62229F4553671E88DC2B006B01DA803E26D71037F57C8227678AF9627F7DDAB8939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198071, "uuid": "1b17969b-c60c-4972-b4ff-71337852f263", "value": "196608:u7Uw2TOYGn7GrAah2qbzQ68hYQoxW+ixYrAR1aPn6qDHGj2mpw:ugROYGn0AWyYQo6xYwDfjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696198071, "uuid": "59c80a46-744f-4236-9c95-761c37aaddb9", "value": 9839177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696198071, "uuid": "34037522-c89e-4903-a5cb-7e6a8a765b5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198071, "uuid": "4059a864-cd6e-4aaf-bc9f-a27752ded276", "value": "Crack_License_Key_Full.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecf4661-605c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696166168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166168, "uuid": "91c79ed3-2b1c-4aa6-bb18-77fb7cf17ec2", "comment": "Malware payload (Mirai)", "value": "be42244b40587d2275e978fcc650f8b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166168, "uuid": "3e556e23-75b8-4c89-8545-f04195654514", "comment": "Malware payload (Mirai)", "value": "2bf4bc1856afdb6cbae2a3a21c4817e873d530385e5922703ca5558f386da43c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166168, "uuid": "6e2d8f44-7ba1-407e-80f4-f6a2864d41b5", "comment": "Malware payload (Mirai)", "value": "3505be0c852276ff4d04dec588ab29c0c8901df0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166168, "uuid": "f4a86041-d339-427e-ae68-81e97be9f561", "comment": "Malware payload (Mirai)", "value": "0bf2b2c0014e5a0c5c7f0b1158789f8d4a3b0ac6d56f42f2a3ce60135ced6dd66f071af73fa8e8c2ee96f0e4c3e569e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166168, "uuid": "67b0df9f-3169-4d14-b9c0-fc59b998bc1d", "value": "T170139EB3C41EAED8C2558678B8254A782BE3E104965B2FF64B8485668047EFCF21D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166168, "uuid": "fec0d701-ec88-4f8a-b77a-da3861dfd1fe", "value": "768:jaq+BwtKDvOwkVQWergtbq4YAYZncMBwsB8ijuCeo9iFCS:jaTBwtCSXYAYZcMBwg6GwFCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166168, "uuid": "da5acbfe-327d-4bb8-ba98-8550b52c5b8c", "value": 44688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166168, "uuid": "4c84f675-a416-4236-acfc-adb6a3a9ebbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166168, "uuid": "ccf22100-2fa7-4677-98bb-f55c0653a5ab", "value": "be42244b40587d2275e978fcc650f8b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf986cc-6073-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696176152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696176152, "uuid": "1123aecb-a360-475d-b1c5-60ca55551e46", "comment": "Malware payload (Smoke Loader)", "value": "c026b67583d8fdfc91e724069480ee4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696176152, "uuid": "fa27ed7b-9d08-4925-98ff-a9bd90fdeffd", "comment": "Malware payload (Smoke Loader)", "value": "303d4734d8dd9ae4b5440ba7c01dc7c3359a5a05b492275ef44c55c5d2ef87c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696176152, "uuid": "766f978b-328b-49bb-8a0f-3ff3e26003a3", "comment": "Malware payload (Smoke Loader)", "value": "30deaf1c8468610a9ed5602b3834ceba4d121f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696176152, "uuid": "9f5cfa0a-58dd-479c-8691-d4c6d4f2476a", "comment": "Malware payload (Smoke Loader)", "value": "c1fb25c69fe44107187a1ffde1b141d5f779623cd6b5a804b36ee4b8189f52e7e729badbf2a82f3cb67e28ab52eabe99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696176152, "uuid": "022f719b-37c9-4d84-bef9-bf2100cbe6b4", "value": "T14714BE7235F0C073E9A745794831DB907E3BB863AB65C58F2354E66F6E302D18AA6313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696176152, "uuid": "a9393fe0-b0f7-4ac6-af81-77ccc11759a4", "value": "3674a15959055454487696cf3e8b751a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696176152, "uuid": "90beb896-553a-4d07-afc2-09f935cbae40", "value": "3072:i+q7jZObRwkvMXgXIofnZa5YZt7sP+VNM/b5/RnNi:cQlGwI0ZOPSixA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696176152, "uuid": "253ccd77-06fe-4778-97e7-e022fb27a228", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696176152, "uuid": "ea98121f-68bb-4948-8a14-9bbd96017331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696176152, "uuid": "8dbadeaa-f407-4921-91eb-9e04a8ecb519", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899ea203-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1696177702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177702, "uuid": "79aeb75d-4279-4fec-8157-68fca21f6223", "comment": "Malware payload (DarkGate)", "value": "f1b91fdbcd062031687e2766ab6773b6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177702, "uuid": "a8d9f96e-bdeb-4ba8-8271-2caa058d9f80", "comment": "Malware payload (DarkGate)", "value": "305de78353b0d599cd40a73c7e639df7f5946d1fc36691c8f7798a99ee6835e7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177702, "uuid": "53b7285c-2717-4f4b-84c5-c9d35f2cc8c2", "comment": "Malware payload (DarkGate)", "value": "26d18f282c1435858b09aff6790d2335bc7ca93c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177702, "uuid": "8deb0ef3-4642-427f-8ff3-4806cd845f09", "comment": "Malware payload (DarkGate)", "value": "0bf74b0ca4caa221cd8f9d5a4bdffa7054af18d2e32be0e61ee77b9113d5abc9e2df7477b0bd8586d788672d4c83de34", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177702, "uuid": "ee999ff1-68ff-4c22-9da0-5627db215dc5", "value": "T1CE33165FF35351FAC167C2744AA79272B670BD104125AFBEC7A0FB352E25E90AA1E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177702, "uuid": "00e6327f-da42-422e-8d19-ae0dcd2e318b", "value": "eb3f1099640d7d708a3042408447c005", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177702, "uuid": "57b7b17b-34ab-49f5-a949-15a8b675717d", "value": "1536:dZq2U5JsS6Nh5wFXscKjrtN/5zqGyiNwmHWR03VY:S9HQNh5wFXscKXHRzaiNnVFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177702, "uuid": "5de309a5-7545-407f-aa2b-688d064394ed", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177702, "uuid": "fbb89b3d-0d59-4996-b48d-d50544f2aa51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177702, "uuid": "50e76f9b-faa1-4945-a8e8-cdee9cd59e1b", "value": "f1b91fdbcd062031687e2766ab6773b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98612d2-6005-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1696128927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696128927, "uuid": "d42e95cf-9e90-4daa-bfcc-3810c2d6f41f", "comment": "Malware payload (Fabookie)", "value": "e38c7f0fa1a4d8ffc18742eb0df40048", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696128927, "uuid": "d21c8719-e983-49d8-a004-ad5d165f0c66", "comment": "Malware payload (Fabookie)", "value": "3193a9adfee944d12a081b3fd327d714aa8a3aece4cbf8bfbfd415d9f0574975", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696128927, "uuid": "3be40b8d-fb08-41c7-b3b9-22013d6f1c81", "comment": "Malware payload (Fabookie)", "value": "eb202808de94d7fa749d67801c06cc3f2bf6efd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696128927, "uuid": "e0fc397a-cef3-4b94-873e-1ec9d07480f6", "comment": "Malware payload (Fabookie)", "value": "a549d49f745d99ba225be2f45345663d5866a93bbd4411bee229f0453ed3fd0a7aecca56c043fa8199cc2c61c94d7920", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696128927, "uuid": "5d777f79-c9a7-42de-81f8-cbd31b65627c", "value": "T1FA240160E3F0A109E9CF56BD8DA292E2693174536317DFEEDD94C154382DAE789C0A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696128927, "uuid": "e2f2176d-e881-4d01-9a36-0fa9762432cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696128927, "uuid": "829f8f38-c7ee-4db3-a4c6-0b8863ccd11b", "value": "6144:QAxjcZaXLFJKcneXwjph8irvDeVcjf7wpYMyMP/1h:PjcZaXecRjHOuj4yMPNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696128927, "uuid": "89be2a7c-aa88-48a8-a691-641548443d66", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696128927, "uuid": "fc3c82b9-beab-4187-b208-ea9be7bab200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696128927, "uuid": "9927349f-ad03-4bc7-bd37-5bb0429fd890", "value": "e38c7f0fa1a4d8ffc18742eb0df40048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c2c47c-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696194852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194852, "uuid": "945f9fa6-8733-49c4-be43-4c83e567892f", "comment": "Malware payload (Mirai)", "value": "15303917b9d775ab001607e317c967e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194852, "uuid": "a91a5615-db8f-467c-ba0a-8c2d6c9f3953", "comment": "Malware payload (Mirai)", "value": "31e6b6d27c5fff2fca46c63bedb81868ecd4e812cc98a14597a3d53587f6b94b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194852, "uuid": "7dd79019-b7bd-4f37-a503-a4ac71b8d78b", "comment": "Malware payload (Mirai)", "value": "ffb265dd735891910964522353777b22a3975dec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194852, "uuid": "17130518-1cc4-4bfa-9e4b-05a4b4e6b21f", "comment": "Malware payload (Mirai)", "value": "36a343e734e3f3a2ec45fd2ecbdf6a5b49560b147231d42aa3a99e2727e816d0a442f0cfc51f1bcfdd58f812006a1e11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194852, "uuid": "abfc949f-483f-4c99-acf1-5205f8efff7a", "value": "T16863F987F901DEBBF44BE3B645D318157130FBAA0D9307727263B9ABAA351D41422F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194852, "uuid": "254b3194-f20f-4f2f-9f70-174b5f21261e", "value": "1536:JBBhuu7HwzTWI8tTPkDd8OyADKfiTPXSHzsZgA7XF5zhmgt7+CY:JBBhuywqTPkDly0KMSTsZ5lmgtSCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194852, "uuid": "8b1daf27-4f8d-463a-9fe0-53a8a8635554", "value": 69724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194852, "uuid": "002a8751-f22c-4fa2-a9f2-bca558139248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194852, "uuid": "fab24eb4-c256-48b9-a6de-b6399b106266", "value": "15303917b9d775ab001607e317c967e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c5d3d8-605e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696166847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166847, "uuid": "598d60fb-b4f9-42ca-9498-82695d90818e", "comment": "Malware payload", "value": "66c9f64257f261a46d691a69f58d55c4", "object_relation": "md5", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166847, "uuid": "044931b6-44a8-4866-a4a9-44a649a2f6ed", "comment": "Malware payload", "value": "31f11124f88fc142e201f13d2b8301c902338b17f84f9a90f105941330f7db62", "object_relation": "sha256", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166847, "uuid": "f70e4d54-fe97-4ed8-be68-54c7a1a4979a", "comment": "Malware payload", "value": "bb02710ce419f869b9cc9f09534688be22714ba7", "object_relation": "sha1", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166847, "uuid": "2d243798-6bde-488b-bab9-97a8b1437a5a", "comment": "Malware payload", "value": "7b8f75aa853c0be9d6caaceb1905465debe1471199941c07d5bdf732b8ba00d14e858446308419f79efd5982c88a3211", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166847, "uuid": "6a6830e6-d199-4b51-bc2a-6aa06060f23c", "value": "T10BD63320C5D843BBC9A767F99F6887041A7429336F7436D9B68D245C5E2F90CC32E2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166847, "uuid": "077f6be9-399e-4f03-b0bb-4c681f5259ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166847, "uuid": "53abae64-7d65-455e-85dc-c0983d433b21", "value": "196608:cUnQdmTg5IRh3SiCrpjvDl6Ry23VEMRn2yQkoXNihMfUf+6afyDYS44b7VLvzvDx:9nQMTRMfoA23IVTUW6afyES4ALTDjKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166847, "uuid": "70468986-70b2-460c-84c1-e73e99b1a63e", "value": 12956672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166847, "uuid": "0940c176-4f27-42ac-a20f-bd41d2c7f39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166847, "uuid": "1d28ade8-d7cd-41fa-aa85-e8c5971be10b", "value": "ChromeClose12.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50b42e8-605c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696166151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166151, "uuid": "8f0ba67e-a0d6-4cb0-ae18-7f9390fa15c4", "comment": "Malware payload (Mirai)", "value": "af60a3912e102ffd629f43e6e3c1829b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166151, "uuid": "16e90867-560d-4d44-9c73-68d502fffdde", "comment": "Malware payload (Mirai)", "value": "33d84de99990ee4f5ec7d46378a2734b158f447903a68cc890addebe10f1d593", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166151, "uuid": "b40500d2-0795-4a8b-af13-233fcb779bd9", "comment": "Malware payload (Mirai)", "value": "e17cf497d00b1ff3baf17df1dc8e981d7c8c57c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166151, "uuid": "ac89d650-447a-4536-b745-57513c9c69f0", "comment": "Malware payload (Mirai)", "value": "0aa385063554c03502b49fe6ea104798567ffc5ee7d1c707f5ad5caf1f2ba03247e3241ab030aefa4058c5de0dcd35fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166151, "uuid": "0280c9e7-6991-42f0-8218-b3004ae98e6c", "value": "T1F2232A42722C0A47D1A25FF0293F1BE093FEE99024F4F6846A4F9B468635E371586E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166151, "uuid": "10bc9efc-65a4-4192-a0ed-62fe3e827dc6", "value": "768:bLjr8x1PT41oxBxi2Qni5RuHAzfFvqIJp4nB4OhIJy0ZEcVw6/2HX6O+c:jonb41ox7iL21HsveeXZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166151, "uuid": "5134c2d1-743c-4ba5-b454-c2af8898807a", "value": 47420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166151, "uuid": "2c301470-fc5e-4f9d-b63e-3f0eec5e5ef3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166151, "uuid": "5118f5d7-5c95-4f43-8d89-af5e264c50ae", "value": "af60a3912e102ffd629f43e6e3c1829b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d43a3f-605c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696166156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166156, "uuid": "d449cc4b-7fab-444f-ac9b-6f97863c7cfc", "comment": "Malware payload (Mirai)", "value": "c0b0caba934f222ffdc59c6cd0814520", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166156, "uuid": "ed68f9e6-1316-4da2-a015-111f7df942b6", "comment": "Malware payload (Mirai)", "value": "3404406e15b7bb5e68f18058355d1aee73bb7e8a28d071d63339081727a0c550", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166156, "uuid": "60fb0746-d737-4549-8c55-b4b437b01efb", "comment": "Malware payload (Mirai)", "value": "3df829e3c9550672e3f923fa860e56dc3f46523d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166156, "uuid": "fe448e60-c0e5-4d24-9196-978579070f23", "comment": "Malware payload (Mirai)", "value": "17e09dcb648884fd05aeab52bdaa1de8837d9b259543ae3cb1f624d9bb81706745a086d72e2a3856d7b72ec0342e0746", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166156, "uuid": "b6913ce5-d870-4d99-9682-e6eaf4d5f05d", "value": "T14B53970A3E21CFBCFBAC863447B74E309658339526E1C585E15CEA015EB074E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166156, "uuid": "e2803028-e1de-4b9e-8bb3-9787a6b6b43d", "value": "1536:8bNi06Du0D/O2PBu2ph2ZFsgiOGu8kvixjX+Mn:4Ni5Dh15pMFsV7uCxjXxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166156, "uuid": "306c9d28-d729-4faa-af7f-642ffd34aa08", "value": 64156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166156, "uuid": "48cfee07-7a82-48bd-9c52-024612660c8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166156, "uuid": "1a6ac032-a1b2-4346-a26e-9f045f8c2aaa", "value": "c0b0caba934f222ffdc59c6cd0814520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4eafe3b-609e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696194525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194525, "uuid": "4603c772-234d-40f4-87ff-ceebd2bebd1f", "comment": "Malware payload", "value": "047324921fcd5ca64134a367d389e900", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194525, "uuid": "99c1a403-cfdf-4848-b28d-d9d20441c3dc", "comment": "Malware payload", "value": "34a8af0af0e818443b87f59fcbb5c10af500f1b45c9b3d1e7d6aecc494d009f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194525, "uuid": "682c8caf-cafb-47ea-8627-008f95d4999a", "comment": "Malware payload", "value": "cffb7fab39322a900e6b855acbd1c97c69d26898", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194525, "uuid": "66b1f0b2-30bd-40d2-ad46-580f43f249d8", "comment": "Malware payload", "value": "37d860658edfec9f2a6a818c1d47ba727850f9c8d70f1496fead4d8fc0495e9d8fa830a3051c15c127dd26aa87928696", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194525, "uuid": "ad895426-6357-4245-871f-a0dc315c47d4", "value": "T1BE357D64B357EC60E02AB975C80B6A84E0E97CD13E1D68CE51AC39761DFD3A33A1C54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194525, "uuid": "96fb20b4-464e-4518-975a-89bd7e2ad6f1", "value": "f44d2d08aa3f7e0759f9441d70198a12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194525, "uuid": "fe395eb4-1fed-4d34-bea4-657f7dd1b8e6", "value": "12288:eo1mZWdG+Q25wOymUo04zNbv/dY/gmfXJJG2uZX8H5ZravCBhOX:e0pG+F53ycRVv/eIKGfZX8H5tav6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194525, "uuid": "b3ed957a-a030-4d19-9c2d-c77559d69c2a", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194525, "uuid": "09a772ec-24ef-4cc0-860f-8dee39eef197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194525, "uuid": "d49cf766-6960-4d1f-b16e-9125e94cbbd7", "value": "047324921fcd5ca64134a367d389e900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4694b52f-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696194769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194769, "uuid": "c2c26f69-9a41-412c-bf10-7562362ad1ca", "comment": "Malware payload", "value": "9009ca103fd3c46ebc0c739a77f29f37", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194769, "uuid": "875fafa3-eb22-4917-a3e4-f49c3b66306e", "comment": "Malware payload", "value": "3610590723a83872e7335f683ee7b9f5f0766ddc7f573eaef5c231f98494a7e1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194769, "uuid": "203547aa-8600-481d-931d-5123f89f2b8f", "comment": "Malware payload", "value": "0208679d2e61ab86dcbd247031b97222f88c2b3e", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194769, "uuid": "97a2297d-7737-4d43-8816-660e61c592ce", "comment": "Malware payload", "value": "ef3eec6b79545dce2349ae8e13adcf2f09a3dffd9fca07f71ed44753d931bc124b77ac2c061afac90ef42b7b43e6f67e", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194769, "uuid": "7b729a59-89aa-4b4c-8d9f-a2339667cc35", "value": "T1E9B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194769, "uuid": "ffc8adea-2118-4891-8095-ec3b055949b0", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194769, "uuid": "1db3d261-2450-45a5-afa6-0068ba25e1a7", "value": 512659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194769, "uuid": "20dbfca3-8c58-43ed-8b1b-6bc4c3aa0434", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194769, "uuid": "d7d0822e-f726-46d8-9740-7b3e8cd998ee", "value": "AppleApp(1).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fe5ae5-5ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696120817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120817, "uuid": "74c062cf-7633-4ddc-91f0-6d267c5ca358", "comment": "Malware payload (RiseProStealer)", "value": "b25e04c883c7e3743de825120470dae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120817, "uuid": "6d943d91-4c2f-4811-86a2-9babe2b4ddac", "comment": "Malware payload (RiseProStealer)", "value": "396c4b50e8bc32fae9f5de6a9c140278fee7600096ce2de145ba2d931e763b13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120817, "uuid": "766dfbc7-2b2c-4e42-8f2e-a90219b3a8b1", "comment": "Malware payload (RiseProStealer)", "value": "6f726d7722e109fd2ffaaea783dfee9ffd632ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120817, "uuid": "56c2889c-8a33-4476-aa9d-0023139ab99c", "comment": "Malware payload (RiseProStealer)", "value": "dcb9d2e273e895c25f44a063335ccc1a46a3a4b4ff48618eff45b7eb6a2efbfc59a961f614b46df84e566f7abb506866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120817, "uuid": "398817d3-072c-4c24-b0ab-b7f9f0aa9c39", "value": "T1D844E01175F0C431E1FB897984749E94A97FB86355F0818FB32423AE2F717C29AA6723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120817, "uuid": "813a1efa-1e85-4451-b688-95f2513c0340", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120817, "uuid": "cff1d1d6-f11b-45c6-98ca-8d490356a809", "value": "3072:RQEygviSogo1igP+H4360FHfFKxcxiwvYftSoD36fpZ3Bz7Cgmq7n9j5BK7S5/Tm:U+WXmHN0FH0uMwPoGfX3BHCpkjnKIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696120817, "uuid": "ff1174ba-cb39-474f-9ee6-a33f3aaf2bc7", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696120817, "uuid": "1989411f-b11e-402c-a45e-a688d3a5b4b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120817, "uuid": "3c3ad4bc-9a0f-4bb4-abcf-dee613e98619", "value": "b25e04c883c7e3743de825120470dae8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a83f11a-60a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696199178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696199178, "uuid": "1d04b832-4bd3-40ce-82ec-af11f75614f7", "comment": "Malware payload", "value": "3ab9d59f2989114bc115bdfb60331c7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696199178, "uuid": "6b68fe64-1349-4568-a4c6-dfaf2f41b0c8", "comment": "Malware payload", "value": "3c8eed8e725d7eb608c751cbaa7bcf13e765dcc34f73145985e22eb61abc2873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696199178, "uuid": "62099433-496f-4431-b46c-eba48014f9b3", "comment": "Malware payload", "value": "c593d890483a9fa5bb3ac142031cc4273040fe8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696199178, "uuid": "d6ab99f8-33bb-44f6-8d2f-e1f29e7fd050", "comment": "Malware payload", "value": "2cd22be6fb8d64cd456246189e8a9d34df961155fd81177430ffe826460eec773af2ee53775e464b2eab6095dc555937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696199178, "uuid": "0a718a48-efb2-4a16-b74f-20944ec58ce5", "value": "T1CC14CF2179E0CCB1F1ABB5384C35DAA06E7BF8326B65CA4F3704126E1D302E1AA75717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696199178, "uuid": "1268a5d3-7a33-4bf7-8d03-10b53d88e794", "value": "6f3146e776f6cd21d6a089c9d9e8d181", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696199178, "uuid": "6e56b37a-1738-4e5f-bb07-09327ad11e45", "value": "3072:RaNCfF2HFzRfqBzFGpRB8GdtxYWIqCx26Ji/WrJXKO8gc150CE+ovV:H2lzRozgR+YtBIqOmOrJaO8VEZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696199178, "uuid": "3ac06e10-2aa8-483f-9b2a-800afb68f11d", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696199178, "uuid": "c1c70b25-7a20-4cd9-81a5-20992c4660ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696199178, "uuid": "9a77bc83-4834-4953-b17a-49b4767c1550", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1629c4-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177677, "uuid": "de67ed69-cdef-4c33-a38d-f7a946a8d113", "comment": "Malware payload (Mirai)", "value": "d3569ae84b55554168a6359ab9fe51c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177677, "uuid": "dd2610ac-6580-4348-aace-309de41d52be", "comment": "Malware payload (Mirai)", "value": "3cdfaf9699901b24cbd6da3da4b4156632fadc6712fe6e6e5490e75a39dec76d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177677, "uuid": "3476e1b4-ff24-4b45-98af-7cd0be1f3125", "comment": "Malware payload (Mirai)", "value": "e7aa084097e76e5dd7a2480959ae1b1d1dc1e132", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177677, "uuid": "41e72cfd-e593-407c-b3bb-687979e9bfe0", "comment": "Malware payload (Mirai)", "value": "8a299fcaba53730c4e484ddd0d917b4b1b447370f2e71ad02c11ad201d1211b24852fe7ebb0d4c6c54c6dfcc28443f67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177677, "uuid": "64f20515-996a-4a49-ac9e-5ac99cbc32a0", "value": "T117E33C52F7808B13C4D617BAB6EF028533239B6593DB730659287BB43F8679E4E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177677, "uuid": "4c4aaaca-32e3-483e-b8fa-e5cecdf6c80a", "value": "3072:hfiaqEeyweZcY07aUXmKdoFzmtB8afYAmkLqM/9i7IE+:hfiaqEeyweZS7aUXmKuFHcYAmkeM/9ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177677, "uuid": "213d6a6b-d86d-4388-90cc-599c1a0840f0", "value": 148570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177677, "uuid": "e579639c-0eea-452b-8dc0-8ded8cbbb9b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177677, "uuid": "929aeab3-b80f-4b69-877d-f14d1c5a9646", "value": "d3569ae84b55554168a6359ab9fe51c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3422685-6042-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696155008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696155008, "uuid": "2ecc53f1-a8a8-4d55-aca4-bbba73ea97a9", "comment": "Malware payload (CoinMiner)", "value": "8186758bf8fadd534337f4724ffb2e10", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696155008, "uuid": "167ea667-c5e0-48bc-ba74-baa0d1927307", "comment": "Malware payload (CoinMiner)", "value": "402f8ae71cdd4c4a8ddcbeb123879824d9c40bd6d8c8d04f1e6575c049105eea", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696155008, "uuid": "ada4dfde-41a5-4fd0-b721-d410cb82470b", "comment": "Malware payload (CoinMiner)", "value": "716eea212a2b1ab6cfb45a9f14a3cce5bab705e1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696155008, "uuid": "51a8c500-6484-41a6-be7f-6fc3ef511152", "comment": "Malware payload (CoinMiner)", "value": "53c0f4095f15a029919fdd52aff6da3adcad899826211b2aae59cd5a76e756e93a8ea72b689268861c9211c1f9a405ed", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696155008, "uuid": "f7d71853-747d-4ab2-b64a-23b419518d68", "value": "T19EE53909B5523D9BDD4901F2DE1F16AC0E429C4B0E04A65B2AC270CE9B7D2E6C5FD39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696155008, "uuid": "b07621bc-6360-497d-96ac-c898feef7250", "value": "49152:N/F6ITLDKa1cEOMZSB5VKfQYrdYBLgO8Ki5cbbb0Y:NdTHKa1Nog4YWgK6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696155008, "uuid": "19c2e532-b28f-4270-b361-a8d9de509155", "value": 3177984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696155008, "uuid": "bde05146-4ab9-4849-8f80-09ee6c4bb2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696155008, "uuid": "17551b9e-34a4-4e12-9935-df8147a73292", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383f3994-6065-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696169834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169834, "uuid": "3585a3c0-57df-4a39-816a-a94dee83e354", "comment": "Malware payload (RedLineStealer)", "value": "9d5d7b7520a095e3dc323bd9355451a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169834, "uuid": "efe7b6e2-6905-4469-b99f-790e0f60ab56", "comment": "Malware payload (RedLineStealer)", "value": "406c875bdd03450b00ae47ad438a57513bc31bf0f5b5abe0f9e0fd65443d8122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169834, "uuid": "b63e19c9-ae28-43e6-8719-e45ba3d7b949", "comment": "Malware payload (RedLineStealer)", "value": "69253ab7718fc0849aefd61da38093b279940d93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169834, "uuid": "d73c4ce7-2456-401b-a177-6f8faba7ce4a", "comment": "Malware payload (RedLineStealer)", "value": "eb38e185145fcf70034cc5a58886ff9eb9a4d5d08bcb4ba93f6e4242aec831197a9a4189614ab96916c51912272d15fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169834, "uuid": "1e1f919f-4865-4e01-b222-d24d25fff61d", "value": "T12E757C6238D0C271DFE211B94DDCF86143DDF36C072609DB9AAC27E9E2166E1DE31986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169834, "uuid": "1bc70761-9097-4999-85b6-35396828bf2e", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169834, "uuid": "b828fe87-f31e-400f-8aa8-9422811109ba", "value": "24576:mJHzyix5pqoZTwsTnZtq6Pv5/7pjUlD89Zrb90:m35pqoZTw+tPR/7pswjvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696169834, "uuid": "54dee646-a97a-4374-96fb-ca07571cc946", "value": 1693600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696169834, "uuid": "c5d53bdd-4f32-4b61-b89f-ed9066fee6ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169834, "uuid": "903f622b-f47f-440d-8f6f-308f38c39936", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773e0f88-6064-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696169510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169510, "uuid": "cbced9e5-23c8-4772-8bde-b8f5398af827", "comment": "Malware payload (Smoke Loader)", "value": "20aa704ebe3c3f55099ef7a2d622377d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169510, "uuid": "0a0c92aa-c198-40de-96aa-9396e9cb7275", "comment": "Malware payload (Smoke Loader)", "value": "40ad1caa10bdb28b0e175989766dcef91dbf48d13002cdecef7dde3c3f9c03ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169510, "uuid": "7d35a145-fa5c-4b88-a0ce-3e480ef71a83", "comment": "Malware payload (Smoke Loader)", "value": "1f864523711217479188f394d14da0a294b7d20e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169510, "uuid": "44951db4-6b16-4ce2-8ece-758d423af7f4", "comment": "Malware payload (Smoke Loader)", "value": "de9525b2e6d20b99acac4adff99ff2d87dc94091536e00cf9199321e102da0b6ec0fa7387ef45210d4696730df0bf251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169510, "uuid": "07e0efeb-24bd-43a2-8d02-c2a1c6fc3887", "value": "T199B40213A6D89073EC712B705CFA03D30B317D625EB8975B2785A98E0D73A84E93176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169510, "uuid": "797fa541-c7d9-4174-b5f5-cfc2666792a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169510, "uuid": "e8022c58-cfaf-42c3-a35c-505127331e08", "value": "6144:K2y+bnr+Cp0yN90QEmRFuFeps2MZAThWz9/Lp7rR15ppUjV6fxhCc0rEQ8t3Z653:SMrWy907OeFlhLo6fxh+EQqEvGJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696169510, "uuid": "e2ec2414-a570-4742-a98f-5431c1a1e19b", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696169510, "uuid": "0920646b-c90c-459a-b9c3-1dbd42871f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169510, "uuid": "a863911f-d6c4-4abf-ab99-b546c6c0069c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f844cd5-600d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696132024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132024, "uuid": "b3bd4e25-234e-4999-a152-2653748d0e3e", "comment": "Malware payload (RedLineStealer)", "value": "7d4a6be80db7c702527cef4e0a692d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132024, "uuid": "18d83f50-fdf2-4c71-8c95-ae7bf98a4f3a", "comment": "Malware payload (RedLineStealer)", "value": "423f42057e1cfe5be167f217caf8d14bcc620e6c43fdf742d221e4ad120bc902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132024, "uuid": "4f3599d7-aa4c-4a18-bc56-151e35f25169", "comment": "Malware payload (RedLineStealer)", "value": "34a0942adf7a2df3b5fc36e99558830b80a7a41b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132024, "uuid": "8718a7f4-db94-4f9b-8ddf-2f54ebb87931", "comment": "Malware payload (RedLineStealer)", "value": "ebb96f27e1518815a430b8934f658f627f915bd6820313a2c8ec4d410424c512c79ab7aece2708905d7f4f864c000cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132024, "uuid": "3543c341-89a8-40fa-b588-74f0a527bd65", "value": "T13594016376D89073E8B61B7048FB02830B367DA10D78976B3646B95E8C72BC4A975337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132024, "uuid": "c882cd1c-af98-4897-ba65-4ca409359c69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132024, "uuid": "556c2e8c-6ce1-45f4-965e-d9467386f0b0", "value": "12288:CMr1y90cr1NXii7kmHRw4+orlWNJ/6Yp1VOB7:fy77B7ooR4JCYnVi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696132024, "uuid": "a1ee830d-c9c5-484d-a05c-ab52771baf3e", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696132024, "uuid": "214b0cfc-25ba-4757-9fe5-6f4c1ddfb2e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132024, "uuid": "bd19a157-1748-4065-a125-76eec9553108", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9de84d-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696194861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194861, "uuid": "0f4af479-4eee-460d-b7aa-8c540af050e1", "comment": "Malware payload (Mirai)", "value": "97a79ce009c9a3dc7bbfabdc4ed9aefb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194861, "uuid": "f9f45c10-6cba-41e9-84f0-e8b3f03d7bc6", "comment": "Malware payload (Mirai)", "value": "43c1adf43fcc385c9f5555e465a7b0d35572f3ffec1c268b90ba1e40c225342d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194861, "uuid": "a2ded547-100c-42a9-a036-62c3ac752c11", "comment": "Malware payload (Mirai)", "value": "dca220861042202bfacdad8b84c05864361adb29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194861, "uuid": "51bcc388-9e3f-4c0d-bbd5-407eb78a9108", "comment": "Malware payload (Mirai)", "value": "1965c3973fbab4a4c1f9bb79a0ac7fb0586ffa9cf7b5cc35c809171b824b8011120c258605a2a9beb4a53058346cdfd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194861, "uuid": "eab37073-af68-4f2a-905d-0660a7599bb3", "value": "T121730746B9809613C5C21B37FA0F438977324358D3EB33069E2AAFB1AF4771A4F2A155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194861, "uuid": "9e3076ce-7319-4aaf-8a13-e8ae6a73cb7a", "value": "1536:VNwSPtWjucJYAkJd/OsUAUz1iFbKUviYWItaWjqqXk4oxBzy:9P2ucJYpBURMiYztNjqqXroxBzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194861, "uuid": "958c7cbb-81b3-430b-86c6-90e15d547a8c", "value": 76203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194861, "uuid": "c9ac13a2-f596-48b0-b43c-f9532b2c2151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194861, "uuid": "8ca9b99c-937d-43b8-9af4-2145eca63e23", "value": "97a79ce009c9a3dc7bbfabdc4ed9aefb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb40ce74-6021-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696140875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696140875, "uuid": "f108fcf3-2659-4800-8737-d8459dec0ad7", "comment": "Malware payload (Amadey)", "value": "66c94ac8dcea9b57d023a2f9a93f1fa4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696140875, "uuid": "92eb2588-f5e8-4f4f-849a-2b9e109fdeaf", "comment": "Malware payload (Amadey)", "value": "4433f192e840db153c7918052da5adcaa205e8b7981dd73ae96380f34d67d8d9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696140875, "uuid": "5224ebab-5ca6-4f47-a862-41d2dfe8cfe9", "comment": "Malware payload (Amadey)", "value": "31f26fd54d739b887b4f5eadb93090116185e51a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696140875, "uuid": "db0c7dc4-96de-40ac-aa8b-bae3d22ca8f0", "comment": "Malware payload (Amadey)", "value": "0e2a0beb5ffaab074957dc140d14b6e2c82ccc57f9ddbc58e1377fbcbf41df9c6f85fd484cb49fde6cb5c73a77dd64fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696140875, "uuid": "eb909db1-4c08-4ce5-a25f-44ba3f3885ea", "value": "T113940103EBE95072E8B61B705CFB02C30A3A7C619974C76B3785695E1CB26D4E872736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696140875, "uuid": "e05419bd-013a-4c66-9e12-12838e440ee8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696140875, "uuid": "3cd61938-71f5-4fec-875d-b52edb5f9245", "value": "6144:KFy+bnr+zp0yN90QEj5AQ85IrAm8gMHBVp0XlmXI9UBWdbOCBh7U1EMtSAu2IGzt:rMrby90F51Um8gWVkU4b/0rQGzhfBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696140875, "uuid": "687ce01d-c837-4e41-a2de-177151e63f78", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696140875, "uuid": "57930344-a5b9-415e-a89e-f6a22a742bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696140875, "uuid": "2b601c2d-a6ab-4c4f-bfca-eea81b6e14f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fed794-5ffa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696124121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696124121, "uuid": "858b90c3-06f6-4c47-8df8-dd73476c816a", "comment": "Malware payload (RedLineStealer)", "value": "0ae837859baed164e2e4cb92832b4c99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696124121, "uuid": "1a251ab1-e06a-459c-ac4c-2588178bbcdb", "comment": "Malware payload (RedLineStealer)", "value": "450fddbeb9955d151c3202642ce7ad3b2efda79fdde90521a988fb3703438c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696124121, "uuid": "7ec1b05c-d37a-40d3-88b7-ce58f649c099", "comment": "Malware payload (RedLineStealer)", "value": "6606ca5a3b8497d346b7e502a25e5eb5d257e552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696124121, "uuid": "5a77ad92-0c98-4005-b7e2-adbe3b8a20e7", "comment": "Malware payload (RedLineStealer)", "value": "6ad3f66ff7efb71b5a8d2403740421dcffa733e38983e1a617ad6626b1a1ee6deffb500ad7b2bd8c356b91fd4cf63461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696124121, "uuid": "810f873f-60df-4386-84f2-14351896b3d2", "value": "T111763385B67009E5C8778338C482CC54F6767877FB78E68742B861AA1E73492A87FF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696124121, "uuid": "d61d1821-4de0-4e49-8591-16447ea275f4", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696124121, "uuid": "46e1d6a9-7885-4ee5-9198-eb4c602e5e86", "value": "98304:NfzTBA4Pf1N2zIh3ET9Y9MxVMOPUh3PdWPEUrJY6AOxbHPS2zh/hQqF7CvSopJJW:NfC4FMIZETKwjPePdrQJ/BNOqpAYPv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696124121, "uuid": "ec507351-08dc-44be-92a4-62eb34ef2c8f", "value": 7697464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696124121, "uuid": "54876a83-a6a9-44ba-b8e1-f69c94054ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696124121, "uuid": "c5aa429b-7921-41a9-833b-b6d275e1b3aa", "value": "0ae837859baed164e2e4cb92832b4c99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e04c35-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163602, "uuid": "af178b49-71f8-4d2c-b648-1298dabd54cd", "comment": "Malware payload", "value": "c5b3f7c9084de3319e54e5557ce6099d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163602, "uuid": "9a661a81-3eb4-4889-b0ec-4b993ea48ab8", "comment": "Malware payload", "value": "45c44eca9f3d83577c76d413259b844549012defe8d31bd0f34924f0d991625c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163602, "uuid": "e08ce530-1a16-4518-ba03-63b0b426f261", "comment": "Malware payload", "value": "3a87e31136d04125d27a49b2ae3fa7842db0f6d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163602, "uuid": "bd5286a7-c8e0-46bc-a687-f1eb6eb087e4", "comment": "Malware payload", "value": "959cb8e017310c93ede634f2b36bad828660f9335fdfad8ad24c5fa0447ee86e21ccaa258897008964aed6f5a98d5241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163602, "uuid": "1e30cd21-1581-4a87-859f-e45ccde54690", "value": "T1CC15121FB572482EFA49017BF69B69B6CA7874D33DD6056E8A0C8E411812E6074CF7E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163602, "uuid": "5d3cb131-f36c-456f-9ece-e0f288bfe8b6", "value": "62016c965c083431836eb161c9bf6f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163602, "uuid": "aac1ee3a-805d-40bd-9e00-d2e64974043f", "value": "24576:mnqR6WsL/nUEbZjBCW4V9CNLPWJycq9BPFh14DsO9YAZUA:Z6DDUEHI9++63n14Dh9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163602, "uuid": "bdf6e8c0-b541-48ce-b2a0-ba0108adb875", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163602, "uuid": "f3ba789b-b254-4cbd-804e-329265d87dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163602, "uuid": "30150809-f611-4fff-a5c2-4b42e4677bd4", "value": "SecuriteInfo.com.BScope.Trojan.Bitrep.13464.12731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092c5541-602f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146562, "uuid": "98243a09-5391-4d6a-b8bf-dd439d3fc23b", "comment": "Malware payload (Mirai)", "value": "410195127d0106e5245fd602e8f89558", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146562, "uuid": "ad101d6d-05cc-480e-b11c-b0507b4fe1c2", "comment": "Malware payload (Mirai)", "value": "467c4adc9f7d9d202e122524c92bd89b6288a9887fb577d0483e3507d4d6e280", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146562, "uuid": "77389eaa-2236-4a80-9976-675a8c41b51a", "comment": "Malware payload (Mirai)", "value": "638f21247eb5d5ce8ecbd733aa6e5f41d959e7ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146562, "uuid": "87913aa5-624e-423c-b7a0-07f6d5c94054", "comment": "Malware payload (Mirai)", "value": "c20cbb37659b46979f8198dddc9616aa72527abe8b033da9f7be24b24f1c24cc6a881cabcff755c48baa6103b6dab231", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146562, "uuid": "4c07d399-74a1-4ae6-8adb-320cd5cd0566", "value": "T17F735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146562, "uuid": "639facb8-eaaa-42e8-bcfc-120debec9a39", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8G:YwfdNu4cmZvFqI3w7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146562, "uuid": "ca057270-6578-4a46-ab20-39df07912c70", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146562, "uuid": "a89657bb-7569-4e6f-beda-5aef47efb81c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146562, "uuid": "72965294-03e7-410c-914e-3d32a314e0a6", "value": "410195127d0106e5245fd602e8f89558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acbe28e2-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163587, "uuid": "95f296c1-5983-4ef8-aec4-2716f7205f3d", "comment": "Malware payload", "value": "775189ec59260fc287c0bdc911efae06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163587, "uuid": "1172e634-647c-48a5-a937-0b0722d47892", "comment": "Malware payload", "value": "4692e6564182d77b41960d15e3b8beb89f0d2c0efe7c035e70e349414233a3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163587, "uuid": "6be474f2-55f6-4936-905a-6d08ba5c3ef3", "comment": "Malware payload", "value": "b589a18f89bc3e7af7b283b839a630928afd8f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163587, "uuid": "b0941746-b23f-46e5-b6f3-29651e3c42bc", "comment": "Malware payload", "value": "4aeed43a8a3261208efce25b3d9aca7e1f02f08aa9b460c4dab483c5768925c892ad48cb7be3ca9f32f6677ce62d6170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163587, "uuid": "5210ee53-4029-4cdc-b834-3a5f2e52c857", "value": "T1A256BE42F312C863D24A047011B55B3A6E31AE354E35CA53FBE5FDEA7D73222527628E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163587, "uuid": "51bcd8e9-6e87-4442-b595-969687bd047b", "value": "bbd425bcea8e3658249bff78e5484636", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163587, "uuid": "d9a5f661-960d-48f4-9de5-6b5b1e0e2fef", "value": "98304:+YotLFEYL+3lG45N6ppXWzaG03OrQNYJBAUZLtg7:+hceYJVRg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163587, "uuid": "c9f2321d-17da-4021-9557-6def3cd1f069", "value": 6008832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163587, "uuid": "d6e91121-d76e-493e-add3-128c9c97d77c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163587, "uuid": "49350fa9-b8c3-4954-bd82-fc4de5f93a81", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.4186.20327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80169a8a-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696194866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194866, "uuid": "539ded72-aaec-4370-ada2-494f38e8d078", "comment": "Malware payload (Mirai)", "value": "bf94beda42aa55c8335050a79f99bb95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194866, "uuid": "877c9ae8-81e4-446d-9cee-132437df2684", "comment": "Malware payload (Mirai)", "value": "4696cb704bdc4ea94df21dcc1a815d736ee4d1b2b76d1db5124968ce651bca19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194866, "uuid": "475c8a7c-dedf-4df2-b401-6d2183ae3127", "comment": "Malware payload (Mirai)", "value": "659b423bd443650276938940b6e2627b16b5556e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194866, "uuid": "47e38d2b-ca1c-4e7d-8b48-85f1081d875b", "comment": "Malware payload (Mirai)", "value": "3ffbd490016740402791879d581478849fd079534e4ecd97dcd9a5a207ba283211f88a3f059bda910f5049749c367906", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194866, "uuid": "47a85df0-dc88-4af2-9881-c89168859d64", "value": "T17483E606F8819657D5C10B7AFA0E034A73335B28D3DF63025E296E74AF47B6B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194866, "uuid": "6b8f45dd-47c1-477a-ad31-ab6282590532", "value": "1536:9OqnP8q6Jl3RtgKDTdaowLh3ZM5ipZ1nfds66v7dn5TY9Tpyyi1B:76JZYKDTdavZfds66vpn5CTUBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194866, "uuid": "22c3d7d0-01e7-4c49-9e36-ae1657e8dc0f", "value": 84743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194866, "uuid": "2a29ff21-8afa-4fef-8865-773eefa3bc6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194866, "uuid": "662c57cc-1b3d-48f8-836f-5d26a669bc49", "value": "bf94beda42aa55c8335050a79f99bb95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c073ccd0-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163620, "uuid": "b2faf1fa-4c6c-42d7-bc1d-cfff6dfd8e53", "comment": "Malware payload", "value": "5827dd90b772c58ea8106a35b10130c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163620, "uuid": "d8d9e628-baba-4ebd-8321-8fa3059943d3", "comment": "Malware payload", "value": "474cf2622078a164b5c318cab7a137f9cdc351c9b74f63ab345f181863bd9ce3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163620, "uuid": "08d448ce-5ba7-4e09-a7f9-6cc8aa31a6fd", "comment": "Malware payload", "value": "ed73a100bc591e9e6cee9b41aac66a01ea058e9a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163620, "uuid": "c227c862-e313-4fb3-bd6b-42803440242a", "comment": "Malware payload", "value": "1fc4261473ce8dd9bc7910ad9a11b528ce71a644a2f2ed79b0d5fe1ef76421ae9643e4867a9cd8a313526d7fab6bbb48", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163620, "uuid": "bbc3ddf9-e575-4fe0-92da-d1915410ec4e", "value": "T19795D0A2F7A6DA27F037CA708D62972AD603EC315F02404F3A657F8E6D3A6E04D85157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163620, "uuid": "2001acd1-9ae7-47e4-b4fd-08c477dff062", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163620, "uuid": "1de55016-ed5b-455b-beed-32de32d47f46", "value": "49152:VsWbkgY35GjIciXTwK2vZ/I+s8KuqGaX0ToIBAUZLYJLTtknfAdG:uWbkgY35GjIciXTwK2vZ/bJBAUZLiqnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163620, "uuid": "0f88ba1e-7400-4238-9d1e-dbd5d9985546", "value": 