{ "Event": { "published": true, "date": "2023-07-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-07-30", "timestamp": 1690761781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "dbc51e13-cc91-4240-b348-8f666563dc63", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f2ec79-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690709534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709534, "uuid": "569de32c-8ff2-4bab-a7d9-0d23369463bd", "comment": "Malware payload", "value": "936c3e791ba1bb80840c6472332c9f25", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709534, "uuid": "b51769cb-af3e-45f8-90ca-7334752d2303", "comment": "Malware payload", "value": "0073d2f00caee069e79c98fd533607656cacb7cb89983f1c1ea4f9aa572e4a67", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709534, "uuid": "1237a573-f0fb-49a6-a7ea-f6ce87f97d31", "comment": "Malware payload", "value": "29e22c54055a754fa3eb71e601707427887f77cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709534, "uuid": "772202a8-b378-4e77-b467-63d41d917936", "comment": "Malware payload", "value": "5643265887ee8ed5a2a86753436625d553e5a455cb7d5094be084d8a111566d5866c0b20b9eee994e3bd0bdf16ec3115", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709534, "uuid": "8acb25c4-21a1-4458-83f5-21275ed54a75", "value": "T14625126782630906DED8DA7CDAAFBEC03D7AF572786289FC5548CCC21A9177044E6B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709534, "uuid": "f12f54e2-f47e-430c-af37-e6b068b8133a", "value": "94c58018430f3da54976c1470e97bebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709534, "uuid": "2bb91d1a-22f6-4242-9ea8-514197b8e4cc", "value": "24576:eTqzwY2YNDWmkfqtYP/Csj6RJrn6BZhExYp7k7:eTqzwY2Y1W1fqtYHCpJT7xYp7k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709534, "uuid": "d40b74f7-4bdb-411c-ba24-e8510be9bf9b", "value": 968808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709534, "uuid": "657eb8de-da66-4a33-9d4a-22c043f696e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709534, "uuid": "218819d5-c55a-4d78-8ee3-47d713d8db29", "value": "SecuriteInfo.com.BScope.Trojan.Tiggre.10277.12396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52717ab-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686766, "uuid": "ba715c6c-8420-410d-90c3-8908ca4d62c1", "comment": "Malware payload (RedLineStealer)", "value": "7979f4ba6c7a01d26cf87c52329b7b7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686766, "uuid": "5da392a3-d9f3-4044-9120-e14a50a84935", "comment": "Malware payload (RedLineStealer)", "value": "00b12b2d809077adeb73d800cb6ffc967d198b26960fe418871e63541715b67c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686766, "uuid": "b64aff23-28f2-46a6-8c97-df39c08ee3ee", "comment": "Malware payload (RedLineStealer)", "value": "9148fb8cd0d3199734bdac4e8c32ec982ac99f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686766, "uuid": "4158bb95-3cc9-4553-bfbd-38340fbd03ff", "comment": "Malware payload (RedLineStealer)", "value": "3532abcd44791531604f7c92e12b67a1588b257de8746298b2b81775d891461ea24721fea234a2400cfc37ffc200389b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686766, "uuid": "1c32217c-9f61-4d96-b9f1-599d56bbd5a9", "value": "T1F4B41243ABFC4022E97527B05DF502D71F3BBDA29838479B2344995A0CB26D0E5B277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686766, "uuid": "d7a50c07-8e68-486e-8bdd-66d62a4d6c82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686766, "uuid": "a04ee82a-b4d4-4b1c-9d4c-96f555134a73", "value": "12288:tMrPy90a24TvHNMJNmITP4gp/fMgeZmfQPe:2yJNMJZr4u3y4QPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686766, "uuid": "6c84952e-34a9-4d6d-a942-b17839fcf7f8", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686766, "uuid": "68ef5a85-a9ab-42b8-a7f2-30ddacb6f87d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686766, "uuid": "566c67eb-0cfd-477d-8cc9-596303b4da51", "value": "00b12b2d809077adeb73d800cb6ffc967d198b26960fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6c04af-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690701222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701222, "uuid": "dceea2ac-952e-4e23-ba91-6e7856052df9", "comment": "Malware payload", "value": "03ed8344f8a630172330fa69730e3b09", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701222, "uuid": "d72972c6-798f-4c55-baef-7c701b7dc76c", "comment": "Malware payload", "value": "01788f4d85df8041b9e1a6c385b53bc783a201461b6c22d592d12e80d247112d", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701222, "uuid": "2ae05a50-b59a-466c-b175-1e5fea642e0c", "comment": "Malware