1909984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163620, "uuid": "a2e29ba9-a768-4139-a1de-8d912d22ef25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163620, "uuid": "2fc41939-dfe4-4847-8bb8-24847e49aabd", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.12736.12345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f2d6ac-600d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696132283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132283, "uuid": "d8198676-1331-4c8b-a29b-c7a100a3c671", "comment": "Malware payload (Smoke Loader)", "value": "2a2e7e3b0c0aee191ade0c57516abf99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132283, "uuid": "37e2e4e9-855e-4579-bbb0-9915626b45f4", "comment": "Malware payload (Smoke Loader)", "value": "48211eb921a38d79ff547aae7fadcb18ca266bb69349de67c2c0bb3ab64bb5dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132283, "uuid": "c1059a66-8615-45ed-ab5a-1821c1c4631a", "comment": "Malware payload (Smoke Loader)", "value": "af6f4ee62a67e9e0a9e06eb8008be5f7389858d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132283, "uuid": "161f53cc-51ff-465b-8f22-fce7eba17a90", "comment": "Malware payload (Smoke Loader)", "value": "0316f3468dae5b8a4e9741a402390baae1997f3c0fc961d66cac7453d1cdf8d9e09b4da85ed493630f9c306b3b854725", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132283, "uuid": "8f417a29-24ea-4fd8-9065-ed691505f905", "value": "T1CE063380A469640DEC544E3C06DEFBFB1239E250790BFF38D962D11DA4A59E38BD48D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132283, "uuid": "46f5ff62-279c-41b2-951e-3fe7725252cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132283, "uuid": "effe2840-b840-4037-825a-da0b169f80f7", "value": "98304:2hn0efxrdwW7qEsNhplBaR4hz1bDvRmeeWIxJe/rU0/8:6n0uxrdPsxagz1n5meOxQ/A9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696132283, "uuid": "53b5e402-073c-4ebd-8639-7c566f7e4d7b", "value": 3798376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696132283, "uuid": "a525de83-3e2d-469e-869c-8f095bc59f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132283, "uuid": "3677be1c-6144-4519-934c-6503572c293a", "value": "2a2e7e3b0c0aee191ade0c57516abf99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45508895-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146234, "uuid": "95a1b553-f9cd-474e-bad0-bc919251189d", "comment": "Malware payload (Mirai)", "value": "a1fe7cfc1448a3b6671470db1f185410", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146234, "uuid": "823b72a2-049d-4311-9380-2b323135e19c", "comment": "Malware payload (Mirai)", "value": "4b9012d9ac88b6102258773747873a82c5da6537da9afc29410009c3848dbc36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146234, "uuid": "a24b3e46-a6af-44fb-bcb8-e9e9d719986d", "comment": "Malware payload (Mirai)", "value": "682f822e03b6297ae52a06e744ee23acdde425ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146234, "uuid": "d63293ae-bd5a-4bc4-a85a-84e5eb650cef", "comment": "Malware payload (Mirai)", "value": "c3a283d1f103e5ec5604930ef024d3c9a0f3c1d742546107b6f0a9ddc4b629d95e73aeb99e73367237d72b5ec901fc2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146234, "uuid": "7a324e5a-5715-40de-b80e-316cbb9518c3", "value": "T1FAC2DF44F005DE00DAEB39F52D449ADABB907B1B7A76CA902A60A3D5AF5C3634206DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146234, "uuid": "3c83f59b-8bde-410d-b4eb-fe59a902fc6e", "value": "768:8VdafO76jpmNJJKehmA7trpfIX9KeA7PYB4uVcqgw0t10tLy2:cam+AnKehPRa9aY4u+qgw0tYu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146234, "uuid": "07d5ace2-5526-4362-a68a-317a2d3140b1", "value": 27544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146234, "uuid": "330bf3bf-96fa-4cfb-9509-f6aa4139c4eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146234, "uuid": "26b01a78-e0f2-41ff-8043-41090109e2c2", "value": "a1fe7cfc1448a3b6671470db1f185410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5e9313-6069-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696171797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171797, "uuid": "99fc3847-e7df-4228-bebf-11f7b98d518d", "comment": "Malware payload (Mirai)", "value": "0ff5217d823ea211d0fae54737cca356", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171797, "uuid": "70d024d4-2d02-459d-b619-41daf08c6afc", "comment": "Malware payload (Mirai)", "value": "4bfc7fb4a2c748c5b3d7f66b13eaedc496fcf630b523c04eaf8b09cab6e556a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171797, "uuid": "11d2c5bc-0b77-4429-85cc-82a508045da0", "comment": "Malware payload (Mirai)", "value": "4389a33a49797319205faebf5d3efb8fff5139ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171797, "uuid": "3df4ecf6-8cc4-4f7f-877f-ab862712fc0b", "comment": "Malware payload (Mirai)", "value": "4053cf16b26fab4cb3e8ade2c1b375ab35c3d3c5d73087f35cd3a17b2d63420bdb7567fa7a982f757d9bedb2ed7c803d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171797, "uuid": "79e18613-8757-40d3-8b01-a7b7fef8f1a4", "value": "T16BD2E170928738F181B00135FA98479B86871D74E1FF7273762018B57EF71CA3AA15E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171797, "uuid": "b89578b2-35ef-4421-ba7d-cca076df3402", "value": "768:BA4uBc0T/nVvqV072G+IFYoXHZCx3GoTus3Uoz8:BPuB7/nVMYn+Kf5Uz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171797, "uuid": "bc10e5b3-ba26-4178-b3c1-c29801f759f0", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171797, "uuid": "8e655186-cdc1-4f96-8aa6-e75f041a4d5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171797, "uuid": "6fd08541-d8d6-4f12-acd1-2e88e952f349", "value": "0ff5217d823ea211d0fae54737cca356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d344c5e-607a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696179023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179023, "uuid": "cadb3526-4f71-4386-a1c4-0fc3063cba07", "comment": "Malware payload (RedLineStealer)", "value": "10db065c4f8d5295aef66ee01c1c94e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179023, "uuid": "ffc3e03f-8e4a-46e6-b353-ffce69680fb6", "comment": "Malware payload (RedLineStealer)", "value": "4d1c47f5907a1a6aaef68932731e5072d533340e5a1eab6b30e92b776b8fb316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179023, "uuid": "1a2b5786-173d-4897-bb13-a5a154d722f4", "comment": "Malware payload (RedLineStealer)", "value": "1adb599208f7f2a881c654dff989d4739da8e0c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179023, "uuid": "8460c166-e568-44a6-8ce1-1937c407aeb5", "comment": "Malware payload (RedLineStealer)", "value": "5581cc840762c6bb747dc6124c1d6870cd3e5a5bde47f2a2eec487d3b2ee6f39901747462731e1a7ef49e1f5993934e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179023, "uuid": "6aa8d34f-7722-41dd-8879-feb0d1310efb", "value": "T18874015076F1D072F4E7D9304031DBF2AD7F783269B08A5F2711526F4E306E2AA6AB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179023, "uuid": "1747a8dc-cf53-4ad5-bfa7-fc04d0f737fc", "value": "6d1ef2766ad947ed03bd197f051e8eed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179023, "uuid": "06c6bc8a-d790-4aca-9130-085b71e7df41", "value": "6144:/u39fQEiJOXJUcc7teY7JrBeGBFjIOEssIuBDnqHaDPqavqZV:239fQEfXJZc17zeGBFjH1upPDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696179023, "uuid": "538d2fca-fece-4756-9ed9-e58a00ed6089", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696179023, "uuid": "89ce9a2e-2245-41e9-81c5-9541ffe5bbf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179023, "uuid": "03f6792f-b68a-4d06-b476-4a8556156877", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407af245-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177579, "uuid": "e9a5c081-611c-4a85-8b8e-a52277f6f505", "comment": "Malware payload (Mirai)", "value": "1089cb8fcac62d5c1a2c98a5afa0392f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177579, "uuid": "c40ace38-19eb-42c3-aabc-154fd00d58d6", "comment": "Malware payload (Mirai)", "value": "4f62c08eaeec7c7a9421a48b40f775dc67851e66635737671dd74cdeb5c8799b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177579, "uuid": "c18a8076-8e9d-493b-ba71-6fb1d1ef47e3", "comment": "Malware payload (Mirai)", "value": "759b30e01e61592e8b25b22c2983262d18f5ea5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177579, "uuid": "1e94cf1e-2493-4b4c-b7b7-99c2a491d479", "comment": "Malware payload (Mirai)", "value": "61f04d59d8655ade889e4a10c74b5281f0fab7778aae91689a05aca2e84da5a205873f4a3a4d5de6f2a3e558bfe6307f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177579, "uuid": "cd0cf431-1400-40de-b74d-b5f349b4b01f", "value": "T1E1631AC5FC01DA7DF88ED77B44530909B631A39156930F3ADA5AB9B3BC711A80A62F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177579, "uuid": "53bd91f3-75a6-44d0-8fba-d839a8669ed8", "value": "1536:CbQsY/yumk6tN/1dRe8wMxviiG2bAnsJLvPBlYdUqrEE3hZ:dsY/R6T/1dRAINb4sJ4TrEE3hZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177579, "uuid": "ec920221-3898-4735-982f-12467ff77085", "value": 71620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177579, "uuid": "e242bafe-9cbb-4bba-b3cb-c2b6b709e073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177579, "uuid": "5f304180-b871-436c-b38f-126755e7fd34", "value": "1089cb8fcac62d5c1a2c98a5afa0392f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd21f60a-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163615, "uuid": "9f860ee3-18d9-44d5-ba8a-0b73ba4e01f7", "comment": "Malware payload", "value": "4c5c42179fe0ce3d01856469bdca3644", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163615, "uuid": "5e1e1a6a-29d0-457b-9470-4243d3ace5b7", "comment": "Malware payload", "value": "506423f42e5a748b4f8376d2ca423d5f1e8f8a4ba225e707573e63e859aec009", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163615, "uuid": "d6bde8e0-0f47-4aa7-97e6-6aaca432432b", "comment": "Malware payload", "value": "05a32d7882369f7dfd06913463a1fe8d4388b146", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163615, "uuid": "d898316b-f72f-4e67-b8df-2257f4666e76", "comment": "Malware payload", "value": "5165cc1436cbdfce75d1df07901e3cbd846b2c886c777d18d3430356377dd1f029600381a9210b97d00275fbe731b951", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163615, "uuid": "0c9dcd91-0bf3-439f-a1f4-9a61232800e0", "value": "T136546B55EA81D079D83780F806B82F3F8F69A584471186DF7ADCF8C95F42BE36239246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163615, "uuid": "dbe3ee60-2802-4eeb-8af0-6e4685aebc88", "value": "f26e164038009fa8994b0ca878a25ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163615, "uuid": "abc188cf-d464-4acd-a180-8ac7d53cc748", "value": "3072:27BowFgQuJz0wXqi8Jjz5/zM/DCjC9Vzh7JwJoH8VhQRTYDC:mKTzlX58JH57uDCjC3zcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163615, "uuid": "5dfad4c5-6854-4528-ba22-05e2051729f9", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163615, "uuid": "e32a0458-b4a9-48cb-a6dc-d884318eb35e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163615, "uuid": "4ad8ecd4-c174-4862-8404-acff7733c212", "value": "SecuriteInfo.com.Trojan.Wacatac.15750.9788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93995ee-5ff1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696120229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120229, "uuid": "bf55b58b-c87c-4c8c-a15c-e2f09f352590", "comment": "Malware payload (IRATA)", "value": "7f371afc4c8992f2bb00d280f6c3d20f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120229, "uuid": "8a31b202-1ebf-409d-aeec-c442f69eff95", "comment": "Malware payload (IRATA)", "value": "5187b98622cb284de134155c4204a3e23fbd0207334fec3cee046c8cf387e706", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120229, "uuid": "f238322c-e881-4b96-b7f5-b7806327432b", "comment": "Malware payload (IRATA)", "value": "3ca597c41bc194ec2901147d05356dd4a49dca1d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120229, "uuid": "f39c2cd9-e2c8-47af-b883-2107aac659ef", "comment": "Malware payload (IRATA)", "value": "f7405252d94f39c821c72194d2f6680a3154a070fee21f2ad2e4dd5b2c0749eb5c65a182267cb9340b7dd12a2bf2a104", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120229, "uuid": "b2b4501d-fad8-447c-87f6-a8c7333a76ad", "value": "T15AE5BEC7F7E8692FC87750B2886E52B162574D028E879F876D483B1C287B5D81F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120229, "uuid": "b832fa49-9ed3-43cc-8bd4-cc44e002f7a1", "value": "49152:AsMe1DzwEpQ7xAxm9YO+9yZNjU9ZrIHury479p+MgLCrgnDrOHIt:AsMqDkv7xAxmJ++NU9KOr7gLCrgn9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696120229, "uuid": "063164fd-95f1-4061-8a07-7fbb977c804b", "value": 3274861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696120229, "uuid": "d2e0867a-c8b3-4454-ad1d-be63f1416a70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120229, "uuid": "7de2594a-e808-41ea-992d-f926f24d6766", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3a99ee-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163591, "uuid": "df5b5eeb-a4a6-490c-92bb-323ff84a3b47", "comment": "Malware payload", "value": "22f272522cd3f367f332985987eb7488", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163591, "uuid": "0b748e48-5772-40ca-8d57-603e6a743e37", "comment": "Malware payload", "value": "51f8d9f00d44e561dced4a75baa285f0dafed6f176dc0d446731e18597b7eb53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163591, "uuid": "8f442086-4c54-4ef4-b330-a35cea0f6763", "comment": "Malware payload", "value": "d8dd99b63e06525e2a14da46dc8ac12600410066", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163591, "uuid": "86373f8d-f342-44a5-a6a7-e4d7924eec99", "comment": "Malware payload", "value": "76874d1d58d4f8a577dd1eff3ea671b9eeee315f027f2b33730d85547f0c0b353f4c01f1cc08e4363e2d5dbee7e6b003", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163591, "uuid": "2766a0e1-75ae-40ce-970d-f47fd16d7fd8", "value": "T103A5BE41F372CB17E2EF903289665F26D66ADC709E824447B5603F8F6CF22D20EA51D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163591, "uuid": "76504f28-e8cd-451d-91bf-919f0eb92d14", "value": "63bc622ddbb364868c646ebb5f982ffe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163591, "uuid": "0b4ac991-c667-467d-a7e8-5999a6fa6082", "value": "49152:cAdf809jidYC2tHqPDVbm+s8KuqGaX0ToIBAUZLYkHgAfOyG:cAdf809jidYC2tHqPDXJBAUZL6AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163591, "uuid": "0eabd128-b8d6-4811-97e7-5a9ffdecde84", "value": 2266806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163591, "uuid": "8776ce85-591b-4ab7-ad8e-54c453d71f11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163591, "uuid": "0cac0c47-14bd-4c03-a2d1-be509c4888be", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.29679.86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3175e975-603b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696151784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151784, "uuid": "98b254aa-08df-4163-9f02-530cb94dfa4f", "comment": "Malware payload (RedLineStealer)", "value": "21902fc7925367caa399c6f5ab1b0e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151784, "uuid": "e9d59790-3b28-4870-9c5b-0c250582ffc2", "comment": "Malware payload (RedLineStealer)", "value": "55e862d782e6a2e36efb809824618c127ca221cefcc4dd83971ef88985bd6309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151784, "uuid": "5464a994-297f-409c-8e7e-8eb450b4ffd4", "comment": "Malware payload (RedLineStealer)", "value": "b332a8edc0440783590c765ba13c2a4e0316e4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151784, "uuid": "79aff39a-0c29-4932-8438-48b58549bbf5", "comment": "Malware payload (RedLineStealer)", "value": "b078ac643f20c98cc1f60dc2ecf9a75487651ff6c8870c731ce6e7cc3d1feb330838949817b6942f98edc5c804ac61a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151784, "uuid": "4a60e816-a559-4afd-b52a-ba496833b03b", "value": "T18B74F16175F0D071E5AB427C1171EBA4AA7FB8B2E6B0C54F3318035E2E306D1ABA5747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151784, "uuid": "dfc02f53-d55b-4a14-b57b-0472519b26cd", "value": "976fbfc3365265809568e7f20eed3693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151784, "uuid": "afb51edf-e2ff-41aa-8342-5985662b267d", "value": "6144:6FMb7BJ2yGaD3EM3RyiNIYLKyJf10zzCXWmtyw5LxzOL:6FQ7BocEM3RLNIYLrJf100W0/zM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696151784, "uuid": "34fc83af-939f-4f9b-bd28-5358c6d35e8c", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696151784, "uuid": "80b9b2a2-6a76-4dbe-a6a9-c5ed047d5b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151784, "uuid": "26ea1d89-db3b-433d-bb1d-7594b1cba068", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e51a99d-60b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696204204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696204204, "uuid": "90c900ef-904f-4165-9a32-6844c1b071fe", "comment": "Malware payload", "value": "b9b0dcf09cdc5c9640b4d10708b2e4d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696204204, "uuid": "e243a773-59ad-44fd-95e3-71c73e221775", "comment": "Malware payload", "value": "56692ad12aed03cb960639abe5cb29ba6828af430e5a7ebed9b11faa39b118dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696204204, "uuid": "2335d707-d65e-4254-9fe2-fa380228bc72", "comment": "Malware payload", "value": "1f7bf500f0591fdde20e4d8e679f63efe5f337f3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696204204, "uuid": "8dce816f-45b0-4260-b56a-c293fc4b9bf0", "comment": "Malware payload", "value": "73a2e06b8609c0029629a46f53167232b616c5245fd5d5de3a327e24aac4d36beb7abff2ad8345f784b5f47ab0e9291a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696204204, "uuid": "a1d45368-953e-4bfb-89bc-b4b169fdb18f", "value": "T12833F2A1F70DA8B2C76431F5F1E94787523036B05DAAEEB753A5C0A43EB346B623050B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696204204, "uuid": "35cd0bcb-3761-41de-a519-9bf42844afcf", "value": "768:bnA9z/7sPtRPqKYRCTraNW3x92bE1Divnvj4TsXbkRx8zrKenEP3U4R:rUL72zSKYNAnScivvc4Xbrzn6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696204204, "uuid": "6bc12c0d-c0d8-4368-8c44-072da68a6a46", "value": 50964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696204204, "uuid": "225aae9b-9e17-4bf1-804e-f96701be6c2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696204204, "uuid": "60965a7a-af3b-4dc1-97a2-3205d0477075", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172d3dad-6071-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696174933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174933, "uuid": "6c2267e8-a8de-4cdf-8618-f6628540a0ef", "comment": "Malware payload (IRATA)", "value": "e84faebf2e0dc33a2ae4926b7842c636", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174933, "uuid": "2ed08b78-71cc-4b7a-87d5-dcc6c26895a9", "comment": "Malware payload (IRATA)", "value": "56bff61b7b973d5acdbd9f2445bef40c5c9fb6c72dce90f448d295b998019adf", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174933, "uuid": "cf010193-60ac-48ae-82dd-2d9e2246980d", "comment": "Malware payload (IRATA)", "value": "74cad458dcfc0daefb84fe7dcdbeddde332d8741", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174933, "uuid": "3cdb1d08-0e02-41e2-b3b0-bf2057f4361a", "comment": "Malware payload (IRATA)", "value": "23c90f43724f46cbc3bc2670f34c2f5f3d3d770e0f6b41b015827e81678a4a9f5c7f89982d05c633188036d5e5a05260", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174933, "uuid": "e42b9fd0-d3b4-4391-9b30-c8016417e30c", "value": "T13EA533A6F3D69156DBDF4638453E57D0497A3C710E4389873E2C73782AB7AE8E301A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174933, "uuid": "352a04f3-364b-486b-b052-78baf332efa4", "value": "49152:AEG46V0F+dWzin0m46jLOA7pVxrMAMEQiXQdoQXPGRPo5b4KuHQ:ATXEA4in02jCA7pLAAMEDQdoEP0gsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696174933, "uuid": "27fdd5bf-0429-418f-bbdd-7bf9f56825e1", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696174933, "uuid": "24dc768f-76bf-41d8-936a-62597b8e9164", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174933, "uuid": "a35fa32c-3094-44e6-8016-af3041cb1581", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2ff4de-605e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696166969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166969, "uuid": "9d115ae5-8dbf-46b0-b265-ce8475714d8d", "comment": "Malware payload", "value": "5adf04a8e1099549c363de66891cf7a2", "object_relation": "md5", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166969, "uuid": "a5c0476e-4f8d-4c78-9e81-581b82967809", "comment": "Malware payload", "value": "56c145f58fdb593e0cfab63eaf324388b0fd3a71dcd1a355ed94440640bc72d6", "object_relation": "sha256", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166969, "uuid": "ea798275-e4ab-4056-8a1a-907d77cac537", "comment": "Malware payload", "value": "26882f4f7c5e6bc11745f26265905a2a3ea5feb9", "object_relation": "sha1", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166969, "uuid": "b75a1b08-307a-4adf-96cd-25fd037aec66", "comment": "Malware payload", "value": "b24f9ad32832ac9f0aabe8091545eccddda0b28ee1ffc8674667b654d4886b182be8910d13a4943c5adce002f1d4ebaa", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166969, "uuid": "aff04e73-2a02-4664-8a99-3b9f4406e970", "value": "T193D01294DB0F8159E79265068161BC04DD0E749508C6FD8CF7D2EE9E2DC40C0CD99E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166969, "uuid": "4f522a73-21a8-4a4d-8d42-a0b3a89c1895", "value": "6:J254vVG/4xtOFJblvsCJwHTuX49oNywHTnHDxYo7:3VW4xtOFJB0CJkY0gyknjxYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166969, "uuid": "42e3c6bb-9fbf-4346-88d3-ec1251f99216", "value": 198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166969, "uuid": "251b0267-946a-4916-9c80-f76a8abcfd8a", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166969, "uuid": "4e147fac-9f12-4d60-a58d-cc184b4dce94", "value": "DAHL factura pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a14502-6035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696149221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149221, "uuid": "832caaed-3760-4e21-ad01-499322d837de", "comment": "Malware payload (Mirai)", "value": "e060c1e84827d320246b86085872a3f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149221, "uuid": "a6159680-542a-4b6f-b784-d87ee2b948f1", "comment": "Malware payload (Mirai)", "value": "572f09caf213c9716d875e3152ab88096414cbe20268bef9b5288b5e6d9ec3f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149221, "uuid": "a5474257-6ac9-4773-9501-53112e906488", "comment": "Malware payload (Mirai)", "value": "12fe2940f6aaa10c27376f95fb10e07e01738300", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149221, "uuid": "3176abf3-d4a8-430f-87a2-728b486349d5", "comment": "Malware payload (Mirai)", "value": "2696f2a7fa08dedca2bb8d4a42b491f425a824dcad95476fe5f6d63a40686bc73cbdc5c14acbc210f6a21567bddfa7af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149221, "uuid": "169cfd6b-b859-4364-88fb-6cae2d0da305", "value": "T1E0C2D1E0B726FE31C4206C3DD52B4D8A3A51067C91FF393664258D399FC165A63B88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149221, "uuid": "01e528f3-9ca4-46a1-b68f-53cb175ba4cd", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrfH9q3UELuy:OKy4qfqoeJdXWgfWLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696149221, "uuid": "e1a2819a-7c28-42ab-aca8-af88a05ef670", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696149221, "uuid": "d9c343f0-fe73-4ceb-a10e-4dff1fe02288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149221, "uuid": "d6951c4a-0504-4405-8f62-ad236774a025", "value": "e060c1e84827d320246b86085872a3f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51ff457-603b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696152112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696152112, "uuid": "4c3bdc5b-a5e1-4fad-b900-bfb5e208ff10", "comment": "Malware payload (MysticStealer)", "value": "8547e6ac850b666ad740ed7721a85718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696152112, "uuid": "fe8075e5-c298-4e58-9815-750cdddc770b", "comment": "Malware payload (MysticStealer)", "value": "57e2dd69a0d0ddc367f29d5def48a52086c86fa1cc011c0ca56a51c0eab2ef7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696152112, "uuid": "4b870642-07fe-419e-99a5-7d2ec56b8d97", "comment": "Malware payload (MysticStealer)", "value": "c3f245ae9223bbeb81dc536a44b2aedb1525ddb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696152112, "uuid": "56521478-b1c8-41c9-96a4-4c9c31e4714c", "comment": "Malware payload (MysticStealer)", "value": "296b073235455f1f95e4628c781af97d4bc7e16941b8cb01eb81956ef41b127fea01badd5529f75798243648dfe6d105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696152112, "uuid": "85aa219e-cb06-47ed-a8d9-cb7e296c04af", "value": "T1AA940253E7D89072EEB61BB054FB02C71B36BCA169B443971B41685B1CB26D4A83237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696152112, "uuid": "69c02910-2506-4311-8940-f3e0587ec778", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696152112, "uuid": "e5183705-eb3b-40a3-9cf0-5a3e27ca7f05", "value": "6144:Kjy+bnr+Fp0yN90QE21u04uWP+TYDroJYdRZU6+Ea72uHC+5sazC/MpLb0NeDxV:RMr5y90A1uFuwuYQYdPaTPNz4IYNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696152112, "uuid": "2f69c580-2817-4353-b6de-01743defa06c", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696152112, "uuid": "227b7c50-d007-4091-916c-65b9a77deec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696152112, "uuid": "8b459c52-8b7f-441d-b04e-305dbf6c906c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d4ba86-607b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696179351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179351, "uuid": "530dd6c6-1435-46fd-bcee-781430e55788", "comment": "Malware payload (RedLineStealer)", "value": "ea1de1b7bfbb13beea1c5e33feeebe36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179351, "uuid": "717bbb3c-665d-4359-8b94-fd18113c740a", "comment": "Malware payload (RedLineStealer)", "value": "57fb77909c72da143300b64811e904848cda8833547fa28d97173bf7818f4e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179351, "uuid": "34b707a1-0f2f-4b87-b65c-33e4d59865cd", "comment": "Malware payload (RedLineStealer)", "value": "bf56128adcafc1bdd3729ef9d29ca91e61641615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179351, "uuid": "d4274fce-e818-4989-9b8b-e3205deb4164", "comment": "Malware payload (RedLineStealer)", "value": "848fba860e362bb81f307ede9763ef057ccd97ada71bbfbbd799913edd78ba2258eed85268cfbcea26f2248dc5dcd89c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179351, "uuid": "eb794bbd-bc26-49df-afc4-a26c32a8101b", "value": "T189A40213BBD48032DCF60BB008F722C71B397CF15D74476A675AAC5A1CB2691A47276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179351, "uuid": "c8b76e38-e817-4c57-9f40-2d38c9c6dfe8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179351, "uuid": "807f3d81-1ef0-45d2-b3b5-961520426e52", "value": "6144:KPy+bnr+3p0yN90QEzcMerLh1yOsOjWtUS19tpp5nXUBlSw9E+54W/oEbMhRZ4H:JMrLy90s3WES119rnXc54UoEbMhIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696179351, "uuid": "46127d84-5040-4003-88c8-66eba9fac9eb", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696179351, "uuid": "a9129386-cdc1-4408-aeef-113f98a7b4d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179351, "uuid": "3a08799b-1883-4b78-a032-748c2b2a6ae1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b636616-6079-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696178403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696178403, "uuid": "2b847019-e81e-471a-b9c6-7e60df1e6f69", "comment": "Malware payload (Stealc)", "value": "afd2a5d7fa6f55e938926660a6bd6360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696178403, "uuid": "76dfa014-e813-4b62-a6f9-1319eccba5ad", "comment": "Malware payload (Stealc)", "value": "5819adb0b26a73052400d156ad5d93408b4950bfbd353e8b0b40f37d32a4282c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696178403, "uuid": "7df10a0f-71d9-4617-971e-c86c04045a9a", "comment": "Malware payload (Stealc)", "value": "712055e1bae6924d375fad2d05ce62d917c4772d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696178403, "uuid": "721de15c-0874-4b9c-af77-1f83332fed37", "comment": "Malware payload (Stealc)", "value": "a07e6548b435c30eb9c8122328e6daa1af30780a214d6372e4aec1704ad74e360417aa2a72a44b00c1506be3f3952513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696178403, "uuid": "df7fd1da-ecd9-40e4-baae-b7fafbb3e3de", "value": "T14114CF2179F0C072E6A785305935CA906E7FB8B2F674845F33D4266F5D30AE19B66313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696178403, "uuid": "8a00d870-5fe4-47f1-baf9-bd1423ff59c0", "value": "b2ec932030ff8781de20497debfb04f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696178403, "uuid": "151c06b4-49b6-40cf-9952-2f543108ff69", "value": "3072:v+x06XFacnSxLzPFAf4WYXS2B2lWS1KofLLSye1bNvR/b5lxNvf:+7c3Ne4W/H71f611F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696178403, "uuid": "583f7d7c-78ed-4dc6-99f4-90b91055342e", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696178403, "uuid": "ebdbac8f-725c-4620-8eb6-e72d5a5f11d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696178403, "uuid": "1e8bd1d4-229c-4104-9b98-37fb98be3dfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3402b24-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163598, "uuid": "bc320704-2ba9-48d8-878a-f5b047e35021", "comment": "Malware payload", "value": "785dcca262cddcd033fed54d0e811a28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163598, "uuid": "1f837ea6-bac3-4188-807a-fda187166e8d", "comment": "Malware payload", "value": "586a18085369848fd7a62ea07721bbeaf4acb0abd56697ffeb3546f49c5ee017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163598, "uuid": "6dc7c42c-0e16-4373-802f-af6abf48107e", "comment": "Malware payload", "value": "474f5e5455b4a832aad2b95fafef4a6ef71b3075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163598, "uuid": "d34ad5ea-4868-43bc-9e92-c012e223e2fb", "comment": "Malware payload", "value": "e8ff1c58efcfec49d7e0666fcd5d400407a756604bcf696572c1cfd8dc0063c39bc6596bb4ba761ab06ebe9f0b7d3f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163598, "uuid": "928bf3ad-4703-4c75-8676-5e97e1fac8db", "value": "T17FD46D013AE6C476C26242760DA2D7396672BE916F2586C37BE03E0FBD706C26E3D355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163598, "uuid": "8d71654a-bcc5-4109-8525-1872e9043615", "value": "acc4e0aa7a4945f630361d22cd43dcd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163598, "uuid": "29ad6a0c-5f49-4330-8983-107cdfe9f694", "value": "12288:IZhN0lAK0EkRE7Y4GBtRX3B7ltkiurpg81EP4:mOb0EEEMBtRXR7/zudg8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163598, "uuid": "2e99fe4d-7134-499d-8c8a-db8297bfd4d3", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163598, "uuid": "a007bbda-96f6-44d0-92f5-c2b477bc9aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163598, "uuid": "4442092b-d78c-40eb-a51a-ca6a73147533", "value": "SecuriteInfo.com.Adware.Presenoker.5477.14428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3c5102-6092-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696189359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696189359, "uuid": "0bd0b020-5d51-45a3-b729-5cc16e86ebf4", "comment": "Malware payload (Mirai)", "value": "2874f195b9f6b09064d7803014a6ad74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696189359, "uuid": "cc149eca-1775-4b6c-9e8a-7c712f31a199", "comment": "Malware payload (Mirai)", "value": "587d4c1c8f1624fbf975fa13cf5e901c8a590f244d15e163e6d9a7096742b73e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696189359, "uuid": "77696e3f-aa19-49d6-a9b5-40fdbe6b6f08", "comment": "Malware payload (Mirai)", "value": "37e9ada11ddf93002475eeeca006b9f4eb2ccacf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696189359, "uuid": "ff1eda27-22c9-41f7-a527-1cd194d469c5", "comment": "Malware payload (Mirai)", "value": "3d16fcb5a4f4057f2a3004306b739cc5c4b689c0dc684630a663f9d0079b05c552fe4dbcba65cefbb1a7cca2f7528457", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696189359, "uuid": "464c88ba-1bd7-4760-b94b-4d662f9ff722", "value": "T16AC2E1FD7CB75FCBDE031136A9696D3381B4E0A4E31DB2872681501261071F9A735DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696189359, "uuid": "6eedf9dd-8114-4f6d-8f90-673db945be35", "value": "384:MB1DMwk8JPyGktDZVEXVZVBy6gIuFm4lSm4nnLZd1ZTTqX7n06/d5e5lLMvW9Nyw:0MwaDZqFbBy6g4021ZTTq1l5eTYf0NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696189359, "uuid": "d8137a38-4fa1-415e-ae0b-383e96c2a794", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696189359, "uuid": "3daab743-4bfd-49f1-a327-d4a13a655b1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696189359, "uuid": "47618401-f940-4764-8a81-b9a0014c9db8", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f999d2-60a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696198229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198229, "uuid": "a3483ffd-88b7-417f-bd55-888cb9181c73", "comment": "Malware payload", "value": "b5457fee3b92624a2a0293868e093213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198229, "uuid": "341d4368-94f1-4e89-a723-2e7e8472ee3d", "comment": "Malware payload", "value": "59362178c72380bb2cf4d43a608a26fe3ec9110b06ffce84eab4d88d8be3bfd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198229, "uuid": "efc0f8e6-c046-4857-84f7-6c686ec9dc9c", "comment": "Malware payload", "value": "387c59ee7caad9f416cfef2bdf6a9f1cf4eccd24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198229, "uuid": "b246993e-4fa2-43f8-b78d-0f0eadd004b6", "comment": "Malware payload", "value": "da2e7aedd55450a11d644962e1e6852f859eeee9bbdcbd9220ab73cba92d4783134ea108bf48c1ad363a36a523d112ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198229, "uuid": "42585358-5ac2-4eec-9204-65dbec007037", "value": "T1C8052216FAE98432E8B123B469FB03C30D393DD29DB457276689685F0CB3791653272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198229, "uuid": "8bc2dff8-e5f2-4de4-a4dd-8ae2f8fbc5de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198229, "uuid": "c59a07d2-cc6d-4772-af2d-f25c2e78ff0e", "value": "24576:1yp6fghZ6ApBciMd2r0Gi3kAmZ5tvyju2BbzLd:QwRMMQ0Gi3kDrKK2dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696198229, "uuid": "6ea53a23-dd98-4ed9-8b6e-9e6b1055261f", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696198229, "uuid": "84a4bc55-c18d-4616-b802-7881e7d6e300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198229, "uuid": "352a7e5d-82f2-45c8-92d1-ef58f48b24e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddaec64-6059-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696164609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164609, "uuid": "d16fad63-0603-44e6-b08e-3d32fe6b4898", "comment": "Malware payload (Mirai)", "value": "f597fcb2b46bf8949742d60f11a1dff2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164609, "uuid": "531df8b3-c08a-43ca-8e2e-8466a236a9c0", "comment": "Malware payload (Mirai)", "value": "5ae2a19102b8d9f6348aee768495f2b31eccb77b9b7bc03cf74b51463211ea2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164609, "uuid": "9d5d8db5-9874-4678-acf7-07be395cfc54", "comment": "Malware payload (Mirai)", "value": "9d1158290425f1cb0111c011f38b54117110deb4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164609, "uuid": "1fe3f558-59f5-477b-82d1-4f3c6362f958", "comment": "Malware payload (Mirai)", "value": "1bc6b6601fb73c0b8309c7df461b159620112ee65a40d89b705792f0f28061f06b4a9a41bb412652be9c2dea60f516b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164609, "uuid": "3fc77793-feef-4b33-b2bf-c3eb55407395", "value": "T1F713E796BCD29A6AC6E023BBBA6E418D331163E8D1DF3217CC241B057BCA51F0D67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164609, "uuid": "719c517a-1bee-4716-b707-df3c0db79a06", "value": "768:yU9fXJmHD+rmwcb/Drdgs63dr1NIyypVGDoCerCzufSBUSjVShrKK65sfDHDcQ/W:ysBmKawcIQyyX8ufS+Sj8h+sjZ8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696164609, "uuid": "1771211a-33e0-4251-8e4f-5e2795b6696d", "value": 42728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696164609, "uuid": "dd0e235a-babb-45a5-8000-893e01fc2a12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164609, "uuid": "e053d9a1-6169-449c-a5ae-63b258be7332", "value": "Josho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2710d5-6041-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696154409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696154409, "uuid": "06fa344c-e973-4ed0-b598-23ebde8736ae", "comment": "Malware payload (Smoke Loader)", "value": "7269e26b49490a07b61413158e85f411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696154409, "uuid": "bbee67f3-d13a-43b8-8289-ac24ebcd2a07", "comment": "Malware payload (Smoke Loader)", "value": "5b4038b6432bfe2dc263a228ab0e1de132b604d9654a10a580795500ff32b5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696154409, "uuid": "f04d38b7-48ed-47ef-989f-225c45db9d6a", "comment": "Malware payload (Smoke Loader)", "value": "b42052cd2b20d343c9a23cb14c6ef5ab785138ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696154409, "uuid": "6115913e-3e05-4789-89f7-e5c0d7e41f5d", "comment": "Malware payload (Smoke Loader)", "value": "7ce35d3d6033bc83968a6920f1dbc032ed0fc0e3e901b60f4c4242b0a5e87fc76195e6b0d9abc504af02053bdfc295b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696154409, "uuid": "3609d8c7-563b-4f5b-9ea1-efdec0150ae2", "value": "T1BF940147ABD99432D8B12BB05CFA03830E367DA09D74D65B238A691F2C736C4A43577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696154409, "uuid": "e7e8479a-6921-4f60-a15b-77cc95ccbed2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696154409, "uuid": "0db310f7-f591-4c51-b8b5-fa959a0de72d", "value": "6144:KIy+bnr+Hp0yN90QEZ4MP9FenEcVJLzAQn5S3UkedhggDs9HSASiZJrRX8rmBEPn:QMrny90b4mSkWpohSASK/X8rmBEP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696154409, "uuid": "6ca9acf2-a439-4e7b-b655-30699423d301", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696154409, "uuid": "2f1ac2e7-c9e2-4689-8925-f3f9da64c293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696154409, "uuid": "478b12f4-1fa9-49cf-b5c7-f2d3b477cec3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b2ddf9-5fee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696118716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118716, "uuid": "d0117232-b861-4160-82df-e0e576cb063c", "comment": "Malware payload (RiseProStealer)", "value": "c8aee2733df41cd0eab113ecc582ef57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118716, "uuid": "adf126ec-9ab3-4595-98b5-2862b98cc13e", "comment": "Malware payload (RiseProStealer)", "value": "5b984ca52cca1a5b02214e3818b49dd0548cb96537ce81c861e4bdda6229eb69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118716, "uuid": "a5e97c32-3192-440c-a424-703c38630741", "comment": "Malware payload (RiseProStealer)", "value": "9797fceb8efd7530ab0fab63bb793598665b6d30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118716, "uuid": "beee06ba-9678-41f1-9245-219832dcb0cd", "comment": "Malware payload (RiseProStealer)", "value": "e060d6108cca96b49fd7751d08a2b5eab58e0d60438db9cf33c26b556f578882d71cf988cba3c99f3ffd87898aa7d3e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118716, "uuid": "04d8a938-4047-4eb4-ba92-9b84b7c70c76", "value": "T13954B02362F0FC21E5676B728E2EC6987B2EB451CE59675A3218562F09713F2D372703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118716, "uuid": "5de9bceb-c785-4807-a0dd-0c939e99d0eb", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118716, "uuid": "8173c54c-db26-4509-855f-95d8b05d6050", "value": "3072:39/JnvI3YyQTrjUNlHoY25ebJ4v3gCA6r8MQCLRv8bzhptIDRozQ8nTSWS5/Djg3:1awjkoYmYy3gCWM9lEbV3KAQGmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696118716, "uuid": "9fdcbfce-65fb-4192-a417-d3b2211d2bb2", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696118716, "uuid": "9ddf0534-bd84-4283-bb2a-93a2ba6b1218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118716, "uuid": "71e46cfa-8c86-40a3-8928-d4d1828b2f5d", "value": "c8aee2733df41cd0eab113ecc582ef57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9174ffb-6097-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696191606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191606, "uuid": "06194667-0585-4a66-8ff0-cea7de98ef45", "comment": "Malware payload", "value": "bee46db93df737c15c59a6e1fd132954", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191606, "uuid": "4ee100b2-7ca8-44db-95a5-700b62936159", "comment": "Malware payload", "value": "5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191606, "uuid": "6ac8042e-3a99-46a7-865b-b8be1bf8470d", "comment": "Malware payload", "value": "680c46e55f600933fa0b5658f27f60bc336fcc96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191606, "uuid": "07f0df47-c2b3-4e9e-b6a3-ae41557b8d00", "comment": "Malware payload", "value": "7b0b23eba69701121e77f9ac0eca27f44628a2dc07a4c971584aa6bf234374344f27a92464a7baaa0f4b03580b758629", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191606, "uuid": "98213217-8d43-45b0-a31c-88b73f411435", "value": "T15B56339B19CA43F5F9C12930D31BFFD733B269A749468C34B9C1A4C7B612DA2E026953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191606, "uuid": "5a5f7331-9249-48de-91bf-c7142ebe637b", "value": "04f4a4454da812f4d2024bd9e3fcfe70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191606, "uuid": "54ef27e4-968a-428f-9a66-8814f86b7100", "value": "98304:GMe3NP8k6r0Cx2MQkxvJrUTjOaBTbRlNIyJM+DP1zgFcqtZs:+O4FMQk2jVBXRHIL+psfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696191606, "uuid": "228ad867-9c09-40ec-97fe-fd033bffa120", "value": 6032896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696191606, "uuid": "d7ad6e26-aed0-4200-b29f-63055e579742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191606, "uuid": "9d0446b5-f05b-4fa2-81f0-519cde0b7b26", "value": "bee46db93df737c15c59a6e1fd132954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fc581a-60b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696202115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696202115, "uuid": "8ef0dde8-e6b1-42b1-a9cc-a55cb500af51", "comment": "Malware payload (RedLineStealer)", "value": "112944e5404be84f08bb5bbec4f54f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696202115, "uuid": "0ad0accc-1cc1-4c43-9c5b-628fc9c055a6", "comment": "Malware payload (RedLineStealer)", "value": "5fd6a92b2bcbe4227685f15f68f9c9631e3e1fffca60f60b99ab71aa12513dbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696202115, "uuid": "96617a5c-960c-4cb0-b8df-0719373d2653", "comment": "Malware payload (RedLineStealer)", "value": "c4980b9db0f580069826f805cb7274ca36a6b919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696202115, "uuid": "e1e57e02-368c-43cc-91dc-28bbc528dfb3", "comment": "Malware payload (RedLineStealer)", "value": "fd0335556bad3e9c07a4d2e90e32421700d3d47d4aa36e626a773143cc807dfdb766b0b8757b09b1d1839ed7a129a58d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696202115, "uuid": "1e72f775-6c0d-41bd-8d9e-47bd2f4a1096", "value": "T13B34AF11B5E1C072DC7225360AE4DBB99A3EB93009915EAF67E40F7D8F742C0E631A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696202115, "uuid": "4d15c5a8-d137-4afd-883b-18a278ee7b3d", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696202115, "uuid": "aaab19ad-a321-43a4-b44f-e8636d861425", "value": "6144:dcz4SHy5uoBMFGV5PEkIXEHvZAONGQ1AiVs0BC+:VCmuoBMUOMxLGmPs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696202115, "uuid": "1db35cf6-76ea-4575-bbfb-0b3dd876574d", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696202115, "uuid": "82db6f0d-910f-4de1-ac6e-66310c287ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696202115, "uuid": "128b7b8a-9856-4354-943a-7c6753eaee24", "value": "112944e5404be84f08bb5bbec4f54f79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72c79ed-605c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696166182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166182, "uuid": "d6946526-1366-4450-a422-4e88b3d6e64a", "comment": "Malware payload (Mirai)", "value": "b0f8da8d30960e6f5559c35c6f51f73c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166182, "uuid": "9bede91e-4c80-468a-867e-01cf788c6a6f", "comment": "Malware payload (Mirai)", "value": "602ee1994e2a684136ec57b993e8a9eb4aa761f8c909d1d8ffa5e0017a7c1c9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166182, "uuid": "82bc6f42-cbbf-4322-929e-705215865d7f", "comment": "Malware payload (Mirai)", "value": "ff2dc3bbf586d6b320dc12f82b943557e6ce3b2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166182, "uuid": "4e2cf456-239d-498c-8ddf-674fa511e0e6", "comment": "Malware payload (Mirai)", "value": "476f58c4a36dc78df297d3b60b7648157adce88866b99fd1a02ab61d859b3131fbbabbcb25efce7cc317a95100cdc024", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166182, "uuid": "825d4153-cec2-4e31-afe2-907e9a5a2a2f", "value": "T19B232ADAB801AF7CF98FEABE80134909F221235151930B3767A7FDD36D321589E52D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166182, "uuid": "26bcbc58-7faa-429a-b49d-40b9066af7a9", "value": "768:7nGenEsX6G3Gc1QGYySey1g5QF4duUWeQSSIp4o+JTp5h8Fopp87z:qmEc6fBtLr4sUpdSg4o+Jl5h8Fo/8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166182, "uuid": "63b19a12-afd3-4f92-8a6f-303faa12a2d4", "value": 49196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166182, "uuid": "3b0030f9-93c4-4229-99f7-3dd8d82885ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166182, "uuid": "8a38bc5a-f709-4747-848f-d0f4b969a758", "value": "b0f8da8d30960e6f5559c35c6f51f73c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532531a1-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146257, "uuid": "feb268c9-28c1-42a1-bb8a-3e3355e472fa", "comment": "Malware payload (Mirai)", "value": "a3238c2251b76d9c0b00314c05a62381", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146257, "uuid": "70743213-07c1-4726-af32-4e995da57df6", "comment": "Malware payload (Mirai)", "value": "608bddd0020420041971e1bdd6f1b84964b85d323f72d30082cd5c0967ac6f39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146257, "uuid": "35efd49f-38d2-4e4d-a96f-2470ad2d5fc3", "comment": "Malware payload (Mirai)", "value": "c80d80a030cdf5978e73c062b4ce21de1ebeffcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146257, "uuid": "da429cf4-7707-4d61-978f-fe8b2367fcab", "comment": "Malware payload (Mirai)", "value": "2d8608268c17dd7b26c5642499d0dbd1b6240676a609fe3c7ce5af62df5f473b5d46c81dc6630d4c306b1c25991540b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146257, "uuid": "5e4f9850-f651-44a2-9139-a6707f0dba8a", "value": "T1D6B2C0948A809647C5F03871E17C4F516B7B15B0DAF728232724D7BDDA828A632FD987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146257, "uuid": "c7572058-f052-4611-b3e1-c8c9990145b9", "value": "768:WaKQFH0rs3zWoDDRsjt7LB9U+B883UQen7k:bK7rs3Kktsjt7I9+e7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146257, "uuid": "6cb9306f-0bac-4d09-8f54-a31d35054f0b", "value": 24672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146257, "uuid": "67452873-337f-4f25-98ba-51710ac463c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146257, "uuid": "365e7111-4d2d-4c32-a38d-a8639c128619", "value": "a3238c2251b76d9c0b00314c05a62381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bee4f1-600a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696130820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696130820, "uuid": "3501bdc2-d8e2-49b7-8516-3298bd3d3694", "comment": "Malware payload (RedLineStealer)", "value": "f8279e626e57278355fc555e4946b870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696130820, "uuid": "c8aacce2-11c9-4437-87bc-c676c4a5e28f", "comment": "Malware payload (RedLineStealer)", "value": "60ee9cc59f97b4bf9ccd8756ec724228797b0d9aa660fb8b19587c1aaef548c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696130820, "uuid": "de1f5a35-c250-47dc-94e4-9ea2b8c7b5f4", "comment": "Malware payload (RedLineStealer)", "value": "480057e855fdd643b96f07b6aee9b2efac8876b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696130820, "uuid": "fa08ee91-2d70-440e-9e1c-035b7c9e6797", "comment": "Malware payload (RedLineStealer)", "value": "d38a003cf325f3675f8f8c8a61671bf181843b2113038a495f9b83b4fa193d090594fcb95e32d098d29211adb35aca86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696130820, "uuid": "39be1fae-0fc4-4435-99d4-72b93383bf02", "value": "T100940247ABD88073DAB627708CF743831F35BCA15CB5426B2786A94A0C736D4A43677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696130820, "uuid": "1c3fb352-9e54-4ee5-890e-cb56b9ba9f43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696130820, "uuid": "09a7210d-627a-47b6-9d57-2fe9be2b81cb", "value": "12288:JMroy90jfZkLZl1mxBhGJVedZ2/HmpUAvaftfw:pyV1l1IGJwdI/Yapw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696130820, "uuid": "fb95a4a6-ec0c-4c11-9764-ce481f873105", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696130820, "uuid": "e7e8692f-1166-4be2-8a1a-04aa28486f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696130820, "uuid": "80175f82-e04a-449b-b1f9-1d12df55fb71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178cbfc3-605e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696166773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166773, "uuid": "4c812c24-b003-486a-b39c-0e33576813e7", "comment": "Malware payload (RedLineStealer)", "value": "bf1ad282d26d48f1a9ae1415c5be4c2c", "object_relation": "md5", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166773, "uuid": "4494967b-bc83-4575-a94f-4b338b01b8a2", "comment": "Malware payload (RedLineStealer)", "value": "61d1514fb945224e3134e0a28f6fa194938148723486cc30c9f1e029008303cd", "object_relation": "sha256", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166773, "uuid": "63675edf-6d8f-48f4-adc0-f1889da13201", "comment": "Malware payload (RedLineStealer)", "value": "688ccf09d74accf7325daa78fc457f88e6539e60", "object_relation": "sha1", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166773, "uuid": "1989ced3-65f8-471c-9177-2a8e3317e28e", "comment": "Malware payload (RedLineStealer)", "value": "33fd8419f42610b754ffb796dae4b54bdc3f26372f6c5faeb3ed457d91d586bf1b3fe0a3a9b8ed72a633899c0ea4025b", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166773, "uuid": "f4d122fc-d4c2-4e28-9245-3a8653c8eaf2", "value": "T15505CE526248652AD3E56B70C962F6720255BD2DA9E0880FF2FC3E1F7FFE583E411606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166773, "uuid": "661e714a-01a1-408b-960b-ae7bfb2b3afc", "value": "c1026f3bc4dbd1c7779566798486c792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166773, "uuid": "6aab4256-5299-4734-a38e-2b0dfd32fb59", "value": "24576:As9rN9YwPzIFbDslb50xV1Dm5DotFppqO4F8JU/7zgesADyI:F9rNWwbeP94oOOqJ70esADyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166773, "uuid": "94ff6d7e-4f5c-4ade-93f4-f100abea440a", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166773, "uuid": "9240bdeb-0368-40b7-b582-cada58bcd7da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166773, "uuid": "d7cfeb6c-2c48-4bbc-ba89-ac0c218629e5", "value": "ed1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c636ec3-6035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696149198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149198, "uuid": "be00f780-80a1-49ee-96b6-a0e1f47c4af3", "comment": "Malware payload (Mirai)", "value": "2f47fded9dcb4f7bc33a4be696629759", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149198, "uuid": "6f25270b-5088-45b8-846b-6c56bcb1f19d", "comment": "Malware payload (Mirai)", "value": "625cc274ecb953b7054a4bbe8d88f3821ba48cd34fb6f502a5040199c4a17d6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149198, "uuid": "78cda853-5081-4dee-b6d8-5d3aa9f9d875", "comment": "Malware payload (Mirai)", "value": "da955bdec816489cba453e7157750bcdece1b31c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149198, "uuid": "052beeed-589c-4c93-b6ce-ab20696c4893", "comment": "Malware payload (Mirai)", "value": "67da69cc1b393be1afb89d59877e25bab5143a76225ae4dd207b306a1156449d2fad3e3abf32e7275f933417af031309", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149198, "uuid": "8f12b325-231e-491e-a58a-0086054f2204", "value": "T14182CF3051AB74E9DBE14431FEAECEC6971A0BF8D1FC369317596B78C94200621F92C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149198, "uuid": "fe29be2d-5e56-4468-ab50-d87112d793f0", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMayahymdGUop5h5lX:6GV0P6+kom0tVAoNvm+to1zs3UoznlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696149198, "uuid": "37910bfe-f24e-4658-aa76-5a20adebe332", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696149198, "uuid": "44e9ec8c-1241-4e35-8b20-a5205e1a2b26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149198, "uuid": "c57db2f6-a1c1-47e4-846b-5a2c2ddcbd9b", "value": "2f47fded9dcb4f7bc33a4be696629759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0f3cee-603e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696153015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696153015, "uuid": "f9894012-96ba-4fdd-8172-f85245ed5761", "comment": "Malware payload", "value": "9e6c4b9551969ac5c23b88447d7f53d8", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696153015, "uuid": "d2c41b14-49e5-400a-9086-2cd9d7852268", "comment": "Malware payload", "value": "62688cb34bc81e79047cd2fa4ae437c6800a7cdc729035208895f73b7b893db3", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696153015, "uuid": "8e397bfd-b140-4584-b43e-bc8dc822d419", "comment": "Malware payload", "value": "30ab87c328aff9f69ef11007ee8e15b83e69e78d", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696153015, "uuid": "9c4a0054-4203-4a6a-92f8-708f4c0c7219", "comment": "Malware payload", "value": "f65826a87bb0654c949541a7a301d980ab529ae571246d68b36d09fd27f356142445cc49596ba6af8eaafb98ccf0be7d", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696153015, "uuid": "a85f4760-46ad-4b28-b7e3-2f21987ada08", "value": "T1ACB423B8E77175ABDCD217784C2C123B4D4F03D316B61594A0A65F288CDFA4BB6C898E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696153015, "uuid": "c7105f2d-ec2a-4601-9530-30ab531016e0", "value": "12288:E6R5pmWVesXbqAM5Nq4rcU1UY65dR5wt1vS+bCEfpWMhsG:EGDmW0lAMzq6cUKtQrvjCPMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696153015, "uuid": "bd541229-4fbb-470b-b4c9-7607c3ce9faa", "value": 512808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696153015, "uuid": "e7537643-6020-4fd3-9e7c-66360247232c", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696153015, "uuid": "6453906a-09b8-4620-9537-ee4fc70fe882", "value": "AppleApp.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b169897b-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163595, "uuid": "6d46630d-c69e-409d-9c3d-e96ff8e6e11e", "comment": "Malware payload", "value": "284e177bfe8834547fea03589cbd4749", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163595, "uuid": "640fa891-9771-47a7-ba7e-abf5f321fed8", "comment": "Malware payload", "value": "646005db048551c0507e518cdb63279685160eb2e64a0d1fa47cdbf753ee8ac2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163595, "uuid": "b59f6b52-243f-4719-91cf-5cdbfadb61dc", "comment": "Malware payload", "value": "a2bd402b090d7f11fc0f56b9c57fa19fa47fcf84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163595, "uuid": "585953a5-347c-4789-8222-c27c40cae1a4", "comment": "Malware payload", "value": "c35aba65a5aed7fb75516afb162209a05223cdd931f37e85a874a94d0061bb494717f9776086d2c0d059c6a2014fe518", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163595, "uuid": "2703eee1-6d64-48d6-bc96-f26f3afb052e", "value": "T1DD95CE11F792CF1BF837C634C8A26B76CA42EC21AB17851B7A25738D8DB76E11E85113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163595, "uuid": "840fe074-87fd-4a77-81a5-9578afc0f663", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163595, "uuid": "ea2f52ac-c0cc-4b4d-966d-7b34e16df359", "value": "49152:VThtqggqD+s8KuqGaX0ToIBAUZLYoHG7uyfPXr:dhtqggq4JBAUZLXy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163595, "uuid": "ef99b266-2035-48e5-b578-e28f4f60d130", "value": 1890008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163595, "uuid": "b03c1560-bfe7-4257-8dc5-c1e6cfc43d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163595, "uuid": "d2e12759-3d13-45c8-b4aa-aaa965a33bda", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.117.9486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fbdb60-60a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696195733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195733, "uuid": "531dce72-afdc-4f4b-96ff-45c616fa7e2f", "comment": "Malware payload", "value": "6dbc63722864577e3de98c084fae5e91", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195733, "uuid": "ce172165-1f4a-43c9-9410-488223c8674e", "comment": "Malware payload", "value": "65ae29225c9dfcb70d44ddce7905f09209dc191b8d9a86cf7ef2b29560ddb93c", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195733, "uuid": "9aab0865-1f4d-46b6-88a0-ed33f6b1850e", "comment": "Malware payload", "value": "aa7e0231c3f0524e68e674643f01b11964cd82f4", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195733, "uuid": "2175790b-eee5-4c15-9f26-d01b35a2b6bb", "comment": "Malware payload", "value": "9226b4d8f85884a23594e7832e76ce617b54c09ade927fec2e4273f1dfaccf5585e164ea6fe8b97b0c8367cfe59d3e57", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195733, "uuid": "40fc4768-2b3d-4a89-879e-8ebe8b36fbc2", "value": "T17CF42306A3B2B51EF9FE74772A19E24AC8B5FFF1B4A96002C3D7DC6A1A6F5414078107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195733, "uuid": "5347a317-5cac-48b4-b5be-66bf65ac8c6b", "value": "12288:yrUmemErzJ8oGZr538quJhuOVIS/+ZgQa3Iw/UoTsHn2Y9VhILtBb:6EHJro538Pl3J1IoTsV2Bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696195733, "uuid": "6bcffd25-1249-4956-aefe-f3f74b4600b4", "value": 764913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696195733, "uuid": "f4db18bd-b3e4-46c7-bf6c-3f233ad95706", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195733, "uuid": "c5736b1e-6d6a-44eb-86c5-7e32b5833af0", "value": "695326187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401246b8-6087-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696184450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184450, "uuid": "5a5f70d7-3474-4d71-b606-b0464aa5a8d8", "comment": "Malware payload (RedLineStealer)", "value": "986a3897c6093cd758e5fc80e5f46a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184450, "uuid": "3b48f0ce-3d44-40a2-8420-d5a2b53cfe8b", "comment": "Malware payload (RedLineStealer)", "value": "65c31f383237c76c4a474bf71d555162360ea071f4738d5a24153d79789ed2e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184450, "uuid": "ca4cef6a-87fe-4a3a-91f5-5f43f11eb596", "comment": "Malware payload (RedLineStealer)", "value": "00ce5b796402d2b3d273d467e05d96080952643a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184450, "uuid": "f3d2fdc0-c15e-4fbd-a817-4c9a3250082e", "comment": "Malware payload (RedLineStealer)", "value": "87c35bc8ca1703b11fb4e4a9fb5defd2ee8de9a45b68732c3deff0c73bfc35b60eee8f0e5df0090d53ebef93efc12f7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184450, "uuid": "d90dd78f-9a7d-471c-84ca-4653c56aebd1", "value": "T1D9845B727490C663D4D292B0186C763791B4BFB0AC24952FFBCD4746FA8E0CE96D948E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184450, "uuid": "42be646e-1879-4fb2-81ea-d7faee9bd34e", "value": "99b61dfa9e1cf5ee0cff9560ceb6d5d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184450, "uuid": "f8dc0e8e-2da8-4e71-a1bb-9eb493307c32", "value": "6144:lB8LT20nyVbUk/qUVNUt8IU1Xa8ZTyRMy3FB+kBsjnjKDTRXW:ls5nyVbUkBUthmlTShCnjYTRXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696184450, "uuid": "83d26949-b62b-4300-87d2-fadcf06b887a", "value": 393672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696184450, "uuid": "7d7f73d1-8b02-4ca7-a06c-14c89ff0ebbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184450, "uuid": "808a28bd-a25f-47ba-92a7-e373dd460c2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7634d3-6071-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696175181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175181, "uuid": "53f28414-83e7-4697-b5ba-128c90eaf288", "comment": "Malware payload (Tofsee)", "value": "8c8b3b3e93edc084a60787d1670f6571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175181, "uuid": "4ca14dc7-3a71-46c5-b607-1a4c390009cd", "comment": "Malware payload (Tofsee)", "value": "66bcc8dbc2c587eb355a5c51b2b344151ad657cf48c4bf22b23e20b4b5ff63a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175181, "uuid": "0bd4ec9a-de49-4488-9ca9-981d8a0d25ea", "comment": "Malware payload (Tofsee)", "value": "8d49792c08d05da4aad0943c953d4766e2c45d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175181, "uuid": "747174c7-e865-412b-ae58-a057df520168", "comment": "Malware payload (Tofsee)", "value": "540ba52074358670726eb861cf4fc634d2da8cb162d0f8e1e3fe34ba4e503a7b80ced6b0bf38c91a8584ebe626b5535c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175181, "uuid": "10870ea5-6fe7-4bda-99a8-c309ad0e58af", "value": "T1CD14CF2175F0C872E2B785748931EA942E3BB8739770898F3790126F5E316D19FAA317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175181, "uuid": "6eaa9cb3-a2f8-4443-87cc-f35795dbc20d", "value": "3674a15959055454487696cf3e8b751a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175181, "uuid": "d7ee8cc5-30b6-4106-bfc6-668f5596ee3d", "value": "3072:pP+qB/Z2bdlViAD6DR4iq0S2AvHmZnTJmQ7rgAwrq0E0iXqJb5/HNl:p/8J+AD6m/9fmZnlmQ4AUEXa/Hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696175181, "uuid": "9e4f7512-d8b4-4439-b468-a859d0666719", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696175181, "uuid": "ccb773dc-106c-4e5b-9538-d0a8bb548b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175181, "uuid": "64f521b6-7f89-4dcc-9ed6-80e4522103ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d8ac20-6093-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696189800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696189800, "uuid": "22604764-43d0-4212-a3a4-dcf667c79946", "comment": "Malware payload (Mirai)", "value": "dae1a89667fb365db65cb51744cc9b32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696189800, "uuid": "b3dd6eb8-e2a6-4ade-8f51-99511ad150e7", "comment": "Malware payload (Mirai)", "value": "6763783f6869a927687fa58d9251126600fa84b827e5da8fa23d4a7c61adf093", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696189800, "uuid": "56d5d7f5-5fb2-45c5-9b98-a9d8fc983fc8", "comment": "Malware payload (Mirai)", "value": "f4d16caef21dcb49d3f479c8e1454e907f737672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696189800, "uuid": "09a257b2-2b55-42e2-8f60-5539670df531", "comment": "Malware payload (Mirai)", "value": "255c9252bc8f3b8f2466f11ec396071bf86e8270a3355e81a00444c16f0413d509201a3e873a24ed68d518752be5fb2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696189800, "uuid": "53a8c46b-3353-4693-b16f-6e6e8fe5aadf", "value": "T15BA2E059BF2D85CBC832293845E9EAD21352FC71F2ECDC492A40C15FB0A33A96474F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696189800, "uuid": "a964c62f-6210-4d28-9fc7-6a383cc5d9f2", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKX:k98o08kxofBE+ZkXaqGbp2F2TWul0c5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696189800, "uuid": "e45e17da-7c5d-43c7-bba0-74b07741ff41", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696189800, "uuid": "95119950-ef79-4dc6-b724-c8c6c26d495b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696189800, "uuid": "6f7b97eb-49cf-404e-b7bd-dfc4bce25d09", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6a66d1-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146217, "uuid": "1a100074-de4c-4a10-b2e1-39913a6b80c5", "comment": "Malware payload (Mirai)", "value": "e45fc6f2292fb2b3b3da3e206fa9bd32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146217, "uuid": "8dba5863-421f-46f6-a81a-d06c22e26b16", "comment": "Malware payload (Mirai)", "value": "676b64da78b7202ae1faab242afce23062d9a9fb5ad49bec4ce32f960a49499d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146217, "uuid": "5fce2014-d221-4bac-9fe1-44dc86184b95", "comment": "Malware payload (Mirai)", "value": "f6a63dad9987a7aa96928921b265bdd6a898ce45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146217, "uuid": "57f5c7e5-24a9-4a8d-8dbf-d18f040e72ea", "comment": "Malware payload (Mirai)", "value": "7153cdbd246652ed3d4e6bf2ea0a7eb3a0b3eccf8b6b45cec2ae3d7e8bff17cd1dcc37637f0bc5ae1cfba7047cae5f41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146217, "uuid": "2200b65c-673b-4daf-a3d4-69dbb6514be3", "value": "T199B2C0B27015B8B6C7A100779EE9DF83FB810EF8D0E8732914A5099DEAD5D42B6F1247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146217, "uuid": "47ce638e-fe81-4b9b-bf13-7b0067e617c0", "value": "384:tZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3pz0hymdGUop5hy:QX9nxn8o9wnBoWzEQf2EjKb3pAs3Uozc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146217, "uuid": "273f2604-22e8-4ceb-b5c8-c28f8364f462", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146217, "uuid": "29ecb5be-200c-449a-bdc2-5adc18d21b2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146217, "uuid": "bcc61952-05c1-4c7e-8072-4f5b022b7978", "value": "e45fc6f2292fb2b3b3da3e206fa9bd32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e660fd79-60ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696200191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200191, "uuid": "ff60dba4-2fcf-4c66-a6a7-62c794558acd", "comment": "Malware payload", "value": "7a6a7ff358282ad609dcc0cceaf41865", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200191, "uuid": "36a17938-b407-43cc-a57e-04b4c88beecd", "comment": "Malware payload", "value": "69d5cca8ed471e5910ce93906456406546e998de8b708b378d3c98c20620d840", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200191, "uuid": "8d8c4817-f7d7-43b6-aaf4-78de44663a5f", "comment": "Malware payload", "value": "ac4c455610dacbd70d0f7a6e1a60ad8d0bc92cd1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200191, "uuid": "992fcb5c-7abb-4d32-a5cc-2237d08e5965", "comment": "Malware payload", "value": "945c4b4fd5c537e87fa4ea070d29da796c187be21aa634be90f8ee0a44ed49c17e186a71267916163b43849816344342", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200191, "uuid": "06516803-0c20-4a65-8bdc-61565e0f5fe1", "value": "T1D675D082377680F0C4AB05346E27E36EE3705A014F6ACEDB95D0258C9C725DA7D7A3DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200191, "uuid": "22cfbc80-6d0f-452a-832c-6cfd7ddd1167", "value": "317f9da236ed42b2c51e3ccdbb82e29a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200191, "uuid": "6e5a970d-a738-4706-b2a7-3e4df1b6494f", "value": "24576:V9ah+UklQtDMSnx21r8bwTjuWrDU4Ag+aDq4Ue764d5G+ZU5s8tbsodiwKUSVQxm:V97UIUgSnx21rLdDMw5G+yftXFFO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696200191, "uuid": "fc13e10e-6fb0-4ef9-a1f8-d31a3012078a", "value": 1641446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696200191, "uuid": "e0a5a997-6eae-48bc-91ff-64395a54b84d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200191, "uuid": "607cd469-7871-4125-a119-450e1e96763b", "value": "SecuriteInfo.com.Trojan.Click2.55197.27404.1980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debb8243-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696195024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195024, "uuid": "df8409f2-7fa3-4723-8b63-f34617e51da4", "comment": "Malware payload", "value": "c435ecf2f40b606029cb488e8b0baf66", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195024, "uuid": "8ac58235-e9d1-4e59-9dd3-c545596eff61", "comment": "Malware payload", "value": "6a19b14538f772b804a26f5280d4cc11b01721a74a95cce01151b5887cce46f5", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195024, "uuid": "102600db-a9fa-4590-a548-9d5dbc95d0ea", "comment": "Malware payload", "value": "964391860d899df01e7725f4d2b56fadd3c339ec", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195024, "uuid": "d3cc8f42-606e-403e-81fd-cc22f255e2c2", "comment": "Malware payload", "value": "02ccd5fe810c596bff9474ae5cff8f5110c3650e23bebb0e5c55c3788cb32b17bb5a7fa005edab70cd241c20ebdae0ea", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195024, "uuid": "56e69840-381a-4885-a340-eefb6963471a", "value": "T131B733035970B7ED72A106489FF1C569BC13D282AC4D87A1EDE4389BCEED9DB9720C52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195024, "uuid": "fbd088ae-e77e-43d9-9755-27222c1b5b33", "value": "786432:3KFILY+RZDmGo8K+V7kAWjTq3wzZC8YlOooirIZpc2oiX2GVqhRXCc:3KFILY+DmGN7uYs/isgvhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696195024, "uuid": "d00f3387-e67c-436e-aa8f-db9e9a33cb9f", "value": 48618398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696195024, "uuid": "2ffa4684-2522-4dc8-9230-10a7814a404d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195024, "uuid": "1f6a39c2-57eb-4e20-a97f-a77bfa29adfd", "value": "information.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20daf163-6059-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696164641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164641, "uuid": "606ce0db-c5c8-4d3a-8a32-e8cc62993ffb", "comment": "Malware payload", "value": "28365cda1f53ad8e8465d2f8be66ec3e", "object_relation": "md5", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164641, "uuid": "b2b03bbd-075e-4252-b1f3-38c1c867b65e", "comment": "Malware payload", "value": "6a4aaa933f161fdc313790e612ee5ba1401280bfe96ef05ea66585452f2b453d", "object_relation": "sha256", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164641, "uuid": "972876a2-c465-4d39-8566-a1b8d92576c0", "comment": "Malware payload", "value": "575f2401c37c3f1ec859be783386444286f768d9", "object_relation": "sha1", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164641, "uuid": "e8eea45f-ca5c-4bac-a81f-b7970c9ef1db", "comment": "Malware payload", "value": "4394253149e44d8e65cf4fa33821da4a14080f878a9ea759832343e8aef8d3365c1c9b279b29679a41808287e0d1b779", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164641, "uuid": "c2ff21e7-d7f1-450e-8b93-cf74228e6a52", "value": "T14BD01294DA0F815DD7A2A1024061BC04DD0E74D508D6FD8CF6C1DD9B5DC80D0CA89F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164641, "uuid": "45c74f55-70e7-4a6c-8d53-a9622c476c4d", "value": "6:J254vVG/4xtOFJblvsCJwHTuozkACoNywHTsMKp7:3VW4xtOFJB0CJkS5gyk4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696164641, "uuid": "bde5a109-81ea-43fd-aa23-caf787325d24", "value": 206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696164641, "uuid": "7074996b-bbde-4034-a3c7-bb2a0c9b6788", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164641, "uuid": "4fc9da33-8e54-466f-acbe-628485fcca60", "value": "Information pdf url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a256b18b-605c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696166147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166147, "uuid": "95541611-e7f2-40d9-85e1-cecd7a9b8933", "comment": "Malware payload (Mirai)", "value": "a1566001be9d02e82193841e5643824e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166147, "uuid": "e307c0ee-a150-45f0-a77f-a5a75efe678f", "comment": "Malware payload (Mirai)", "value": "6e3ab031d4a09c132a3948b20f837c9482d42345356f3d620f81cac76f5cdbfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166147, "uuid": "785f2d4c-afbf-4ffa-87f6-eaf64d737bdf", "comment": "Malware payload (Mirai)", "value": "c3683ecef7d9f3924c848e026f4963c4cda6615e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166147, "uuid": "ef116133-f84c-4113-a610-8fe92153a7de", "comment": "Malware payload (Mirai)", "value": "96577850a44d1b189f59507a3f22655e3fea1778cac78e65253f4422a28d6ee71574ea492ee57a0cfd52e9f4219e2744", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166147, "uuid": "a59f67bb-79b0-4acd-a734-c2e55a57b8c3", "value": "T1EE336B35BD7A2E17C4D4B57A12F34768B2F1265E34A8CB2E7C620E4EFF14A40605B6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166147, "uuid": "c769ebcb-cd32-4fb6-8d7c-834c25da1f16", "value": "768:qw+orXYsq9LtzkKn2MqFfQ3u15jxDO+QYvTw:qw+8XYsSLtzkKnFWfQY/3rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166147, "uuid": "e668634d-0e3e-4582-9d6e-acc25c4c2cbb", "value": 52364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166147, "uuid": "3752016b-838d-454e-925e-4e377bf3102d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166147, "uuid": "d0fb7735-3f16-4161-98f8-ba57e29b847c", "value": "a1566001be9d02e82193841e5643824e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc6620e-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163612, "uuid": "21dee7f1-83b4-4428-a244-a7899ff60246", "comment": "Malware payload", "value": "7d577c997c34269603a2873bc819c250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163612, "uuid": "48236be9-524b-4ef3-8c3b-cd7d5dec26f6", "comment": "Malware payload", "value": "70498f66845c99374d5a8e88c52c82f4ae2396eb9dec2cb29806dbf481233e45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163612, "uuid": "ecfee8bc-4827-48fb-b380-52d072fae550", "comment": "Malware payload", "value": "7b150332e450c271fffa2a558fe26409a482b21a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163612, "uuid": "bf96ee36-bf14-42f6-a62f-6f9b8a3bba67", "comment": "Malware payload", "value": "df093e9d7144335ad5d89ec463147e598c8a8e32cfb0a289e6e5d96feec4c14710c68b7e1f041665e3ed47ac78a80bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163612, "uuid": "4771a884-ea3a-415c-9735-0dbdfa70f568", "value": "T15CB77C42A3E708E1FEF75E7165FA926795377D016F3440C7A2482F2A5E332E04A3A716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163612, "uuid": "0adb7970-58d8-4a32-b504-e71bd51b8536", "value": "7a5b5ae3a0ac4de63ba3fb2219b9bd7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163612, "uuid": "48ad99fc-0d36-4129-89e8-3f46cd4121d5", "value": "393216:ONWo+S/Vxdl2m7AjOhWs8RToxisNJsv6tWKFdu9CsRhcxR9BSqChVx7jMsPO2GHt:70jl2m70EErUhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163612, "uuid": "b2d09fa9-4e54-4395-be5a-68cbb8a62643", "value": 50472960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163612, "uuid": "42161cda-f748-4530-a337-cea2f22b51b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163612, "uuid": "b73959bb-bf88-4ea8-88dc-4804bd34801a", "value": "SecuriteInfo.com.Adware.Presenoker.5261.27826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2193717-5ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696121157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696121157, "uuid": "a993119d-5026-44be-b5ee-ef730f94d60f", "comment": "Malware payload (RedLineStealer)", "value": "91756f2ba2bc49c76407452f4f7b65c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696121157, "uuid": "ee768a29-33cf-4829-b96b-07042ffca0e4", "comment": "Malware payload (RedLineStealer)", "value": "71684336789eaab8dbcdf37485d0e75234fbee444cddc643a1574535883a36ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696121157, "uuid": "ba8b15c8-b365-4bea-8e4e-4249250df862", "comment": "Malware payload (RedLineStealer)", "value": "4a90b75c3cd9b9073f7467877b65e7097f2aac4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696121157, "uuid": "46bfb253-46f8-44a4-9b41-142fbde0c9dc", "comment": "Malware payload (RedLineStealer)", "value": "452d6d096e781936f308fb745e8b3033f69c768835aa02269b263a496601cc2e376ed3350239b86dc0e16f7963071c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696121157, "uuid": "e0851f8a-1135-4eb5-9ed8-6de70c354d20", "value": "T146940202E6D88473D9B537B01DF603831639BCB268F8476A3346D86E0D736D46A7672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696121157, "uuid": "c85588d2-696b-41eb-a095-950abc9e1455", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696121157, "uuid": "948ae1a6-f17e-4077-bf1e-bc4d7f3eff2a", "value": "6144:KIy+bnr+jp0yN90QEkVu/iphr7da/6w1A/q+9plVQyCG6orjC/WOTmN5QGtpZIIV:MMrvy90mU6rrYyyX+9RHVhsy1tLRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696121157, "uuid": "77881cb7-1261-42ad-93a4-f8dc1e060e30", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696121157, "uuid": "c3b40cf5-07b0-48e4-bd5c-61099f4f4adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696121157, "uuid": "92f38529-8b9e-4787-8ae3-080efad2ab46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db48e7f-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146248, "uuid": "53635165-6311-4cb0-9eab-79a880fec608", "comment": "Malware payload (Mirai)", "value": "cd042fbd83dccd75979cd16976c56721", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146248, "uuid": "682fb3ad-4925-4ad2-9282-8df84f047845", "comment": "Malware payload (Mirai)", "value": "72152914055055c7a5eae9dbf94e1cfec15ad62f037c62afdd41595d72eb5c82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146248, "uuid": "c2a4ac1a-cfde-4f88-808f-637cf903c5d4", "comment": "Malware payload (Mirai)", "value": "7ca707b08c663cef1c071046ffea7466774f850d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146248, "uuid": "bd954c9d-f79f-4b50-aebc-d1c2e3f79a11", "comment": "Malware payload (Mirai)", "value": "c8aa6f85f564fa3fcccbdc425b1765eedaa6fcd721a6bb017cd91102f907ea49d0612782fef747ace3cebfa48a5e2933", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146248, "uuid": "d8e4cabe-9110-4478-873f-741dcde805c9", "value": "T121539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146248, "uuid": "6cc1006e-bef7-49ba-8fab-aa19aa9d897f", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146248, "uuid": "fc4e1771-5470-42bc-87d6-2b18e94a4179", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146248, "uuid": "815eab2b-8a93-4c62-ae1a-5a90321d99ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146248, "uuid": "f9617765-a50f-4ce1-8e8b-ebf8f79eeb5b", "value": "cd042fbd83dccd75979cd16976c56721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c18f4e4-6035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696149225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149225, "uuid": "8d7cda83-1734-4485-9a78-c7dc5ede16df", "comment": "Malware payload (Mirai)", "value": "e5f2fdcbdbf27eda3288b00f986bba5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149225, "uuid": "79a4190c-1275-4166-ad60-f937f89c33fa", "comment": "Malware payload (Mirai)", "value": "7621d30957e74248e024a868abb2a3debc4b3e59822dcfd0ce3d0f7c03861fca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149225, "uuid": "a90edd61-9432-4131-aa68-bbc06ecba552", "comment": "Malware payload (Mirai)", "value": "f48a25923260bbe800bda50b2be3756c61d2ef7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149225, "uuid": "9fa6364c-5bd2-48dc-b1c2-7263c1b23d1a", "comment": "Malware payload (Mirai)", "value": "e58a304de8c9135f32e21a2a60402c3d5db55decaf0ddda4c4767499c295dcf6e0ea79a85fbda85c460feee69f003cbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149225, "uuid": "7114ef4c-0972-45df-9cdd-fa40834a218d", "value": "T12533FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149225, "uuid": "d15b6c7b-66da-4fbb-97da-3d0ee2d4084d", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGQ:r/hqaJMcjeqK806MHdMfQXoHuCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696149225, "uuid": "0ef1c7e5-2a55-4332-95c5-0b290a9f9c64", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696149225, "uuid": "77f43c76-591f-40a7-aaa9-fd25e6445465", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149225, "uuid": "8a7b94a9-6409-435f-bc76-ba6fb4ddada9", "value": "e5f2fdcbdbf27eda3288b00f986bba5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fd1683-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163601, "uuid": "38711875-85b0-4da9-a38c-03080363e9d0", "comment": "Malware payload", "value": "00c6a442144bcb5cb97f43c0a9ceb2b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163601, "uuid": "d29b579a-dffb-4625-bca8-b6f5a2459eae", "comment": "Malware payload", "value": "7680791dbc5b249cbe3163f9aa39840f778243db73f5c3ec63b7309813d91e29", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163601, "uuid": "ba9d7c14-013f-42f4-8da9-eceb41a2a41f", "comment": "Malware payload", "value": "f6a1dbaaeb07080d003caa17ece1e2e6a79c726d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163601, "uuid": "7fd0a871-a3b6-4e40-b921-28aaa3e98c02", "comment": "Malware payload", "value": "98a09eb34489c99e81207b30dcd1b2d11219a1c7d309bcf141a2c0f6cd74c2f670701a1eda21d707110d0a0cc45d4b1a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163601, "uuid": "5aa20137-e38f-4eae-8f5c-5ae8c016f869", "value": "T17595CF61F7A2CA17F437C53488E2972AC603EC726F06441F7B667B8EAC766E04DC6116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163601, "uuid": "eff8aee5-033e-46ae-b829-c43bb247a4b6", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163601, "uuid": "3152573d-2efc-4a44-ae13-11823eeb932d", "value": "49152:VI8lS/GkDX+s8KuqGaX0ToIBAUZLYNzWymfIFC:O8lS/GkD8JBAUZLKmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163601, "uuid": "f11f6339-5fbf-4646-9a7c-07366ef3d667", "value": 1913196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163601, "uuid": "294dac06-6667-4383-940c-f7832758edda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163601, "uuid": "552f2f0d-b006-44e5-ab4b-39a4427079bb", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.26999.26509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31277266-6072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696175406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175406, "uuid": "9f5dbe13-c12f-4ed6-9e1a-3c5dc8e75ef4", "comment": "Malware payload (Mirai)", "value": "e623774f4b9a9f34bc25d05370d61e3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175406, "uuid": "77cdb2dd-ddf9-4d52-8e80-48b52f507557", "comment": "Malware payload (Mirai)", "value": "76ea1524b615e7f8d4599286b002720cea4a751abeee6a5b8eb9c6dd91152abe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175406, "uuid": "ca826be1-04f3-416c-89cd-40e919ff4afb", "comment": "Malware payload (Mirai)", "value": "009a8cdb97a311ebf5270ce4af5c7b80a764a930", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175406, "uuid": "dff978ff-7ed4-45e8-af63-088a8b8d29b9", "comment": "Malware payload (Mirai)", "value": "4aea611773fc2980753046b50f2c6699375959bc83ff637dbd12cb2e5bd15ab25a75920867d4899b002e30932ab3cc5b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175406, "uuid": "e26d9ccb-c60c-4b6c-bb44-8eecceb21e31", "value": "T167A2D019BF2C818BC836393955E9E6D61356FC71F29DDC493940C16BF1A33A51870F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175406, "uuid": "6f0e0c08-0bea-48fe-a8ce-cce43a303bac", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTu:x98o08kxofBE+ZkXaITbp2F2TWul0c5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696175406, "uuid": "5a554449-536e-40c5-b2b9-6d33249f5153", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696175406, "uuid": "b5043136-48e9-4410-9897-a87aa501422d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175406, "uuid": "6accb065-02d3-4f35-bfce-9a814283828b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdff5090-6008-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696130115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696130115, "uuid": "0a9a9a54-156b-4092-8760-67915ae47f2c", "comment": "Malware payload (RedLineStealer)", "value": "0e6d349740ca2ffbc0666f1b7c86aceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696130115, "uuid": "1c74a267-56a0-431f-85c8-a467b0baae62", "comment": "Malware payload (RedLineStealer)", "value": "796361eadb9efd53e8c93c2d2e87870eefcae5e87010d7501be91a63316ac4ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696130115, "uuid": "4a7c1706-ae38-4949-8a6f-f69c4e83246d", "comment": "Malware payload (RedLineStealer)", "value": "e997eb22fd6e3f00b7035aacbf0d9333056f731e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696130115, "uuid": "30370e0f-7c39-4835-b3fc-2cc02bd6de93", "comment": "Malware payload (RedLineStealer)", "value": "e47f7f5964ba194d94510f6f3551c62e9d268b92573f94f6eccba8411f7ec2735b8e304388dabafa137b2958ebd8e6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696130115, "uuid": "b87d395e-4582-4341-871c-4f09347d1d2c", "value": "T156252356E9CC0066E8B2A7B059F613A30A3B7DA14D75E34B330A681E0DB3754E931B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696130115, "uuid": "5218d849-9487-4577-a0ea-09efce9afaf9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696130115, "uuid": "24564032-bc45-489e-ac10-f55568b72fe5", "value": "24576:lyqpHTWum/z/fpNsrgTLkeqa4UkYzDEbDGP6yeW+WoYJPwa:AqpHnm/zXpxTqa4jZfA6yeWdomPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696130115, "uuid": "784ed90a-8761-484d-85f9-651e2033ce41", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696130115, "uuid": "97f6aa18-617d-4cd0-8fd0-8e7b953cc630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696130115, "uuid": "66e8da7d-c264-4561-b2c6-8e73489c74d0", "value": "0e6d349740ca2ffbc0666f1b7c86aceb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258f05e4-6035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696149187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149187, "uuid": "d690130a-8b4d-4d73-9356-45d2e084992c", "comment": "Malware payload (Mirai)", "value": "09be23677d9758deee7cb42ebc2f31e6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149187, "uuid": "70a64e8f-864a-4057-9ded-07ca536b5057", "comment": "Malware payload (Mirai)", "value": "7b11860fa1ed11dda9263457714d3a797f35f2d1602cad0bdb9dbd87cb7d1671", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149187, "uuid": "0991aba4-14ad-4eb0-9bec-310ad6c50c45", "comment": "Malware payload (Mirai)", "value": "0d5610bbfb94b3eeb7ec40203bf7131eb33ad21e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149187, "uuid": "d87bc15a-a691-4ddd-9dac-691d04fb214f", "comment": "Malware payload (Mirai)", "value": "f44012ba58b161c7e920f380f1e114a878061c01eda5c53e3b1eae684d0261d24d36ce637d4becaffebde036e8473a57", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149187, "uuid": "2fafd503-881a-4f10-a765-f77464a14966", "value": "T1B0A2E0ADFFA28089D0C6453C19E36977666BDDE38398025B6D55D5C619D38CC805FC31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149187, "uuid": "466cbde8-6863-47ee-a784-596a0de82017", "value": "384:EDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chNuHfmmcb4/N7KbxTKqHDWcuiFqcJ2:EDZ5Dw7RjFjcU+O24sDOuuE/Nmbx+qHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696149187, "uuid": "0b6fa950-00ec-4bab-bed7-63bb63e2d12a", "value": 23260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696149187, "uuid": "833d4556-8426-43b1-9ea3-1b68d721d5f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149187, "uuid": "cfee15dd-17b0-4d04-9609-17f19ee9e35f", "value": "09be23677d9758deee7cb42ebc2f31e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111da288-60a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696198545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198545, "uuid": "ae16aded-1014-4ab0-8571-5564b76244be", "comment": "Malware payload (Tofsee)", "value": "9521d635a05ad502cc554991c46b4483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198545, "uuid": "8c9b657f-5c63-4b2e-9e15-34fa20683114", "comment": "Malware payload (Tofsee)", "value": "7da2dcc910a884fe0dad46b7cb06f27caca416b9f2cf237ea8cef6f402c145be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198545, "uuid": "c7521126-28ba-4ef1-ac76-8b4b932614fb", "comment": "Malware payload (Tofsee)", "value": "0577ecd929032aa60ac2410f0668176bbfb98159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198545, "uuid": "4e5b5506-1913-4135-a296-724aab79994a", "comment": "Malware payload (Tofsee)", "value": "0e1051442fc46b51fcce85f77721edb89687f7b15e505e9d393cd99679ec65444f3fa65587dd78adb1d7846213c30261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198545, "uuid": "170df9b4-3bfa-4c4c-a461-dafe662a16f9", "value": "T1D514CF3139E0C072E6AB4A385831EB647E3FBC63E7A1C56F2354166F1D302E1AA65357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198545, "uuid": "5e228956-e196-4504-b4c3-ea0bde4cb644", "value": "6f3146e776f6cd21d6a089c9d9e8d181", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198545, "uuid": "637b41bf-911b-46c5-92a2-6877f31da2fb", "value": "3072:RsYQSFGHFnx9CTg/7RPBdXEwm/sxlZN/iXWYl3veBc150D/Ym+ovV:tGlnD7RPB9m/YNamYl3vPmZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696198545, "uuid": "daa3f5c7-51ed-48e7-82ad-679b3bca80f2", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696198545, "uuid": "dcab29b7-d02e-427d-b9ca-0789defb61e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198545, "uuid": "9b062449-2796-40e5-b6e9-ad120bffc369", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3f31b0-5ff3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696120821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120821, "uuid": "993d7046-5218-4ecc-8887-c34a6c5e53f6", "comment": "Malware payload (RedLineStealer)", "value": "1e3ba7b2ffbbd46d1ef257bc06959895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120821, "uuid": "3a51f877-2554-4442-9b3a-9fa7d7ab6494", "comment": "Malware payload (RedLineStealer)", "value": "7ddb87a6dc65b20c17730fe743fd8db0ec468c4da06d9046e02c23deddb9d50d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120821, "uuid": "195e6cef-1f56-463b-ad2d-6a396f55cac7", "comment": "Malware payload (RedLineStealer)", "value": "3a2f94ebc045f3f6d21b4f53ff3aea5ab95abd8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696120821, "uuid": "534a4e1b-bf6c-4c8d-9e51-fa43673c61b2", "comment": "Malware payload (RedLineStealer)", "value": "59f037d2ab9c2ed0643f87dfec8862ccafcf23863a18985fe9e4f009c41542bf5e37624238f48177cede1ff0d96806f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120821, "uuid": "5903fbfa-4889-4cf0-972f-0ff32990cbc9", "value": "T10974F15231E0D432D5BF89BD4575DBD0AE7FB4A25BB0868F3304129E1D307C2A666B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120821, "uuid": "24a15d58-296f-43b1-84fa-94d728a8f004", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120821, "uuid": "3332e795-9d86-49af-a777-2016cfe17686", "value": "6144:ZaRqp9B9iLohjEmF4qpx3JxdgwvagYSZjiCBA:ZaRQTmcEmF4qppJFagYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696120821, "uuid": "c1f18bfd-73fc-4134-a39c-f2219819fd78", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696120821, "uuid": "acfbe7a2-22a8-426d-b4d7-e73beda35a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696120821, "uuid": "7d235234-e02c-4874-9aef-091cda811db0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c54ea6a-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177572, "uuid": "31e88ff5-9856-4dc4-b450-8bb345b99246", "comment": "Malware payload (Mirai)", "value": "81ff610cb725dc87efbcc776528e5797", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177572, "uuid": "635db2be-8591-488c-a34d-46b4201ad6db", "comment": "Malware payload (Mirai)", "value": "7df9fbfe2b6325227b58857e8eea1293ec43362bcfed9007d932872026458011", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177572, "uuid": "b2aad4ca-86d6-4752-88c5-1c33d38c8ed5", "comment": "Malware