payload", "value": "1537f23cf019afce2ffd603da89b5a9d2f83852d", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701222, "uuid": "94434491-8854-418e-b5c8-2972c9b47145", "comment": "Malware payload", "value": "00d661abd2eafa0722ab403231148b9694c15a2cf66bcb3a15724704b588261c40d13f572b6b584bc25c857e83559df0", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701222, "uuid": "6bd63073-a633-4a43-a810-f71405029e71", "value": "T1F6D42337CB122CD6CAB16AB5F5535583E83BF22015844BE91433F5E61A5E0CB838B09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701222, "uuid": "c7065a41-3a2c-4d44-8192-c3f303307fc4", "value": "12288:NkwuYJDKcMjT/ITrFI34xEyfHt3tD05WPp2X3KoIIiaPsO/Nq:KHWDhMvb34xEy1i8O3KoIjaPswNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701222, "uuid": "6792e593-017c-426c-8a21-09edd0dcb7de", "value": 598602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701222, "uuid": "5ebb1072-2805-410b-936e-7ea8a7949a4b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701222, "uuid": "38916d62-fde4-4421-a257-e4e8893ff346", "value": "ORDEN DE COMPRA.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2e65a1-2e9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690696413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696413, "uuid": "b3ff67ad-c884-4597-8413-f72486e517f0", "comment": "Malware payload (Amadey)", "value": "6c599662270bb7cb2db2decda333ebf7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696413, "uuid": "ed209e50-9e4f-4d86-beee-96af54e85991", "comment": "Malware payload (Amadey)", "value": "01dadc61954ff36b7fbb7890f4dc0bc35028fd92c7ce2745c2662a94afe66eac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696413, "uuid": "e5acfb75-1f59-4730-9f61-c2df7f8d0f0f", "comment": "Malware payload (Amadey)", "value": "f7a87744e5e39486bb9bc6630e200ce9d69e95e9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696413, "uuid": "88cd6b69-2b9d-494a-865f-05f5be686087", "comment": "Malware payload (Amadey)", "value": "65622357262264cc7185b02889c0dc55aaa4973ac52d7cb917cbbdec6d7bc3d2728fc8d3a84badcdeed8a5ad244bd2ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696413, "uuid": "ff3dc57c-9cc7-4ea8-9a59-9779a8ea2144", "value": "T154B40292A7D88533D8B51FB098F243830A36BE646D74936B3385AD4B0C726C8E176737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696413, "uuid": "42cfea72-df0e-47a1-8f11-cc44ea6defc8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696413, "uuid": "f02d5e01-2a9a-4719-8d2f-b61778c71593", "value": "12288:RMrTy90Zx67DPYZr6RwzO6l443e0SXKSohLaZaP:myuxAPwCwe0IZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690696413, "uuid": "d83adff7-c71b-4dbb-819b-aa559b81affd", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690696413, "uuid": "dab96db9-7b94-43be-b040-424250eaa21c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696413, "uuid": "a9a57d6e-c91c-49ba-9d8e-03145ccc7338", "value": "6c599662270bb7cb2db2decda333ebf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032e8b41-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685501, "uuid": "230c2bbd-825e-405c-a178-a23153408880", "comment": "Malware payload (Amadey)", "value": "010d90c5f223f8fad5b7d8ea7550cb5c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685501, "uuid": "ce4a7811-8b2f-42f7-9374-4aac4ff54bdf", "comment": "Malware payload (Amadey)", "value": "01f8be83dca24e753c5395450f23751dd9ac2dfb2bc32bcf45abd110b4d2b29d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685501, "uuid": "6813a301-63ad-463f-b72f-c1ae7ed9ff98", "comment": "Malware payload (Amadey)", "value": "3d515545549e4ebcb43efcc6795317a1285d2d78", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685501, "uuid": "4aa0c9c7-9aa8-41ee-99cd-0ece45041f5f", "comment": "Malware payload (Amadey)", "value": "17ea096058ce054bec22995ee666b432405e918c196f8617e649bbcc7ddb42a8f69096684e6a949d7ad10ee2f6e85633", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685501, "uuid": "c1011bab-3ae3-463f-801a-d22bba7f89ac", "value": "T14FD41253ABD95536DDB127B018F303831B35BDE2586883673B567C4E0D72AE1A83273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685501, "uuid": "587eedd6-e359-48fd-b1b7-84a20217825f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685501, "uuid": "99d9877f-da8d-479a-b909-d65eec5106a6", "value": "12288:AMrdy905CppUNMr/b2rvK99/kXYw2AmN8yOSBvb9MNLJ7IRA:Nydpd2rv4uIwfmVOeol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685501, "uuid": "e9f0f11d-2bbc-4e44-b8ae-400205e8ee33", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685501, "uuid": "9a9402f9-65c8-4b2d-a6ea-cbaf299463e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685501, "uuid": "3dba9da6-ed05-4f54-aedd-3f57572bf4c4", "value": "010d90c5f223f8fad5b7d8ea7550cb5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eeb9b1c-2e9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695507, "uuid": "3cf4f762-0c03-418b-b579-ab74043aad18", "comment": "Malware