payload (Mirai)", "value": "4ff31cdf73a9ce07e2372c24dae06ca174268b55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177572, "uuid": "0ed2f65c-a8cd-4d00-9a69-4846e5d0c8f8", "comment": "Malware payload (Mirai)", "value": "97a8d4470decfdd3f9a42da593f6cdf33fc5d3232e7b4507ecca6923bfa81180e2654d98def1113a60651539e3c79436", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177572, "uuid": "f1b41d7f-c2f7-4a5d-a9cf-f1cc10306d34", "value": "T187633B22BA761D1BC4C1E47D22F78728B2B1979E25F8891A7D720D4FEF216406D43AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177572, "uuid": "7e195c84-d07f-48f7-aa55-97e9f6ea4026", "value": "1536:YQyKq7W/iwb97IYnb93ULhtLJ75M4tdQc:YQRb39nZsRJVMwQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177572, "uuid": "a52cf923-351c-44ec-928d-9a23d3f9a807", "value": 70944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177572, "uuid": "54e41c1d-3062-4016-8cc5-fcbd171f1de5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177572, "uuid": "a77fdcda-3b6d-4dcf-adac-921986f6e52d", "value": "81ff610cb725dc87efbcc776528e5797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eef2e5f-6035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696149203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149203, "uuid": "848bc22a-10ec-46d3-a6a6-f4ae3ca69470", "comment": "Malware payload (Mirai)", "value": "95cb442ee15f48070e8d9cced4a3532d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149203, "uuid": "34b1d323-ef65-4cdc-9f5e-2fb2be888270", "comment": "Malware payload (Mirai)", "value": "7e4df4b34a72fdd2ff908a59ee40e266ec305b35dce17c40d4e19ec1c2be86c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149203, "uuid": "53d611e7-b71d-4b04-be9d-2e15a91ff079", "comment": "Malware payload (Mirai)", "value": "0fb47a98d42d71273924cb7b76b0fa9ac3239e8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149203, "uuid": "eb956212-3d35-44e7-b3c9-ea4ba0e4d96a", "comment": "Malware payload (Mirai)", "value": "af41e203875a997f1ae65668e08611da42f54008febec7044b2411a6e8fd82245d430902ffa049e93cbc04b32fb8a3be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149203, "uuid": "648fc770-d621-4c7a-89bf-86a52a26e781", "value": "T1C6A2D0FFF8E5064BDC6E907BA12D08D614F92D1013E783911E8A74B299EE415FD3AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149203, "uuid": "3dd885d7-a2c4-489a-a276-62af6ef20d13", "value": "384:MVcDqRfKUWFH39z+/49ETXsayqWruQ7eqOZi5MoJz0mdRDy++v1Rpv:EMkKJFH39CBXsaAyKOZi6mjDepv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696149203, "uuid": "84e86f0b-00c6-4148-baf4-3d8def589f05", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696149203, "uuid": "7f0aaa12-cceb-40f4-b2ed-8aeeb9935a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149203, "uuid": "e96550cd-4963-4642-a665-237a35431b37", "value": "95cb442ee15f48070e8d9cced4a3532d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932ccf9c-6031-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696147653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147653, "uuid": "34c19211-f587-48ed-a874-ab8b74527eec", "comment": "Malware payload", "value": "d057b04ca41c0b49e22ec802ad929cb4", "object_relation": "md5", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147653, "uuid": "fde9e06a-8d9a-49e3-a0ab-60fc4e874489", "comment": "Malware payload", "value": "7fc8d002b89fcfeb1c1e6b0ca710d7603e7152f693a14d8c0b7514d911d04234", "object_relation": "sha256", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147653, "uuid": "b5ab4ef5-681e-468c-a783-e0e64f6a5d42", "comment": "Malware payload", "value": "9d41e61cc6a74aa7716f9d59359e6fc006f87d1e", "object_relation": "sha1", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147653, "uuid": "00d0c3b1-9486-4651-bd6b-b545436d65ac", "comment": "Malware payload", "value": "a39945f8b2cc8a9801474d29aae66a47324b4a46e331bcb7776ecea4c1e9e43c6d6b59bb47a0fe3a48519c6623686611", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147653, "uuid": "999ada70-9059-4647-957f-d78245b072e6", "value": "T1D241D8D1957A48A3E8C032FC35D4952BB388FC071E0EDB5084CE8BB269572066F87E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147653, "uuid": "6755f130-8fdf-4e42-ac70-565f41e536c6", "value": "48:e9u3updf3iOGFEJlXQjOJxbfZ392s64qx6HelqlynupUAN1SG99Ytu3i80f3sB7u:e9TdNGFEXXk0ZfKs64K6HelpnupUANMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696147653, "uuid": "d893c0df-4073-4fcb-893e-61c24eed5ea8", "value": 2360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696147653, "uuid": "8bac5872-aad5-4c9d-a04b-0a3314ae8731", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147653, "uuid": "f0ffbafc-db48-40a8-a991-8d98245ff42c", "value": "CVE-2023-40477-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6751a0-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163618, "uuid": "f6dbb665-8f00-4f28-ba2f-56fb10dc9457", "comment": "Malware payload", "value": "cf89bb357090e2aa7cace744b89b0151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163618, "uuid": "aa00b57e-b578-4a04-88b8-eefe269fb7d1", "comment": "Malware payload", "value": "80b18f1a8ec4dbc8097d1052cabfebfc32cdd9a9a6b54103193ffe42b3dfe573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163618, "uuid": "c156842c-4ef3-4e9a-b1e3-8f85a0c63595", "comment": "Malware payload", "value": "cf14cba57e4c36f6e9c8e25de21ee919c1f72630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163618, "uuid": "7fa4d73f-3349-487f-8c97-f9b534b7543c", "comment": "Malware payload", "value": "9738ce6088ddb69d75cf2fe391510ac8c15c16e9e208e892b8986adecee4a0cd13b2619a8a2291631e90d4fc520bec5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163618, "uuid": "47cdca73-ae19-45ed-906d-f59a5886a5bf", "value": "T15ED5B042F742C8E2E5070B700CBA9B39AA3EDE111722D697356CFE6D9F72260D95B143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163618, "uuid": "7f499e19-9fc0-44a0-ac96-92282d625c48", "value": "49152:IufZrf4x19K2HS0+s8KuqGaX0ToIBAUZLYv:trf4xnHS3JBAUZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163618, "uuid": "f87c39c0-54a3-47d7-a79c-ea46331d962c", "value": 2830336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163618, "uuid": "c5222d2a-a9ee-4d64-bf90-7fd7bda5f3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163618, "uuid": "7bfb8e8a-79aa-4ba4-b84f-39655bf5228d", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1S437JY.23351.10174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852a4d6a-6037-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696150206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150206, "uuid": "cadf9d07-710c-4d61-85bd-50ccef1e5bee", "comment": "Malware payload (Mirai)", "value": "e483ea61a15df877108c2259aa5de286", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150206, "uuid": "b837fbd2-70b2-4fdf-bf4c-ca27bd96e35b", "comment": "Malware payload (Mirai)", "value": "81fd54116cd73988313e73f4518767dfb174bcff8e6754e4bd8fdf82a363800a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150206, "uuid": "13918382-731c-4ef0-b4f4-e051a81a70e4", "comment": "Malware payload (Mirai)", "value": "382a432a5b5f43b5d24d28797a84c4af997039d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150206, "uuid": "6f228df2-620d-4e69-ac28-44bb334449f1", "comment": "Malware payload (Mirai)", "value": "c0bcc63ab48cc12175f2144730016991b622860bf79bd7920991da25bb2874ea7cfed60e4eb9d1ffbdc23335942b8e77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150206, "uuid": "8e3be717-8d72-4a4a-83ef-42712cd9084c", "value": "T161632A92BC819A02CAD412B6FE5F519E331623D9D2EA7207AD15AF2037CBD1B0E77241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150206, "uuid": "5adb6b7b-bf51-46c1-924d-bff9eadd0a2e", "value": "1536:sWPKw0DX+CaF8wl82EFy0LJwq0E4oFDTFUI070R3tvH:sWzGX+n+2SlineBUxIvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696150206, "uuid": "e71df0b2-9201-44e9-ac30-891b33758625", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696150206, "uuid": "f2f0125e-5da6-437c-af9c-6b76160d3a1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150206, "uuid": "ea3c62e6-37cc-4342-98ac-0ae82cc5b040", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd8e90a-6037-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696150359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150359, "uuid": "ace9b12c-4045-470a-a5a3-ba285aa1d915", "comment": "Malware payload (RedLineStealer)", "value": "965fcf373f3e95995f8ae35df758eca1", "object_relation": "md5", "Tag": [ { "name": "77-91-68-78", "colour": "#B35AE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150359, "uuid": "0497d636-c65d-4c99-a89f-27a534d52711", "comment": "Malware payload (RedLineStealer)", "value": "82eab1b2cab9f16d77c242e4ff1eb983d7e0a64b78b5dc69d87af2a4016f4f39", "object_relation": "sha256", "Tag": [ { "name": "77-91-68-78", "colour": "#B35AE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150359, "uuid": "52064270-432f-420d-9c28-3f3cc0797d5c", "comment": "Malware payload (RedLineStealer)", "value": "a62d2494f6ba8a02a80a02017e7c347f76b18fa6", "object_relation": "sha1", "Tag": [ { "name": "77-91-68-78", "colour": "#B35AE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150359, "uuid": "e0cbf1a8-8c2a-4a6d-a182-1308b00254a4", "comment": "Malware payload (RedLineStealer)", "value": "0f7d27cbe37dcdec76b6acc63545bd67917c2f2ba12ee3f459333e107d62c9b71d82716dc35a8faf6bcba9d45f6ab35a", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-68-78", "colour": "#B35AE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150359, "uuid": "f7545474-6e05-41db-9854-d322978b7f3c", "value": "T1FE657D6379C4CFA1DEE2107642ECB510427DA4A40B2705DB97F45FEA87216FF2A3E582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150359, "uuid": "c7f93502-e5d2-4477-b041-c770b4f8666a", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150359, "uuid": "610630a2-0d3d-4faa-b36a-abe598a4b1a6", "value": "12288:qbYbF8jzyivUBpqoZTaSKlzLR7EnRfaYRZAjTkYWtq67DQC4w4C9u6gohgMmOFwx:q+yzyicBpqoZTgVKfptq6PQMUAgb9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696150359, "uuid": "a3ef9a16-19cf-4742-b4cb-a4f109d808a9", "value": 1487264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696150359, "uuid": "0f028195-a4f3-4349-abdf-76d619f7f79f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150359, "uuid": "c916be28-04f7-4744-b24c-ebbbecc53333", "value": "rqrba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e3c7ad-6086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1696184116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184116, "uuid": "88812f9f-17c1-45ac-b04d-5e1f561304d2", "comment": "Malware payload (RecordBreaker)", "value": "19868ce5d5b4e1cfacf94bc55edc4da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184116, "uuid": "a96de8f3-3a5c-44cb-9d46-156c86e16e92", "comment": "Malware payload (RecordBreaker)", "value": "84d1b1f0588cac4fb502da345ed7ee3bae4000b7f6b096a7bc797789c1fe8120", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184116, "uuid": "eb1a7a5a-aeff-4026-89e5-0a4cba072270", "comment": "Malware payload (RecordBreaker)", "value": "a761be38a92c40a88b2c609b9ebc94996f9f86b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184116, "uuid": "4da420b4-3093-4096-99b5-9bdf8a9062d6", "comment": "Malware payload (RecordBreaker)", "value": "7f47e00041e4daf0e779802ca46080c020a94489e40c11e880e2423d39d3f3cf191cb0727d26c48147817b11936b0fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184116, "uuid": "59164898-183e-42c9-be0c-5d456dbbf5d0", "value": "T1910739D0FDDB14F5D9035B3048A7626F27341E098B28CBC7DA60BF6AE8376E24936519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184116, "uuid": "25772c91-687c-4ad7-a69d-f614dcceba79", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184116, "uuid": "c5759f2f-ba72-41b0-a1ac-7582c4e7aa47", "value": "98304:imQLdOvAzwCEk9u3YxKbfZZr0hQTZTHcN5ggkp03uEv4rXZM/AyHG:9S+k9YymWHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696184116, "uuid": "9a26cde0-dc97-4c37-994a-1c4865cb87bf", "value": 17187841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696184116, "uuid": "5cb7c2ce-def5-4172-a082-df9d53562058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184116, "uuid": "5ccd20e9-a21a-4c1e-9a5e-2aa967dd8c0a", "value": "19868ce5d5b4e1cfacf94bc55edc4da7.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e4a481-6069-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696171793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171793, "uuid": "7e2b0272-7dc8-48b2-8f40-78f001772ac6", "comment": "Malware payload (Mirai)", "value": "2ac1948f67b9a03945c0ea92d8610adc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171793, "uuid": "3ae5fc58-a9b0-4877-9221-98fe76d3075e", "comment": "Malware payload (Mirai)", "value": "850776f7d6965c8ef79ea62adbf19eba73f2f39930082fb3911c699311c02ab7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171793, "uuid": "e9ecca93-44b6-4221-b0f5-0d7b88b81c70", "comment": "Malware payload (Mirai)", "value": "837490d0185e556f43cd64612cfd526697994a81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171793, "uuid": "a12217d1-a963-40c5-9080-49f54d71bea3", "comment": "Malware payload (Mirai)", "value": "0790ff88c509f73c2f39be6ff616f622250d3fd5af3bc3b3e85db95032964460cba1ce467ee1b1e41f600c7f1f40b5b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171793, "uuid": "96c2a7bd-d29e-48e9-8d68-4dd2eae404e1", "value": "T14DC2E180E3002E85FFDF7CB59E3691C07B2B1B5F678754A2777895126562D2B28009C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171793, "uuid": "7d3ff1f3-2b80-44f7-8ca4-fbd5259aed7b", "value": "768:BUbgeS1f8Dnz+AHyRas6JAshPVqZRFalx4uVcqgw09y:BUbfaAQGAiNl4u+qgw09y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171793, "uuid": "bf548d9b-db15-449b-95fe-ea264faa925e", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171793, "uuid": "5999b41f-36ea-4244-949e-e8fa48a057f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171793, "uuid": "b47cfa48-b83d-41e2-8dc1-94cb286fc689", "value": "2ac1948f67b9a03945c0ea92d8610adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee6ccd9-6059-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696164745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164745, "uuid": "9c33f4a4-8187-4c18-b57a-f166c7ccc193", "comment": "Malware payload", "value": "9a4ccc5278012144e572052f735ff31b", "object_relation": "md5", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "Information pdf url", "colour": "#F47ECF", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164745, "uuid": "47c77a9b-5404-4a07-96ae-9a2f2448e6bb", "comment": "Malware payload", "value": "8667da488e414e1cf0448a3045a1b16ecce8685505a28097543b6eab777f1d62", "object_relation": "sha256", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "Information pdf url", "colour": "#F47ECF", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164745, "uuid": "1a0a9b65-bdd5-4a59-b107-9a198e11cc2a", "comment": "Malware payload", "value": "388fad428fd940dd0cc146c3f7470ad459c3dd74", "object_relation": "sha1", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "Information pdf url", "colour": "#F47ECF", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164745, "uuid": "4599738e-a78a-4e7f-9eea-590a67fcc4fa", "comment": "Malware payload", "value": "c4446a6df20b1d5d045f960a216d032cf7f9571c4c96ade69af27b1916b9253d88656449292ed67b2ba24d94d47985f6", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "Information pdf url", "colour": "#F47ECF", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164745, "uuid": "d837166b-dedd-4f23-862b-b729db89ce61", "value": "T1EEF0EC91D19E7462C23FFB7501D62220E770958493D0D2EFDD585022090B7D45B0335B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164745, "uuid": "2ca0a295-159d-4899-9b6b-fb6bd56e401d", "value": "12:5johhd41iSkSXKFhnKYxHVdFCW1ipVJ1X9tot:9oF4kJKYln4zJFwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696164745, "uuid": "d4f0d949-67b1-4e6c-8309-1186e92a4fbd", "value": 518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696164745, "uuid": "dfc884eb-598f-49ae-8100-854ac90223e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164745, "uuid": "72283362-3121-4981-bbda-5cbcf6990b13", "value": "Information pdf url.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760f96fb-6057-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696163925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163925, "uuid": "fadb3f2a-73f5-4495-b944-5330bd81f0c6", "comment": "Malware payload (Smoke Loader)", "value": "bbbbf5417f08423ee1eb4c62c09298c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163925, "uuid": "95371542-6236-48e2-832c-66d41d60a662", "comment": "Malware payload (Smoke Loader)", "value": "882e233bda6bc921fd8ba1853c6b51a1ddb1c7eb81d8d0ba2ccddfff8d572b40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163925, "uuid": "96aeec96-cc23-4dd9-9f3e-a274238349e7", "comment": "Malware payload (Smoke Loader)", "value": "8539a196feb7f62524a603db5296fc08033e30bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163925, "uuid": "2d14f039-8749-4745-bc33-08d8601bf856", "comment": "Malware payload (Smoke Loader)", "value": "37b6db7198b16324fb4905ead6ef680231ba79dfbc923e5e5b0c74d2db182e91f4542530514088caeef97b82a5ba54c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163925, "uuid": "ecdea2b0-6b76-4a2b-98af-9be3f71acf85", "value": "T1CB14CF6231F1C036E2E749744873DAA0697BF9A2E7B485BF3350527F2D306C2866A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163925, "uuid": "725851f6-e5b0-4d48-afe4-5da170280411", "value": "93d103d7b72d447eca6f713c27a7a3a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163925, "uuid": "0855a513-a989-4d83-b384-ed43da79642a", "value": "3072:4+I0sR4UNxrw65jpjx65Aq71h77ZEy6qA+5vet987:waKx1F6+q71h7VEyFet98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163925, "uuid": "c488bb5d-4ae1-45f0-b553-b8e82b6baaf1", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163925, "uuid": "6784bdc6-321e-4bcb-8d98-5b628f279c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163925, "uuid": "67bb568a-4f30-4627-9c63-ce15b8a6e60e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2a36e0-605c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696166160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166160, "uuid": "88ccdc54-d150-4504-abc5-558723eb3d07", "comment": "Malware payload (Mirai)", "value": "2034403427931da775711da31c3d3039", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166160, "uuid": "a12d081e-4c51-4a47-b67b-0f969277b76e", "comment": "Malware payload (Mirai)", "value": "883858a9fa65db51bf8c256b989ba925b2c07fac166b61de55e1f8ee002d62a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166160, "uuid": "9ffa4c93-5759-469e-95fa-788d64ad1aee", "comment": "Malware payload (Mirai)", "value": "df6b8a738222ca1a9b6cc1508921e8990f6bddd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166160, "uuid": "9dbc4ed4-31d8-43fd-ac80-12a1d174c6a2", "comment": "Malware payload (Mirai)", "value": "7e6e0e1d5331dd6e8fb4d743366d6ac3ae8d3c0859b868c1f58f3a24450fea5beb07cb3750ee0b839121ab3673b000b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166160, "uuid": "62084848-ee4f-4779-adfd-b874c91e208d", "value": "T15C430956BC818A05C5D413BAFE2E118E33176368E2DF72129D106F247BCB92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166160, "uuid": "5e5c17f2-dbda-4428-8764-ca4c77ed1c8c", "value": "1536:N5nBm7EjG6d8G8Kic+/SoYPyz1FIpKUDLoICilqGPKWQ:wIj5eGTilqhazYtqGPKWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166160, "uuid": "8d963661-2bd9-446e-b713-ecdd5db19d57", "value": 59688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166160, "uuid": "691cd18c-6812-4549-848a-d17f7034b6bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166160, "uuid": "28ff6d01-d101-446b-9f27-ad82987dcba7", "value": "2034403427931da775711da31c3d3039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ac2c21-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177586, "uuid": "71be3a99-0ca4-409f-bd54-ba5ce30cfc79", "comment": "Malware payload (Mirai)", "value": "3c4696d964038865c619acf367990ff2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177586, "uuid": "c3fbebb7-6627-4634-ac95-7848d5b59821", "comment": "Malware payload (Mirai)", "value": "89a000c0f38ee7d3ff79f9e9b40429f4b2932f45e45764c86227015eff615f8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177586, "uuid": "0a25f0af-fe6a-4835-b4a2-631ef9efd74c", "comment": "Malware payload (Mirai)", "value": "c5da3a9d5d0d38d362cc37be01837bc094094aa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177586, "uuid": "65559933-c7e2-47c8-8ab7-b5920f38c8ac", "comment": "Malware payload (Mirai)", "value": "64d5f41f92077cc4fbdc34460434c78c64951410f7b9c9eb43ac251021551e1b1bb794f85784a4950e54e174ed6b122c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177586, "uuid": "c1894b80-b0e1-4297-881b-a75cd02b3a6f", "value": "T185330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177586, "uuid": "5277e470-43aa-476f-ba25-58c7e1470304", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGj:r/hqaJMcjeqK806MHdMfQXoHuCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177586, "uuid": "47749228-8e53-4f5c-9408-827bb69bd0a4", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177586, "uuid": "9277fb8f-a883-47f3-b120-825762586dd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177586, "uuid": "6cc375d2-500a-4c43-8b1f-a4c9d562bbbf", "value": "3c4696d964038865c619acf367990ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73bc194-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163605, "uuid": "747c1fd2-a72a-497c-8ab0-64da842edcba", "comment": "Malware payload", "value": "0abe8781dda410de15fe8dd53129ea00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163605, "uuid": "783658df-fda3-4eb7-809d-cc3f900ec4e6", "comment": "Malware payload", "value": "8a03346a064fe8e08c14e6e38a7ac71da70ce54eac90113116c72b7a9abcb722", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163605, "uuid": "bbcba9b8-2fa0-4027-88dd-41eab4e94d3c", "comment": "Malware payload", "value": "0e75e2842da7fbc7bc6d37f8f54d3d7bf6cc8c7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163605, "uuid": "0ef8d812-18a7-42fe-9e7b-28eac3be49e0", "comment": "Malware payload", "value": "fc609c30ba5d16e9ddaa6cb07d9aef1fb184f6202f200a6f0150a4fefe93a2b67170c53cbd4a95e0be6482d9d71db4d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163605, "uuid": "78cca8e3-ce8d-42b8-b813-087333e19a62", "value": "T15D555B1777928437C03A093C98574FEC9F626C081D17978B3BBE665C1F31ED229926EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163605, "uuid": "888a581f-fb2f-458a-bbac-691608060d16", "value": "e76a31e47b260839eb52c868b8befffb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163605, "uuid": "3aab4a43-1866-4520-adbc-b126bf28e6c5", "value": "12288:AkT0gpkg8QtVXeGGQtEIVbl5WmAJ3//pbBYKOY19qpbh3wTWr8hUkQsWDaM:AkTqEJWmAJ3p6KOC9qBh3SWgSklWmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163605, "uuid": "69d3ddd4-0bd3-42cb-ae32-222c9673c588", "value": 1359258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163605, "uuid": "87651bff-c304-44a7-9c4a-29f362597d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163605, "uuid": "d9d0e987-ee75-4abd-84c7-7aeae3d0a0f9", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.22417.4002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4390686d-602f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696146660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146660, "uuid": "dc4e5188-ea8e-4c35-a6a9-43553979ba40", "comment": "Malware payload (AsyncRAT)", "value": "62951e5ad7ccb914e3992103c5fe492d", "object_relation": "md5", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146660, "uuid": "e719c40f-107c-4118-a1d9-badaba763736", "comment": "Malware payload (AsyncRAT)", "value": "8a39fbbdc6242227e330edfb6a3916058c613b0535633ac1bbbc2b0d22647b5f", "object_relation": "sha256", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146660, "uuid": "127421de-77d4-4553-9bbf-f2e17f3edf09", "comment": "Malware payload (AsyncRAT)", "value": "733fc789fc0dcf9b92c5cc6088ec4186a20c450a", "object_relation": "sha1", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146660, "uuid": "3675b8d6-3187-47ac-9fc1-9f1f26a79e43", "comment": "Malware payload (AsyncRAT)", "value": "e20429265803daf438a13f898e3760a09e4e06f724c9cdb232cfdf8f021616d79adb9f2ff1238078aa823fe58802b802", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146660, "uuid": "6d36ae3a-bc3d-49fa-aa6e-57ed61afeb9a", "value": "T14D31E0849E587AF7C1B3CD5688DBA3258A6EE203A11F010477FC8355FFAF24E55680C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146660, "uuid": "998387f3-d96d-4de4-9925-3f961011b03a", "value": "24:ZLm7LR6L6XfvDzyzTlzOZANgPXUbu4bFaUg+Yl+mIrUXJlaf+mKvKqUXJwg:9mPRO0vfA1JNgPXk7zRY8gLyfGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146660, "uuid": "07e5bd31-a223-4ebc-bfae-030d00082338", "value": 1482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146660, "uuid": "8d3016b7-88c1-4753-b081-90bcc4b85308", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146660, "uuid": "a5173463-c633-46da-80ea-f0aa97c63ed4", "value": "c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536868a6-607d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696180188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696180188, "uuid": "83d39ba8-4027-4232-9bd1-1726dfc4e4cd", "comment": "Malware payload (Smoke Loader)", "value": "d2380cd1655c39e3ded9f95d853e6212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696180188, "uuid": "589ec081-a86c-487d-8091-93c388829651", "comment": "Malware payload (Smoke Loader)", "value": "8a633d717c4509c9c447ec5a237c9b53557622c23d3ffb6e2b8f6bad668cd637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696180188, "uuid": "f1aa6bf7-4c7a-4f19-80be-01e7a2026fa9", "comment": "Malware payload (Smoke Loader)", "value": "ff275594805c683ade31578d0ca8d37869e51b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696180188, "uuid": "7ac0693f-ec85-44d0-98ca-c7057f2d6f96", "comment": "Malware payload (Smoke Loader)", "value": "b6c36d4feb3ab1d78f3a2fd7ca83cf7d06ddc787944fead943784163e7c1905c904e0cfb2eb1ee3e3d73bf138f706471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696180188, "uuid": "19d770b7-5ee4-49d4-ad1e-d6279755d9b5", "value": "T18B14CF21F9F3C0B2E1AB45344A71DAA0AE3FB8325774866F3354163F5D302D19A6A736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696180188, "uuid": "d0c928a6-8f28-45ed-a7f0-967d09a14318", "value": "6d1ef2766ad947ed03bd197f051e8eed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696180188, "uuid": "fb9a84fe-7655-4af5-ae51-6a03f52f6c0b", "value": "3072:h8X4rJKHc77tp7m2W2E/rqwQG8eOkYAQgSsWe50FScB+ovV:pK877tpBKTqbGAgmBZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696180188, "uuid": "ded0709d-9fd5-4d5a-8a9b-d1d4573b2c4b", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696180188, "uuid": "1af5335f-11e2-4041-a5d5-3931640c2cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696180188, "uuid": "76258a38-1fb5-45ae-af9e-f0785ce75eba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15720c9-605c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696166172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166172, "uuid": "223b3c88-6bde-4be7-a9b5-dd787be0b9d7", "comment": "Malware payload (Mirai)", "value": "9377664c3a5990f016ec473a0da8e4d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166172, "uuid": "f83bfe73-7519-41b6-8760-99e8aeb8b425", "comment": "Malware payload (Mirai)", "value": "8b3cdbfc449371d8fd73eb42e2180e6d96c8d5737b9ea12eae9ce31cdc419304", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166172, "uuid": "b2d0f712-42b1-4fe3-a589-0e78cb998fb6", "comment": "Malware payload (Mirai)", "value": "f9257ab4b645535c0cc466c1e80b5482e4cabbb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166172, "uuid": "0c85e243-3de8-4cfd-ae91-3091f28805b0", "comment": "Malware payload (Mirai)", "value": "e8888076716a4ce1283ce97c066f3fc3ae4c1433004f12beffd0b482e30e9c2ee50f3349693f442d329a9842d8ecac94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166172, "uuid": "fe7dc2e9-76b9-41de-8ee5-1c45f34d7104", "value": "T14F63940ABF654FB7EC6FCC3749A91746258C641A21A93B397D34D828F64B24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166172, "uuid": "2461379d-1318-4ed0-8f22-264c87f42eab", "value": "768:J+xGiJEEYlDIR99CKiuqByeCC/zxG85oFe/e3/euDToNMpkhq5yXir5M9AtXN:J+xGiJxYlkfBvC/A8Eae/RD8YYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166172, "uuid": "efed33f5-536e-413a-8200-77dc0c2e8753", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166172, "uuid": "e4b28fce-224f-46a7-b962-26fe514c2a94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166172, "uuid": "589d4664-5f4b-4691-9d5b-e4328bdeee88", "value": "9377664c3a5990f016ec473a0da8e4d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec227920-6042-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696155104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696155104, "uuid": "a45befa5-c4ef-44f5-8922-f4b2c944884c", "comment": "Malware payload", "value": "8f601d2b441922e7154d996b18083204", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696155104, "uuid": "3b9c7276-4a29-4e32-9f33-8e4806d46985", "comment": "Malware payload", "value": "8c0d8638d789af502ae119c7b2d24432cb05eb995eda0303d01a70adb0ad2264", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696155104, "uuid": "b477b679-9d9c-4596-bc98-4dc000ed1be6", "comment": "Malware payload", "value": "af992991cbae22f9f8ec262ac08d8fe4ff7a51aa", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696155104, "uuid": "220048b0-f753-478f-929e-3071e6ebbace", "comment": "Malware payload", "value": "a8327ee2e8ea0d0e87428f5ebffc2e1032547b344bd1af73269b7b9b890ae957443b4287a4d1351061de55610e7035ae", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696155104, "uuid": "f9aa90b8-b292-4d30-b405-478b3bfc1241", "value": "T1362723D6899527F4D3934B08929F238B63C13127DE869D0D2688BC033972D57668BE7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696155104, "uuid": "bcf91d55-d0e9-4a36-895a-1b9527d248d4", "value": "8d018cca8111991a63eca5face69f344", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696155104, "uuid": "81098249-a753-4624-9f81-2c2fc5674aa5", "value": "393216:o/LogVKL3kKIwwkQmkybhLUg9k9eWKAENUSfL:o/LZU3kEw3+9LUge9eIAHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696155104, "uuid": "9b771972-9dee-4a18-aa45-ffae376f2763", "value": 21363080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696155104, "uuid": "ef4410f8-85c4-4c94-8257-a6d7c7810966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696155104, "uuid": "c323ea7b-0fba-46ca-92d0-cc288410b508", "value": "Chr\u043em\u0435S\u0435tu\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb84337-607c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696179665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179665, "uuid": "c06ddcd2-98b2-47ee-8e2c-2b3004a631d9", "comment": "Malware payload (Tofsee)", "value": "cdd8fb5fd8173073487020946c01bba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179665, "uuid": "d5c436b2-8959-47a1-bc4c-fe2dfd1d96e9", "comment": "Malware payload (Tofsee)", "value": "8ccc83f4285a9fe57f49fd24b9d3fff791071bf137377187821af806a0a6ef3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179665, "uuid": "f1121c34-d9df-4336-b4bd-81fcd308ae8d", "comment": "Malware payload (Tofsee)", "value": "f4c77b133d4da8d57e12be1a2da2c64e1f01ed94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696179665, "uuid": "c915e68b-f1a1-46da-8b14-20995c2531b0", "comment": "Malware payload (Tofsee)", "value": "6c2ff5616262501c8a6cd41e89f250521fb8ab9dd23670900db0230cab671b631fbe57ce5abe8fbe779a48bc4c6d4cce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179665, "uuid": "298d95d5-07a5-4e95-b210-bdc441c51810", "value": "T18214CF3039E5C0B2E667853458F1DAA0FD7FB86357B08A5F3304166F5E302E2966A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179665, "uuid": "de43f139-5df8-4ef1-801b-84457da88d8f", "value": "6d1ef2766ad947ed03bd197f051e8eed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179665, "uuid": "d3d50957-4aae-45be-96a8-ba2d5255126f", "value": "3072:Kue6PJYHcv2jpyfXGco+AMcNF9o1SmcSw7Zpbkmjte50ppFz+ovV:BY8vNfo6cNOSmc7romjHFzZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696179665, "uuid": "c7d683d6-d91f-46c2-b242-06265d5c8e9d", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696179665, "uuid": "f9285046-641d-4875-a630-91f79b1a7129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696179665, "uuid": "73486902-1df3-449b-89af-450a1ac68002", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a27c000-604a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696158214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696158214, "uuid": "c7e468eb-8940-43cc-a018-e611f4a9c9c2", "comment": "Malware payload", "value": "62f78b70dbfccd73552b7e75f42020ea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696158214, "uuid": "df17f67a-c399-44da-bf0f-adb62dc00b29", "comment": "Malware payload", "value": "8dc65343aa7ca833b3c99da4f54d362864e030c3c9a77b6d7a94110d59b20cbd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696158214, "uuid": "974d5438-efe1-431a-94a9-7f05b006814e", "comment": "Malware payload", "value": "7b0dcd7f805ade8c2f15d5dba5a50a007a8668d0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696158214, "uuid": "53533e6b-99e9-4b39-a33d-49cad124bfe4", "comment": "Malware payload", "value": "b99013d08a357dc9b0a75e0cca5eeecd1acc9b7982c632a2e9023287fb68a89936b68d334d5d13379aeeca2065ef5298", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696158214, "uuid": "ba0dfefa-a946-4773-b258-cbd829a38155", "value": "T1CFB5E02DFA29D4834F208F2D85751AEB0640BEB0C73BDDD99A4BCE0151D56CA3A527F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696158214, "uuid": "feb6ed0e-228f-4399-b24b-9c6e96864734", "value": "49152:SCQvsAVys7BgH7p4YVxdhrA7njufUIWhQMPPwAaKZ:2sK727pb3dh0bjuMfPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696158214, "uuid": "5821f4b2-2cb8-4067-af09-457f9f1ead2b", "value": 2309835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696158214, "uuid": "b023588d-028f-4043-aa8c-644605c727c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696158214, "uuid": "fe5baccc-cfdc-4fcd-a9e2-5b1e1d2b2843", "value": "Unconfirmed 874903.crdownload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf698ca1-6069-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696171806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171806, "uuid": "504d8681-5bac-4b8c-bb30-4fe0443df9d4", "comment": "Malware payload (Mirai)", "value": "8c581e9d6232b7f9f9d0afbaa59cc960", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171806, "uuid": "f86f67bd-4711-4696-b12f-247e0c43a60b", "comment": "Malware payload (Mirai)", "value": "8e0d80e26e1e625913c95b19e7ad8b91c5811f7dd3491cd6709a01500d394e71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171806, "uuid": "05d71d43-0359-49d7-b79f-1b91dc0c0762", "comment": "Malware payload (Mirai)", "value": "c8ab901f6dfbe15354230d1da3364e221fb22617", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171806, "uuid": "931e1c0d-5e29-43bf-bb51-dec9c0e3178a", "comment": "Malware payload (Mirai)", "value": "57abd933f62be4369ce21740aa0349ef48eb079caf0ed4dd011bcade63318aeebff3f7e2e419584cadd350bc14cd0ba2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171806, "uuid": "c3148a26-e894-432d-9e21-49c8a7ecc899", "value": "T1D1539FB5C5A8BD99CF698278B61488389723900565E33DFAE741C7A6D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171806, "uuid": "51dcd66f-55b4-45bb-bd55-dec0881c1bfa", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJOa:BjiBGFOdOT1Rhf+Kn1cY3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171806, "uuid": "11d466eb-7d87-420e-add6-3a35f1dd7a52", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171806, "uuid": "5c8bb102-90e7-46a3-ae6d-9d65e6058e33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171806, "uuid": "16e596bf-70e9-4931-81ab-014c7d662adf", "value": "8c581e9d6232b7f9f9d0afbaa59cc960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8546dca4-601c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696138610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696138610, "uuid": "7785d3a1-d53f-45c4-94bf-87fa84253da4", "comment": "Malware payload (RedLineStealer)", "value": "965a181ab8dd9b4aa60238900925dcf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696138610, "uuid": "2e8c5ab7-cce9-48af-95ce-6336be8433e8", "comment": "Malware payload (RedLineStealer)", "value": "90109d9ca0dfbfedd253c71c5abd2788afbdd24433544bf6f493b31649ebe728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696138610, "uuid": "2e4dacbb-db76-48c6-b105-cdd7f77c0c98", "comment": "Malware payload (RedLineStealer)", "value": "153d9d9d6d6a24f6cd73617120d6b0584b7045f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696138610, "uuid": "500df194-b764-4113-bfe4-a1b52c135e90", "comment": "Malware payload (RedLineStealer)", "value": "97ea07fcdde612c6cd566af5c6afb4b65703f385123ace5df45514e339f034606f823f981242568fda9d79f7c8b3c8b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696138610, "uuid": "94750c5e-da2d-4f93-b642-c23a3289dc2d", "value": "T109940247B7E85033D8B5177068F612C31B3A7CA29C78835B2786955E0DB32A0E971B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696138610, "uuid": "88446788-84e6-455a-933a-280af20fed3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696138610, "uuid": "ea57947a-4415-426d-852a-2a5b402996ba", "value": "12288:sMrVy90CakW4HcA3WCMT4TOFgKvuLnrhjnc:hyVxW+ITCOyLFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696138610, "uuid": "443bb720-771b-4353-a2cf-04319540bf6f", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696138610, "uuid": "e44124da-3d25-4843-95ef-e1b83580df94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696138610, "uuid": "46c09b89-b6d4-4310-93ae-a731a5106cb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68976b45-6026-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696142857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142857, "uuid": "5d4c1183-50d1-48d2-98ba-ccd447bd140a", "comment": "Malware payload (RedLineStealer)", "value": "4cd9b20147cfdc7a7737b37d0e606065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142857, "uuid": "26908f53-cc81-4ca8-af5b-662130b1f373", "comment": "Malware payload (RedLineStealer)", "value": "9477d4d634cc43a608e5d578678cd87d15fe28b71e82598201f0e4dc57655c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142857, "uuid": "94ce7885-3dd6-4fda-882b-cadc777353e3", "comment": "Malware payload (RedLineStealer)", "value": "c8189173210ed5336dd0c2410160e1e875ecc5f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142857, "uuid": "4f3fd76f-0f2c-46c3-9abc-25ae8f6251b6", "comment": "Malware payload (RedLineStealer)", "value": "71fe9ab28fbb4a1d3cc9de81400af9a63b43083de6b44c2db2dac53570c99074bbdb1307f422460d7993876a3b99a2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142857, "uuid": "f34d2a3b-e0b6-444a-802d-26b8a75526f5", "value": "T122940207B7DD9033D8B11B3048F606D31B36BCA248B9636F2796989A4DB26D4B47133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142857, "uuid": "8c5659df-2f93-48d8-b67f-a7c061e6de85", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142857, "uuid": "ec666ee3-c20d-49eb-ba9e-466d752c0526", "value": "6144:KWy+bnr+Tp0yN90QEZxkmOJUaOkEXnsZvAEWcuZDG0A9KteGJfcFLAiF5nRdrdvY:iMrTy90H5OW0HZ4Eky4teGJUFLLFRNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696142857, "uuid": "e22b8db1-c8fe-4490-9473-3c91c1935940", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696142857, "uuid": "e82432fa-8598-4983-8528-535dd09008fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142857, "uuid": "104241b5-3fb5-499f-9aa3-d7d5f6bbbe37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721fde6a-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1696194842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194842, "uuid": "fb2a5d63-6d2b-4d44-bb4b-18b063eb070e", "comment": "Malware payload (RemcosRAT)", "value": "53e54547d85361d226badc2070b56416", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194842, "uuid": "81a9d837-9384-49f7-b480-d99b8c6273e7", "comment": "Malware payload (RemcosRAT)", "value": "94de4dc571040c2f3d1f9690384778017cf94e58d2f4b25b8e9d9568210eb1ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194842, "uuid": "d2a166f4-d416-4875-81d2-00d6723fd852", "comment": "Malware payload (RemcosRAT)", "value": "f76ceac7224459b0f4928e655d96afceb4e904a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194842, "uuid": "acf741aa-97c3-4f10-bce5-64c781bcc2af", "comment": "Malware payload (RemcosRAT)", "value": "348e18128ffed8f510cd89a2420997847ecf58512b319025be928b42389b480f7f73fff73c94dfff8f99612ec4063a71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194842, "uuid": "edfaf5bf-d77c-41d3-9b8d-2e3bbf833ce4", "value": "T1FD453B4A7FADCD60E0A127FE8C8D1BE1782D79D136B4CCA127A43D4B09112E57D990BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194842, "uuid": "8ac2ff74-57e5-4a85-a86d-e410359b4d29", "value": "d020f949ba89411d7c49f3baa1ad9952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194842, "uuid": "209ee1b7-725a-4ba5-9c56-5d61546ee556", "value": "24576:E+x0KeaVl6fTAz/92jMRffknKdEfa17E+/:E+9zIg1I+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194842, "uuid": "7ed86869-3194-4db2-b2af-ed8cde1d567e", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194842, "uuid": "7e67c35e-272d-497e-9335-a5b21e8b0cda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194842, "uuid": "90ad2a01-6f80-44b9-a2e2-ca3c3bc5890b", "value": "53e54547d85361d226badc2070b56416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0668b56-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163593, "uuid": "0e74d2db-f9e5-4a36-ac3a-918293112b72", "comment": "Malware payload", "value": "a423847a422396c313332a22c7b333b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163593, "uuid": "702a9406-8c3d-4c34-90d9-721f0e5b59dc", "comment": "Malware payload", "value": "953c10a70284a0a7ad35f5ba4e70d7fa5b1fe755982e11feea85a69b8954d536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163593, "uuid": "01909df3-e04f-4a07-b704-712e03a86c8d", "comment": "Malware payload", "value": "118e529f69fb938d503d2153ec6f34f34db67d51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163593, "uuid": "5a8dabe2-d526-42f5-aafa-51137a0402d1", "comment": "Malware payload", "value": "9873874d7252ee14d073641f1d0426221060440e8314d682e720ed6242b0ce06b44cd352085d761c92ded34108a0fb42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163593, "uuid": "276b1b89-c169-4a05-b37b-464bead6b164", "value": "T112D34C103BD7C87AF5D201B28AF9AA9B113DFD726B4430EBE3C8065A19B46D139315B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163593, "uuid": "60634d7b-f9e4-4fb0-9690-923f0a145c16", "value": "0a620964341f3b2fabd3619eb659a5e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163593, "uuid": "9b62452c-a10c-4a64-92f8-73b8cc0b848d", "value": "3072:KagkPLPr5tc4p5A3SaALpvY4pvYIa1sOBR4OTGMK7:KaHRtd5fu1sOnk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163593, "uuid": "f7c11e17-55a8-4529-b5ee-fb8c246f37e3", "value": 141792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163593, "uuid": "9a36ca3e-7479-48db-92ca-2195a13c1eb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163593, "uuid": "ad60a797-a4c9-4e9a-a82e-530ac870943c", "value": "SecuriteInfo.com.BScope.Rootkit.Agent.23387.30798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324d2cb1-6072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696175408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175408, "uuid": "55aa9155-77a4-4017-94a9-9772637e5cf4", "comment": "Malware payload (Mirai)", "value": "41c972549ce3978946ce7f68606ef3dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175408, "uuid": "72587eae-e2db-4f9a-9daf-d7210f1d14ab", "comment": "Malware payload (Mirai)", "value": "96525cd8d560d7f9d43b9925d18807b3bf7a064c1c8e9a8b11eb3fcd95f53b36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175408, "uuid": "8a03d92a-58df-4df5-a398-6ce858c324b5", "comment": "Malware payload (Mirai)", "value": "817a509801f361c35d67a407364c7cc80ab5c2b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175408, "uuid": "5814671f-2d88-4694-9757-099def7edd3c", "comment": "Malware payload (Mirai)", "value": "592c2ec5eaefc348a9d64a1b0b553f61f377e9f2b5669e0b1d355a23025b9898b5282b38f5c2fdb43424b1d926614494", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175408, "uuid": "585c4d7b-0832-4af2-a893-5cec34783f20", "value": "T18CA2E01172A32D66F3EC1C3CC96A8317FD670BFC80F6327639445620C94924A3E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175408, "uuid": "55bfce4e-f853-4f48-91a0-f1979d957e73", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjXGRhymdGUop5h8:vvQn4j+ZO5fKAlxzGRs3Uozi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696175408, "uuid": "52f3ca78-0e98-4000-b01b-57d7c54be624", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696175408, "uuid": "2e40c889-4a22-47b2-8755-82cf6994fad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175408, "uuid": "393be84d-3b91-43fa-883a-8478083e8d32", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595d4d88-6098-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696191794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191794, "uuid": "973857e1-2ab6-44bc-90b7-bd9f3a87b298", "comment": "Malware payload (RiseProStealer)", "value": "e7468363047771e99cf89bdf31e1a1a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191794, "uuid": "eba3baf2-44ee-45de-b036-a4fb5b6fbec0", "comment": "Malware payload (RiseProStealer)", "value": "973867150fd46e2de4b3d375d9c2d59eeda808a9dd1d137bd020b2f15c155ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191794, "uuid": "f02a0ad0-8cdb-4227-9410-c3c4a93d333a", "comment": "Malware payload (RiseProStealer)", "value": "7f0a80ab836c1b9df165f2a00444507fedab1e16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191794, "uuid": "ed253371-99d8-4c30-84fa-fdeb0b329f5c", "comment": "Malware payload (RiseProStealer)", "value": "75993ed54b52d9feed8fcd28ec35e7989f6acc46f03dfe4b726325af357a818a8dc8e82af3103644240d5dbb1616e023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191794, "uuid": "2d3726c0-7c4e-4661-97ae-390901cdbe69", "value": "T1BC462373126176C6D9D688384D3BFDB5B0F123778AC1ACB9E4AAB5C426A14E5F503E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191794, "uuid": "6517899e-5ed6-477d-a439-a9b40ef06c97", "value": "70c1f94033ff845050d4c215ee60d865", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191794, "uuid": "dd380d46-1142-446d-9a71-7e2a75b3c352", "value": "98304:JAoFYYf8Kc6Lcm+HPjnZ01n3Vstf4FUwBI+/og9AAYV7c4dpN2/O+x5rr:JjFz8KcEcm+va1FHFPh4J2brr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696191794, "uuid": "9d683c5a-568e-4a69-a283-b246ef1184c8", "value": 5621304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696191794, "uuid": "48c604f5-5d0b-421c-8f1b-f8640f34c96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191794, "uuid": "9e4814b0-b06a-4adf-94be-955887d59d83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d62356-6030-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696147208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147208, "uuid": "9c23105f-6e92-4117-9592-bef52222ee20", "comment": "Malware payload (Mirai)", "value": "475c4234484242a4a153b4a6a0d6877a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147208, "uuid": "6a5c7788-60d5-4ec8-839f-45938607306b", "comment": "Malware payload (Mirai)", "value": "9771279e874b98836b54261256fdc005343a1cb011d588ba58712271d981fc4f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147208, "uuid": "595545b5-52e2-4799-b246-5a0b70712896", "comment": "Malware payload (Mirai)", "value": "0bbf6db10e7e804cd2049c2eda5dc47ee30fff46", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147208, "uuid": "686df2a7-0e16-4dbd-9b06-1d1d3439b97e", "comment": "Malware payload (Mirai)", "value": "e547031fce45ee06ec971f0c67a36cacee13d174d96d4de1cb34c209da74f10467f908f0d46d247c16bd371217ce2dec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147208, "uuid": "ad389c0f-9f7a-49b9-bc7a-f25d25748214", "value": "T1D7A2D01172A33D96F3ED1C3DC96A8357F9A60BFC90F6327679405620C94D24A3E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147208, "uuid": "b8a64343-1235-4c21-8d03-01c9c68f2027", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj0FhymdGUop5hw:vvQn4j+ZO5fKAlxIFs3Uoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696147208, "uuid": "78e5543d-2d4d-40d0-afd9-4e6a821b1ae4", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696147208, "uuid": "5992383c-2527-473f-a419-0c6a37a3ae2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147208, "uuid": "83b79121-36e1-4ac9-ab4f-826351654857", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc98ad33-6087-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696184766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184766, "uuid": "b5ab4a75-9a16-4584-9832-91766b5ff72e", "comment": "Malware payload (Stealc)", "value": "213d5798c8c6bb8fab66b348e0175e65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184766, "uuid": "8b0027c1-f97c-414f-9893-0763648ed371", "comment": "Malware payload (Stealc)", "value": "97d844ff52da40be55f368ee5db3ff2fb0e925f2df6a877e56b8269326aeab53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184766, "uuid": "5fe11750-e6af-47fe-8a43-933b7e39229e", "comment": "Malware payload (Stealc)", "value": "e660b45b9c779ec7adf64e4bef462533edf2f657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696184766, "uuid": "d6096bf1-9bb9-4cf1-be88-38fb4472a9f1", "comment": "Malware payload (Stealc)", "value": "fe1c7164119bdea4aa0436d6edb0d4d27311e60762073f76654595cb61a130e51dea1c3941d9375011d3eab89b88bfd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184766, "uuid": "65eedf8c-a667-4b36-86cc-31e5176b8a25", "value": "T10214CF6139F0C472F7BB45304836DFA42E3BB862AB718A9F3710226F1D217D19B69716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184766, "uuid": "7bd199e6-45ab-4702-b1f3-117338d294ae", "value": "6d1ef2766ad947ed03bd197f051e8eed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184766, "uuid": "14a5e16c-7c5f-4767-bfb7-7c1602c556eb", "value": "3072:l73EsJoHcT5UAtWBnBvypNlEnx5VAF8krmy0e50mK+ovV:5o8T5lW2pNlK7AWkSvZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696184766, "uuid": "0419a4ef-f4b4-4b43-bb2c-9aa01d226528", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696184766, "uuid": "9929a2d1-439b-4cf9-89da-fcd1ba19b500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696184766, "uuid": "218366b6-1b69-480a-abf5-d23ab08dd228", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805fd96a-6035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696149339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149339, "uuid": "8dd2607e-8f6a-4906-9f49-bb05ce3f1c3f", "comment": "Malware payload (RedLineStealer)", "value": "762bdd4f13589cc0fb1de03410f924cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149339, "uuid": "3a6ece38-e1eb-44c2-b959-658e5d0d26a9", "comment": "Malware payload (RedLineStealer)", "value": "98912576e25e14b01af0544d9312595571eaf5ba4486687b265de54fa7726e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149339, "uuid": "9d0471cb-d130-426e-b428-97b254d37c83", "comment": "Malware payload (RedLineStealer)", "value": "1314a19473186fca59eeaaf03fff4cb362e2b152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149339, "uuid": "7941f6a9-6e42-45dc-966f-112c827158ee", "comment": "Malware payload (RedLineStealer)", "value": "fe7725e9ae14d81d158b0833e82a9268f0579c384d86c5ef7b1d03c97e7ad1bcfbdfa212578aab65676cf9f5c4a8a4cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149339, "uuid": "c51e2ba0-4b03-430c-ae06-905361058d17", "value": "T1C1940203A7DD8073D8B627B018F703831A367D655D7583AB2695D9A91CB37D0A832B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149339, "uuid": "c44c8c2c-1a82-4b74-bfa2-9d1afc238fd8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149339, "uuid": "06c01fbf-c284-43ca-b64a-c29450079320", "value": "6144:Kky+bnr+dp0yN90QEj+laC3qh1ymUWWLxJOnHWV9SgrZZI6WMLE7Z7Fx+GmLhVL:oMrhy90hMaC3qTyJLxlYgvIXooRSht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696149339, "uuid": "8bb36d13-3427-4d9d-bac7-06322e3bf8fd", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696149339, "uuid": "5849e961-f95f-4ca0-8baa-6353223f96a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149339, "uuid": "78415aba-5fcd-4c2a-ae02-07629135c514", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47d6fb9-60ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696200188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200188, "uuid": "ec6deba0-a414-48f3-8972-2a0cb4e3bf5e", "comment": "Malware payload", "value": "edf9aea5935fcc149a6ddc6c5c7a2f35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200188, "uuid": "75a73d2a-f8fe-4aac-86f8-926e9808c926", "comment": "Malware payload", "value": "99b9a7d3fea69b3c67fa4a9358746fa5b45c7f4f14131ebaca59ac91378ead6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200188, "uuid": "bd9fd42b-5a84-4c8c-a84e-aacc93cb9dba", "comment": "Malware payload", "value": "cecd6b3fc81cec356b7320430d5282583fcfd13d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200188, "uuid": "ec846bfb-d9ea-4bda-b684-842c030e8c09", "comment": "Malware payload", "value": "fd30673db05330dd12845cb2214263fd2cfe4236ea733bf7ae7fa7dfea104bed5e01c5cf8ff109c050de335520707cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200188, "uuid": "9182541c-4d6b-4a67-9ce9-925fdc604daa", "value": "T1FF130850F79446F5E93A037604B71F202B72BDBAD875C65FA889713A5FB32928023A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200188, "uuid": "3c48c216-5607-448d-8775-8912c18dbd0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200188, "uuid": "91bcb30b-b48b-4043-b6e8-306d866a17fd", "value": "768:1rROj38Wwx9xhLpwJJ3cwwuSPzKUMyQlAbTe4aNdYcl:vGbm9fpwJJ3VpSbyyQCbTe4aN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696200188, "uuid": "f04f747f-5465-438d-9edd-f88353ed0d62", "value": 42957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696200188, "uuid": "0d1b4875-0114-485e-85f2-9124d382fca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200188, "uuid": "b734b764-f6c7-441d-baba-4f88b4c7187c", "value": "SecuriteInfo.com.Trojan.TR.Dropper.Gen.17552.25976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90bb2f1-6049-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696158105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696158105, "uuid": "7bb58a0a-af34-4a2d-8b9c-8f16b2e2f4df", "comment": "Malware payload", "value": "9eedef706ca10b0bcd5cde1e691a587b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696158105, "uuid": "ed5c2729-6aeb-4d98-88e5-a8d93d0fe874", "comment": "Malware payload", "value": "9aa5520bd0bd4403510e478d3862b477271fe8d1d088deaf26b1e6b86bb8c737", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696158105, "uuid": "b001afe4-60f1-4b88-b9d8-5dae1c2d71ad", "comment": "Malware payload", "value": "6030cbd0403dcac28d6d2cb1bceac430c9cb9c4e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696158105, "uuid": "9e3ceb15-9560-43b9-9184-e39ba5c89ba2", "comment": "Malware payload", "value": "aba004a4c8f4317ea107ec726668502762b4a92421bd7e99f9d677ba6291634f20ac962c19cc8c0ef6753b1184e33b79", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696158105, "uuid": "9d1234f0-da61-4a63-9460-bdf568cac38d", "value": "T1F984BF293DDE9C35D94343F34452EF97746448CA9C4ADE5EBA904B4A9C7ECA22703EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696158105, "uuid": "eec19b43-e689-45b8-a6fb-deaaaa789e6a", "value": "6144:2D5uJHv3fH6+BrYoCJ1LMsCsKjDvEntfxX+4usgn4d8w87/BNzgd4iAE0iLN9MDF:2D5s36hbTv+HYtZ+J4qwk/nkxAbiLTo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696158105, "uuid": "60b0e4dd-47b2-4536-aa6c-f8545a9aa220", "value": 383292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696158105, "uuid": "617c6d97-2bf6-45f1-af93-bcd06056e34b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696158105, "uuid": "17b4fb3d-d53a-4fa7-83c6-bfe53e6bbbfc", "value": "NexEngine.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412db142-605d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696166413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166413, "uuid": "49b3512e-80a2-4a07-9b66-06b793dec8eb", "comment": "Malware payload (RedLineStealer)", "value": "71f9ded48585b9bf3b813a3eadd5cd5d", "object_relation": "md5", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166413, "uuid": "6124c538-fb0f-4c63-bc0b-f5e811f1865a", "comment": "Malware payload (RedLineStealer)", "value": "9b40ddb1bd9ac664ac385a25e4947acb591edd202cad89956102b789e0a608f7", "object_relation": "sha256", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166413, "uuid": "7c59f72a-3170-4727-8ec0-c92bcd84a956", "comment": "Malware payload (RedLineStealer)", "value": "50f0fa60c55ca04d3f7b0e875ca5dc078650fb11", "object_relation": "sha1", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166413, "uuid": "a7e510ba-1cb0-4a0f-ab2f-79b2f43fa178", "comment": "Malware payload (RedLineStealer)", "value": "cd54f5f92d254e86fa360723caa191b7b6eb36791f60c057c1f2b51b32598a18a211cbc330963d602ef8bb02cc7be54a", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166413, "uuid": "acb19191-886f-4d55-bb95-09cd8cebfbf6", "value": "T10676330FA0ACCAAFCE514CFD7B63930C1177340D692AE3174CE9D5A46419BE893D6A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166413, "uuid": "b2049716-c7e9-4e1b-9760-48e89de6135c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166413, "uuid": "d257b16b-cc0a-4c7c-b340-caad2382f5d4", "value": "196608:Pa0FomejD+5ik0s2D3PaFX/3jNV7iVlCP6Ii:PnZSDYik0s2DiFX/TNV7QwP6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166413, "uuid": "348d9385-fb94-47dd-891a-c1daa110f0d1", "value": 7515648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166413, "uuid": "4a533f4f-bb85-4bf7-b65a-90111c7fa7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166413, "uuid": "c39c131f-a4e0-4bf4-b27d-de423b58ea42", "value": "information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ac25a7-604d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696159517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696159517, "uuid": "251fa128-37a3-4e12-8914-bd23315cf8aa", "comment": "Malware payload (AsyncRAT)", "value": "a19ec34df640568c43c292a89c383ee1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696159517, "uuid": "cd120d2a-a304-47e2-9cd9-0bc39e4d6bb9", "comment": "Malware payload (AsyncRAT)", "value": "9b4298ad3fef1f609e9c34fa9471fc2b76bd6f5542823b66ace638b8c2edb079", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696159517, "uuid": "9ddf8521-efea-4f32-b46d-c52b6fefa7b7", "comment": "Malware payload (AsyncRAT)", "value": "23753f88ff613085e363fed6246a3b08a78bf1df", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696159517, "uuid": "17fda69d-a6fe-4b72-a7bb-1007104cec16", "comment": "Malware payload (AsyncRAT)", "value": "c12f0da82b2585b43e4aae08c62b4a2e1faf8a8923567b5b5096bcf267d1b640cdf2cf615d0245589d9f0d53130d6894", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696159517, "uuid": "29090796-2c15-441e-8ec0-fb88d7159be8", "value": "T1CA83F1A99BA98914E4989B351E331B183BF0C49706ABDF9F856D081DEE137C8D3C07E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696159517, "uuid": "3dd90f0f-8361-4048-aa00-049fb4c55121", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696159517, "uuid": "84f004b7-698c-4b28-823f-88fdf7624cf7", "value": "1536:/Wz3o9ePLfXsTuuIuE9yUUuHY03DCePFf1Iwwlyao8f94qO:/Wz4cP78TM9y6HHDj9NIwwlRf9DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696159517, "uuid": "9813c8d3-24ee-4a67-b21b-259f65571fc8", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696159517, "uuid": "8e04662e-990d-4765-84b0-ad031d40bac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696159517, "uuid": "42f5ce8d-8ce8-4569-a167-815f9a5b2b9c", "value": "a19ec34df640568c43c292a89c383ee1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195eaab8-6095-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696190398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696190398, "uuid": "d902ea41-b1e0-4c63-817f-944cb7506a2e", "comment": "Malware payload", "value": "812d99a3d89b8de1b866ac960031e3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696190398, "uuid": "a52abd7c-9e34-4b98-97d4-0fbf07c6dc1f", "comment": "Malware payload", "value": "9c5898b1b354b139794f10594e84e94e991971a54d179b2e9f746319ffac56aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696190398, "uuid": "d2b37d0e-4dea-4905-92bb-b46ed6cab9fc", "comment": "Malware payload", "value": "6817df1da376e8f6e68fd1ad06d78f02406b6e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696190398, "uuid": "5a85063c-e3f1-4b82-a025-ca2c5b2cfa0a", "comment": "Malware payload", "value": "7c061a44c6e80b2ea49cd4df2f12e9d2013943f3768a4dda7cdb64eacefb3f368aa231ee68e77db167e3f253147cde3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696190398, "uuid": "e33bc52a-ad27-45b0-a7ff-f4953c548442", "value": "T1C2469D01FAD310B0D99231B4149FB25B59749D154318CAE3FAACB9845FB12F2B93BA8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696190398, "uuid": "41844640-4f9a-4152-aba1-d2e0a47b11fc", "value": "f431614f9a326d9e8e574a4fbd31b79f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696190398, "uuid": "1949d0ed-250e-4777-92e0-3e7386f18a6b", "value": "49152:eFlKjoqMGbkf8XfH2cvoJ7JdCrM5faRYZs9rri9/F0U2cRP8JF9zdP+T1E6gpPyV:eFlJqM48QunJ7JkA5faRO/06EnRyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696190398, "uuid": "4448a1dc-ca06-4708-a4aa-3355ee05dc87", "value": 5489792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696190398, "uuid": "64afdfc1-f63b-4ad5-8533-065e0d86057e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696190398, "uuid": "1c481287-7a3e-4651-a2b0-2eafb11fb0cf", "value": "fmxsvkolk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e6628e-6079-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696178714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696178714, "uuid": "86c77edd-83fb-45f3-b9fb-a4f2035e1c39", "comment": "Malware payload (CoinMiner)", "value": "25e4d96c4ed02a3ac4281f3464ed44c8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696178714, "uuid": "578e861c-2709-441f-9e4e-1742f10fabd6", "comment": "Malware payload (CoinMiner)", "value": "9dbe3e8cf5c6abeab8d79e18ffd27899c4963e035e5f3989a44ef484f4e579e1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696178714, "uuid": "ffd1d36b-315d-4bfd-a639-3eafe307c887", "comment": "Malware payload (CoinMiner)", "value": "9a769bb5cf4e4e1a0511c59e10d6e3c83c00903e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696178714, "uuid": "14ec5d2b-355a-4a00-81f2-c4903d5c1337", "comment": "Malware payload (CoinMiner)", "value": "561068957637b2ba0723480153f807ce90ff1af5b458cb5c374d7f549dc7b76449f6253da868af65b0180c6f00a5c8ac", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696178714, "uuid": "1a0f3bca-b43d-45c2-9b50-3cf46fdf3295", "value": "T18214BE2239F1C072E6B789354971CA902E7F78A39B71858F3354266F5F302D29BA9353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696178714, "uuid": "15ba04f1-15e6-4cff-b353-c3114a089362", "value": "3674a15959055454487696cf3e8b751a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696178714, "uuid": "eac9e67f-c10b-4f5c-9534-5e27e9f7bbee", "value": "3072:l+oC/Z5bxWCvsEzuHU3gyK+KxQvGAlR5b5/TRzNi:YLFWCb/3FKVxnAlldzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696178714, "uuid": "4b50c174-cb84-4cff-972a-51a8fc4a7846", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696178714, "uuid": "732fc6ba-64e6-4dc8-a597-505bd0db84c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696178714, "uuid": "2409cbf4-43a8-4053-8907-c18c0dfbcbc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6bb8cf-6059-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696164605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164605, "uuid": "65f2b246-751a-46f7-912b-68e2ce71533f", "comment": "Malware payload (Mirai)", "value": "7929d34fde40f6e028ff4fadb99d7101", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164605, "uuid": "ddd99995-d93d-4fe1-abee-5191ed9bd2e5", "comment": "Malware payload (Mirai)", "value": "9eeb18783e8949c789c0fdc627666d9ccc1b1defd217e97bcb3fac1cf5808bd6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164605, "uuid": "3ec346f8-bfc4-4f10-8e29-69e7d77f1f9c", "comment": "Malware payload (Mirai)", "value": "6c97db0d1ff94a645bca542e179f8551473b1901", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164605, "uuid": "1a794fc9-ee9a-44ed-b58d-de1509d6cc46", "comment": "Malware payload (Mirai)", "value": "5d657fe593ac2c8f1cbc40b6429cf1ce0e37e349f87900bf4ba4d3824b7de7c17ae5c2d9922c45339f195aa5b69944c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164605, "uuid": "e072c2e5-fbc3-43d5-a092-88d3f4fda92c", "value": "T16EC33B56EB418E03C4D5177ABAAF42493323E754E3DB330699186FB43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164605, "uuid": "b9f27056-68e4-4f2e-9427-0eb91050c6ff", "value": "3072:pKP9asb1mbvEVWn4Z1U+NBsZQ3GUm+395M/9lQl/:kP9asb1mbTe1U+NBz3Q+3LM/9lQl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696164605, "uuid": "9934fd6b-5af7-447f-a048-45f1f0623b01", "value": 121606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696164605, "uuid": "985ba0bc-e00c-4b6b-bedd-2f523a186d88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164605, "uuid": "5e526dc5-92c2-4475-ac5f-59f508af3f34", "value": "Josho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3b6ecb-60a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696197567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197567, "uuid": "ce91c7a0-3f95-4c9b-8343-6a393e29f4d9", "comment": "Malware payload", "value": "25a357e7444fc599dcef3036e5e91fc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197567, "uuid": "1ab3299d-15c6-40be-ad64-dbf7f648cc59", "comment": "Malware payload", "value": "9f5289a682a53144b0a38d1af54d935194934188efb4cdb92127f3afe5f3753a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197567, "uuid": "8e3915a9-1f89-4fbe-bf24-e8f562e4d788", "comment": "Malware payload", "value": "d9af6f3c59dd1d66a0fe63126fd9e5d0074e46cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197567, "uuid": "4db73e86-43e1-4440-b22b-d0ac1a77c5bb", "comment": "Malware payload", "value": "6ffde5435ba7cb3457166675bca22faa70f7a8a1247d763db242d7eb3b836703a8c1e42817f92ba154dd8a46b13a6c9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197567, "uuid": "c86e9e3f-46b0-4dd4-8999-c6ac59662cc5", "value": "T157052391EAF44070CCB52771A8F903931A357D919DB4832B2B997D8E1DB26843932F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197567, "uuid": "f7c7248e-a461-45dc-b0c9-415bbef2d61c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197567, "uuid": "ddadd5cd-662a-4081-9ca4-2ebf74f568af", "value": "12288:HMr/y9001fK4TjrHNoyHYrIvDeu/0b5E1iYSzi3eXMofmU0dhmRu9S4MrWqRrsK8:IyP1XtYy/0b28YYJDOEMUWqRQK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696197567, "uuid": "f036fe2f-cb7e-41c2-8134-8e7e3be32b6a", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696197567, "uuid": "dc099a0c-0b68-462f-a481-f230de1c613f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197567, "uuid": "e3a0af53-589f-499a-aabc-49c4a28e9d13", "value": "25a357e7444fc599dcef3036e5e91fc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8a1724-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177601, "uuid": "dae7c52e-3fb0-4382-a33d-436a711b239f", "comment": "Malware payload (Mirai)", "value": "b6e52425fd37056075c5f7386e0e85a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177601, "uuid": "7304b856-3250-4fee-8344-10b9a5798667", "comment": "Malware payload (Mirai)", "value": "a0d5cb9a6c52fec6d014a375370e653cb2a52749b468015b91e1e96e597bc634", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177601, "uuid": "9880aa73-cce3-4903-9adf-17b529310968", "comment": "Malware payload (Mirai)", "value": "9f77dc9e2245d0a0806fa1e24bc57f061177bf10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177601, "uuid": "d2adee95-ffda-46ff-b138-6f37c720ead3", "comment": "Malware payload (Mirai)", "value": "b289ae1517d471c7bd95c1b6ee9a30a222acbae2fc125729650dc61c0795aa43511264a1d3adcb2ec2d551bcd6333d36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177601, "uuid": "c5308a8f-c56a-4b30-b664-0b51b48936c8", "value": "T1C613B493B8C14B3AC6E0237DEEAE418D336077A981CBF6578E615B01378551F0DA3B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177601, "uuid": "74b75f90-ebcc-48a0-9a6a-d945e4fea66b", "value": "768:NtStQtZulOMLQBS7uP4ytmnVUC3z6WystQyVKyxfZX+m4VklK7FhPRRx1T/n+nw9:N77EHLQBAuPPtmVUCD6WyUQyV1xfh+mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177601, "uuid": "7c83086c-200f-40c4-a1e0-830dfbcca2c6", "value": 43096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177601, "uuid": "ec933326-ef6a-4c1d-a279-81cceb8781f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177601, "uuid": "14e0eac0-041f-4e43-b6f8-c586fc28d074", "value": "b6e52425fd37056075c5f7386e0e85a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0947c762-6033-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696148281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148281, "uuid": "f3a9dba9-fdf6-4e14-bd9c-e32d5ffca938", "comment": "Malware payload (RiseProStealer)", "value": "e5e46b96a7205c88ea38c29c66d234e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148281, "uuid": "9d0d2803-7ac2-4959-89f5-2bb6dfceb0ea", "comment": "Malware payload (RiseProStealer)", "value": "a45b0a2c9b50d058ed9b1fac56eca9d3fc92cf6a16b37d96a3284e127e7313ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148281, "uuid": "a0036266-8025-4bd1-9bb4-12444829a843", "comment": "Malware payload (RiseProStealer)", "value": "71b959e2784d47917880bb2b68a4496402305b2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148281, "uuid": "76c6c2d6-87ee-421f-8925-e9efb84fc608", "comment": "Malware payload (RiseProStealer)", "value": "95ecf03aaa823686211c45a537f4ec9e2547d08cf7d944032c47a32737fa175da20c735be30031d23e6b4811ce51406c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148281, "uuid": "c9cac059-886e-4439-9a9a-cefbadb8d2d1", "value": "T1B036BE02B7B9CA62C16EA733D5E1001843F3E882A622F71F36C527994D437EE4D95B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148281, "uuid": "fde0ffe9-8342-4be0-9196-12ee5c638299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148281, "uuid": "2973a6b9-4c2e-4b82-a314-d28ecdd3bc18", "value": "98304:OOQPsaWTo14714+qpSTaP23zN4jbiONCJ+BlillNN:CsaJ14pYg62R4j+ML6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696148281, "uuid": "a2500dd2-3977-4b2b-998a-1420cbe998d1", "value": 5289472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696148281, "uuid": "a3a8ab94-b0df-4051-acf5-dc0f025510c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148281, "uuid": "4804e655-e71c-4092-a0df-d75574ba6308", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca79cd1-6059-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696164983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164983, "uuid": "4d3ba3ac-766a-4540-849f-7d2d05864e40", "comment": "Malware payload (Smoke Loader)", "value": "8ef0c1605b7cccd1cd1fca20569c0518", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164983, "uuid": "95087ddd-8596-478a-8001-ccbfb96310e4", "comment": "Malware payload (Smoke Loader)", "value": "a4ce09752fb325fb3ec8de3ec1beb05ca3c92015d1ed8c48fd0b9e3a57cd8c51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164983, "uuid": "1dfcd26a-45ec-488c-9a99-335417b25eda", "comment": "Malware payload (Smoke Loader)", "value": "979d41a2bcc78fa02b568b1048d34725f4e3ba08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164983, "uuid": "066c00a1-a638-41a0-91f9-7d025d2a7cd7", "comment": "Malware payload (Smoke Loader)", "value": "c1098c9fc816cea56755a1c02179f01597c3934b1d46e23a25585c477da60b40298d5565d260887d4efdc059d1133fd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164983, "uuid": "5f2f8d0d-bd57-4396-be1c-ecce13a5b42b", "value": "T19E14CF2D39B1C472E5EB86389831D7A4697BB8B26771818F331417AF2D306D29B69313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164983, "uuid": "81e7286e-2be3-4149-a445-3de9579a09f7", "value": "93d103d7b72d447eca6f713c27a7a3a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164983, "uuid": "faa2fc0a-56cb-4cef-9686-f3e5840895a2", "value": "3072:C+4fRnUz8c+acudpqoGLelf3wM2/rYgfyupY81zGSbKx+5vLeq:wU8c+acuqigb/rDBUS9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696164983, "uuid": "48fc06f7-a867-4797-9a1d-5609b5e3ec2c", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696164983, "uuid": "6b3fbf7d-4d82-46c6-9c04-d8ce88475d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164983, "uuid": "868ca44d-d7f3-4564-af4a-c768261566b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbc9e28-6025-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696142463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142463, "uuid": "28e50650-d185-44e8-bd00-39027d1407c9", "comment": "Malware payload", "value": "d75d46c562ea63bf94a8bee853173a93", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealear", "colour": "#15548B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142463, "uuid": "728eaa0e-9c6a-45e9-baa1-e33bf0d7f33f", "comment": "Malware payload", "value": "a7129f10503e35ae71b08e6ca3a00feeb91f3f783754e0cb1ea0053d5aead9e0", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealear", "colour": "#15548B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142463, "uuid": "b6635fac-d1ea-4308-a65e-9969276384ab", "comment": "Malware payload", "value": "34ef1f5b9febc8c5fe33622e94e5281e798f7d37", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealear", "colour": "#15548B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142463, "uuid": "c643e222-9ef4-4562-b027-097640fe4fd6", "comment": "Malware payload", "value": "d00232e3fc9df5ab81162e9fbbf8bad51c2b4d8a61568a861f58989ff1f798ac3295205c69b14f2a5971c605c15fb22b", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealear", "colour": "#15548B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142463, "uuid": "37c9954e-5429-4d8d-9af3-cfa8556eb0be", "value": "T17535ACAC74B5B91AF5D4833BC6C42CB6CB2CE540D79A3D9B8E2081567D8310E9F6BC61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142463, "uuid": "fd007502-8b61-4fb5-bac1-9fbd091ebbf2", "value": "6144:Pp8wlgiXxQknpPOK2+iAW4gQJpuODUp94yKTl1vuqkOVGXR:blRiknx2+UynuaUb4yKp19kOV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696142463, "uuid": "ec8d6a61-d816-48f6-9c7a-68250d270c8d", "value": 1062350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696142463, "uuid": "9d3c18ab-1b02-4901-b715-7f9f75273665", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142463, "uuid": "22a9ab55-8bd8-4142-92ee-5ba398d0dba3", "value": "information list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db3208f-6038-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696150650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150650, "uuid": "d5609a6c-d987-43c2-9252-5724625fe82b", "comment": "Malware payload (RedLineStealer)", "value": "264d1eb69bcce00fdf11a6a39472dd0a", "object_relation": "md5", "Tag": [ { "name": "77-91-68-78", "colour": "#B35AE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150650, "uuid": "c01defc8-d737-4d94-a102-2f2448abefc9", "comment": "Malware payload (RedLineStealer)", "value": "a744a3c6231d68eb30fd4ec1c1deb3830b13b36d3c4bae9ebf03c3d1380b0f79", "object_relation": "sha256", "Tag": [ { "name": "77-91-68-78", "colour": "#B35AE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150650, "uuid": "e6363d89-d698-4c21-8550-b68dbfff619c", "comment": "Malware payload (RedLineStealer)", "value": "e466c80da7f961743681b6dbdae3eaa0756a4dcd", "object_relation": "sha1", "Tag": [ { "name": "77-91-68-78", "colour": "#B35AE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150650, "uuid": "4e67056f-0c15-46d0-a9e9-51287ec34411", "comment": "Malware payload (RedLineStealer)", "value": "44f5adf32d87a750fccce8c79baae60822831109a3f4aa91d1f1bc288d3616c4c81b4557ff892803c3b36152fc877a07", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-68-78", "colour": "#B35AE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150650, "uuid": "1f90b888-7901-47b5-a587-0ed0b7cfea03", "value": "T183944B25144AC95EE6CDC97A81E6CCB56C326516E3B042CA26FB20ECCEDD397791730E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150650, "uuid": "3cd6921b-bdbe-4715-b6b7-cd3eb1ef0fd8", "value": "231ae748dbc4fa94aca4a2ab6a3f3a91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150650, "uuid": "1f444262-cc9b-46a7-aec4-8a73b14c01ee", "value": "12288:eMAIy7c3/N0NZab1USs2zwAmNOr7hXqs:qIy7cVqZabE2EAn7hXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696150650, "uuid": "3e60ae73-f8ee-49a8-8c7b-dc7481e3343b", "value": 417281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696150650, "uuid": "f259f93b-1cd2-41f6-8745-637bcbd12872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150650, "uuid": "b2561a75-4796-4d9e-9318-b107b2256083", "value": "asca1ex1234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc821af8-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163614, "uuid": "54933dbe-43a2-4237-8004-89b577f62922", "comment": "Malware payload", "value": "5eea9654b47a5e8bb8e36ffcaff783b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163614, "uuid": "89de820d-ca3f-4de6-b44d-2820c33fdb07", "comment": "Malware payload", "value": "a8e0a081b63d69fd66fc46359cedaaa84ca32d04a0cfccf38eee1af2b1099b9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163614, "uuid": "a0b96207-b210-4104-914e-d3ac2b3a14e5", "comment": "Malware payload", "value": "757b20ae13295ccfe9c232688e9fbc47ed711bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163614, "uuid": "7e3e4fdd-8e9a-4f25-a90d-5608555f200d", "comment": "Malware payload", "value": "fefd36310319ab6352d66cb6e148a52820140e1f3d43588bf26aff1224767b54701fd9a0460640fb7511c63c361f0290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163614, "uuid": "b3831434-a076-47df-b2ea-6f861a30d4d6", "value": "T1C9F48E12B5D240F2C625563409BA2B37AB35EB4F0B18CFC393A5DE6D5D37251AC3722A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163614, "uuid": "a0428ae0-f9b6-4b30-b5c9-43561a27a05a", "value": "57ec7e056932dce00f5082a193650959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163614, "uuid": "de46dc32-f9a7-4ac9-aa12-045835c6fc65", "value": "6144:cWZdlwRJeErOw+43lHCva4qfslFR3pUKxfjtY9Rcnl8V/KPLVfs96CYg4gNhFZvH:cWZdaJFrUC4qfsvIS20lu/qLVfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163614, "uuid": "f3f281bb-d022-4871-a342-044d0c0c827a", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163614, "uuid": "e9cdcf79-1ac8-4aaf-8f9a-d0b0e2fba66c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163614, "uuid": "08980965-db48-4ca6-b7f5-ef8914bd6d20", "value": "SecuriteInfo.com.FileRepMetagen.17123.23918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dfdac0-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177637, "uuid": "2b289ed5-fe7a-41e1-b3cc-304f9edd442b", "comment": "Malware payload (Mirai)", "value": "6d4a8345a00de5f706ba8aa1a99bc095", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177637, "uuid": "1c166625-79ef-4f61-a5e7-42521adc1667", "comment": "Malware payload (Mirai)", "value": "aa1528f8a6c8e342bd728613771531a8bfa18c1f5cef482cd4ec2ddf498ea70e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177637, "uuid": "76c1bc94-0bf4-4f2a-8223-b2e8a8db5608", "comment": "Malware payload (Mirai)", "value": "fb142facf3354480a0119bfca831a716462f226c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177637, "uuid": "a02efeba-c993-45be-8bb9-a1dd8dec2a4f", "comment": "Malware payload (Mirai)", "value": "948d6728511626a79583cd04c18420244c90c94f4e4e656e98ea1cf8cae2a733599c26ceba8427eee729283d9d546670", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177637, "uuid": "3e3f84ef-fb99-42c8-bf04-03370bdc0155", "value": "T1FB630782B8C14627DBD1127EF67E438C332557A8D2DBB2138D226F113786A2B1D67793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177637, "uuid": "a58f814c-acce-46e6-9cf5-846cb7f3dcdc", "value": "1536:XbF4TLPHXCaAV23LmaTz+IS9M5E67LNh7blzRWnX58rO//pluvVuCC0/:Ll07h7RWnXXXwVuCC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177637, "uuid": "c0442467-2dab-4dd3-b974-9f67ca88c731", "value": 71548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177637, "uuid": "84eab7eb-88d9-4316-9e1d-1c947cddbf3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177637, "uuid": "d0cdd126-6a49-407e-b012-4e20913e4947", "value": "6d4a8345a00de5f706ba8aa1a99bc095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6e1600-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163617, "uuid": "8d22abfe-efbd-4c4d-832a-03e1beca774d", "comment": "Malware payload", "value": "f1003eb385a596a1ed3aeb245e73b98b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163617, "uuid": "9c50d789-0895-4483-aa17-7960b586121a", "comment": "Malware payload", "value": "aa2f6511463335040b212257b323d583a3c0fe8fdc5453ba186b38f960083704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163617, "uuid": "d87beeda-dccb-443b-a2a8-bbdbd99033c2", "comment": "Malware payload", "value": "67433bfb5cedb7581fc7a48b601ee63f3ec4b9af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163617, "uuid": "23ce0cd7-6fba-4613-a9a1-a7327140689c", "comment": "Malware payload", "value": "e197666627e5aa71d2d195bae8239ab679c29e27888746460fe5d1e8a588a42c8f08fb09e58b70c7ece179e74a6c5de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163617, "uuid": "0c5ad827-709c-436d-8047-535d67231d04", "value": "T1B835E700B542C177E87A4A75CEFA95FD562CAD32CB0091C722C47C6ABF36AE67D31246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163617, "uuid": "4b5c3777-ac82-49ea-8d21-3edf09aad07e", "value": "a0862d502190e1742219fdd0bc870aad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163617, "uuid": "39f28a9d-babf-4ff0-b56d-04bbd87c3d9e", "value": "24576:HEwqCJDx5+jLiDaq7/1E7/MReEdaRLgS:HEC9x5+jLGaI18/MndaRLgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163617, "uuid": "bcc23dc4-e2c9-40ad-a003-999658a1e274", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163617, "uuid": "a6cfb9e1-12a8-429a-90af-88cec89a8151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163617, "uuid": "084a19e0-06ec-4e59-bef6-41f5590f8a71", "value": "SecuriteInfo.com.Trojan.Win32.Hesv.dsrc.26548.27472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99b0f64-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696195069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195069, "uuid": "ebc18f14-1e8a-49a6-8a36-a925d73f25aa", "comment": "Malware payload", "value": "df8c8d2c67b7c96a31644005a60469e5", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195069, "uuid": "e4cd5661-05bb-4ec8-9afd-24d7e67ce4bd", "comment": "Malware payload", "value": "aa4836a0f3a10388a961b4c6f2667efe06facfd6c79d2c4a3a24cf145c68f971", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195069, "uuid": "b5e4fe2b-9ec4-4a7b-b788-8ad96b61f4c9", "comment": "Malware payload", "value": "334dcffac7f9e8ca82fe7b2f8fc1d8351f2fdbe0", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696195069, "uuid": "9d8bd2f3-ec63-4ab8-aab0-ee315ac48f79", "comment": "Malware payload", "value": "72823d92d784bb09c69ca1e84fe9157e0a21996fdcfc2d6fdaed62a1225c944cfdce3e8f5e7ae33ea47f98aeaa986b96", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mega-nz", "colour": "#02CFB1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195069, "uuid": "d74ee777-4bd3-4004-9ebf-6e721b82c922", "value": "T13BD5BE02FA4184B1E8970271647ADB7E4A39AE244734C4DBD7D53D3B6D312D23B3A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195069, "uuid": "690e3d30-ee67-408b-9b5d-49f30133de52", "value": "df40d8be5c4e5f68cce5e2718020b391", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195069, "uuid": "e59abb2d-a0d5-4b1c-a618-78c110020a64", "value": "49152:5qvB2J/AjYwZYdK/wGhMt5edMFxjfyW153EZXPGutPn7MdE43iKXL7D1:5qvB2J/AswZOGWt5lFxjqWsnl7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696195069, "uuid": "56055adb-2be9-4695-8f2e-3c6acd8076e2", "value": 2994464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696195069, "uuid": "3722e590-0d11-4de3-9d84-16764fb75a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696195069, "uuid": "4fec0827-c643-4053-a292-c9af3c3a6827", "value": "reservation info(date, name and etc).