payload (Amadey)", "value": "707fb95d5cf4fdb254282ae6c0d7cac6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695507, "uuid": "ab381734-9bbb-476d-9011-2d218ba863c8", "comment": "Malware payload (Amadey)", "value": "0231b1afa2fa7f34821454196cec71ec9ff129f6acf0ba805999b460d3597228", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695507, "uuid": "3d145b99-70f0-4636-874b-9ba8247ae55c", "comment": "Malware payload (Amadey)", "value": "1ec930e3dfcd675cdc43b372f1cacc81a09d1149", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695507, "uuid": "ebaafe2c-b632-4bd5-92f8-3d1524f94db9", "comment": "Malware payload (Amadey)", "value": "7e27eee07676ac31f433396df1f95b17298925851eb130bd848860d5dd9d95b1bccafe66dafa0fcc45784ca84dc36faa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695507, "uuid": "26f8f2ba-75dd-45ec-89d8-0022ac485144", "value": "T1E9B41212FBE88072E5F52B702CF703971E36BC929978C7671384A98A0D73251A53676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695507, "uuid": "04b1344b-e335-4478-99c6-33b913003b5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695507, "uuid": "de190dd1-a55a-449d-b1c3-aa0f4d4e5abe", "value": "12288:pMrvy90Loy0s8YMmMgSHOny+xUsjYMKyB4dQM3I:+y4pQYiv2yIU0KySmM3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695507, "uuid": "20a955f4-59ee-47de-9168-cfdebb288859", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695507, "uuid": "37acc6d4-00ad-4182-beda-d4c444372b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695507, "uuid": "40924ad2-9afc-4428-9e2b-33656b0cd35f", "value": "707fb95d5cf4fdb254282ae6c0d7cac6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86aa4eee-2e9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690697318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697318, "uuid": "5c93bb60-313f-4b7b-bbcf-ca1df68c2350", "comment": "Malware payload (RedLineStealer)", "value": "0dee85ffd8261b6578962d70ac10da90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697318, "uuid": "620e0e75-d3f6-499a-a7b1-eb2a25d8898e", "comment": "Malware payload (RedLineStealer)", "value": "023a02edecb2670eadfefbaf146818e77054f687a8f7d75e0d36af79726c94ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697318, "uuid": "7b5d9fca-fc10-423b-83bc-63c0124e2afc", "comment": "Malware payload (RedLineStealer)", "value": "dd25f6d0d8d7d9a7b675caa7d797c15cc3c3ba28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697318, "uuid": "c3aab039-18ba-40c5-aadd-be3a87504f51", "comment": "Malware payload (RedLineStealer)", "value": "22c4d767882626767650d35f4df0787daaf252b46336d652e9d226ba9bcb9e68bd990eb0680f659e32193090a8197669", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697318, "uuid": "25aa0895-098f-44ae-845f-ece7f0d77c17", "value": "T19DB4120397E58133D9B4277068F712832B327CA54C799B5B2785A89D0D73AE4A4B273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697318, "uuid": "08adf8a7-2adc-48c9-9bea-e33b1167a3d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697318, "uuid": "4cba8fdd-97d6-43de-8922-078ff7b7907c", "value": "12288:LMrvy90CGOLDgh0c8yld1GGTMKI0FVgBYC66aylCqcm:4yhPA6JylrGQpI0wz5BTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690697318, "uuid": "8dc71d62-5df7-4511-8c75-c83cf45cda0b", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690697318, "uuid": "9a392edc-0735-4b3c-8df3-90b9bf5e55b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697318, "uuid": "298a2f7f-3157-403b-9162-9eb2e0031bc8", "value": "023a02edecb2670eadfefbaf146818e77054f687a8f7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f4f3ad-2f20-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690752915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690752915, "uuid": "d80bfa72-3f47-4010-a06c-f511a0a68161", "comment": "Malware payload (njrat)", "value": "085ccf9621bde766df39ff95ee203c56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690752915, "uuid": "90610422-8943-4ee2-8504-19b5c38e8f94", "comment": "Malware payload (njrat)", "value": "0252a2c1d321499ce83b232e636d6df82049bac70697734c1bfc3e8d2eeb4f7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690752915, "uuid": "dc98da52-556c-41ed-a2e4-2035cf9cc67f", "comment": "Malware payload (njrat)", "value": "57ac4046dcd6cfb13aded01e22cabb39ce0d080b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690752915, "uuid": "bbaf839b-09e9-4fb7-8ecd-4a6a0412f59c", "comment": "Malware payload (njrat)", "value": "3f78d11aa2739f0335456a70b74e92c4d7afa777e5d63174448e777e8f7eb655ef842e9e36cc885d3ea46badf9ac625e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690752915, "uuid": "68098427-4595-48ec-b103-7730a64b65d6", "value": "T17906CE35A2424C3BC13D07349C2F6278A6FC7900257E278BB7DC59EA9FE7344A59934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690752915, "uuid": "ac726f8f-a373-43bb-96a5-175c612beb9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690752915, "uuid": "f2d130ad-45ac-4a53-b90b-6708fd6f9f9e", "value": "49152:d8ZofuZRuWrwSi3HTjIK5mKGa4de1oR9tg0GfpAE0DP:6ouZQyY3I/ja/PWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690752915, "uuid": "76ac976e-faba-4596-ad10-4dd6012e785e", "value": 3678208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690752915, "uuid": "a9d6252e-35e7-4679-8145-d0b8af6aeccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690752915, "uuid": "59ac1a96-fc5b-4504-baa0-557606816486", "value": "085ccf9621bde766df39ff95ee203c56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a526d6f1-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695222, "uuid": "b3893771-2b17-4ff4-8472-5587d93a1cc8", "comment": "Malware payload (Amadey)", "value": "95451c978ba10d799748ce8b9a0de26b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695222, "uuid": "d4307d60-6dc9-4c61-a99b-7fc8b9c07db8", "comment": "Malware payload (Amadey)", "value": "02ccc5d8c6c830493db5b01c9f4bbd6d68b0de8b7f4904e178cb3c963a7d9d3e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695222, "uuid": "754f7e13-1955-4b79-94be-9f49c9c07818", "comment": "Malware payload (Amadey)", "value": "d6a1000ef48b4e21cd226c50c34ea9a1efa79955", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695222, "uuid": "e5cbca13-2093-40b4-9288-79c73fefaa78", "comment": "Malware payload (Amadey)", "value": "2d249b1634e2f3820934072bcdde2d8379459cebffc11585f85682b51f6ae4e9c5aa3354460a579d2272ccdd42f01ebc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695222, "uuid": "37e12866-8cd9-43cd-8241-93329d6323d9", "value": "T1CFB41213EAD98032E9B937B05DF612930637BD226D78876A1285A98F1C733C4E971773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695222, "uuid": "3278a0d9-5a23-4f95-8476-560bbc92fd0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695222, "uuid": "6a0cbd6c-4757-4edc-b70a-77764bcb26c9", "value": "12288:JMrpy90YGD57ApCRT6hooprjo6gBYCAL/UHdJCB:Yy47mCRTTI8zu/iqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695222, "uuid": "020e9cee-5e58-4a6d-83dc-15c038201cb3", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695222, "uuid": "953200d2-51ce-42fb-8ed9-7c04f4220741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695222, "uuid": "5e028258-df13-445c-9b42-bad83e747b17", "value": "95451c978ba10d799748ce8b9a0de26b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faec9d53-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686776, "uuid": "0cde7a94-dfd1-49b1-a3bf-ed4ca8d96ca5", "comment": "Malware payload (RedLineStealer)", "value": "ac9932bd8b782d7d3c587a98a37e034a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686776, "uuid": "7d8261bb-5d5b-45a3-b39e-d9295291df56", "comment": "Malware payload (RedLineStealer)", "value": "030c490e0e77f2a27ef6ced74b3000bfb85cc01034056e3046727bb4ada56d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686776, "uuid": "e78c4113-7a2d-4f24-9e63-d8c271de4dac", "comment": "Malware payload (RedLineStealer)", "value": "e202440f89dba87788c7b2884f800c4d338722ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686776, "uuid": "ed3d5859-cfb0-4679-bdff-e4f63e1809c0", "comment": "Malware payload (RedLineStealer)", "value": "8aceb73f381df3b9dace49124468cab7884a57b7e4ced994bde6f74cbf20c44159e07c2515b86ceb34b4cd1c7d8ca0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686776, "uuid": "147a3838-07cc-498c-ae73-d2ab17bc1829", "value": "T1FBB40247B6E98576EAB51B7018F603C30F327DA29C78932B7781994F0D73294A57072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686776, "uuid": "599a1af6-ccf9-4436-83b3-269680feae7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686776, "uuid": "556b35c2-b75b-4fed-814d-dc3de1a58834", "value": "12288:0MrXy90rMAx8wUf1AK/bAEalCITS/ybxg9Pnn0mmzu3np:ryatuwYSIArGMSPn6y3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686776, "uuid": "108ca8aa-353d-4075-a39d-a7bc0d8cbc76", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686776, "uuid": "d0f38b8a-db27-4fa5-91e8-c004234ffae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686776, "uuid": "7dd3a22e-1410-46aa-b406-f193ff8c5c05", "value": "030c490e0e77f2a27ef6ced74b3000bfb85cc01034056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa2b4b5-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686462, "uuid": "81e558c5-e784-4382-885a-3d32b12ee9bc", "comment": "Malware