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d28616-6030-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696147206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147206, "uuid": "1c36a420-5e5d-4dd5-bca4-353ec8c670f3", "comment": "Malware payload (Mirai)", "value": "43c50918e34110708ab2554d5de4b9e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147206, "uuid": "80bc0689-3b62-4b3a-9ead-b3244ad6fd3e", "comment": "Malware payload (Mirai)", "value": "aaf6f70cbb76e2fc2b3b3a2b7a3ec33d9778a868f51f747588c6fe9707697568", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147206, "uuid": "859bd506-7778-4d81-901e-fdd2194dbdc7", "comment": "Malware payload (Mirai)", "value": "3a1b9e70efc4036aa5843efc17f9603439fc69e3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147206, "uuid": "ca86236b-ec12-4bc8-9e07-9cbeec2ea31b", "comment": "Malware payload (Mirai)", "value": "bb1f9f7fb9af6c491e1fd4c2a62da64d9a79fd6db9c325988b7ebd5812088dbbe61e1e76d8889ab81f6e3de4636b76fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147206, "uuid": "af5c624e-e46a-47f5-a510-04b6d6150369", "value": "T1DCA2E014BF18868BC832693455D9EAD61393FC72F2ECCD592940C15FB0B33E92474E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147206, "uuid": "2d6f3302-68a8-44d7-b7da-15c808a516a1", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK9:M98o08kxofBE+ZkXaqGbp2F2TWul0c5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696147206, "uuid": "bbdfec23-1045-4f54-ba2c-8532b4e03400", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696147206, "uuid": "27e35a66-96ba-42cc-8b5d-8ecbcda6198e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147206, "uuid": "0efbf561-87de-4e49-9b2b-0d2874567a79", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8449d149-6037-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696150205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150205, "uuid": "1f0f2705-6f9c-4baf-b1d5-e7bc41050805", "comment": "Malware payload (Mirai)", "value": "7cfb8140b87125b59082f75249b51726", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150205, "uuid": "f5575ce7-eaf1-4bfa-ba5e-908be82215aa", "comment": "Malware payload (Mirai)", "value": "ab00c532444e4c5f3d3d17277ec925b2739a2272d4d84a492c69eda0e48b29b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150205, "uuid": "590a31eb-faa0-4de7-bfb3-58164e94a1d2", "comment": "Malware payload (Mirai)", "value": "3b60836101af279cffc1f2282cebe079dcbd4306", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696150205, "uuid": "06b0fab7-16cc-48d2-8cf8-44b8fcdcc241", "comment": "Malware payload (Mirai)", "value": "45998f701cd889ae7bda9da79f016d660f7a8aa0f6979e56b2e3a4b799deab9c8b5e0018df0fdc680142db1419c36582", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150205, "uuid": "ed540897-3f93-422c-8c85-471cdfee968f", "value": "T1B4E34C46EA808E03C4D61776BAAF424A33239754D3DB73068D28AFB43F87B5E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150205, "uuid": "c89d2e02-b7be-4560-a0ac-f8eed1be2934", "value": "3072:NRR6WzonOKwaVDV2uiGUD/vzdMvEi3cxgM/9yD+Sf:/MWQnwaVDV2uZUDhQEi3ceM/9ySSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696150205, "uuid": "1c27cefd-4363-4a04-989c-763bc505842f", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696150205, "uuid": "c857deef-8c1d-41b2-9595-6ea0f8da77a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696150205, "uuid": "0e6a83d8-238a-441e-b7bd-157b72ad7848", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456e93e9-600f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696132920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132920, "uuid": "4d2b1d16-f2f3-41f5-bf47-f12334b83d1b", "comment": "Malware payload (Smoke Loader)", "value": "1c9340de0397e328269ebf8a2430cbef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132920, "uuid": "a6e8a7ab-0be3-41bf-94fd-dbfbecbe8548", "comment": "Malware payload (Smoke Loader)", "value": "ac10f19352030f5a91d0f24de522eca4eb4aa2e16610a05c805219ff400adac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132920, "uuid": "6dde6b4a-5aa5-4009-9e90-340916e752be", "comment": "Malware payload (Smoke Loader)", "value": "a85573ea1219f934a06101ff67019e56961db13d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696132920, "uuid": "922b1615-111d-43db-8f68-c34a9944d4ee", "comment": "Malware payload (Smoke Loader)", "value": "4cd65f4a578579ec197ffa1a1817560acc3498e2a944c1e97efbc7e6c6722a283b7e1a0c217fa9fdc17a51588b4f27fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132920, "uuid": "f91ce63a-233f-4dfb-aed6-2e98ca5a2cc3", "value": "T1E9940243B6EC5172D9B12B701CF71693073A7CA18E74836A339199AE1C72684F93637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132920, "uuid": "922e3761-10b8-427d-82c9-25028e02c89a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132920, "uuid": "6dd6901b-318a-47b6-82d1-ae5084f2e274", "value": "6144:Kxy+bnr+rp0yN90QEbgkgzQqdttUXB5YluXBxBthr7wsHPti9kXJmOl41U+e:LMrny90EkiUXBKwh7tHWkXoOl2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696132920, "uuid": "7257dfed-de9b-4372-b8ec-fb06b53ad68f", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696132920, "uuid": "c65f04cf-c729-43c9-b5a2-350fb8a085ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696132920, "uuid": "e93e948e-0a69-4048-8a18-1c8ce13fae0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738e33f2-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177665, "uuid": "f336e926-c028-4b15-8c54-74ba23fc8ff1", "comment": "Malware payload (Mirai)", "value": "39363377ab1b4a94b0aeb7e880d9d44f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177665, "uuid": "3c61150d-ff27-4f90-84d2-413b4e0933ec", "comment": "Malware payload (Mirai)", "value": "acdaf003daa47a6f504e2347272a29693b795c6eaca1b5d057b3e1f2767e9294", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177665, "uuid": "fb0e50d1-71ba-44d2-a4eb-89e5d989d3fe", "comment": "Malware payload (Mirai)", "value": "a69ad4c65ff1a8955571b56dd934b24e5e141525", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177665, "uuid": "a7700a47-0456-431a-8ef1-7071f5be7d62", "comment": "Malware payload (Mirai)", "value": "8482d26396a242cbdf9265401cedbc2f48efbf032a7b094a03ff53f748b6e4f816c5845c78090dc1a4ff8ce01a66a3e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177665, "uuid": "f1d0bb65-8aa0-4e52-9867-351878eca31f", "value": "T1F6432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177665, "uuid": "edf9f8da-f608-489e-9148-13d12cbaf368", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwz:RqtmZPuutfbltZFBSJsBcfDSTFI+BEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177665, "uuid": "80b842f3-93c1-4a6a-85c5-97b3acaa7567", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177665, "uuid": "3e1d790f-8172-4bcb-89e2-e611dbccd3a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177665, "uuid": "e6ba343a-1f4c-40a3-b154-5df2c4e3ec28", "value": "39363377ab1b4a94b0aeb7e880d9d44f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beea4356-609e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696194541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194541, "uuid": "90cbe844-1899-4d41-a634-b6d8acb5f70a", "comment": "Malware payload (Smoke Loader)", "value": "f874356ddee152fcdb366283fbb70d86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194541, "uuid": "32d154fb-94bf-4c1d-95a5-9641dd9ffb0f", "comment": "Malware payload (Smoke Loader)", "value": "ae346575b504f4c6440a8c7f3f3b6d3ca3507679cb851aa1572edac210ff1eef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194541, "uuid": "1dd12286-c229-44dd-a65f-f48a77da346e", "comment": "Malware payload (Smoke Loader)", "value": "bb4e45490cb24ddbf14362144a96fd4eeb3810cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194541, "uuid": "bc8c46e6-c678-4a7a-a133-55c435638a64", "comment": "Malware payload (Smoke Loader)", "value": "917a46fe60a85f1348afde5a58f3c191a1b893b8e7fee8a8ceb00a215824b933095f5edec2a35da48e3b79c9ea6cecd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194541, "uuid": "734252f1-e86a-42fc-98bb-775819121765", "value": "T1E9F4BE926248152ADBE56B70C956F6720255BD2C99E0880FF6FD3E1F3FFE187E021606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194541, "uuid": "c24ea68b-2eb7-4cc8-b014-f60afa90762d", "value": "c1026f3bc4dbd1c7779566798486c792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194541, "uuid": "f136bd56-9607-46d3-97bb-91b5a36adbda", "value": "12288:tUs9rDJBnYwPzIFb4Hkslb58JJToePbRp/D9k5Z7Jjlpqj74F4rN+KvLU/7frwFQ:qs9rN9YwPzIFbDslb50xVdDm5Z1ppqXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194541, "uuid": "d05233dd-162d-4960-a615-c6d1d9e2d97c", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194541, "uuid": "cdd43b05-a624-4698-9740-2d5075fae3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194541, "uuid": "0f5f2a5a-c97e-44a3-9239-72dc2e47a016", "value": "f874356ddee152fcdb366283fbb70d86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f506405c-6027-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696143522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143522, "uuid": "61867459-4528-4a7e-807f-32363adf31b5", "comment": "Malware payload (MysticStealer)", "value": "027a867a807844888d839cb71ae4c30e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143522, "uuid": "875eb234-7c95-4ae5-9dce-887692bc4fe2", "comment": "Malware payload (MysticStealer)", "value": "b13cf761b1fddf59f6830626416f51c2ae230de7e1a547fa52dcef1c26c35f26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143522, "uuid": "419f986b-fc3c-44a8-94f1-e57139227d53", "comment": "Malware payload (MysticStealer)", "value": "2fb67e59bc6fbcdee8599473dd7fb3c0e9cedda3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143522, "uuid": "878fbc1a-4d91-461c-9e36-dd69afbd00ec", "comment": "Malware payload (MysticStealer)", "value": "e71a7ca9c4b4321a9974c7bdb2e607f2d8a7183a05fb9b5aac5244488dfb341655d48142f0e72ec79fd96eedc446ef10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143522, "uuid": "dcefccc3-30ae-47f6-b86a-4128238de399", "value": "T19194F152E7E85433E9B627B01CF612830F3ABDD1897887AB32456C5E0DB26C4A572727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143522, "uuid": "d8a69cd0-a3de-495a-86c5-b9309635cf06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143522, "uuid": "37b8eaf1-a676-468e-ae5d-34ce13b4a6ad", "value": "12288:NMrhy90jlzkGqNCc5xbFjOOt4Ww+NLkvJc2w2:YyGlzUC2tVO+4t+aS2w2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696143522, "uuid": "0d00546a-6b1f-48fa-8736-31c77677378e", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696143522, "uuid": "f148854f-28c6-4af9-a78a-022b9c8e96b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143522, "uuid": "09699226-f6bc-45fe-be2b-2a8925c5ddd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1cd910-5ff4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696121467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696121467, "uuid": "0a861ab0-3478-4c00-8066-73bd7be9e029", "comment": "Malware payload (Tofsee)", "value": "2a79daf1d098c21ab2ba34351cd31f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696121467, "uuid": "04cadc65-5379-49a4-93ea-9987f458ac5a", "comment": "Malware payload (Tofsee)", "value": "b17ff1cfe2d0c5dba1be435d1cc098e85b393014749b9dace6b57d6391c7cae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696121467, "uuid": "9b87073a-bcf3-4b1b-b0bb-3311ab992931", "comment": "Malware payload (Tofsee)", "value": "8c05eb97a7db3cd3828503829a26a01e1eb668ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696121467, "uuid": "bc26874e-6bda-4948-9973-96c6e929123d", "comment": "Malware payload (Tofsee)", "value": "bb4929759a44b24d637b3ea71e7e33492acd8559d7a3c958f8fb19a5002daac76d83edc03fee31ec042918dc94c798b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696121467, "uuid": "32fc7a43-c4f9-42d4-8e0e-b0c34aa9d62b", "value": "T10914CF6E39F0C0B2E2B7857199319F946D3BB8636BB0C19F231413AE2D706D18A76707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696121467, "uuid": "753b694a-7291-44c5-b96d-fe720fe2c1ee", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696121467, "uuid": "218f8431-88fa-4cb5-9972-530ae3d4ee52", "value": "3072:uGiR1hf/312fYTDifrJIzgzMVxuR8jS5/oC3:6nuuo9mnvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696121467, "uuid": "999e3ca2-3931-475a-abbc-cb2b03131ee8", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696121467, "uuid": "36678a54-e412-4f87-afb0-6fb14219e07f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696121467, "uuid": "1d3e7f89-0fa8-4952-8f10-7cb7bd8ac551", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae66409-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696194857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194857, "uuid": "7a4738f3-5c2e-4be4-b93a-574fc747796a", "comment": "Malware payload (Mirai)", "value": "1a7d1fdfb0252cf227d6b9c1113c9a51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194857, "uuid": "2c73b1fc-176b-451f-a51f-c26fa81e33aa", "comment": "Malware payload (Mirai)", "value": "b2adc856dd4343fe9722adbe71110e29cfbcce0df88c38bef484351ef49d3773", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194857, "uuid": "70032d87-fc69-4d7e-a2c0-5eefffae30a3", "comment": "Malware payload (Mirai)", "value": "7e4e18dae98c10d33aa5e32470bea2a01b621981", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194857, "uuid": "b71d6826-cd1b-493d-9b11-ea91d7fccd5b", "comment": "Malware payload (Mirai)", "value": "da018342dd082f7c3548cee3e7eacec280d13b909f550b45d9f9d3ccfc630a21bacd43ace6c59229ffa498060f475f54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194857, "uuid": "e73e348f-9904-45bc-8c5b-bc3004eb6643", "value": "T11063F846F9419213C5C11B36FA0F43997B368314D3EB33029A2AAFB1AF4772E4E67515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194857, "uuid": "9b4e8506-cb2c-4888-b929-09e443cdc96e", "value": "1536:F6L/JWZvq/V0/d0OPoEbhEydJzV008Sl5MPBltuJm4EOvy:Fe/wvq/mX1EiJZKSl5EBlIA4EOvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194857, "uuid": "2502521a-7760-41ed-8266-43e4a4433db7", "value": 71492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194857, "uuid": "b48e9ed0-2463-45e3-86ac-9e434b52d5ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194857, "uuid": "b74d5f58-9e30-46d1-bf2c-446a0b3a356d", "value": "1a7d1fdfb0252cf227d6b9c1113c9a51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509fb41e-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DBatLoader)", "timestamp": 1696146253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146253, "uuid": "27e0d6a6-3f90-427a-98c5-c66a6cc0f9ab", "comment": "Malware payload (DBatLoader)", "value": "96cd472e7ce09e4dcde4e4e2623587b7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146253, "uuid": "2fbc87c9-3aa7-4aea-8c71-fd9144d74dcd", "comment": "Malware payload (DBatLoader)", "value": "b3279050d6b5fee9c5660c3d98c0d6dead4c7f6ca150bebc257d054424bd6e79", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146253, "uuid": "0947412d-1a98-4047-b9f0-28fdc751d3ae", "comment": "Malware payload (DBatLoader)", "value": "500653f103dda92d7d0aded3b8152963343fbe12", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146253, "uuid": "28a3f22a-d741-45a0-bef8-d4c0e7a3d426", "comment": "Malware payload (DBatLoader)", "value": "9d143b7a3941379eb7c6d388bcc1481ecb235a3962522694d36d4971fd336bf88e9380e17793e4bc1ff9ba47f0b2480d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146253, "uuid": "e699e99c-6170-43c6-a8f6-e729127e9373", "value": "T15024335CD78F48A18F54A77A03674E4958BC7A2EF71148B530AC83B433EAD3C84AA57C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146253, "uuid": "5dcbf990-7967-4c32-88ff-ea268327db95", "value": "384:Y3oLMmQn76P7re1DnPyqPy89WFMMsBSNIyhvzsO/ZSNPiEQZKgr00kep21:Y3oDi76zreYqNVBSNIyhv4OYNPiN/00w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146253, "uuid": "2dc7792e-3a4e-4dc9-bd62-c9949d15c239", "value": 211041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146253, "uuid": "14ce263c-d23f-47f8-8d12-9c4beb4ebc7a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146253, "uuid": "f2b89042-8b89-450c-8ed2-b332b42d6f4b", "value": "CV-Shabana Hassan.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab30a40-5ff5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696122030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122030, "uuid": "49e6728d-b4d5-4161-81db-9902c7e35513", "comment": "Malware payload (Stealc)", "value": "698d59936866d3682052cf37f4e11a83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122030, "uuid": "421a31a6-4580-434d-a337-97dea0bf33f7", "comment": "Malware payload (Stealc)", "value": "b33e145fbed8a2aa63bf595a8bdd2c06166ea57a7added593c598ab2c63014a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122030, "uuid": "62d21748-2eab-41be-bf96-aca23c3f14fb", "comment": "Malware payload (Stealc)", "value": "c0b9586035fe1a8596de8b8f5b8048d8e0f98455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122030, "uuid": "74949987-b361-4292-a3f1-bd7dbf753344", "comment": "Malware payload (Stealc)", "value": "b799ca16095120e724f6b33ccc63390c01ce7db5ac841598ad13919ddc738471ccd7955ba106c41ad055e15c10b2d639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122030, "uuid": "ef425ad9-6388-41ab-8d9f-ec45c5890237", "value": "T12514BE212AFCD072F1AF89354936DA941A7BB863A370854F3314276E5F307D29A7A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122030, "uuid": "a2ae5aab-de1c-4714-aab5-2e45ead616e5", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122030, "uuid": "5b0e7bd5-0c90-417e-afd8-a2d9e1f0dace", "value": "3072:6vcRkKJ5yRr2hsLy7Nzz9WQO2fsGckO7xgwl+S5/fb3:9JcRAgyRsV2DckOO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696122030, "uuid": "a75e43c7-34a9-443f-9768-c2db7f3a04d3", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696122030, "uuid": "d9eedcc4-e454-48ac-9c2f-25cce2e8e866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122030, "uuid": "36d79ea5-17ed-4b32-b993-3ace19a54122", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467f7c83-602f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696146665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146665, "uuid": "56a9523d-34ff-4305-82cb-87c4402fa24b", "comment": "Malware payload (Formbook)", "value": "6a79e63153f793a8713a591c80167cb3", "object_relation": "md5", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146665, "uuid": "210ab870-83f1-4585-8866-8052155bbddf", "comment": "Malware payload (Formbook)", "value": "b77e4af833185c72590d344fd8f555b95de97ae7ca5c6ff5109a2d204a0d2b8e", "object_relation": "sha256", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146665, "uuid": "e44f6692-7d91-429e-bea7-cc8232ca8aea", "comment": "Malware payload (Formbook)", "value": "89f104911e2a54d612a791940501f74687b39046", "object_relation": "sha1", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146665, "uuid": "9dca8edd-647b-4646-b2a6-9e2150ddaf19", "comment": "Malware payload (Formbook)", "value": "e079397aeffeffb8c9e931cd7791972dec452ed7db99813962718d7290c767eb84f71706d0be2c47b1fbea0026dc6cb6", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146665, "uuid": "5332a17f-f101-46c3-bfa9-5f22a0737e55", "value": "T1FB735B013BE8CD2AE2AD47B9ACF255074EF4D1576512CE5E3CC440CD5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146665, "uuid": "b6eddcef-7d72-4029-ad5a-6fd3ab95515d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146665, "uuid": "21694f65-2e23-404b-9a3e-4f304f3d4fcb", "value": "1536:1ULkcxVKpC6yPMVKe9VdQuDI6H1bf/cLoBQzcGLVclN:1UocxVENyPMVKe9VdQsH1bfDQfBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146665, "uuid": "1a02e07a-d6d0-437b-aaa0-33b063f714b5", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146665, "uuid": "1951ea79-60c1-4a50-a72e-cb8c346a646d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146665, "uuid": "1044dee5-37c1-4daf-8ca2-df12da3bfcec", "value": "ClientAny.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6751c2-6039-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696151163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151163, "uuid": "b0e2abe7-531e-48b2-93ce-dc7fadd77ff0", "comment": "Malware payload (Stealc)", "value": "eeb4c3546d9849092f2ad2ebea443889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151163, "uuid": "d44b1858-b949-4601-a78f-df498bb81b7f", "comment": "Malware payload (Stealc)", "value": "b84dca43f767fdbd21c84088690a3027be608c56ae00568e79ce12225a96d28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151163, "uuid": "453ec400-14af-43dd-ae72-7dc1c337df9a", "comment": "Malware payload (Stealc)", "value": "cef5da441dce2044bd6298c201b7cc8033ec96fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151163, "uuid": "6bee3758-464a-4b22-89ba-b11b0fc978f3", "comment": "Malware payload (Stealc)", "value": "29b8a29bab0d621db82de3f520dcf298f40a7272bd473ae000b6002b8472e245237080e86cc15d1a92428a10192ec52a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151163, "uuid": "86dcab1b-f157-41c9-871e-12339151e89d", "value": "T17D14BF6139F0C032E6BF46348871EAA46E7BB862A770854F3704276F1F717D1966A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151163, "uuid": "ddaf9483-1bcb-4040-9bf7-1d40d47f7fb9", "value": "976fbfc3365265809568e7f20eed3693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151163, "uuid": "ef754dff-8e4f-419c-8ce3-0acb82bb2bc7", "value": "3072:XN+qRKPTjM7e6ocW4vZuXfxnCvx9vnypQfl5/FRg3Y:SP7cW4Ru9CnIQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696151163, "uuid": "bd86f1c3-4c3a-4c1b-bc94-9dc13e14b8f6", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696151163, "uuid": "120bf30e-ca44-4a61-a875-13fde8e6615c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151163, "uuid": "20017d9a-c17e-40b0-ad54-7e38eb37cd44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e83430-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177647, "uuid": "6b8116b2-60c4-46f9-917f-c91bb346c818", "comment": "Malware payload (Mirai)", "value": "e2c1036e2ab6a2f84045171d6292bf59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177647, "uuid": "c1b48f75-2099-41e1-95d8-20612fec4f6c", "comment": "Malware payload (Mirai)", "value": "b968ae662aa5511633c72215be76f6b8b663523ee16a710172f46c8062448a7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177647, "uuid": "9d361765-50d1-4d08-b7e1-a788fd596dd3", "comment": "Malware payload (Mirai)", "value": "e6c412264fdb078fee75c879349801cf38cc269a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177647, "uuid": "ab12e929-21a2-4dfb-8bb0-a94b8b322068", "comment": "Malware payload (Mirai)", "value": "8339a945f77ce11968090ec45dcb464e53cb1aea43c0b6a84a770bfcbbaf6488d3970faf450553cbf4389d6931a9fe28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177647, "uuid": "0dfdac6f-d573-40e2-9bf9-97e02d81c437", "value": "T14183D60A5E12CFFCFB99823447B78E21779C73D626A1D642E15CDA012E6034E641FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177647, "uuid": "416a0467-6c99-43c1-85fa-36819e7984d7", "value": "768:3Xjh+lo/XfmC44zJpmJnbf96FWoHzbkX3b4QCDPaRrW90ffyQyQepy/QwOIEvvC8:3z0G/vX44EpyubpecW6fVeY/ROo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177647, "uuid": "16e0000e-dfa8-4e07-871b-39b07c78d1b6", "value": 85364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177647, "uuid": "1c2e994b-5fea-437f-905a-6d87b38ef4cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177647, "uuid": "54decb81-f0cb-4933-a926-fe2ae026e28d", "value": "e2c1036e2ab6a2f84045171d6292bf59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703e19bb-6032-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696148024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148024, "uuid": "c12dc051-363e-422e-ac55-276db8feb391", "comment": "Malware payload", "value": "eee7d756afe07e006776791a350dbbf5", "object_relation": "md5", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148024, "uuid": "f7265f3b-79bd-47f6-ad74-6b77ed22d227", "comment": "Malware payload", "value": "b99161d933f023795afd287915c50a92df244e5041715c3381733e30b666fd3b", "object_relation": "sha256", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148024, "uuid": "1823b05b-41d4-4a5b-a65b-f55ca9865edb", "comment": "Malware payload", "value": "b9f9a2c9ab2bab3bb3c6ff6ca3d5be5736ef1f72", "object_relation": "sha1", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148024, "uuid": "fa0b24a6-de3e-4c4e-8b16-3f21e1a9bad9", "comment": "Malware payload", "value": "32fcd014557f0ce1dea1bcfeb4f8339f85fa10ed9c9e14865f45f489ebc05565882e9bcea636e7e64c8a03324769f1e1", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148024, "uuid": "5634f355-be02-4448-a9df-fb73910479c2", "value": "T1C2415454996D3AE2C271CE66CDDBA3194A3FA307A11E010072ED4214FA6B7AD85A80C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148024, "uuid": "f3b5cf09-5d00-411c-80b2-0e0bf4f5fcc8", "value": "48:iiSmPROTvfA1BnNgPXhUjAgi95dsF50czRY8gEf5g:WmPETvxPXhUL/zYr+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696148024, "uuid": "80143e56-937f-4ddf-ab0a-334a6550c6d2", "value": 1931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696148024, "uuid": "7b738f64-c00c-4e34-bfdf-d1ae78502afc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148024, "uuid": "4b559df0-2e4c-4e2a-a22b-62039af388c6", "value": "c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5524a4e-6075-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1696176916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696176916, "uuid": "812e8547-1947-4c9a-9988-c978552033a8", "comment": "Malware payload (LummaStealer)", "value": "b0a66b502b535d708bdf43710cee6c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696176916, "uuid": "4710f3ea-ebb4-40e8-acbd-18e2370b37a0", "comment": "Malware payload (LummaStealer)", "value": "badf899c904d4b2a13073166995737f54175325efffda48638a1d27837e0c8ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696176916, "uuid": "393fd77b-0ae7-41d0-888a-80a352f951f5", "comment": "Malware payload (LummaStealer)", "value": "bf4c7b801ab54a749647b1963c7b9e10415cbb22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696176916, "uuid": "53231d51-69f3-4c50-be4e-2764488d4530", "comment": "Malware payload (LummaStealer)", "value": "264f70b991b0408500f454098422cb61d3ff20ee0dd0f4b6a9a495ddcf61db6861fefc5f41294a58a4ee85403746047d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696176916, "uuid": "b3ed2f6a-1c86-4e98-98bf-5aa7d8279de4", "value": "T175A4BF11B9D2C0F2D823253101E5E7769E3DB931C9718DCBFBD41D78AA3A390A75A24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696176916, "uuid": "8b4605ab-71e2-4f77-8a14-3cefbd446853", "value": "f6f05543bfd8242a24ed7d1738a5cdb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696176916, "uuid": "71710db0-ace0-48b2-8db1-e8c34dcf7695", "value": "12288:nsAA+RVy+MBlSPyJVuoBa8YyANOV5qp1n0+:n7Auy/Bl6gVJa8fJV5M1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696176916, "uuid": "9a5f5596-cf22-4c73-a816-04dd6b6a783f", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696176916, "uuid": "54b7af65-799a-46cb-861b-f08dee07b07d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696176916, "uuid": "9969066b-1d60-4fcf-bc53-9630137c9d92", "value": "b0a66b502b535d708bdf43710cee6c24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6471fec4-602a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696144568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696144568, "uuid": "dd88bdd4-516a-4fe6-a530-49270f43bbcb", "comment": "Malware payload (Smoke Loader)", "value": "4cf5792c9acfba1859d70a1e7b3f2174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696144568, "uuid": "40e2cccc-7fe8-4c32-af21-8e2caf8520b9", "comment": "Malware payload (Smoke Loader)", "value": "bcea32218a0f36cb4f573d0b139db62cc1c8987e698556d48bdaaefa63b691c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696144568, "uuid": "81003663-82d3-4a66-a854-a5e6895bb9b2", "comment": "Malware payload (Smoke Loader)", "value": "cb73ce1025a4130ff12820b0d8bfaccade212ec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696144568, "uuid": "8c386e5b-40e5-4cf0-b276-0ac34ebf3332", "comment": "Malware payload (Smoke Loader)", "value": "3408ba81e292d10b640107e25ed0afecb31da4e5764ffb4d7f16290a3fc4bcff0834dec66170a58e5dbb2726543b70d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696144568, "uuid": "3386364d-1ed0-4240-b1bb-fa045d2135a1", "value": "T1C5940102ABD84433DCB51BB019FB03871A36BCA59D7483663755AC6E1CB3AD5A53133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696144568, "uuid": "6b540ce5-7dd6-4f55-a48c-e82931b8aa12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696144568, "uuid": "78a0ed4b-486b-4308-a6c2-f8339d70fa0c", "value": "6144:K1y+bnr+xp0yN90QEZQJ/iVjr+vQkoRcVhGWeKmKzTJmfuC37AAUNimgQ3adfJ:jMrxy90Mli1SLFG3EdkmgTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696144568, "uuid": "1ee63f04-65e7-44ea-94cb-61957f38a035", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696144568, "uuid": "9dcb41bb-4def-4644-9363-9ecb053e373a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696144568, "uuid": "7355d32c-75a6-40d0-8ccb-f0bf4c5dc5ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba65f2c0-609e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696194534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194534, "uuid": "831dcb12-21c8-4289-b3bc-7c4424963a08", "comment": "Malware payload (RedLineStealer)", "value": "d93bd06f08cb5c81929306d5212bd233", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194534, "uuid": "6dc965ac-6bd5-4ee5-8980-d4394a5a9c0a", "comment": "Malware payload (RedLineStealer)", "value": "bd0964b7e5e42fd4444353996e67917d54a08f17e4488d73610e28e14ceab70e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194534, "uuid": "f05e5b4d-af94-4260-829d-5a11c2b24daf", "comment": "Malware payload (RedLineStealer)", "value": "a4e4f77ea01f2ea41dc64922e51f8b3938794736", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194534, "uuid": "41d8d7c7-3436-4448-8e38-5f24f702f5f4", "comment": "Malware payload (RedLineStealer)", "value": "2ad1bf4b4b78f88f677e50ad407c3636ec2f37d20bbbbe2c77f09718c54f486bc58e52679113c18c90c67ed2fe2e8d26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194534, "uuid": "a501385d-e96e-4609-b72c-49d9c286c8ff", "value": "T11F052262A7D48463D8B21BB414B612C30A767C26A83593AB37C5DC4F1DB36C4FA72736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194534, "uuid": "9ebc43e1-cfd0-457d-a5ae-ffd20aa0858a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194534, "uuid": "008cddac-19a0-45f1-af87-4da2615d62fc", "value": "24576:zyc3FDUMM2HZkiIYHaw45PbGK13VP+gB:Gc1HNZ6jH1FWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194534, "uuid": "9a08e650-64b4-4ca7-8d02-0f64e0ea2392", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194534, "uuid": "6698b9a4-c613-4b56-b307-88deaf5eec7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194534, "uuid": "faf60177-8507-45d2-a149-d6ba582b1a48", "value": "d93bd06f08cb5c81929306d5212bd233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74f3f34-60ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696200193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200193, "uuid": "24f28525-2ac5-4e38-88f1-da4c35c66aff", "comment": "Malware payload", "value": "9fa8d9b539d59d95f8aa3767a7420bf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200193, "uuid": "bf57d054-312d-4cd7-879c-fed260345dce", "comment": "Malware payload", "value": "be6d19ff8623b327cc11dea258bef676ba63a355cd3a1c2ba1fa3169325bc60d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200193, "uuid": "d502d398-2b84-407c-a01f-0f7535e9cbc5", "comment": "Malware payload", "value": "205a67fb0cb95d32c7686729cf5f03d6a4799300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200193, "uuid": "c7b8810b-1927-460e-b335-4fd7c8b00cd1", "comment": "Malware payload", "value": "4c074eb88f4e5c56e8dc6f0facc402f17ae1bbe4d0e68f5d26559fec23cdd8f01ac3ea1009aa7c74d3a2de9efdbf72d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200193, "uuid": "c58122fa-d638-478f-b040-bc8a81ba6db8", "value": "T1A5D49E12FAE640F5D635A432057B2735FA76EA060F228FE39364DE292C326615E37137", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200193, "uuid": "cda7e36e-70fa-4056-bd25-56949c854499", "value": "386af1bae362dfbd5a54321c9b661f39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200193, "uuid": "c32717e8-1f60-4122-b901-e92ce2fade5d", "value": "6144:6aCabwy4VPKRBx5gMgc3c8wYTR3s25YkKcNI9gkVinz5mhgzANg++I:6Ib9JXFgc3c9DKcxVinTzAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696200193, "uuid": "3d048da2-9e80-411e-8ec2-7c06dc05b30b", "value": 650540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696200193, "uuid": "dccb64f8-bcf5-49ca-9999-bcdd16a545c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200193, "uuid": "dd4100bc-b4cd-4c5b-ba13-2d7ed34eca38", "value": "SecuriteInfo.com.Win32.Trojan.PSE.10S0A6W.11947.1381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77608679-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177671, "uuid": "b9b53171-56de-4e12-ab39-f1c82c720baa", "comment": "Malware payload (Mirai)", "value": "c8f2c2b55ee01ce8bc50c4f6b15053c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177671, "uuid": "1453d261-d7ea-42d9-8a27-0993b76b2c90", "comment": "Malware payload (Mirai)", "value": "beff94cb8215eb035ca81447f733c8c4b72eb146af1a1f14a7d2d6107e2d639c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177671, "uuid": "716f899b-81d7-49dd-84dd-de65b49742c8", "comment": "Malware payload (Mirai)", "value": "969b96e070b5555e67bfde293b71aecdff68dfe8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177671, "uuid": "79449ded-32ab-4b52-9de3-75056729f6ea", "comment": "Malware payload (Mirai)", "value": "027f549dfe24bc979aa80a290b66b36025c3b05d6d9239e6cdf97b87be3605a4d528483c19decc8731248457534ef20b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177671, "uuid": "3fb7c296-49d5-4b01-9559-2377df3c0356", "value": "T143C2D0E0B726FA31C520AC3DE52B4D8A3A51067C91FF383664259D35CFC1A5B63E48A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177671, "uuid": "6a75ee25-2d2b-4c53-b6d7-a04c2d0ceaa4", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrn9q3UELuh:NKy4qfqoeJdXWg2L0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177671, "uuid": "73309327-5dd6-48d3-ba62-88fb567d45c2", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177671, "uuid": "2de9d62e-a9d0-4069-a324-b380a444833e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177671, "uuid": "09a3e387-dfe9-402f-87f8-de166168ef7d", "value": "c8f2c2b55ee01ce8bc50c4f6b15053c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0df24a7-6070-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696174868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174868, "uuid": "711f2e11-5ca8-432c-9ae7-edb064d31e88", "comment": "Malware payload (Smoke Loader)", "value": "3b96fade4fbee8a7618548ed9f4252bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174868, "uuid": "515bb0cc-62b1-4a88-a25c-90b56834107e", "comment": "Malware payload (Smoke Loader)", "value": "bf28fb1523bed45e463f46de607a11362039635d38a09419483275c8b4c31ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174868, "uuid": "d7c21d93-9052-48bd-b613-3024e1a85139", "comment": "Malware payload (Smoke Loader)", "value": "c9ffa78ff0c93b33292f04ce386e9a238c504909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174868, "uuid": "853a2c59-e30e-4e3f-9a84-9831183b0a1a", "comment": "Malware payload (Smoke Loader)", "value": "385ee9c34416f4ae2cccf7df5d52071056c5b4b1693e0658f3708ca116512d87fbc3d67fee7e097e50dec24290b6d64a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174868, "uuid": "cf2a0daf-618b-447d-9015-7a6a7e1df4c5", "value": "T153B40256ABEE8137E9B2137068FB02D30B377CA24DB4935B6785485E1DB3184A93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174868, "uuid": "6d16ce3a-a074-4041-96a2-391a44961cb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174868, "uuid": "82b40be8-2360-4924-8a58-ddb078beb54e", "value": "12288:/Mr3y90L2XLqEiytrLUxK0+jpvZsGONH:sydmetyK0+4Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696174868, "uuid": "1b409077-afba-465c-9a75-31fc18adee6d", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696174868, "uuid": "e5e6ab3f-4016-436e-b7d9-d898c88f1f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174868, "uuid": "3bb6c3b4-82d3-40dc-a804-9aed3ce51f0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52335937-6069-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696171596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171596, "uuid": "eaeba632-fc37-40c7-b241-052b9101b1e3", "comment": "Malware payload", "value": "9c74b2aafd2d43d5ce2108211f8517c4", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171596, "uuid": "a98962f0-5d77-463b-9e0f-a0e70df17e44", "comment": "Malware payload", "value": "bfc1dddf70c9459c2363b5d7977c8da3617dcf5a8b2817b1513731bcb6882417", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171596, "uuid": "001297b5-9ddc-47cd-bf25-8d5f87ae6a2f", "comment": "Malware payload", "value": "700cfafe6993423856e7dc4081b023c9b894da3b", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171596, "uuid": "1af9cad7-9a38-4b75-b8df-1b5f84cf87ad", "comment": "Malware payload", "value": "7cb556197f7ee42e5fcce2b578d4fb27e7bd8fffe6bdf8257d445f9aae1f6a9c4baa355de0ba1ae1ce3050fd7c9bede1", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171596, "uuid": "dbeca03f-4304-4c38-a547-8f5da194fd8a", "value": "T14BB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171596, "uuid": "6ed79bca-4381-4293-88b9-7e976fcac9fb", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171596, "uuid": "f69b074d-bfe7-449f-a37a-69e790447166", "value": 512659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171596, "uuid": "f716426a-90cb-47b7-9ed0-8d4b8bde029d", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171596, "uuid": "e7debb1c-bbe9-4ac9-b56e-8b98e957986d", "value": "AppleApp.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68a8126-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163604, "uuid": "2a1596c4-a7ae-414e-afa2-913febff5b85", "comment": "Malware payload", "value": "17fedc21f556c82a0cd4cb96d2df0307", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163604, "uuid": "cd0bb2fb-a9f6-4fd1-8ae8-b88f230ae731", "comment": "Malware payload", "value": "c00c1aa87be17451ba2b006504b628e1d9ec0d0395c20647cb24f9e8af89e549", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163604, "uuid": "23e0d166-c85b-4853-af68-2df08228b90e", "comment": "Malware payload", "value": "33e9d8d6977b8c6ac365c3d7b0e86c10e2e43209", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163604, "uuid": "8ee7c7e9-76c2-42f7-a99d-6dc617b60789", "comment": "Malware payload", "value": "5c351edd6a3247291587d0d725b144b30d2d8f0890b4b2dccca5bcfa31f52467ab52294edfb473fa978f141603222a87", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163604, "uuid": "9552049e-e78d-4840-beda-3892f1e1184f", "value": "T1A2E45D2371E38937D2361A385C5797A86C67BD102E2B9A476BEC694C5F352803D372B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163604, "uuid": "d1e044f7-2f35-44cb-a259-aac24159eb95", "value": "e76a31e47b260839eb52c868b8befffb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163604, "uuid": "d1c298c2-2527-4b77-b828-1ecf6f137840", "value": "12288:AkT0gpkg8QtVXeGGQtEIVbl5WmAJ3//pbBc:AkTqEJWmAJ3p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163604, "uuid": "af124ba7-2f79-4480-89dd-1691c30b349e", "value": 662236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163604, "uuid": "1b3ff8b4-8f7f-40eb-86ad-0ad82188f9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163604, "uuid": "740c784c-4bca-4da4-aff1-16724bcf457b", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.18058.11158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ed5ae5-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177612, "uuid": "ef6bd819-a827-4cee-be02-13a08a53dd80", "comment": "Malware payload (Mirai)", "value": "7717b2ec74a75d80b9e21f09109d94fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177612, "uuid": "cfd33c53-9ceb-4d55-8030-589693b2613f", "comment": "Malware payload (Mirai)", "value": "c0538916175d561e699f33c1d0e69c77b87a7a9b3de7e2146c7bb4453f5532e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177612, "uuid": "1b926bfb-bc72-46b1-a599-8a83f887ed05", "comment": "Malware payload (Mirai)", "value": "66423faacdbb7eadc7d731606656ece16d35e491", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177612, "uuid": "ac63b81a-7740-46f9-98ba-bdfb84376c9b", "comment": "Malware payload (Mirai)", "value": "5ad9366ea32c118136e50b2eab209b9800754a1a342e3a4123923f05c911ae8c4a61e4f58681643822685dcfa4bf982c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177612, "uuid": "a87703e7-916f-41fb-990b-d6a16e96d9fc", "value": "T1F182CF3061AB75F5CBF10431EAADCEC6971A0BF8D1FC32A316596B78C94210651F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177612, "uuid": "a1138c71-5a72-4d3e-b369-203ae9567883", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaohymdGUop5h5lb:2dV0P6+kom0tVAoNvm+to1os3Uoznlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177612, "uuid": "31c3525a-dfa2-42d1-a98b-7e960a59afe6", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177612, "uuid": "5332a4be-dc1d-4468-a74a-b77baa31a16c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177612, "uuid": "1a1e0ed4-daf3-44ec-8aa5-b1e621ab20a1", "value": "7717b2ec74a75d80b9e21f09109d94fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3666bbbf-6035-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696149215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149215, "uuid": "ebbb403d-2f99-448a-98de-79b2d8500696", "comment": "Malware payload (Mirai)", "value": "ec7950f19f5368af9ddd3cba391b8ec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149215, "uuid": "b80e5228-57e8-4c3b-beea-b88aabc84459", "comment": "Malware payload (Mirai)", "value": "c075fdb90006ff2bd83afa612dc06c95abc3ce29df1337b00c7826702a21a390", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149215, "uuid": "bdd0bea8-d802-4591-995a-ae0293451f6a", "comment": "Malware payload (Mirai)", "value": "9ab947436a923e076792a84bfbd54a58d2bdbfe8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696149215, "uuid": "c2136bd5-a6b4-4890-bc89-795746885b00", "comment": "Malware payload (Mirai)", "value": "d886393a43a22d05b3e94b96d9c81accad7f312cf2f2663dacec4c77426e2c431bf78d53cbaf54ce48b5c1b068f09c3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149215, "uuid": "6f516cd0-5f41-4681-8829-87d099f51b7d", "value": "T1A4B2C0CC61543084C98D7C7C278D4AA75F6CA190BAED9B25E350CD94B3BEA8B349D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149215, "uuid": "ae32f475-0c6d-447e-87d8-f20d38d4ac30", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpvZqSWvz:4QlS07FUXqIYSXQKquRqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696149215, "uuid": "7dcfe32f-ec38-455b-8184-0ffbaba796e3", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696149215, "uuid": "51d4ab71-60e8-479a-ac99-47a2930f1ea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696149215, "uuid": "dbf43171-0907-4500-84a8-930610f00365", "value": "ec7950f19f5368af9ddd3cba391b8ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6d571f-60a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696197596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197596, "uuid": "b380ff02-a78a-492c-b4b0-fe604f680086", "comment": "Malware payload", "value": "742d7c155459cef4ea61551ecf9f3444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197596, "uuid": "0509cc12-f7a6-4c1a-af7a-cdfdfea6ed21", "comment": "Malware payload", "value": "c0a53497fc09f48e55acb6098dd067462bc1cfa79da69c3cf240337c81441cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197596, "uuid": "40efe7c7-2b24-4ac1-8a2d-38e4b08f61b2", "comment": "Malware payload", "value": "d506e4c7d5cc02af9f851ee89cd70fe77bb583a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197596, "uuid": "1d02f76c-7123-49f6-add1-48fbe16d9b33", "comment": "Malware payload", "value": "ba7958218e65c3b8808a457b29d32cec230ac0a16e79414e1ce67b2611bff16754c765ec85ae7f8473294438c37104f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197596, "uuid": "42b99772-af46-48ec-acc1-05fd950ec43d", "value": "T166746CF7FEC1817ACFC3783104A05E74967AF658A7D20E9B322A064E1A2CD7C5398975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197596, "uuid": "ea5f4e7a-31a9-48fb-a685-fda3f638dc92", "value": "99b61dfa9e1cf5ee0cff9560ceb6d5d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197596, "uuid": "57de545a-2349-46e2-8a09-cb712c94bfe8", "value": "6144:SB8kVY4JWa/YcPgOdVMot8ID7QW8zI3CyIJG42k7sCJTRXK:S3XJWa/YcMothhBAG42k71TRXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696197596, "uuid": "f42f4601-27b3-4835-87ca-44ef49e0bee6", "value": 345544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696197596, "uuid": "bd5b9a1b-24e9-49db-b2b8-ffd151e397ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197596, "uuid": "db716ac7-cc6c-4353-81ad-24065b240891", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cde9562-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696194833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194833, "uuid": "65694475-0c30-4df4-870e-4196b54cc262", "comment": "Malware payload (Mirai)", "value": "21e69bc58af0524156d9f8810c40bd21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194833, "uuid": "b0a9d7bb-6188-422f-96bc-a4cf8d5eafb9", "comment": "Malware payload (Mirai)", "value": "c17dfbc6bc1e35640970d8e7d8b650a73d28fe5cd7a96932e893eeb8c14f0446", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194833, "uuid": "e3e7ab37-d77e-4dad-9988-f20800b1d3b1", "comment": "Malware payload (Mirai)", "value": "d9a86ef8720c4c1dbdf45b02a7c7de7efab58580", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194833, "uuid": "b12c97ad-08fa-4749-a8ec-82c2388eed96", "comment": "Malware payload (Mirai)", "value": "fc488e73167736ae07c79f54868447a9be4dedb9a591c7892c380dfcc7a750d04e08e466ad345b4527067210fd45934a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194833, "uuid": "dd87a984-fd79-4e26-83ce-cbd21e6d5137", "value": "T13583981A3E22DFAFF65D823047F38A30569977E62AA18584F15CDA481F7038E641F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194833, "uuid": "8fa2777e-153b-4e61-9b7e-3b754ab38399", "value": "1536:MJg3YA5fJjNJIU8qRK0AAHON3fOneX8BLP8NTSubd:mU8Q7HOJfOLR8NTSubd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194833, "uuid": "419c480d-48e9-498e-bb30-6fb0978a3d3b", "value": 86456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194833, "uuid": "8582ee5d-6cfa-4325-a2c2-62aba491f1b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194833, "uuid": "f4389233-1a03-4741-b6d2-1fb841960947", "value": "21e69bc58af0524156d9f8810c40bd21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efcf8cf-6032-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696148022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148022, "uuid": "516f520e-4570-45c3-966e-689c1a432e91", "comment": "Malware payload (AsyncRAT)", "value": "22e9c2bffa98abb000cc511869f85144", "object_relation": "md5", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148022, "uuid": "cb02e82d-c415-439c-a033-d3901592ea1c", "comment": "Malware payload (AsyncRAT)", "value": "c2a2678f6bb0ff5805f0c3d95514ac6eeaeacd8a4b62bcc32a716639f7e62cc4", "object_relation": "sha256", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148022, "uuid": "801f476c-307b-49c2-ba74-a98a93a590d6", "comment": "Malware payload (AsyncRAT)", "value": "5988f4cb692e118a3dc5c85f5e6fc9448f07c3cd", "object_relation": "sha1", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696148022, "uuid": "d1a2ee04-c9eb-4cc5-93c6-b788998ec7bc", "comment": "Malware payload (AsyncRAT)", "value": "330bdb4a2de271c5fe1b7ac201655b0ce23819900bb72cea1e0f189f9265bc4aad538cbb5035b090840f7ce8855053e5", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148022, "uuid": "1c04b3e0-48c4-4dd2-bb2d-6209ef0a53f7", "value": "T135B1A57A7B6162508E33305032385B9AE34391ADE739F56C7C3C236427EC3C9B6296D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148022, "uuid": "9c35d025-787f-44ff-816c-272c304da5bc", "value": "96:Ci112LaqOkewluwHcR7runHZ5qxJbBqXrZlQFdJRMuuia5NIa:tE8R7wq+HQcDimIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696148022, "uuid": "d85d57c9-5256-4d67-881d-7efdb016f915", "value": 5452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696148022, "uuid": "e1476baa-b88d-4344-9136-2891b50a8272", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696148022, "uuid": "bf673d2b-5450-4995-a64b-e387aa4f87fe", "value": "code.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91427c2e-60a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696197901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197901, "uuid": "c61d5c31-91a5-43ac-b7f7-0e9c31b82388", "comment": "Malware payload", "value": "26c6aa098f77ddcd1c66bde67d7245f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197901, "uuid": "c3cbb1c3-4c2d-4df3-9c95-6aac4b8e3d77", "comment": "Malware payload", "value": "c2a2f75ab5d4428383b81e804bca961557ba3429dbd3f58b198f559e77befbee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197901, "uuid": "a8adc483-ec6b-4f7b-9c6e-564c523d65a3", "comment": "Malware payload", "value": "44d0a87cc1e5aea57cd3de3cdf3d41b55269c2fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197901, "uuid": "59bf129f-fa71-46c5-afb8-d54dbe747182", "comment": "Malware payload", "value": "bf75545eb9f6dd83b11b596473f4b61263e0a652ad92529b10d305514529f87b5cd68d1e5eed5325fe99358763fbc290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197901, "uuid": "4b6f692a-4740-4263-98f7-affc335d5ce5", "value": "T1EB74F15178B0C070E1BB64311575EEE8AF7FB872A954C69F332062AF4D30391DB66B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197901, "uuid": "a4fead88-07f7-4b3b-b60d-596abc43f5ce", "value": "6f3146e776f6cd21d6a089c9d9e8d181", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197901, "uuid": "a05edfa5-cc4b-49f0-ba6d-2b4bbfe376fb", "value": "6144:60G+OMCeqLWSCfb95vzk9lfZv//UIT+WK/Nlig5ELpzumCdapZV:vG+OpSjvzk9lfhUIiW6dgpaZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696197901, "uuid": "d07a1cf5-c1ea-4f51-b6f4-120462fef347", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696197901, "uuid": "7a56eae4-2b00-42ae-a942-6e3830fd742b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197901, "uuid": "11bb2618-4714-4b58-abe3-add3ccf7ebae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2f1488-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696163618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163618, "uuid": "65d629cf-acc1-43ef-9afa-e891c9a91538", "comment": "Malware payload (Stealc)", "value": "bbbb80e3c52e4b00a32698095221cb26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163618, "uuid": "384114fe-5ba7-4313-b6d9-b912c65e16e6", "comment": "Malware payload (Stealc)", "value": "c3daecc6cd3ad22110bd6c4126f78b893c1588324530f539877bd5547e102fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163618, "uuid": "2288ae4a-cf44-4941-b328-b2e6c07e8809", "comment": "Malware payload (Stealc)", "value": "34f9550e934af78510901c08a669943f601ba0dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163618, "uuid": "218d7fe8-4c88-46e0-b915-7e8dcbed9708", "comment": "Malware payload (Stealc)", "value": "900fa440f3a55fb825d0eefd82b1928f42e1faa1869b1b92deb7587c36937f11320b54eb9cd46214cd5764b4310b577e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163618, "uuid": "587d165e-2249-44bd-a68b-bdd07557e834", "value": "T16D14CF3175F1D032E6F786398571DAA4697BF8F3AAB0814F2354226F1E307C29A66317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163618, "uuid": "3c4dfa08-14c2-4298-a948-c3a4d6775d48", "value": "93d103d7b72d447eca6f713c27a7a3a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163618, "uuid": "c56291c5-8883-412b-b7fb-244ce6360433", "value": "3072:z+nSRd0kseCkF2ZslMHUeuNp29+dxm2y7ytzeQI+5v0h847:dDGkPrNw+dY17yT0hN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163618, "uuid": "71f53e56-83af-4078-9c9a-6c44628054fa", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163618, "uuid": "1da3a6a4-ab7b-4b78-b485-18d35311c344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163618, "uuid": "e6b4015c-5e03-454e-a6cb-f8115842926e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cae9077-6059-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696164607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164607, "uuid": "0a2b3678-ddd6-4495-ab17-ac2dbb799ed7", "comment": "Malware payload (Mirai)", "value": "156084292a48f8260acabfb715b522dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164607, "uuid": "ed45d184-045c-4f83-afed-cf341a6aadaa", "comment": "Malware payload (Mirai)", "value": "c6329db058ffa575eaf0433d247a352ce854619fc1d7e69677800e9e4f49469c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164607, "uuid": "0473d4bb-10ee-44d9-88ba-1d11fe9ac2b4", "comment": "Malware payload (Mirai)", "value": "f0908c38c4124e60163f042fb45f27781696a800", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696164607, "uuid": "87432f0d-faa7-4811-97aa-02808d3e1967", "comment": "Malware payload (Mirai)", "value": "aea817b8176320d33c1200c1e47d3ad016732bf8ecc643ac829749a4a16fbcfe0909cd8d244e964ff735200159028235", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164607, "uuid": "9acb741a-9227-4a0b-8d61-ac143b07bd8c", "value": "T141235CC1A953D9F8DC1109F52173EB369B76F07A2029EEC7D394A533AC82A02D2472DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164607, "uuid": "0482631e-ac44-4e70-92e6-db46cf6064ac", "value": "768:l8DRBUaGoT5fsz3ClcTTPyPuenlQ+ueSDWDdfUI8YHbJRihO+Yff4a:SD7UaGoT5fCylcTTEK8jSdY7JRihO+wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696164607, "uuid": "c1a1aedf-5fd5-4792-abc1-42808a488fbe", "value": 45660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696164607, "uuid": "9b871385-8cc9-4b4b-864d-aafa0c60bd6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696164607, "uuid": "26da5ecd-f882-4df4-8cf1-ecb8f1ea01c5", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425a9a64-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146229, "uuid": "3417a2b4-0214-4dd2-8898-f955ac6f206c", "comment": "Malware payload (Mirai)", "value": "3a76583f474b91f9ec7f5da4ab1899c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146229, "uuid": "84147ecd-26ab-4a7c-bca5-5c1febb64603", "comment": "Malware payload (Mirai)", "value": "c648600c5de89a0373ae69c2b41bc2b551f5504a453dd05f3aef78e4ae3d812a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146229, "uuid": "9c951053-2230-46cc-9da2-5ace83332b27", "comment": "Malware payload (Mirai)", "value": "819c44d5c6c110775be9571a22f037fcc1093db8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146229, "uuid": "788547d5-7263-4b4b-82d7-6ade4170f3a7", "comment": "Malware payload (Mirai)", "value": "892402b311f5d2e129f864c65733f734bb82844637a14ef8d5ac13e67da708e0895716dd213f0f3e451e017a4ae40464", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146229, "uuid": "0f9f241c-7460-4195-84ca-ec8367b31cdf", "value": "T131D2E01CCD2EB985C65D3EBD91DE65B6358C74C0A35DEA8E0626C418E613F4BBC470A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146229, "uuid": "5efddc58-4fe9-415c-a498-0fa77b1fed76", "value": "768:K1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNiJbpWGPOH:KbDs06t4BEub4sU/MbUizPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146229, "uuid": "d50cace5-3cb8-46ff-854b-4ba29ab053b9", "value": 30548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146229, "uuid": "2250b2b6-acdb-4735-b2e4-a013e3d3e378", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146229, "uuid": "d1629f56-aeb9-4d85-8102-a3c6565313b8", "value": "3a76583f474b91f9ec7f5da4ab1899c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08fde7f-6050-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696161017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696161017, "uuid": "f55e0eee-4f76-44ae-9d2f-a0a978602e0f", "comment": "Malware payload (RedLineStealer)", "value": "a2ceac5a8509a11f58b58a09cf9302f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696161017, "uuid": "d6cca603-c669-4494-b3aa-bcbeff1055d5", "comment": "Malware payload (RedLineStealer)", "value": "c6845e9f37437ffd4ee1bb170b696fcdc80f5c9c1fb1be3b75d0c48b87423b82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696161017, "uuid": "60870a44-db8a-44f4-b55a-777e1b2993c7", "comment": "Malware payload (RedLineStealer)", "value": "8d22ab1318281f5d39ad895013009f3cf06b18cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696161017, "uuid": "c1c2f0e8-a3a9-4f70-82e7-1b60db0280de", "comment": "Malware payload (RedLineStealer)", "value": "bd5ffe6c78dcecebf44ebd3ae3b6087dd6eac269ea9fd36ceb39263c7b7294525d13ea818cb319a59d69f4acbaefa121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696161017, "uuid": "f2d993fd-e857-4659-a2a7-f0f654529f12", "value": "T1B6763385B67009E5C8678378C482CC54F6767877FB78E28742B861AE1E73492A87FF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696161017, "uuid": "ea096f60-0ac9-4a8c-81d1-461f82487dfa", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696161017, "uuid": "1e34e76e-57ab-45cd-a107-b1170876f750", "value": "98304:AhzTBA4Pf1N2zIh3ET9Y9MxVMOPUh3PdWPEUrJY6AOxbHPS2zh/hQqF7CvSopJJW:AdC4FMIZETKwjPePdrQJ/BNOqpAYPv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696161017, "uuid": "66df4150-ca4f-4ce8-a665-e96dcf218092", "value": 7697557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696161017, "uuid": "5ca61e9e-1b9f-490b-8fa4-848efa64ee0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696161017, "uuid": "a9d574d0-d8c2-45dc-a92d-d48dcd990bab", "value": "a2ceac5a8509a11f58b58a09cf9302f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0e759b-6070-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696174516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174516, "uuid": "f8ed56db-e505-43aa-b5b8-5b17af358336", "comment": "Malware payload (Smoke Loader)", "value": "5332d90a1803f6fd30e1be1b248eb51e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174516, "uuid": "d68637ec-3f84-463b-8e01-2732e6444339", "comment": "Malware payload (Smoke Loader)", "value": "c7f5e229a1af111c5a0d98b6de96e0f4bf3900587b978c0659ec78c6a2a339b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174516, "uuid": "b508c181-aea0-467b-bf9e-ec064821aecb", "comment": "Malware payload (Smoke Loader)", "value": "fc06124a79843f1e1f8510e3ff82b37799c1437f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174516, "uuid": "a7a25a45-6765-42b4-bc39-99f6330ffed7", "comment": "Malware payload (Smoke Loader)", "value": "a20bee2c1c61de62209c9727584eb8ac2e5a910903d3037ebc204623e5c85a2e9e6a1e7241da065935fcefef48fa4865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174516, "uuid": "b114543c-2edd-4404-9958-94b13cd647ed", "value": "T17314CF2275F1D032E5BB86785931DAE06AFFB8739760816F335022AF5E306D29B61353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174516, "uuid": "a7783689-b41b-46dd-9226-f148c11abf9d", "value": "3674a15959055454487696cf3e8b751a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174516, "uuid": "a0934229-a43c-4840-82f3-4179378260e3", "value": "3072:R+lyBZzbmNYtZmdUVT+jcYqdqNCBI3Oldzb5/JnNc7th:13qN7diKjzqoNCy3IJnNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696174516, "uuid": "c62da6e7-10e6-474c-98a8-14d48b1e73f4", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696174516, "uuid": "0284d62b-0e58-428f-a0b4-6ac0a984146c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174516, "uuid": "09986ad8-7b02-48ca-becf-bae0a23d1181", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83e8403-60a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696197564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197564, "uuid": "a63d4b00-26cf-4593-839a-f720bc5bcaeb", "comment": "Malware payload", "value": "ffab9ce3896e9143182a7a8de0d8e02a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197564, "uuid": "3efc560c-e8d5-42d2-a5d2-27f6db27757a", "comment": "Malware payload", "value": "c9c1f49d3c0d94bbb1169cd0a8adca99deee21c3e17d7c1236963f4919dfc967", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197564, "uuid": "6420ecf9-4751-4089-a04e-2eda85a8301f", "comment": "Malware payload", "value": "fee06b5d3c1e427cdda449c3e95f4c3697e1fc81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197564, "uuid": "d0aa854c-0254-411a-b027-24f7b9ca9185", "comment": "Malware payload", "value": "56a0ba06847f4174b0037a033860dd7a424f7726a5ee3866d1d88e07c0f5e84060b1d83e51610c84f724c579b7edb841", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197564, "uuid": "68d18443-9b34-44d2-84cd-6e9ea3ca8d45", "value": "T1C563D84A6E228FFEF668823047B34B21A79973D523E1D6C5E2ACD5041F7034D585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197564, "uuid": "7bbde387-9478-491b-9313-4ab002da6067", "value": "768:Q6y+gR9rjCIi0+fZ8JYJ8Uk4JyBXJerR5qVv3rgdhhnumc5I8CTj:E/R9rjeBfWu+terR+ErZuL5nCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696197564, "uuid": "f97048ea-891b-49f3-bdd5-0809456aa7ff", "value": 72408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696197564, "uuid": "5e713dea-db4c-471e-af23-2e26a08c3bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197564, "uuid": "e97f27a6-24a3-48d6-be47-f2cbf2d94c34", "value": "ffab9ce3896e9143182a7a8de0d8e02a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af513de0-6063-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696169175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169175, "uuid": "6a36bd30-c066-4c2b-b727-8d50a593e55e", "comment": "Malware payload (RedLineStealer)", "value": "ff6ab4a9c61bfa4bd33ce0be52758133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169175, "uuid": "2ac4480a-eec3-47f5-993a-d70ed785704a", "comment": "Malware payload (RedLineStealer)", "value": "ca0faf739b92b535bc7d0eb79698d073bcff55a9fe659839f11a1355de21bb7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169175, "uuid": "dc159c21-f731-4d1e-92ef-535092afa7b0", "comment": "Malware payload (RedLineStealer)", "value": "5cf4a178b32032a5185dd4e3767abbc1e924d0cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696169175, "uuid": "5e13694c-fd6a-497d-b478-cfda86c15077", "comment": "Malware payload (RedLineStealer)", "value": "2882625a84d73a21025f11bf45c6ef799591e601dfe99cfcd5066da15b8a75742c5357b6afc6b132f4bf55864fe8d55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169175, "uuid": "44537c4d-0fb1-42bc-9500-047b086a8b9b", "value": "T1BA74F122B9F0FC72F5A70AB40470D7846E7FB86356A8815F3354126E2E307E2BB65316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169175, "uuid": "817d8970-dafe-4180-ac16-928a1f5c2f19", "value": "93d103d7b72d447eca6f713c27a7a3a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169175, "uuid": "a6c256d8-2c90-4aba-8809-ff4f49b1fd88", "value": "6144:Ywx+2+Rh4c6Uz6ezSDwJlhuM8g1AygZae6JaQDN:Ywx7wOaeXDwJEePpHhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696169175, "uuid": "71d96c7c-b2ae-4f4f-be07-b03176409ab1", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696169175, "uuid": "35f7f514-39c8-48d7-a74c-be024f527bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696169175, "uuid": "88a190a9-3d59-48e7-af70-375556d6b15d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15bcc805-6026-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696142718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142718, "uuid": "68cc83b2-1fa5-4c4f-a363-4bd3cdbc44bf", "comment": "Malware payload (RedLineStealer)", "value": "2bcee44e6dc3855e0b56231150d949e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142718, "uuid": "ae06969a-9624-4b70-9bee-d733a5df2a83", "comment": "Malware payload (RedLineStealer)", "value": "ca66a1ab0ee421b1fce0c0bcbbab23edbca6f56404cf31b38fdc6fd8f57fddec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142718, "uuid": "62e84013-e817-40c7-92c2-4965b3599bf9", "comment": "Malware payload (RedLineStealer)", "value": "d95f840001f6f431dafbf3b63342a87e5a7630d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696142718, "uuid": "9262112e-fe91-4f0d-97b5-1e9d0d2dc260", "comment": "Malware payload (RedLineStealer)", "value": "d17ca7591c784fe9ebb4a2f4507f2ba634c6e85d6ec60d2d4029f59c0b8f6982985163a1b069d41db02acfe58a5c407e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142718, "uuid": "c962515e-ab8d-43a8-b356-6c2ec590d22a", "value": "T116A35D3067AC9F19EAFD1B74B4B2012043F1E48A9091FB4B4DC154E61FA7B866917EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142718, "uuid": "e1540200-157e-4921-8ea7-0f24bfff843a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142718, "uuid": "13ce1889-7de9-4567-b17b-51b7108c8ea0", "value": "1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2v3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzd3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696142718, "uuid": "0c86af47-6ccb-4dc5-b727-21e67cbd9132", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696142718, "uuid": "c6512847-ab1b-4a7a-a12c-c742e90edc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696142718, "uuid": "d84a3a18-e833-4277-bca0-157879378023", "value": "2bcee44e6dc3855e0b56231150d949e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4c03a4-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177624, "uuid": "89a53a39-a0df-4afa-a0a5-8546897a81ce", "comment": "Malware payload (Mirai)", "value": "280de5d107e77b57af67f1a441944076", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177624, "uuid": "51f67e27-584e-459a-a16d-ad53111c7192", "comment": "Malware payload (Mirai)", "value": "ca6c6bfe9b6d061bf4ffcab8d9a4053680135658ed4b7f808da1a2f2fd47774c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177624, "uuid": "e186de9a-c448-424a-88d2-cef9a7e7685c", "comment": "Malware payload (Mirai)", "value": "cf31affe9585edeb7a6599ab74529fcbd9b5bfe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177624, "uuid": "a37e5e1f-866f-4be3-87ca-f09a8274086f", "comment": "Malware payload (Mirai)", "value": "0f78a9bef099734a5f7f66b139e07bfb18f99d7a52cd21277f39c10cbd4e97a6869e1f3b37e2351cfaba15edf366bb2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177624, "uuid": "447a6552-30b7-4ac8-a150-c794b087f171", "value": "T1C1B2CFDD61543084CA8D7C7C2B8D4A664F6CA1D0BAED9B19E350CDD8B3BEA4B3459078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177624, "uuid": "73b87029-9334-42d5-908f-e5d3644c2110", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpGSZqSWvT:4QlS07FUXqIYSXQKquG2qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177624, "uuid": "65dad897-201c-4e5f-af77-6998bf4d96ec", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177624, "uuid": "16f4531b-fedc-4c21-a1ad-c7c0ea7a89f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177624, "uuid": "3aec1cb7-eefe-4592-aa2a-bda61cd7a70a", "value": "280de5d107e77b57af67f1a441944076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416ae9ea-6062-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696168561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168561, "uuid": "557bf70d-63cf-4c05-a5ba-595242ba3177", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9282dec0a1e3937774197331a3f68a3d", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168561, "uuid": "4d26bf38-0786-4224-8a63-9a7f7de99d2f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ca85523f663978f574cfda25e010bfe0bf94d750a5e352ae224be3fa32c87822", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168561, "uuid": "da9685d0-f98a-41c7-a4cf-1e4e0ca8dfcc", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c6a4a29bcefbfadb939d9cdbed860e0035c68129", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168561, "uuid": "aac0140f-388b-4ab1-9df0-e21c3aac4172", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f46812c6ed9fe8904bd2ad9abf8373dbeb187e7d27b06b4d3d4e9cf59707b53a168c07e6a994987cbd683d739280fe04", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168561, "uuid": "22fe1f5b-3692-4b44-806f-f80687929d8e", "value": "T1FF14BEA175FDC075E1AB85794931E6906E7BB863A7B0C14F2314236F2E706D18BAD323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168561, "uuid": "e04ea8e5-1e1b-4729-98bb-9bd8d7ad398d", "value": "93d103d7b72d447eca6f713c27a7a3a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168561, "uuid": "ca93cb82-a815-4b26-959b-1863172e43e3", "value": "3072:g+3zRS0NLpWt2uzwnPKlgRGtdZ9h5VEE+U1dXjr7ldHa+5v74yr0x:Iqduzwiztj9h5VNdXLlJV74y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696168561, "uuid": "e82b1a49-ebd5-461e-8b50-2ff6a55940a5", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696168561, "uuid": "fedbea9d-b1e3-444a-9b14-3d1138497846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168561, "uuid": "ae981a94-a709-4896-b9cb-ef070b91a343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a38a7c5-608d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696187098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696187098, "uuid": "eec54fa6-0f4e-4dcd-8eb1-1a5a440d6744", "comment": "Malware payload (RedLineStealer)", "value": "d6c42f6b761f1406559668654915c415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696187098, "uuid": "c5449f07-339d-4822-82ba-cc390845689d", "comment": "Malware payload (RedLineStealer)", "value": "cdd48f5fe986eb1322c2b27dd95afe0afe919d04bc84fe77c782203a00a5cb3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696187098, "uuid": "ee262918-1d6d-4c2b-979a-b2a001989822", "comment": "Malware payload (RedLineStealer)", "value": "34d142a697a1c535db4fa4dbc04e911687286247", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696187098, "uuid": "24a42ae1-be9d-44e4-8e5d-fcfb4843d32a", "comment": "Malware payload (RedLineStealer)", "value": "169694ee6edf7fbebae5c7c18e3d53a5aae419b072c15625618eed35a9f1ed24fa5f37bda7caf4120a56fc79cdcd3a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696187098, "uuid": "95c74970-8bfa-4144-8f13-063583ebf078", "value": "T1A1F41246AAD8A033D8B52BB16CF712C317317DA29978C3AF174A5D0A4CB2585F87137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696187098, "uuid": "5865d996-0cad-4c75-825c-c350d6a4b980", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696187098, "uuid": "15a14009-7219-4be1-90bb-00e74fdc4f3d", "value": "12288:jMrty90iIPNc9sUAo9sU6lfjkKicE1j3J8aeqwYL8p3dA6ajds1lq7:uypAUAq2bkfcE1jZ8aPwYL8p3R+dsT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696187098, "uuid": "133a30a1-3e7c-4eb1-bd31-2a3e917b9ca1", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696187098, "uuid": "9418e7fa-501f-46e2-9325-28bdf6356b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696187098, "uuid": "f15371e7-ec91-4cc3-90b2-28528773274a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc51990-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146221, "uuid": "9ead6ee6-7639-45a1-847f-90c4a8eb1d7e", "comment": "Malware payload (Mirai)", "value": "f490c9b56a0ea433c15a2e01416174c6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146221, "uuid": "63e38968-beb1-420b-b69b-5b07e0e73ad4", "comment": "Malware payload (Mirai)", "value": "ceb2c9e35f5cdb36abd86c6391c3fc69c59a56af0d0e294bc45b0522690b9249", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146221, "uuid": "104a7df5-1fd2-4350-b5e8-06e2e904485c", "comment": "Malware payload (Mirai)", "value": "e4a33eba242d6632e15b146408fed81547e6afe8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146221, "uuid": "da26deee-cd3b-476f-a97a-e726edcb6d1e", "comment": "Malware payload (Mirai)", "value": "20df148b84587c1fb51dacb6cbd942150a5dfb4bef26e213388ac07040630593d9aca89dc44c6d48e24fbee65f55ce70", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146221, "uuid": "e933f4bb-45c9-4aee-bafa-3d303fa4fd1a", "value": "T125D2E0FBF287D4F1D6F688B951AC10C0E43C62568720C6BF088562BE8CA77CA5175F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146221, "uuid": "2b31e1d6-5011-4c4c-8c5e-943c35ab78bb", "value": "768:YYSoXdJZtUjkFfNJlVrQeHvPx2csGHERRHYcShuZV:YYJdJZGjkFV35/McrKR4TuZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146221, "uuid": "bc01957d-3a0d-4c49-9719-c67f73fbe2bd", "value": 30104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146221, "uuid": "c7f08c56-745a-4ff5-b5d5-0c645f23a49d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146221, "uuid": "7dc6a8c7-897a-4baa-91ab-bf7f45ab7d23", "value": "f490c9b56a0ea433c15a2e01416174c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1133f7d-6080-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696181714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696181714, "uuid": "f12f7117-4233-4908-8f4b-60f29678a98a", "comment": "Malware payload (RedLineStealer)", "value": "d1906fd8d9e6b18ee8a134e81982e23a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696181714, "uuid": "396ca65b-1d30-464f-bf45-55c95ad735b4", "comment": "Malware payload (RedLineStealer)", "value": "cef823e614c07e8813c9e32db81d8dc6a20d00a3e55aca97a6a5c340aa6e5d1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696181714, "uuid": "6275afdf-0dcc-4aa8-a219-89c80e3ab66b", "comment": "Malware payload (RedLineStealer)", "value": "3420d976f980b963fec140739f0eaef07c7333e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696181714, "uuid": "30ff4956-40b5-4fcd-bbea-ebf223310452", "comment": "Malware payload (RedLineStealer)", "value": "bcf8e73492323b99756570b1ee246f41930d140ed81262f1112eaced9111954d93f9b4af0fbd9853cbe361c1ff383e6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696181714, "uuid": "b7aa579c-2065-444a-b556-ca147a4099b0", "value": "T1D025EF966218242AD3D51B70C962F6720655BD3CA9E0980FF6FD7E1B7FFE583E011A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696181714, "uuid": "e60fbd0c-2103-4752-84b9-8ad6336fecbc", "value": "c1026f3bc4dbd1c7779566798486c792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696181714, "uuid": "62c18b9b-32fa-4d39-8086-f1fc6824b894", "value": "24576:4s9rN9YwPzIFbDslb50xVwJF5Jq9HnyKLW2U08U/7zgesADyI:t9rNWwbeP9wsnC0Z70esADyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696181714, "uuid": "b422a49c-0ede-469f-a645-872f345fd122", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696181714, "uuid": "94afda54-0fec-4d81-aef7-b26cebd535f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696181714, "uuid": "5ec5982e-723f-46c1-946f-721ff0f6f013", "value": "d1906fd8d9e6b18ee8a134e81982e23a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2804db1-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163597, "uuid": "c184ede3-fae7-4c33-9540-194afc18fa4d", "comment": "Malware payload", "value": "392f66b1fee991a95f46cddf9d7ca1a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163597, "uuid": "ae1cf9a7-ee15-4754-8b20-86edce843169", "comment": "Malware payload", "value": "d1545905cae912f68e9c7cbee610aebee6dbf8e8663c7fa71e95a92040aff424", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163597, "uuid": "62759660-1bc1-4adc-8a31-73d029d2aff1", "comment": "Malware payload", "value": "37a8622c10527434714ebbf9faff11a45f56e55a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163597, "uuid": "93fc5034-030d-47db-9c00-ab937bf87303", "comment": "Malware payload", "value": "992c31a42131df8ac464e22b81d2fd7da29d054e623a4a45886806e1548c1b53eebede6bda6e4bb4b09aa174e5650a50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163597, "uuid": "bad620a1-a88b-4df3-8097-083c8156d484", "value": "T1C6B5F125F7A2CE67F133C7348862AB36CA13FC226B5240577B26778E8C772E059C5256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163597, "uuid": "7e5a08db-009c-49fa-a80d-92a27229df7a", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163597, "uuid": "a2c8eb62-6a79-4780-b1d1-aa148857fbb1", "value": "49152:VrhAyGWv4uA8+s8KuqGaX0ToIBAUZLY0cVofdvM:jG0+JBAUZLyo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163597, "uuid": "1843927b-ddf0-401f-a720-5edba3159b82", "value": 2396144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163597, "uuid": "99431d51-d133-49b5-be60-52c7d1b54dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163597, "uuid": "67c06939-9f4e-4049-950b-ff8f4bb1213a", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.6020.6908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc5dfd3-60ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696200012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200012, "uuid": "421d3b65-098e-4674-b189-a34322b81480", "comment": "Malware payload (Stealc)", "value": "11606d8485942bce6e42919f4462c475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200012, "uuid": "658c1732-cf55-4f48-8af5-ad2020c88a28", "comment": "Malware payload (Stealc)", "value": "d162b43548b240b52475ae67d28b96b4b88ba9cae1a06bd799da89df3372ac48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200012, "uuid": "f95da6d4-65e9-405e-913d-9a5d3d80354b", "comment": "Malware payload (Stealc)", "value": "72e2a149bc1f982cf01650b6b4725015adf4a8c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200012, "uuid": "9d68537a-124e-449f-be2c-db1f2ad9e22d", "comment": "Malware payload (Stealc)", "value": "9d00a0a5a728970aa0be2638ccda8ad3110b8d34268f96ecc494aae5845de621289ff3eabda3ac529e604ec7b43c0d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200012, "uuid": "71194013-0d55-4365-a97e-656eee7aec04", "value": "T1E6A3E600DA40542EE1A504FFA6AE4BEBE81C3DB41340C0C3EBB2ADB925E51F564B597F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200012, "uuid": "b03f757c-b3e2-4a08-a19f-41f66a464133", "value": "372dad7e771f409df9ab1b912548c291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200012, "uuid": "0d151bf8-79eb-480f-b8af-f67d1482f2a1", "value": "3072:dK0ufpwQ5jXl9t6Swu6bCYf5z46CyOVfFe5SIeRgyyq:c0uiQ9jtpf4DHO/e8dRgyyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696200012, "uuid": "ea3b09de-bcc9-4bdb-a547-7292b524b192", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696200012, "uuid": "6e828565-b06e-4d3a-9a88-652df1a86938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200012, "uuid": "4b6a57e9-4743-4196-a639-f12c6a15b05b", "value": "11606d8485942bce6e42919f4462c475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcde486-6097-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696191429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191429, "uuid": "1c1a0664-562e-43cc-bd3a-0879aa4e4ba8", "comment": "Malware payload (RedLineStealer)", "value": "c9276f6556428f807e6abae1cff7d038", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191429, "uuid": "14ba102d-f397-43cb-8671-591ad884555f", "comment": "Malware payload (RedLineStealer)", "value": "d22e05011f74614f059d777133a8f090ba2e1303ffd6b9c42fab8d39d83e0ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191429, "uuid": "11133aee-68e2-4b81-afef-cbd4919b1b62", "comment": "Malware payload (RedLineStealer)", "value": "81171b2582b1378fa831758df0f5af1a5fb49652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696191429, "uuid": "5a2c1480-5e50-47d3-9b8c-e3438574977c", "comment": "Malware payload (RedLineStealer)", "value": "ca63e7da91889e0c3c08cf778cfa04722d8b46b504d9737189f12eb93c918d03e1252b24448790c73ee1d909e9326eb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191429, "uuid": "1cb5a4ee-8a09-41ae-be24-91a47ce1832c", "value": "T10BF41242B6E91476DCB1277018F622C31E33BD66DD78A36B174A694F0CB2AC1A13172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191429, "uuid": "93050dc1-a486-4ef1-8b5a-e10997a96681", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191429, "uuid": "cf2618d8-baa0-4bc4-82ca-e0b8dc3fe8af", "value": "12288:SMr5y90+wqkE7qHpOmk2J+hMy1aELEmG6J65JIPxhXuft3trrBG9nhTt4XqiK:TyXwqxSpCb1aEL3GlHsX6pBstZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696191429, "uuid": "77e32d49-99a0-4fd5-8abf-cf243ae5d502", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696191429, "uuid": "2e7153ac-edfe-443e-be02-7497af713078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696191429, "uuid": "d7e5ae5f-64bb-460b-a096-7b16fdf5903f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ebca93-6062-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696168867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168867, "uuid": "57d6d92f-1794-4734-a5a4-7f0a101b3ff6", "comment": "Malware payload (RedLineStealer)", "value": "dbc5453ae374113b308369384980ccd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168867, "uuid": "83dadc89-d216-47c5-adfd-e9bac3ab58f7", "comment": "Malware payload (RedLineStealer)", "value": "d23faa96b5f4d28db30edb4c9379670dc1d7f5befd8f67b8c06a311b61925ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168867, "uuid": "f627f8cf-3c09-4350-9d11-9cec046bc9be", "comment": "Malware payload (RedLineStealer)", "value": "c60dfd55bef7050eddafa24162d8d3e64fd415e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168867, "uuid": "24616166-41b8-4114-bde9-9c5d0ed874ee", "comment": "Malware payload (RedLineStealer)", "value": "4aa0ac42fae004eeb886069c416427fb4978db3b1ae260a2135d3cd677bdf1e54aa56597d6b1781cf8903e1df92361d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168867, "uuid": "797be505-ebe9-450e-b368-b6a1be1358ea", "value": "T18E745ACEBE80F2E3E72159B809F39B7A57A5F49107507A6FA7F0478534F224011E9E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168867, "uuid": "7b100b1c-9e00-4778-ae02-33580ec2c327", "value": "99b61dfa9e1cf5ee0cff9560ceb6d5d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168867, "uuid": "6310d82f-9a56-481b-8037-a7c6c566a045", "value": "6144:gB82D1AIW0/Ycj5z4Vwat8I7LFva8IXIN/yuNfnajiAs8gWTRX6:g/OIW0/Yctath7L9aR+VNfaIuTRX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696168867, "uuid": "437161d2-1055-44e6-9d43-b189fef155ec", "value": 345544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696168867, "uuid": "9a7cdbcb-7ea2-4304-a660-95e1de3346d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168867, "uuid": "ca0b976a-f239-412a-847c-693240526d46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8baf7da8-6061-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696168256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168256, "uuid": "07ddcba7-603b-4125-9c5b-ea2fca917f9e", "comment": "Malware payload (MarsStealer)", "value": "1f808e080d62acfda4d570fc5bd087e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168256, "uuid": "46ec143d-d260-4f67-a724-1361fca94dd3", "comment": "Malware payload (MarsStealer)", "value": "d383b7317144968474ca5318340e6d0e5c47bb2ed95a0ffeb8228d28b3538ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168256, "uuid": "fe861b77-c432-49af-821b-43429024c40a", "comment": "Malware payload (MarsStealer)", "value": "29c85c2bfadc56c67213f0c88755812479120e97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696168256, "uuid": "dc13cc76-8198-494d-8749-9d32e17468c5", "comment": "Malware payload (MarsStealer)", "value": "55d3006156b12c7eaafa800a2c5ef9a5d28612627a4efe80929eaf8e1ab54a30d97ec88afbedcf6132e4a488972b8b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168256, "uuid": "0afc8cb3-6bf0-4a44-b12b-4558ba68f8c2", "value": "T11A14CF6235E2C432E1A376B45537DB9C1E3BB972D771815F23402AAF5E326C28B29353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168256, "uuid": "8abebfd2-4f8d-4c12-8778-bfc4dda4cd8d", "value": "3674a15959055454487696cf3e8b751a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168256, "uuid": "8db53f4f-b184-4de1-81e7-e382d9258c7a", "value": "3072:M+Y8WZnbgbWtoslfiNGq8WA/cLIOqjQGjJZ7mb5/3Hl:HGEK+slfzqc/TNjVvEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696168256, "uuid": "437061b4-c867-407e-adf7-b04cc15e615c", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696168256, "uuid": "3ba532f0-6f7d-4c0f-8619-dd4f06652201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696168256, "uuid": "4ced2f19-0b31-42df-a06e-ad28a05f05d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efd8fc6-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177630, "uuid": "3eec39bf-a079-4dfd-bd7a-330ff7f185c6", "comment": "Malware payload (Mirai)", "value": "db5f2654f1a17fc7ff607006190ce628", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177630, "uuid": "fa4db381-7b7a-4f8b-a6c4-e0596b574c30", "comment": "Malware payload (Mirai)", "value": "d5c80300cc1fcacc63504bf0e3838383a65cc20c39fea3939272bb4d4d975159", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177630, "uuid": "904f02e4-39c6-4669-a55f-d1667df5768e", "comment": "Malware payload (Mirai)", "value": "3664deaf25bd265deb263757559bcb89f2ebe051", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177630, "uuid": "41936343-9da6-42bb-8e7e-d0653466ac20", "comment": "Malware payload (Mirai)", "value": "62f663785fd32b09ad6ee44b3c54ffd8791048c130e47a88ebd7bdd0495b17e933338960243d79fe089b8af2458d9733", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177630, "uuid": "d26305fe-54ff-49e4-b09a-7023c4d754e0", "value": "T108A2D024D345AEF4DFAF9CA456C2D3C276E542C7268AC8F240EEAF022516042FB89D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177630, "uuid": "feb1f422-d94d-4cc1-bb6a-67e8515ca8bd", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5ZZM4uVcqgw05VxJE:9RxsSVsMD6xiJJE5zRWNC4uVcqgw09W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177630, "uuid": "11688a38-05df-4ab6-a7d8-aed4175cb757", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177630, "uuid": "44fa0a74-eae9-477e-92af-d1e6dd456ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177630, "uuid": "8ac5b8e0-06c7-4fc2-8b7b-c2dda7d665ee", "value": "db5f2654f1a17fc7ff607006190ce628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37244c8-6069-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696171813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171813, "uuid": "5f5f92d5-14b1-4a1e-91ae-fe70d655f631", "comment": "Malware payload (Mirai)", "value": "89235307ae28c7dc019823415837a5bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171813, "uuid": "65d1eca6-6f6c-4420-84af-d9a315df0f35", "comment": "Malware payload (Mirai)", "value": "d6effe57121393c4d493b185154af47bc03132b7e9f62702a6e80484cbeded38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171813, "uuid": "5f0d93f7-5817-4c8d-af47-22e54681ab7c", "comment": "Malware payload (Mirai)", "value": "06d5cbebaa2a4362c9ff4a5e7b2ec74d7c36a6a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171813, "uuid": "58fc5cf0-86e5-4ae2-a2dc-3b242627550f", "comment": "Malware payload (Mirai)", "value": "23decc881eb10d7e8116457760320902b3c01f6b67d0139088e37a28bbb3bebee85617e623aef2ba97bcf8d0e004dc6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171813, "uuid": "9fd0b0d8-1105-47b8-bb7e-aa524a1668e4", "value": "T15ED2D0BD530423B9DA6E90F9176607A43DB98F319093DE6E6181FAC1ED404E479A3AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171813, "uuid": "f8ad8021-abe0-4905-b7c0-e8c5299448c3", "value": "768:myvYLznDEB2iC+sDqC6NtxsfzxPnNsGblXmJgGlzDpbuR1Ju:BYnnDEBI+smATf0VJuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171813, "uuid": "68ef6560-b466-4d20-85a2-90e87f334a4d", "value": 30840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171813, "uuid": "9161baa2-51d1-47fb-92ef-174391616d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171813, "uuid": "bce34e72-80a7-423b-bbb9-dc7891e594a2", "value": "89235307ae28c7dc019823415837a5bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbdf917-6070-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696174786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174786, "uuid": "c614d393-b5b4-43cc-91c4-796494bd71d3", "comment": "Malware payload (Mirai)", "value": "cdf6313a26822f78265201b8fba9043b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174786, "uuid": "62e64c1d-3763-4ab8-81ad-9563857d7c27", "comment": "Malware payload (Mirai)", "value": "dad4a7222068153ebdc396fc2b040611206f13e1bb62776f46e8b6af8e1e89b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174786, "uuid": "22b8d24b-33c5-47ce-b037-6a0706a9334d", "comment": "Malware payload (Mirai)", "value": "ea53cca6e869534e6509695c29ddb6b0cf52d529", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696174786, "uuid": "ebfc4fa7-2660-47ca-ba9a-b5f991557a9c", "comment": "Malware payload (Mirai)", "value": "f175bbacb94b6cd7446043d0e2dcad9b985cb97543d1b3ca51197248be8dc9e88455bc3a6d539918f39f489748214078", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174786, "uuid": "5985923e-8ca5-457c-aec9-b393a7211c35", "value": "T1BB735B24A97A2F26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174786, "uuid": "90082895-b453-4476-a6ab-6c12a2c63224", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzf0Fx8:kmcjaq+Dcc5J+vN4Fzf48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696174786, "uuid": "e1220d6b-bd01-4dc4-bb36-3d37906681c1", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696174786, "uuid": "4d8d47b9-6440-4200-a6c8-6051e2fad716", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696174786, "uuid": "a14cdb4d-e572-4ab8-aa14-d9be3aeab16a", "value": "cdf6313a26822f78265201b8fba9043b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5c22e9-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696194829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194829, "uuid": "e132816d-65da-40f0-9185-0ff404f94365", "comment": "Malware payload (Mirai)", "value": "f8479d15abc114a140aede2887c370a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194829, "uuid": "526138e8-a56e-43e6-809f-f74f325d30db", "comment": "Malware payload (Mirai)", "value": "db4f6b2b61db6f58e73f20a84bfa768c09facd8ddaec33fb25a242d0e8bac473", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194829, "uuid": "756f629d-941d-484b-b524-7d0e23815c94", "comment": "Malware payload (Mirai)", "value": "e7509b5c33266a6d8bbf263f130470cdf03210a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194829, "uuid": "41d10999-6365-4c97-9f58-7c89012c8af0", "comment": "Malware payload (Mirai)", "value": "fca1f5a7679d0540eb84e0a6f96382e6297b05d6a297eecf381389626f137ad63f50826e1a492c2267cb2a4140274d7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194829, "uuid": "6fda9383-3c9f-46a7-95cd-f6cd427b3928", "value": "T17E83B506BF518EB7D85FCD7306F94B0124CDB85726A43B3A3574EA6CB61A18709E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194829, "uuid": "1e8560ab-0f76-4b3e-8f1f-8a778fc342c1", "value": "1536:r07IFnSc/DfWobsO6z63g9JwX51IYaIwVyn6xbBfD1n:HFXV6z6wPY6jhbBfD1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194829, "uuid": "2b5e4215-a6b6-4bf2-84df-c9ece66bffd6", "value": 86456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194829, "uuid": "eb00b64d-fd0d-4541-8fa2-8eecfcf440cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194829, "uuid": "47bbc9ee-b5c0-4571-ae0a-c55944674e89", "value": "f8479d15abc114a140aede2887c370a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f768e9b-609f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696194838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194838, "uuid": "37e2cf3f-e4c4-41b8-b206-625552c5ddce", "comment": "Malware payload (Mirai)", "value": "33e6e216453b86aec0ea69cf526eb973", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194838, "uuid": "33b28e31-7f18-4c3a-97df-87e2b4349f58", "comment": "Malware payload (Mirai)", "value": "db90a24188113250e4c759b851b32b6fb76d75972ca840eca5b8a6d684070ced", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194838, "uuid": "6b4e4918-f190-46cd-848d-9644354d49cd", "comment": "Malware payload (Mirai)", "value": "dff52ed1d1c2967ad20a84cdf4b81e446dc74ce1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696194838, "uuid": "e7b6e380-2f84-42b9-b330-674a3453ddb1", "comment": "Malware payload (Mirai)", "value": "a77e047de2ae3b67eef1404da6b9429b5cbb9efe17cfecdadd3fcafbe994f5d38d71b32506298dae9cc6f4ab5931c7e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194838, "uuid": "532056bb-826f-4578-8197-025213de9861", "value": "T16433F746AB42CFB7E61311F102FB5B728A71FD3A0C26C691D374FCA4AA515D0A6173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194838, "uuid": "daf8cc85-5933-4685-99ea-d1fd5a17528c", "value": "768:MUSCuaHgrls92m84obVFF/KHH45NsLsm3ECPXhFfGXYrX68sJoaERAeq6SsICeyI:5g292m8FVnKHYfw3jhFeIrX+ZPsSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696194838, "uuid": "4a56b020-f158-4ef0-95eb-d219fbfeaf7e", "value": 53252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696194838, "uuid": "2f34dcf9-132a-4aab-a56c-3ec44e4ca187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696194838, "uuid": "34495bb0-169d-40fa-8241-416ce182bdeb", "value": "33e6e216453b86aec0ea69cf526eb973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c606bd1-5ff7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696122677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122677, "uuid": "670521b5-ec1b-4cb0-8ecb-a4fb58b36218", "comment": "Malware payload (RedLineStealer)", "value": "9aaebe9b1e1776c8779e10b52ae520a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122677, "uuid": "ec08c3c6-edd5-4250-be70-667997173b90", "comment": "Malware payload (RedLineStealer)", "value": "e1210ca89973e38e0ede8a3c433bdb780d1267a168d8ca96153e5303193131bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122677, "uuid": "67aee535-69d5-4ab4-8e69-0b509bdc6992", "comment": "Malware payload (RedLineStealer)", "value": "d7751afb473cdfefaf70a0a6e63a971641213a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696122677, "uuid": "52accec5-d346-4722-9d6a-5d66a6ac5514", "comment": "Malware payload (RedLineStealer)", "value": "eb3e138646f439578dab13d64b1c17b918498c4c4aabadaf468085ffc40da21de41894b80a392314585feec579551cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122677, "uuid": "b0ace552-7f7c-4738-830b-136fdf111514", "value": "T12F940212ABE94133C9711FB01DFA17C31A3AFCA19D78834B2B956D5B0C72685A83573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122677, "uuid": "8b9e465e-d7b1-4b4f-b558-143e1aea34b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122677, "uuid": "5e0cb0f6-2589-46b7-91ab-f2c82d865836", "value": "12288:MMrfy90kd24CdC5Re5dHM9g2QbqhSUiBnm:DyuC5MDz2QlxBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696122677, "uuid": "5fe1785e-0363-4d9a-8997-166e94e17c73", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696122677, "uuid": "94a49e72-d462-4d0c-8672-bbb71bb50090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696122677, "uuid": "d39d1d19-23ed-48ea-a768-197adba034c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dfb2d5-602f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146548, "uuid": "aae4dbd2-765c-47b4-858d-765fe48d0c1a", "comment": "Malware payload (Mirai)", "value": "98ccbe7b1589d6b1d3e7e5fe4dd24c27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146548, "uuid": "5e080224-8ba1-4164-b3ec-0590dbffe8c6", "comment": "Malware payload (Mirai)", "value": "e6a3668e8dacab0de8097d2eaacf1de160ce48fa7af05b92cdaeb1e7909461d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146548, "uuid": "c466f780-d952-40d9-bc86-634bd93bf44b", "comment": "Malware payload (Mirai)", "value": "fe079d27ae92bda3d01845c1415b2413052e1419", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146548, "uuid": "8bbfcc9d-e12e-4b51-8268-e4b20fa83dcc", "comment": "Malware payload (Mirai)", "value": "d3158ef5b90dfcc94f516b07c1e52c6bd387333fabd515dcce7ce6fc5df5800df7789500160f67c545578ee5db514fe2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146548, "uuid": "ab3f4bfa-d20b-49cf-a19c-2c602de03b84", "value": "T1BBB2D11AC0AA6EB4FDEB7D795D41E2817BA15BDF3E618DC016C15B010622D2C1F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146548, "uuid": "1d2c0df9-3d2a-4081-af75-625d2288c899", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo0iaDqM4uVcqgw0j:2AApCdvwJr69VJoA8FZtxCo8mix4uVcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146548, "uuid": "28b080f0-69ea-4531-888b-25a40fd1112f", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146548, "uuid": "8114132b-b5c3-4493-bc1c-46cc3d67744c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146548, "uuid": "dc3cb8bd-13c1-4c60-ad3e-701b7a6898b3", "value": "98ccbe7b1589d6b1d3e7e5fe4dd24c27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494a33a1-6077-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696177594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177594, "uuid": "510e76cf-ac71-4f96-9b01-9428179a64b4", "comment": "Malware payload (Mirai)", "value": "3f02dbe8f0834c861c7b62e5ff67a19b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177594, "uuid": "b52b8398-51a4-4b67-8a9f-2aac4ba1533f", "comment": "Malware payload (Mirai)", "value": "e725f7b4d5004a88d075e9630349e746c1aa1c7d592ccde037e5a8208433cc16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177594, "uuid": "47b9a69f-f5d3-4289-befa-9db7c329aec6", "comment": "Malware payload (Mirai)", "value": "1bf88cd9e3c7279d6e44d47b45b6aa1ceeda435f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696177594, "uuid": "f5c01155-01fc-4982-b893-d8f32190b9bc", "comment": "Malware payload (Mirai)", "value": "f8beceb7db91b76040eec73ee4197cd44d4d434d367e927109b26fadac9cb1ca79cff5f6ca38b27a2517ce41f4f0a2a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177594, "uuid": "2e0659d6-d5bd-4d22-86d9-83469634ffa2", "value": "T1C4336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177594, "uuid": "882d3695-dc24-464c-b9fd-a2e532b85f27", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696177594, "uuid": "54b1af69-599e-44f3-a0d7-2688322bb689", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696177594, "uuid": "111d2ce8-17fa-4430-9c68-6abe5ea51842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696177594, "uuid": "aa206399-affd-4c1a-9b18-25e6c4166e64", "value": "3f02dbe8f0834c861c7b62e5ff67a19b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffa973a-6072-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696175404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175404, "uuid": "54c4f2c7-5837-419f-b7ce-c4df1ddea62d", "comment": "Malware payload (Mirai)", "value": "5a1c13f42b141d6421aef13930d0fd14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175404, "uuid": "5d2f55bc-1078-449d-94a2-bd6879c43756", "comment": "Malware payload (Mirai)", "value": "e74d4a70110308d42c79289e5feae132d5f7a5dd8664c90224b851f3a1da0e99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175404, "uuid": "49580991-e37d-4f19-9275-60f621c0e7ad", "comment": "Malware payload (Mirai)", "value": "0023b1b72e1208bc724125ac0d2b0c263de413b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696175404, "uuid": "439cd61b-d158-44e4-b776-832ec579e6eb", "comment": "Malware payload (Mirai)", "value": "1524dcef3424e1e2374612520cfa7287526a623d9190990406536870c2f77274dba8ab517dfc494b663cde9eecd90161", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175404, "uuid": "6641fc8f-7699-4228-bac9-818d99934a4c", "value": "T1E9230271480E9EB115303C76DED5E793B6E129B1C5673013D6180A3C2F69B531E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175404, "uuid": "9096c08b-d30a-4e7d-aede-8b9c7e78f674", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3ZzW9q3UELbUXfi6nVMQHI4vcGpvl:DECFd+A6YHAxJLRQZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696175404, "uuid": "8ae9c2b8-e21c-4867-bf05-67856a42d569", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696175404, "uuid": "18bd6caf-1634-475d-9141-4b64ef30fe06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696175404, "uuid": "4ed984c0-705c-4ce5-b31a-b9f564832d89", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e37541-605e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696166792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166792, "uuid": "aa183726-7d59-4c49-9c7a-b73621801de2", "comment": "Malware payload (RedLineStealer)", "value": "5ceb7ba81b838f6205f48da133ff3483", "object_relation": "md5", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166792, "uuid": "a0392c07-63b0-4299-98de-8eb68300f022", "comment": "Malware payload (RedLineStealer)", "value": "e7aea847c8133a0d6f619c847951d982e97e5f54c91e4c5562a7f15b6202fd07", "object_relation": "sha256", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166792, "uuid": "06394657-e234-40b0-9f56-76bef892d466", "comment": "Malware payload (RedLineStealer)", "value": "cc59ac1a24f18b33e43a973a7325c4bdabfc3abb", "object_relation": "sha1", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696166792, "uuid": "d8953c53-06b4-4789-b860-a68625281519", "comment": "Malware payload (RedLineStealer)", "value": "1027833f926b759cfa6a6c7516f602844f4e0c42471b74a717979caa917fac5f090e470b5fd8c90fd401969cdf57ac15", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-97-131", "colour": "#F54A7F", "exportable": true, "hide_tag": false }, { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166792, "uuid": "e0d9b671-f284-4002-b2c1-89a0a99a82e4", "value": "T167D63338BB598090F909E175B44DC5908FD77D3DA0AC8E67289D379E5F376B0801B2BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166792, "uuid": "66d930a9-7022-4e36-8c76-93c4e73dde97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166792, "uuid": "2d4424a9-be58-4237-9d4e-c859d5a4ffbd", "value": "393216:2EESgzjhhJtwre72mVURTBivGpbKPrF2aNPNgWnv:LESgptw8gTBiv/rF2alNpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696166792, "uuid": "1e7569c7-7593-4fe4-9955-185bf81fa1cb", "value": 13471744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696166792, "uuid": "cdc2369a-a09a-4b53-9f1f-883e7b6e67e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696166792, "uuid": "5797db63-06f1-404f-a84d-f1b69f849fc3", "value": "info.