payload (RedLineStealer)", "value": "f365a239f5f850f97450c8cf4627e592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686462, "uuid": "054d49bd-7cd8-40f0-85ff-7b03c63b7df4", "comment": "Malware payload (RedLineStealer)", "value": "04fb541c987d92c3612cf1abf41d238b1ee37fd36e8b247184c78fe92bbb56e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686462, "uuid": "2120c660-2c73-436e-b66a-3a573e86ffc2", "comment": "Malware payload (RedLineStealer)", "value": "b939a612fbad2b7300f9e0c319c4d94c9fb4f6f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686462, "uuid": "f1bed8dd-fc14-457f-91cf-dc0a064a5563", "comment": "Malware payload (RedLineStealer)", "value": "0826b3299c1c4c483f0331a6203280c1281689ddfac1111687163edf88f52d57571a9001ec6f3b3b0d1a74d271d15911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686462, "uuid": "f90987be-43b0-40be-9737-5efeff364844", "value": "T139B41243EAD84176C8F5277058F703C30A717CD19D74D62B2B96A95B48B3AD4A93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686462, "uuid": "c86fe579-a9ae-4888-8c57-18053e72dd6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686462, "uuid": "fa8350f2-94c4-48df-a828-9947c9eb7cde", "value": "6144:Kry+bnr+Lp0yN90QEXT5Dip5QsxL7K2ZSB3H0r/je4BNGBJ5cOVBxTrN1wPn/jq1:JMrXy90ty7FZSB3a4/frKonmpQYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686462, "uuid": "fdbbdb81-fbf8-40b0-a3cf-5c1ea73fd61a", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686462, "uuid": "209eb978-614e-4c43-ac2c-bbeda2a5f718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686462, "uuid": "c1b39c40-36c3-4692-bc93-44c1a2f4d8ae", "value": "f365a239f5f850f97450c8cf4627e592.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47be600c-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686475, "uuid": "704dc681-e5c3-467c-b66c-2dfff20e30a6", "comment": "Malware payload (RedLineStealer)", "value": "ff06b4f2e98c6e10a186d49d9c9bfde7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686475, "uuid": "dbabe275-30ed-412b-a270-823959bd7e9c", "comment": "Malware payload (RedLineStealer)", "value": "055df4701000984cde32fabecbedd687963065ec3159b8356d2686c09a55917b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686475, "uuid": "f2efb28e-a721-42ca-b351-de8696703b4f", "comment": "Malware payload (RedLineStealer)", "value": "4a18658faa781294fa370286acf5d030a7ccf366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686475, "uuid": "3eb90dec-1f28-4e4b-b27c-89e1f8dfc2cd", "comment": "Malware payload (RedLineStealer)", "value": "9e7e819e0acc0b159bbcccf7d3be319d5709393623aaf287d9c51a50844eab6d877b4db76ee98cfee7b60c6ae716794f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686475, "uuid": "1db779bb-3991-4e40-80e3-19ed00f43988", "value": "T1E9D412636AE88032E4F81B705CFA17931B35BDA1AD7C435F27815C8A0C726D19876B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686475, "uuid": "5543e8be-5e7f-48a1-960a-8ae8fd1a07ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686475, "uuid": "c2db2ddf-8e98-4411-a259-57b7b9dd6f47", "value": "12288:6MrSy90MWc0Da2edQZsT5kMD4foXkJnO9lQhi0QkANQdA6LN+af49b:YyNWcaaXqZ8hUfoXkxWehi0QxNQdjN/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686475, "uuid": "37ca985d-6a27-4c3b-98ca-1394471b2ec7", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686475, "uuid": "40991b52-cedd-44ce-9004-93776ec53080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686475, "uuid": "f2bae0b4-8ebb-4d43-9cab-0387b0120c1e", "value": "ff06b4f2e98c6e10a186d49d9c9bfde7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a690d188-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1690701237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701237, "uuid": "4b533e09-b140-4b01-9481-80f8bcff370b", "comment": "Malware payload (WSHRAT)", "value": "a4e4a7b64b91de9bf076b0581e0604b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701237, "uuid": "56fc7a84-2513-4135-8bda-0db582877e84", "comment": "Malware payload (WSHRAT)", "value": "058c764614c8b0b457852a71ab93b559f81abb9e13b7fc2d6c6a4962881bf062", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701237, "uuid": "981bc7f1-f487-4e55-914c-36e0eb109c04", "comment": "Malware payload (WSHRAT)", "value": "550faad818bb76d01333f0469ea6e715feaef2f0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701237, "uuid": "2c91e3c0-43b8-43d0-ae25-f207813eb40e", "comment": "Malware payload (WSHRAT)", "value": "a427d3c7babe695cf72b3219036f9a75017dcb9ac15a9e5d1306a610fa32eb44f9ae7282e9dcf363cbf77ac107a3e37c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701237, "uuid": "76542894-4299-4564-9721-7beaa6b0968c", "value": "T1FB257DC43AD47606D362D66DC325B23BFE71EA22385710C6BDC43F49AE66C441CADAB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701237, "uuid": "08b1eef4-dc7b-439f-8ec1-48c64339b6ac", "value": "6144:QQzyAxQ+JwPaeAa4OqhBIqmfd8NWriWdfRFiUg+KDtnntPhyV2LvoF2krMtks2PK:T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701237, "uuid": "5fad75ec-8bef-4819-884f-23f9db55074b", "value": 972652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701237, "uuid": "d07ecce6-b2e3-498e-98de-5ff49c0d8cac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701237, "uuid": "fa18ff30-c591-463f-a1e6-fcbcfa695ebe", "value": "Proof Of Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d761b75e-2ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690700031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700031, "uuid": "4cc032fd-c163-418e-987d-272569dcae4e", "comment": "Malware payload (Amadey)", "value": "6e47b26778f2dacc790ec5c6cb5d40c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700031, "uuid": "0d6db343-8b15-4aa2-a663-6952fd859f27", "comment": "Malware payload (Amadey)", "value": "05a5c581c651300f726c549c559d253ce4d2a65256b23f4ff475cc613d52fc75", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700031, "uuid": "a8e65e09-0feb-4829-903b-9db0cdd2b62b", "comment": "Malware payload (Amadey)", "value": "0bc68036f85ca1cc53e6ac5fa134e194972e7fbe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700031, "uuid": "a9b8b741-d3ff-4eba-affa-45907d8929d2", "comment": "Malware payload (Amadey)", "value": "031f980aebe2ab269e5f410a9aea8ec8b3b1fd921cbeb947d60c89c2d4f7d0d09d3fb72a2d4733debbf1ea0ff595b8ce", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700031, "uuid": "10b4db8d-d6d1-4fe0-aff3-6de3251d4656", "value": "T1A6B41206E6D89073CDBA277034F603871B3A7CA26E7882AB2795695D0D733C0B53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700031, "uuid": "e3ad6081-7049-4935-b43d-7ddcf3884200", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700031, "uuid": "067913b5-7743-4846-9cd9-d18a8910bbf5", "value": "12288:bMrFy90ndbOQkEe4UiDyp/QYhhcgBYCYJOubT0H:qyuR+gGQkhDzIXb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690700031, "uuid": "ca6b241b-a2c8-4f03-b453-d298c1d58874", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690700031, "uuid": "2c8e1ee0-d321-423a-aa2e-759c193f8858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700031, "uuid": "81152dbb-863a-4e04-9132-57696592ba8f", "value": "05a5c581c651300f726c549c559d253ce4d2a65256b23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663279d5-2e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690693398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693398, "uuid": "35dbdfe9-9590-4040-9e6b-3126689f008f", "comment": "Malware payload (RedLineStealer)", "value": "178e7887cab79e354f78a098e669686d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693398, "uuid": "dfa15356-27d0-4540-a8a9-db1213fd841f", "comment": "Malware payload (RedLineStealer)", "value": "086980d0851eb53223263888bc29d67e26fd9596a2fb92117d9cc9a0c24d7985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693398, "uuid": "bb845b89-2cae-4713-a57f-3538600bbc14", "comment": "Malware payload (RedLineStealer)", "value": "e5aa72feb85461fd0ab23eb9d8dae606f7de9042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693398, "uuid": "7a251b5c-b6b0-4df5-bfe9-3587da0c7c33", "comment": "Malware payload (RedLineStealer)", "value": "08253da6bab7911d30a2eb1fc7ba0be27e02a19d48391ec022a6bc831793f0880f038dd861b18bf1ed06893d15364443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693398, "uuid": "95a0427d-b0b5-4a3f-8201-6773d0e9bc5c", "value": "T1CAB41257A7DC8423E9F11BB056F712A30F36BDA159B9C36A3B66844A1CB36D0A031737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693398, "uuid": "f8212b0b-730e-4bff-8d7d-e84190d5124b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693398, "uuid": "fb3933ad-6dd3-4562-ab27-275c7c0dc2f9", "value": "12288:KMrny90q31h8R2ZAZSyuvqrPv7bXVRHtbjm3P/q4X61jXwfkA:Fyd315JVvqzvVTjavkjXoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690693398, "uuid": "1b2fe508-a1e2-429e-8f82-00df7bc0fec3", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690693398, "uuid": "5ff4b402-7c7e-4c67-a8ef-81be289400ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693398, "uuid": "d96e0848-26dd-4a9b-9a5d-556d6242b21f", "value": "178e7887cab79e354f78a098e669686d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8590c709-2e9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690697317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697317, "uuid": "8e40743c-d07c-4ba5-99ae-2c9f53442508", "comment": "Malware payload (Amadey)", "value": "10241eaac714b5c3f2cdea7b9aa0b717", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697317, "uuid": "910097e6-77db-4b34-8cbc-4dcbf709ca90", "comment": "Malware payload (Amadey)", "value": "087634b3586cf62deeeb905de3ddcc3c0e8ae187afb9dd6ce7ea2f6bdef2fe2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697317, "uuid": "2de4dc36-75a3-46d4-9ddb-4d26a4bd659a", "comment": "Malware payload (Amadey)", "value": "10e8b56a5948cd0a98b020fdff8387d660bb5654", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697317, "uuid": "5c570a85-72cb-45ff-bf7a-c2dae9ef6961", "comment": "Malware payload (Amadey)", "value": "a78202075b7d0255bf37021b33257ea713b2cdec02b08b938beeebee5dc0f4aaf6206ea31fe08e04c7fc5b4cd585a607", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697317, "uuid": "97547da3-b84e-4ce6-8672-a2b57c12c700", "value": "T177B41252E7D88077D8B5137058FB07831E36BDA968B887AA2349661B0DB36D4F871733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697317, "uuid": "5c7e337d-ea42-4083-93fa-18803300933e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697317, "uuid": "a01bb066-e9d4-401b-bed6-59ce4da8951c", "value": "12288:6MrBy90nQ5hNa1b5gtB9Io3kZifwPKjXe:zyuiQb5gtB9/PftDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690697317, "uuid": "68108a93-d9b2-467b-b4a6-babb227ad305", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690697317, "uuid": "035d0105-7e8b-4a84-85b9-08fd0ad57f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697317, "uuid": "d1fe2bb3-7083-4f64-ad76-4b3c470db71d", "value": "087634b3586cf62deeeb905de3ddcc3c0e8ae187afb9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0f4946-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686456, "uuid": "b0cc9473-f911-4af5-bc5e-3df81631d850", "comment": "Malware payload (Amadey)", "value": "f0b03d3290d5088f400c87d7136057c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686456, "uuid": "3067edcd-a3f8-4189-aaa5-ccd8cca09c5b", "comment": "Malware payload (Amadey)", "value": "08ba6bb9ca2423f3adab21b084faff638fc54844798d790fa4e91f44091e9d3a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686456, "uuid": "197d8a8c-7123-4ec4-b78d-25f2ffd01449", "comment": "Malware payload (Amadey)", "value": "d09a24c1535b4d87a33d0106c11087897f4659c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686456, "uuid": "1b6afff9-4109-49a3-aab5-27b6f964caef", "comment": "Malware payload (Amadey)", "value": "6969648f23c93337a968402092dc62016d54356d75c50c9b3c4da765b086ba619e251618a0b3c7266bbc58506f3dc1ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686456, "uuid": "5ca9576c-48b8-442a-a5f0-4f1617d6e7d0", "value": "T1E2B41212E6EC9033EC761B7068F701932F37BCB159A5976F2741AC8A1872AD4693533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686456, "uuid": "9b493ffc-d08e-4c66-8d50-baa9f310cc31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686456, "uuid": "176fda41-f0f9-40b6-9cdb-130d28fedc06", "value": "12288:2MrLy90HWEIpsY6SoICHpTw6ZDzgOUyuDs4J2:9y6WEksPNxwwUDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686456, "uuid": "0f7bdffd-8766-4ddd-ad9d-dc749d67facc", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686456, "uuid": "321e07e4-fdf9-4d50-a01f-0339871a3e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686456, "uuid": "c272685a-e675-41b5-b90e-88adfc3264e8", "value": "f0b03d3290d5088f400c87d7136057c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa05ad47-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690687070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687070, "uuid": "0cea165c-04aa-4ab3-84e1-927a66431ff1", "comment": "Malware payload (RedLineStealer)", "value": "559f0686749514ce222dc59348aa1bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687070, "uuid": "06bb4251-170f-4a35-b0a8-3c0c27f03441", "comment": "Malware payload (RedLineStealer)", "value": "098e4dd332b0246f8a1aaa87b1f9fb14769ef457466d2e823129c32d31e41c2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687070, "uuid": "c6fa3ad5-f14a-4a16-95a5-7a23b8b7fac3", "comment": "Malware payload (RedLineStealer)", "value": "de071eadf0dbacdc89242d0f87e5cb78928da499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687070, "uuid": "aae16b99-dc4d-422a-9734-32e68fa72763", "comment": "Malware payload (RedLineStealer)", "value": "1d660ca35bb0a6b1b8f248b53b0af1f7435516099f5688fd16de3228b244a6b213cad9151535d05aa99e2c973dc49c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687070, "uuid": "f0d98e6d-1b01-4253-8825-7b38e1c17b71", "value": "T169B41203BBD88133D9B92BB058F613830A357DB25D74936B178AA95A1CB3BD4A431737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687070, "uuid": "ceff052e-523d-4282-aaf8-fed25166be11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687070, "uuid": "f476cb13-fe2f-4fb2-bcbb-72f2c741bb15", "value": "12288:RMrZy90H+3SvZAHzbsdZtVdKlpBjk3gBYCv2St8G80w53S7:Uy8+3oZoQpf8uQzOYK3S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690687070, "uuid": "9786a54c-1a15-452d-9119-1cb5019adb24", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690687070, "uuid": "b7200378-633f-47dc-b152-d129990fd169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687070, "uuid": "d2f99963-8b5c-41ce-bc75-57f26e42515e", "value": "098e4dd332b0246f8a1aaa87b1f9fb14769ef457466d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375594a1-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686448, "uuid": "2c46fa66-f12b-4695-b8fa-6b6feeb1a2e8", "comment": "Malware payload (Amadey)", "value": "eb2a9ba16574b07c80d151e827d5590f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686448, "uuid": "1a475d2c-7dff-4f08-8228-199a92b4901f", "comment": "Malware payload (Amadey)", "value": "09a4cd25e33f07d79749031af7af20cef07f52e3ec26c4ae2e2b4bd7b515daa6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686448, "uuid": "16a00cca-7a56-4ecb-b0cd-f1ef28aeeb6d", "comment": "Malware payload (Amadey)", "value": "9db236ae48c189f2f971888f69afb57477727f8b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686448, "uuid": "96f43e1c-9ce1-4494-99c8-91db5625f4da", "comment": "Malware payload (Amadey)", "value": "352dba40ccf3a62d05e983fb8ef88ecd75b22c1d802c009a590205ab739b5004ad36ef30cfb83c03827bb4ce84a7d185", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686448, "uuid": "17cfe20f-ebb2-45ff-bb9d-d5bb1e1ee9a9", "value": "T18BB41243A7E890B3E8F11BB148F702931E307D955D78569B235A9A8D2CB3694F53233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686448, "uuid": "b1c3ad05-818a-408a-9de3-75dc26e50e97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686448, "uuid": "05f5765d-a653-4dba-b864-a788e8ad48db", "value": "12288:BMr1y90iysFXZOEd3+YIaodNFZ2lh6dgBYCvAUbuU2qofpHvSu:IyppZL3+YfhNz4Ubd2qUqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686448, "uuid": "92f07a81-c2f0-408f-a12c-e6170f519eb9", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686448, "uuid": "e7c4f3e1-a1c3-47c7-8e04-78270200d48d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686448, "uuid": "d1dd0cb5-7d59-4bfd-ada8-da375098db86", "value": "eb2a9ba16574b07c80d151e827d5590f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fd6309-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686764, "uuid": "c0567727-ecfa-42b0-bbf1-50596892ce4e", "comment": "Malware payload (RedLineStealer)", "value": "93d15b6aeb35375b99eb3084c59f9032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686764, "uuid": "b9b3868a-288d-42ca-bf90-ef1e19381cdd", "comment": "Malware payload (RedLineStealer)", "value": "0b44b7c45ede2fb0ac036fb34ac965d2260e9de2fa740c83df6e854653d4e70a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686764, "uuid": "08fddc5c-a887-4029-ae72-8d231424a361", "comment": "Malware payload (RedLineStealer)", "value": "d3b6d462fe4bad3d1c57e4827f3c8f2fdb4fb36b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686764, "uuid": "a617214d-6104-4e4a-bb8d-9326b5ff3c1d", "comment": "Malware payload (RedLineStealer)", "value": "7f4ef6123fea14970776b919f1fc0b771928fba7ba734e71fb916f54de3bac6f66cf03e5c730540140b9ebf9439a659e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686764, "uuid": "7ac47e24-c4b4-401b-9f1e-85af49e5ade0", "value": "T19CB41212ABD881B3D5B517B008F707870E357CA2BDB0826B2346AD8B4DB35D4A979737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686764, "uuid": "07ee70d1-3be9-4e57-86ca-dbcadf1e6a99", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686764, "uuid": "c9f90ac2-8632-4c27-9bdc-b6c1ca4dded9", "value": "12288:/MrJy90sqMQZuTWoAqFn43Xkd2cCw71MZYjR+R3h0iY4k:2yUZuaHqF4C2Bw71kBh0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686764, "uuid": "79e12bc4-220a-4fa0-b01d-4eb1a5bf5f07", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686764, "uuid": "dfc1945e-8a07-4558-9f8f-6218a766ad17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686764