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44383248-5ffe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696125616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696125616, "uuid": "1f16b099-3a59-403e-a3ae-20edb6607719", "comment": "Malware payload (RedLineStealer)", "value": "bf50b39aa7b50c021d5946c85b5564c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696125616, "uuid": "a49e071a-afd5-4bf1-b3df-28cba3c72865", "comment": "Malware payload (RedLineStealer)", "value": "e8ccb590c6750d7fc800c21584e87f615a69682a9ba287ba7d3defc7681fc15b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696125616, "uuid": "5c0267e1-0823-4d18-b256-4a3cd546fe63", "comment": "Malware payload (RedLineStealer)", "value": "6f94fe837b2ed4cd0dd76a8d9da44614e0f1c775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696125616, "uuid": "2e0743be-f0fa-486e-a8f6-4e5998e82947", "comment": "Malware payload (RedLineStealer)", "value": "e30af0de26b79e67e25ae823269b961b8062fc00c42c8838b9c8c12ad613a0476677f29c5b083d6249860e7459a46caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696125616, "uuid": "b2082b7a-aef7-4bb2-bd53-f8be3099458d", "value": "T1B2940203E6E88072E9F52BB058F602D30D37BDA15D7453AB3795AD1A1CB36C5993232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696125616, "uuid": "917a2d42-07b2-492b-be7b-ae0c21feb1c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696125616, "uuid": "ea59bea7-44a0-4779-a425-718eb93cf862", "value": "12288:NMr/y90aOJpIJTdkp9uUKNcG2iVzRODn:iyIqkGVR2cODn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696125616, "uuid": "c5926211-32d9-4f24-94bb-4ab054388049", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696125616, "uuid": "6fcea492-e254-4f84-80bd-aed5643a865e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696125616, "uuid": "9bac5011-bf0c-459a-906d-768dddf71c5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379600a1-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146211, "uuid": "688f9124-9bd2-4a25-a8b2-412decf1c2d3", "comment": "Malware payload (Mirai)", "value": "a977beac4963d8f70dae259101b5b796", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146211, "uuid": "f98dd63b-9d02-44ec-a16a-240e65ee3e2b", "comment": "Malware payload (Mirai)", "value": "eae5bc33a593a19031f67d2d18bf6765a2211d59a8ddc4278707bc511f930ab1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146211, "uuid": "80123a7c-083d-434f-a59d-d840b92dd3ee", "comment": "Malware payload (Mirai)", "value": "1b36a392503a909652d313c89b4e5c3a127fe15f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146211, "uuid": "83b171a7-f9f6-45ad-9800-12c61cd514b7", "comment": "Malware payload (Mirai)", "value": "3150c4f09c8c44c0f163499bb1e610eae268c8eb7c67acce261760accfa4614cb559bebed3fe77c037a7f8c82e2f8e5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146211, "uuid": "3001f96e-22cd-4854-bd46-59830472136a", "value": "T11A338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146211, "uuid": "8f0a3f34-daed-4b5e-82f0-2bfe090a6402", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvx:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146211, "uuid": "ef8cfb12-f433-44c4-9af1-85715c982eca", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146211, "uuid": "82ca492e-b48b-4497-aca9-cf9d99c3657a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146211, "uuid": "6fe29732-de6b-4ceb-9406-59a5c6480120", "value": "a977beac4963d8f70dae259101b5b796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e35cc7-60ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696200187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200187, "uuid": "2cdc0600-ff0f-4e9e-94cd-f6c296246798", "comment": "Malware payload", "value": "2d82bd2390c54d5853ea8348a21d5d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200187, "uuid": "e4d86702-f4c2-4d32-b2ea-6904e2346bfb", "comment": "Malware payload", "value": "ec67ccdd38fc80587a46af103bc9b4553809c7efaf6276cd892fd2b329265953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200187, "uuid": "2afd7c86-cb5e-482c-9285-46106e2a1ddb", "comment": "Malware payload", "value": "be11343f3566de26753ee241e98f136f5c2ff9b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200187, "uuid": "5a326da1-bddb-4fde-b30a-f5c65a06064e", "comment": "Malware payload", "value": "b823e3a8e3507a50db666b79bcf0c698404b5ec9b6b0c1603e21d0cca97e2fc426f5d78e3cc42dbeebd3b1d1c7060e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200187, "uuid": "14d668bf-cd5e-4f9a-ac64-f6de68d2ae91", "value": "T192B31951F28AEA98D79419703224D6BC37A6EE201B3341FA3B851E2EDB3D5E3443572D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200187, "uuid": "c0d74ab4-61e0-46b6-9a89-8788d21ed3d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200187, "uuid": "513f4620-d523-4b70-8d92-7fe9e731851e", "value": "1536:foOM19Qe8k65I6Kl5pe0/N8k65I6Kl5pe0/GEhB8k65I6Kl5pe0/H:foOM19QvkuKz/KkuKz/GEh+kuKz/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696200187, "uuid": "1cd670e2-ba23-419c-80b5-bc041684c8ce", "value": 115483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696200187, "uuid": "db7baa89-d128-4a19-95d1-fee7f086f699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200187, "uuid": "cd75f85b-67c7-4005-88c2-80cd3a40d739", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Generic.23207.15682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b21125-6031-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696147677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147677, "uuid": "e46261e4-c65c-4fad-887a-d9f3d97592e7", "comment": "Malware payload", "value": "76c2325ee34e08a426625af001e79573", "object_relation": "md5", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "poc python", "colour": "#7D262C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147677, "uuid": "df354cc1-859c-48e7-80be-d79cd84b6be1", "comment": "Malware payload", "value": "ecf96e8a52d0b7a9ac33a37ac8b2779f4c52a3d7e0cf8da09d562ba0de6b30ff", "object_relation": "sha256", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "poc python", "colour": "#7D262C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147677, "uuid": "68fc5395-4af4-41ee-a2ef-4104aede7052", "comment": "Malware payload", "value": "34269a04359e5bf4491e5e3bede0dec71bad2ab3", "object_relation": "sha1", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "poc python", "colour": "#7D262C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147677, "uuid": "dc8e0080-e273-48e1-8769-e6c19a308126", "comment": "Malware payload", "value": "bf5d96ee8479b93bf9afd3df35f1fb455d5c4162efe8fee862d8d1f269b78f2962ca9d202ea72ab80c6693221a38a0ee", "object_relation": "sha3-384", "Tag": [ { "name": "94-156-253-109", "colour": "#E62519", "exportable": true, "hide_tag": false }, { "name": "Fake-CVE-2023-40477", "colour": "#882EC8", "exportable": true, "hide_tag": false }, { "name": "poc python", "colour": "#7D262C", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147677, "uuid": "e81486e9-bd16-4b29-9f5e-cc98836addd3", "value": "T15371965A9C026D3581B6A8ECE8463165EB1EE81331717031BBDC03FA9FB40479016EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147677, "uuid": "7a9371b1-aefa-4517-a3db-86e228fc5024", "value": "96:c+ppqaz0RcEMaXlGzOLt0cWq4iqGeHj+9rqGrdCo2zjwawJis:c+ppqawRcMXlGHc/xqGaKqGrl24awUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696147677, "uuid": "2ad2c849-af09-407f-ab49-d0ed53c89316", "value": 3656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696147677, "uuid": "b1fc6342-c9e4-4b10-b8f7-9da7bcaa2208", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147677, "uuid": "846cbedd-234d-44a6-a1e5-e1dadaef6c6e", "value": "poc.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25db3a77-6028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696143604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143604, "uuid": "118f464f-fc9d-4139-96ee-b83997579214", "comment": "Malware payload (Mirai)", "value": "dc5a0277107c582fcaf65e857c2e14ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143604, "uuid": "01ba1b26-eb1c-4540-959d-48ec8e87d8ae", "comment": "Malware payload (Mirai)", "value": "f05f5a0f3ca5a02d68ad95133959b4ad363d2c45bfd783c70718b438134dcbd9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143604, "uuid": "444c855b-bd7f-489b-b0ba-18189f37c986", "comment": "Malware payload (Mirai)", "value": "97b3165736d9eed45141198e296f28f20ba3c48f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143604, "uuid": "77dc21ea-aa16-4b35-aba3-1a6d892cf48b", "comment": "Malware payload (Mirai)", "value": "e01c60f982ed72cd425f930dcbc245b8790bb6ccd73ce41e06952dfa19b723698c23ae6818424f7d665f7153f3fe1dad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143604, "uuid": "5a2787b4-662a-4a7c-9c80-a1b76fe2e374", "value": "T1D9C2E0E67D7B7A5BDB2A103834AA8D379274F162D75F7213D202424C20171B8BB724DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143604, "uuid": "a91e56eb-1697-4a4a-99bd-41257178048d", "value": "768:HMwKDZOFbBy6sSHRYfeAxdd83OVXZE2Znzk9FNR:H2gTYfe6Kexaqzk9Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696143604, "uuid": "fc598554-1aec-4c5c-a776-146d830d8929", "value": 28272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696143604, "uuid": "891487af-773b-435b-a6eb-15482ad31f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143604, "uuid": "ab001d43-6477-431f-8795-7904a0ea6c46", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92df720-6013-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696134805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696134805, "uuid": "72261a2f-0cd3-467e-ab4a-75618dfbc88b", "comment": "Malware payload (RedLineStealer)", "value": "dbcd0bd3d290667882c1ab2dba469f61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696134805, "uuid": "56c8c8f5-a758-42f7-a507-ffbf789fed68", "comment": "Malware payload (RedLineStealer)", "value": "f36b1f58aebb51a74d55b774fb51849fb1668ef7c9915ac6da56d7d43fbf6782", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696134805, "uuid": "0e463d10-a5f0-439d-b475-25101328d876", "comment": "Malware payload (RedLineStealer)", "value": "6a8392b6cc84d5fe11eebe5c7608017aec5fcdfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696134805, "uuid": "a7184992-947a-4e8b-8402-64bec866fcbb", "comment": "Malware payload (RedLineStealer)", "value": "54ec572684e779504773d9723e1a3719019977465bfde39021a61bb4cf06e3ba463d698258bf1a1ba02b6215069d2204", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696134805, "uuid": "23118174-8737-4971-b7f7-c9d6acda8cc2", "value": "T194F5335138C9449ACF14AFF3E35BD57195BAD4B50E9C16C8BC7E1B8BBF440C2AA35282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696134805, "uuid": "18729aad-7f25-4d20-8f42-ae01174716e1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696134805, "uuid": "dcebe66c-7f2e-4ace-82ea-3bd073d7cbd7", "value": "49152:DOpya1VuZQol8eADmnYviG3yqpuhhofJr37Qtcb7KD1licT6HQMb:Cpya1Vw2eADpvbyqpyhofpCcbSnIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696134805, "uuid": "8f01188b-65c9-4280-81ef-dad84e0cacad", "value": 3345920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696134805, "uuid": "0f50f999-60d3-4678-879a-5cd3292de8cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696134805, "uuid": "06974538-5df0-40ea-b730-1ae60da5d264", "value": "dbcd0bd3d290667882c1ab2dba469f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2e104b-603b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696151778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151778, "uuid": "700be446-57d6-4c2e-8956-afc1ba3a9314", "comment": "Malware payload", "value": "1b41e64c60ca9dfadeb063cd822ab089", "object_relation": "md5", "Tag": [ { "name": "balbalz2-com", "colour": "#037D15", "exportable": true, "hide_tag": false }, { "name": "blahadfurtik-com", "colour": "#971F4B", "exportable": true, "hide_tag": false }, { "name": "blahadfurtik2-com", "colour": "#E0E35A", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151778, "uuid": "019fac9d-a708-4d7f-a19b-883adba9900b", "comment": "Malware payload", "value": "f4e2f28169e0c88b2551b6f1d63f8ba513feb15beacc43a82f626b93d673f56d", "object_relation": "sha256", "Tag": [ { "name": "balbalz2-com", "colour": "#037D15", "exportable": true, "hide_tag": false }, { "name": "blahadfurtik-com", "colour": "#971F4B", "exportable": true, "hide_tag": false }, { "name": "blahadfurtik2-com", "colour": "#E0E35A", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151778, "uuid": "6932c0e8-a009-4a4b-8b27-87f926270c99", "comment": "Malware payload", "value": "abfcd51bb120a7eae5bbd9a99624e4abe0c9139d", "object_relation": "sha1", "Tag": [ { "name": "balbalz2-com", "colour": "#037D15", "exportable": true, "hide_tag": false }, { "name": "blahadfurtik-com", "colour": "#971F4B", "exportable": true, "hide_tag": false }, { "name": "blahadfurtik2-com", "colour": "#E0E35A", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696151778, "uuid": "3d729e93-f8a7-41b9-899b-521a3f273580", "comment": "Malware payload", "value": "925ef68a5ad1aa7dde194bd7f6b357d5f5028ccb69e4c8042c272c526ad8dc71a03b12829da90988955aa1488337a176", "object_relation": "sha3-384", "Tag": [ { "name": "balbalz2-com", "colour": "#037D15", "exportable": true, "hide_tag": false }, { "name": "blahadfurtik-com", "colour": "#971F4B", "exportable": true, "hide_tag": false }, { "name": "blahadfurtik2-com", "colour": "#E0E35A", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151778, "uuid": "4ab81014-7182-427d-b2a7-b324a5985087", "value": "T115D095C7D163611B079101F17FB1945F91C48521C22C7C4477E8263D2D919243FEE05C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151778, "uuid": "e062546c-7632-44f7-87f1-0aa2bf5742a0", "value": "6:O/oPDvXk4xRPjwx3LzX81DKHMoEEjLgpW2MorGLUfKdYpPM/ioxTKa8l6i7s:X7XZR7wx3LzXBJjjqW2M23KKPM/iox7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696151778, "uuid": "ee0d7970-031a-45aa-b9a1-70953ae9de13", "value": 258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696151778, "uuid": "12cd0fb1-7361-40ba-8931-044539becddc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696151778, "uuid": "99b3e066-4b0f-48cf-970a-28d0cb0fe605", "value": "NSM.LIC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c0768f-6069-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696171785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171785, "uuid": "09a72bfb-3951-4014-a771-ff1e2ac93777", "comment": "Malware payload (Mirai)", "value": "f98694be56819b989a32acfa8d025a75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171785, "uuid": "e88ad395-a3a8-4ed0-a4dd-6b4843c09873", "comment": "Malware payload (Mirai)", "value": "f50f17e66d11629e3e24201718cc4328cb954e667312d02c1eeda09dee3ec320", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171785, "uuid": "5f1e3409-17a6-40a7-93e7-840d6038753e", "comment": "Malware payload (Mirai)", "value": "48b5510b56a4ecb6315c390fc5516b01d16ed455", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696171785, "uuid": "c4e1e044-f759-4db1-af72-8205ce55b319", "comment": "Malware payload (Mirai)", "value": "d6e7bc85d5e72197f5391784f17cec43418251cd18bacf984dc5d206bf7058801db8f05da7e4cdc8b77990b2ec977b60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171785, "uuid": "d703f5fc-d179-4481-83f2-a9c088ff475b", "value": "T181332A8A64112E6DE9DA5CB981764F0ACE541210B093171FB3BBFDC33933368FE66949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171785, "uuid": "9eb4f4b3-f67c-4a6a-bbf1-5571b3307f05", "value": "768:UaRTre1lS2oueg2me2nPQCHEM/ArPwqLWHG2TqOhRol7gSu9+f1prZadIt0eNia:Ua0zoRg2mew4ChAVLzF7gSyg1pVa6Ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696171785, "uuid": "5ab7bdb5-4180-49c7-a0cb-b516a7abd43d", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696171785, "uuid": "4f7c844b-a508-4930-a1d5-66c9b9069075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696171785, "uuid": "d4ced1aa-cf23-450c-bae6-41eb849818ca", "value": "f98694be56819b989a32acfa8d025a75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4f10c9-6048-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696157496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696157496, "uuid": "5c966447-13f5-4218-a5c5-a2b2c99c5cd8", "comment": "Malware payload (Smoke Loader)", "value": "7c067e12baca57f9c82481be333bed9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696157496, "uuid": "2decd422-18eb-477f-9da6-02f89817fc8f", "comment": "Malware payload (Smoke Loader)", "value": "f58dc661b892876d0b8a560a72b04ca707b28dc516133fea7d91312211fca020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696157496, "uuid": "2a1f5257-afa3-478e-a8eb-f41ef382b159", "comment": "Malware payload (Smoke Loader)", "value": "82ae2de6b219ceadd66ec95c7a18b30d31ac36f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696157496, "uuid": "c602b5be-0ec9-46fc-9a62-710ab16be36b", "comment": "Malware payload (Smoke Loader)", "value": "34f855d09d49c5774b0d04850945d638819c5d2fcc0266c754d7fb716cef96b603a023878605f246965acb22c4cd30d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696157496, "uuid": "2d6283be-cdbd-4b7c-b781-efbeeddb201d", "value": "T17A940112FAEC5132D9B41BB058F703C30A367CB29D7493AB2795A96B1C73684A53137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696157496, "uuid": "c4010ba8-a9f8-4b30-ad0b-08d817738fc2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696157496, "uuid": "24af3973-dcfb-41bd-8e9d-7addc381d0d2", "value": "6144:KDy+bnr+fp0yN90QE4tTvT4ar7peps4Nht8VmteVdSA8QHh5kT+8mD1UC5bHIDA:ZMrry90ytTU0/8eT1H0TE1UC57n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696157496, "uuid": "7438fc81-c2ca-4d6a-8063-69cedefa229c", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696157496, "uuid": "f6bdc8b2-c673-4d97-85b3-c8d847929f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696157496, "uuid": "237587f5-cfb1-4beb-ac7f-97451af70538", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf3324e-6032-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696147909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147909, "uuid": "2255fb0a-3fee-44da-bb4a-289f56b4a7d6", "comment": "Malware payload (Smoke Loader)", "value": "548a5dcb2c4ca9eed47b5ecb95a28360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147909, "uuid": "e16ba555-5e56-46a0-b2cf-b49d6e18ade3", "comment": "Malware payload (Smoke Loader)", "value": "f5b41fe7726594035afa43bd053dedc6ea0463e0bef29214448730ca220c0bb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147909, "uuid": "6e2289d0-bcd5-43cf-8b62-7720e684e5e5", "comment": "Malware payload (Smoke Loader)", "value": "7bbb9fcc67fded152fd18f867ae61cf7514ae804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147909, "uuid": "fd3a68bd-5ff1-422b-89ed-9ff160e778f2", "comment": "Malware payload (Smoke Loader)", "value": "6f61788cd9764951d63b995113f9bad19668bdce6003251dccc10eda63165923b24061f984d8f93f79a5699bc7bd8290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147909, "uuid": "778f1de4-799d-4792-ab1b-ee3c8e4ab4e1", "value": "T1DF940253ABDC9432DCB517B168F603C30F36BCA16939976B3786981E1C72690A432777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147909, "uuid": "09d0dd29-5913-478f-b4c0-8d2fbe2419a4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147909, "uuid": "84c4e679-2d8d-438b-8172-8277baac448f", "value": "12288:6MrHy90KwvYypSOU1/B0ACKzzeHhPaP/U6V4t:Vyev/8OU16WuyP/dV4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696147909, "uuid": "e2450c34-f0bf-476f-ae60-36a6cc9ad9ae", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696147909, "uuid": "9c50eeac-9d80-4dfe-b098-8ae04fa0daef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147909, "uuid": "89a7b309-7b99-4967-a21c-b52d1e508fb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3b67d4-60a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696198053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198053, "uuid": "43579f22-a1a6-466b-9683-74dcefcefa25", "comment": "Malware payload", "value": "c119f9703b856f21019dd41275372413", "object_relation": "md5", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198053, "uuid": "a1a528d9-e793-475a-be16-aa403fd617f0", "comment": "Malware payload", "value": "f65dabdd07a266b0fac6020d2a8f2ab9ab36059d648b82a65e06d58b160db343", "object_relation": "sha256", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198053, "uuid": "86c55ce8-fda4-46c2-8124-ce2b4015d67c", "comment": "Malware payload", "value": "bebdbee12d8b0864e02bb89727b4b3959ff675ec", "object_relation": "sha1", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696198053, "uuid": "c12db808-c99c-4d67-bbd4-433d32dc89d1", "comment": "Malware payload", "value": "466c6dada244c50fd89288c0e88beadfd0c47a5e8aa951e2b2b0aaffc2fb599b1f18405641645e40c0edd77b216e76f2", "object_relation": "sha3-384", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198053, "uuid": "8991c820-c801-4f89-bb66-b1c755ba9e85", "value": "T110B622AC74B4B95AF5D4437BC7853CBACB2CA540D78A3C9B8F2041567D8310F6F6A8A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198053, "uuid": "bb37d5ad-cca2-40db-8cda-f95736c0fd63", "value": "196608:I+yZM4cwKKBiaFxBUAGT0uzkhr/fG2HBJhDh3KdJqJnyIQx3QBuS23Y:I+yZLcwpTFnUjzQK2HxR+8JRQup23Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696198053, "uuid": "52ba1dfa-4542-428f-b77c-61405067986f", "value": 10593335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696198053, "uuid": "2427530d-1134-46aa-a22f-b1ec4fe6af6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696198053, "uuid": "b8644936-ec7a-4f60-85ac-db1aead9be8c", "value": "setup_free.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc472e8-6056-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696163616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163616, "uuid": "1fa47d97-8d14-4b8b-af40-fe6774378006", "comment": "Malware payload", "value": "479a80097e5c951a4914e0a5823fa0b7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163616, "uuid": "9f8e6700-dcd7-4b9b-9a39-a113e7cd9819", "comment": "Malware payload", "value": "f673aea90feabe33597d9ff47da86ae42efd6313540c6564aa0dd9e9c5d357dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163616, "uuid": "e9b8a5a7-eecf-4152-b0be-edf4654894af", "comment": "Malware payload", "value": "7c514084fc9351a922122cff516a0d9beb68f614", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696163616, "uuid": "f2efac36-346b-4412-9fd0-2ab6c4762abd", "comment": "Malware payload", "value": "66479b2f4f2c5f151b319f577b8ee4847b6c3923661758fb8edf11f40f206284c7412a3c6d7440739ba5b9b74694c470", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163616, "uuid": "b9ec79e9-11ba-4e92-96fb-38d44bb3f7b8", "value": "T197A46CE97687F513F22DFEFC0CDA9A784DB2B4002D4641471F9505ED2B29FD46E2A228", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163616, "uuid": "ab855ca8-c1f0-433c-8cbe-2db83d49a8a0", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163616, "uuid": "4372d471-8f97-43c4-a162-28172aea756e", "value": "6144:+RR5rhZFQGrsUwF7vlPoSkDFGpNuXYLqw5a3/57oIQ9543Kt5Quw5O:+R5nWFpPoSZwD15EjG3fut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696163616, "uuid": "4e56facb-f34d-40c7-a5f5-139763838bf7", "value": 463286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696163616, "uuid": "6e565360-facb-44a5-b2c6-39ceab07cd53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696163616, "uuid": "16a2b9e6-a110-4cba-a76c-dea55c3c3226", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.5126.17505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25094163-6024-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696141885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696141885, "uuid": "c1c66378-ffea-4043-b0fa-a5a7fc353f6a", "comment": "Malware payload (RedLineStealer)", "value": "22bf99655e52e02b637162d427e69534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696141885, "uuid": "d4838f6a-1edb-4a98-9f3d-b25872eec67b", "comment": "Malware payload (RedLineStealer)", "value": "f74cc16b740f0d7724a719deb48234a85b371e47cc1d626e04b212758dea4703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696141885, "uuid": "1da3fa9a-ab8b-4187-aa37-7ceda3fb0588", "comment": "Malware payload (RedLineStealer)", "value": "f95c9531dd7e8ec7c51ae8c236b692633136dc49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696141885, "uuid": "d0a64c12-306a-4839-a4c0-8cb0bd76402f", "comment": "Malware payload (RedLineStealer)", "value": "a42044346ceb121dfb44c94de326f91d3d3be1649a066697489d9364ca32d61af7de9ae0862c4f608e70365cb44f60b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696141885, "uuid": "3b4a2a41-28ef-40d6-a646-682c1155b28f", "value": "T1A2940103B7DC8472D4B5377019F706C30F36BCA19CB89B67274AA99A5C72A94E930736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696141885, "uuid": "8b8261cb-949e-4e15-ace4-1b5e80a3ac52", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696141885, "uuid": "a9365a0f-f09a-4ea4-aca3-18b7ba48f6f3", "value": "12288:VMr9y90dM2+Cv34XFdo4TULNumhonB6B4NyuGay3:Iyp2V/4jo4oNuf6BqGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696141885, "uuid": "95bffd5f-380d-4e84-9412-d13fb0eaa721", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696141885, "uuid": "bab8d4e2-fd85-461d-9ebc-88b5d341c2dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696141885, "uuid": "83a0a3d6-b5f5-4fae-9690-7a385d6b7650", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd875ea-6048-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696157714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696157714, "uuid": "73d77a69-eb31-484d-908c-2d3846f479c5", "comment": "Malware payload", "value": "316e3ee9229e0b06a6a7b9bf890bdbda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696157714, "uuid": "fadbd0ab-08b6-4566-9fe1-020fb04ae4f8", "comment": "Malware payload", "value": "fa0388d10c5b777ec6b0107022c6000fb1b70665f89e9d9f96d50eb16c865bb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696157714, "uuid": "5848d1e6-2ba6-41bf-97e1-87d29965e059", "comment": "Malware payload", "value": "cf73077bede3afecdaeb7acbb7c0e93a196ee6e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696157714, "uuid": "86aadc84-6fcf-4411-8e48-8d4c632683cf", "comment": "Malware payload", "value": "b2f8915d7f0108ad49f45c912bfd79366e64ff8c6bf0d8c2636c7a0d242d6d36d97a84e963917c1844d7484e9e6c71b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696157714, "uuid": "02e2c760-c6de-4b53-9ae7-c223d19dc998", "value": "T1C845AE203D9681B5DCE230B685DCB995427DA0B0C72D0DCF15E47AEFF5E46D2AB32682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696157714, "uuid": "dc6b95d1-01a5-473d-ab6d-fba909e7ef75", "value": "a5db911979066385d2f2a2a10d0783e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696157714, "uuid": "bcfb727e-f87e-4da9-bb15-425d540f74a0", "value": "24576:t+7xMpDDU1mPxLfvwV+8csVSu2KxpIy7w02AX:+xj1mPxLtzQQ2Zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696157714, "uuid": "b86d7378-cb8b-4b61-81f1-8475b0097ced", "value": 1269760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696157714, "uuid": "20858e98-edd3-46e4-bc4f-cfb09010b4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696157714, "uuid": "b7e783ed-c4fb-4f8b-9bbf-3abe5e5c5aba", "value": "316e3ee9229e0b06a6a7b9bf890bdbda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283c4b2d-6028-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696143608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143608, "uuid": "42b5fce4-22a0-4857-bca2-66ab21d2dc46", "comment": "Malware payload (Mirai)", "value": "bf857ed4126e1aa567d5e4bb2f773814", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143608, "uuid": "1b2bac9b-7cf2-420d-b78e-a09f08aa81ad", "comment": "Malware payload (Mirai)", "value": "fb9fd955a4f138fbc27c3f8db9e722697013e9aa88b15bec0cc17e670985fd22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143608, "uuid": "1ca1ade2-604a-4b93-a143-8ef610186c32", "comment": "Malware payload (Mirai)", "value": "059c469ee34a7a3ffb2b3bcd9e3f280b7aa04c37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696143608, "uuid": "4bae3d55-d7e5-4007-83fc-9a91d9720955", "comment": "Malware payload (Mirai)", "value": "e3766e253d6d7c73092a636a1cf7e9ffa0b79d2d528aaff8a438e44a39caa3f202df143d1b84c59b2b7bedaac40cce36", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143608, "uuid": "5bf90a31-9e2a-4738-898f-82f6eba40641", "value": "T110D2D07096A918B6C6500A71F1783AC4BE474F7CFAFE2C901100CBBA7981D453AEE987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143608, "uuid": "bf79d911-5e0c-47de-887d-1022270c79d7", "value": "384:gSt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNENzumdGU5eT6Nue:gSsoTAZ3alkXLvFh8nNEI3UQeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696143608, "uuid": "de5258bf-1b01-41b7-bd48-a86b0038ff40", "value": 28312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696143608, "uuid": "ee7a3617-c515-41b6-a98f-5bfae0e9020c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696143608, "uuid": "644e146e-c22c-46d2-a317-0f67c907f04c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834546a9-5ff8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696123145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696123145, "uuid": "11f57f60-2a49-47a2-b922-edc88f3dfb3a", "comment": "Malware payload (Smoke Loader)", "value": "48110caabf965da87055877ffec19a01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696123145, "uuid": "661a15ba-aa37-479b-ba14-681c8c619abd", "comment": "Malware payload (Smoke Loader)", "value": "fbc03c46cf9cc6b4694a5fb659f4d815c19902a4ee8359557744c934a7813e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696123145, "uuid": "22ec7e73-81bc-458d-b968-28229f95b599", "comment": "Malware payload (Smoke Loader)", "value": "ff15a1416acaa3109743c3509204cfa7db905c73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696123145, "uuid": "d100ee02-a246-4e1a-8804-a09ad3f5225f", "comment": "Malware payload (Smoke Loader)", "value": "76a04b079676035cfafa7128e25dc57cbed9f4a019435d883575a78c104fa998f70f1d01221b68d49045d1799c708987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696123145, "uuid": "39b55770-d364-44d3-9e3e-aa1b2c6cf952", "value": "T11514C0617AF0C072E1AB85764571DA90AB7BB863A7B0814F332C176F1F306D19A7A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696123145, "uuid": "c79e40b5-6b95-4dc1-82a3-49a609a38962", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696123145, "uuid": "2543bb7a-0435-4a90-98f2-b8fcf9844e65", "value": "3072:wErRVrg0tb1tMklnKU6R2b/yB1c17Ajla9S5/RRnC63Y:PgOBCklKNR2mBCRAjlDj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696123145, "uuid": "950aefcc-4201-4798-b31f-f9342ae1a5b6", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696123145, "uuid": "7fb6c903-d056-4781-94d3-9804b62031d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696123145, "uuid": "7bcc1da3-1507-41b2-acc2-a877c0b4b7d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5429a72-60a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696197532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197532, "uuid": "c6798d25-2ee3-4549-9db8-22c1f074c81c", "comment": "Malware payload", "value": "30d703e2f7e0848a75be68fb8df3be76", "object_relation": "md5", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "pw-2244", "colour": "#8FD126", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197532, "uuid": "e9dcaf28-9e38-4d3c-996f-8c1f94683b42", "comment": "Malware payload", "value": "fbddbcb0a8a2d870c53f1b7f496ef22a58cb3e65feba319ee491c3d2ca40c576", "object_relation": "sha256", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "pw-2244", "colour": "#8FD126", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197532, "uuid": "d4448a1b-3b8a-4b44-ba0b-255ce29c785b", "comment": "Malware payload", "value": "f95d849964c9e7bec98142083c245e05cb495f08", "object_relation": "sha1", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "pw-2244", "colour": "#8FD126", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696197532, "uuid": "4268741e-b067-442d-b378-d5fc92ce1f30", "comment": "Malware payload", "value": "7a1e9de959a845f89fe82a271fb8df9a15c5cd83bb587c2846be8c92965665af6028c8020c36eb0c53fefa44d59319a8", "object_relation": "sha3-384", "Tag": [ { "name": "Crytbot", "colour": "#10C2DA", "exportable": true, "hide_tag": false }, { "name": "pw-2244", "colour": "#8FD126", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197532, "uuid": "2bbc5605-4c7c-419e-8e32-0bfd9b4ee11f", "value": "T1D86633796FCD4DC443CA8731439C8B65C568AE5A669A481C3A7713EEFCE43B5EB87001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197532, "uuid": "5908b954-ecaa-47d9-aedb-6e694afd764b", "value": "98304:wtuG04nuRydU5/e+ntt+yNGZsZgiO0kWwKpZfi/pRIPrzIqm1dXM/hw+K3VR22E+:mb/+/xtNR/kWrnfuGrE31dmwhFk2tse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696197532, "uuid": "f9019e77-b544-4677-8793-74105574b5d1", "value": 6971678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696197532, "uuid": "82d2d704-bef1-4ba9-a59d-5011755c3967", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696197532, "uuid": "7ad3cf38-6cc5-477a-a094-b70b9ac01f8c", "value": "With_L1cense-key_[pass-2244].rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb326f0-60b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696203612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696203612, "uuid": "2802cfe9-b548-4e08-bd87-938c56ee29f9", "comment": "Malware payload (RedLineStealer)", "value": "d5ab3431bdfe035ed3a3b2b02202db83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696203612, "uuid": "eb1c71d5-6468-456c-8be8-8745594d00a0", "comment": "Malware payload (RedLineStealer)", "value": "fc2d6f9b172f093a4c406a959f95aa9f4f5b7a95eacee221c25b1525bb8384ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696203612, "uuid": "a68275f7-3b20-4464-9cdc-8347c70a4866", "comment": "Malware payload (RedLineStealer)", "value": "5d3af247d34b9a0dc0b22ce7f0d7235afd4ce95e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696203612, "uuid": "fe1abc3b-9649-4ad9-a3a9-f0d6b3365cba", "comment": "Malware payload (RedLineStealer)", "value": "8001b8743e50e7eb432f623a03f82bedf271e51b9e7e9d5af1e2ecf1ca69887008b0363cd2cf7e0f1cd90cbeda9de131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696203612, "uuid": "bcb18220-73ca-42c0-a6d0-e11e3b27f2a8", "value": "T135758D207BC08265DDF3D1B583EC6864866CA0A8871716DB57CC37F6AA141FF2E31E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696203612, "uuid": "ded1722f-cd59-43cb-81ff-f7366c161840", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696203612, "uuid": "e82fa7d2-de59-4c7d-9e04-3f1802aaaa33", "value": "24576:5w3zyiB5pqoZTw8zfptq6PfJbI1rkkb9U:5o5pqoZTwm1PxbI1rkgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696203612, "uuid": "5b2ebe9c-0f87-4dc6-a23b-6e7477f6548a", "value": 1694112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696203612, "uuid": "761bf846-b8d7-4c4f-89f6-c7c4e0db8c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696203612, "uuid": "5958b43f-4567-4840-9255-57a734881f94", "value": "d5ab3431bdfe035ed3a3b2b02202db83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87beac93-6030-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696147204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147204, "uuid": "13613b65-5592-4186-838e-10c236ca7da6", "comment": "Malware payload (Mirai)", "value": "739ace99d0ce28118dea5f6d2c024af0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147204, "uuid": "5e8e537a-aaea-451c-bf24-f178db49e6a4", "comment": "Malware payload (Mirai)", "value": "fd8aa8d8896e8221bab443e8da9209e363bd12480f722775f8578a4ddfaf7415", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147204, "uuid": "6c9a26f9-7aa5-4948-8719-c159c4bda7ed", "comment": "Malware payload (Mirai)", "value": "78254ee61e80fe92a05ee356f84bec282df1784d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696147204, "uuid": "5153219e-5e4f-40d1-8019-2b8aa6ab2e0a", "comment": "Malware payload (Mirai)", "value": "3c9a21b5cfccfc12e0ab18d1330a0529eef6b1dacb7aa6010adad7b79ae1ae83b312d86f7f314d1ecff5905bf1739e3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147204, "uuid": "b409cd66-2bd3-4aec-8593-cdf225fc30d1", "value": "T1AE230231890A9EF124303C76DED9A393A5E12AB1C6673013D6180B3C6F75A631E1BF4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147204, "uuid": "40b31c11-9e19-451d-b749-53fa813a72a4", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3Pg9q3UELbUXfi6nVMQHI4vcGpv/:DECFd+A6YHAxPpLRQZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696147204, "uuid": "bd755207-a832-47fe-b3bc-3dca94217308", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696147204, "uuid": "8e385a12-6739-4661-8128-282602af054c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696147204, "uuid": "f0ae142f-09dd-47b2-a659-542471212571", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a1b2d0-6088-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696185072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696185072, "uuid": "d5a633f2-5a49-4138-8870-ef49a8300788", "comment": "Malware payload (Smoke Loader)", "value": "f5b57101db272b94c6958bd133de55c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696185072, "uuid": "478cf93b-2f74-4398-9728-c8e29a8d2b81", "comment": "Malware payload (Smoke Loader)", "value": "fdb63d84c0d67fe6401263666ddbeb50b717906589b5c9a77078ffe7cec0a31e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696185072, "uuid": "ed74a76f-f2d2-404e-9622-a8ffa713c552", "comment": "Malware payload (Smoke Loader)", "value": "2fe86b35f639d1e177f253a04c44687251ee4fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696185072, "uuid": "c623730c-c91f-4a07-946b-ba96f6827429", "comment": "Malware payload (Smoke Loader)", "value": "72442f0c9d1442207095c77819a0bbac5794005ac2a2b96569ff30ba9fa9a615da9bae7e9788dc16df148568698f352e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696185072, "uuid": "9c41235d-fc01-41a2-b357-755d23b9d4dd", "value": "T14714C0217AF1C0B1F7AB45354471DEAC6EBFB8A2A770854F7740222E1E302F19B5A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696185072, "uuid": "ec1b676a-5c19-4c60-8db8-70570519d695", "value": "6d1ef2766ad947ed03bd197f051e8eed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696185072, "uuid": "398ba0c5-702a-47b2-977a-609265477fa7", "value": "3072:xdN46JZHcLExZSww5l7pZBEryI3cvS08RIf84We50Ik+ovV:TZ8LWSwWfZTI3UuIUkkZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696185072, "uuid": "1973b367-9c28-4019-9e80-a36f8e6ae6aa", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696185072, "uuid": "07561751-b026-4af4-86c5-45b5013ff612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696185072, "uuid": "a1a809fe-c4af-4567-90de-375c87e6e65b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b60ae81-602e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696146244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146244, "uuid": "b0fbf6a4-7e93-473a-88db-bcb8163bc704", "comment": "Malware payload (Mirai)", "value": "870db3c34d350320c62f6c68804cf04c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146244, "uuid": "8796886b-f4a7-4863-baf1-50330de97eb9", "comment": "Malware payload (Mirai)", "value": "fe110a41c2f90fe369a2bb3a3206e6ef03b16eefae1d6a7690b25d3554a98a5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146244, "uuid": "d68ac863-f4d3-4d5e-8885-26f8f2711579", "comment": "Malware payload (Mirai)", "value": "027257a5e3eb04f149e55c0d9984124ac10786b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696146244, "uuid": "3e01b872-0093-4f29-8f8b-c8b4185f06cc", "comment": "Malware payload (Mirai)", "value": "295c7e87971130a5d797a9dcb5496373fd74c0a70f04cff6796ec666291b6e288d7dd08cdab4972c970d00b02c569ca6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146244, "uuid": "8a1e3a5b-c191-4f22-a593-59ff9a98eb81", "value": "T1EA536DC6B4119E7DF5CBE7BE44220D0EB821626150931B27BB6FFC83BD721A48956E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146244, "uuid": "52a349e5-f057-4f0b-ad69-252c8031daae", "value": "1536:kPqRg0FZTbSX5xZLepSGossFpxhOx2X/ZOqc/yA8z:p5ofF8I9cKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696146244, "uuid": "aa270503-681f-4d3c-aae8-cf81b79b5681", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696146244, "uuid": "a4215605-0900-4018-8a5b-6e231431afc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696146244, "uuid": "44b7b762-02b1-45e4-be2e-3aa0031be2c8", "value": "870db3c34d350320c62f6c68804cf04c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f337b88-60ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696200340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200340, "uuid": "9e51cded-d8f7-46e5-97f5-eadf5d2eb649", "comment": "Malware payload", "value": "ec2ee2bba9d24191dc476ebab3084eec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200340, "uuid": "8e805c1c-9a3c-417e-8234-9690788570b7", "comment": "Malware payload", "value": "fe20677e710700aaa7ca96797fd2de8e0c0c7b4c5d1c4f29d072391371bee5a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200340, "uuid": "d70e4797-be13-405a-9607-3993b4b3d8d1", "comment": "Malware payload", "value": "59d9da6861e496bf1ca216f60bed3b4c86da1093", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696200340, "uuid": "d414a829-ab12-4700-9622-8c597aab2554", "comment": "Malware payload", "value": "867d435ef5d67702d2660b50de6848de41cd690fd3c9c13455597bcb9e504a2e52fe374f6bc24258e1573313bc216069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200340, "uuid": "19573b18-e3ec-496a-86ed-e93ab0c54bdd", "value": "T12363D75A6F228FFDF17C823147B74B21A7A963D523E196C4E29CC5041FA034E585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200340, "uuid": "f57aaf78-8bac-419e-8633-b7750218eb31", "value": "768:fx93o9IwbbRG2tHDLqoDV14jjfkCeyNsHdeiY13gjEPkdbQKif5IdFfuf:rqXj5/C6eiY1ahhif5WFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696200340, "uuid": "cd0fbca3-9c2a-4760-8c0b-3a8e176616fa", "value": 69772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696200340, "uuid": "0dc31e03-d0ed-4037-bb64-757045ddc588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696200340, "uuid": "54c958c8-3df8-4be0-bb6f-bcab9ee66925", "value": "ec2ee2bba9d24191dc476ebab3084eec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }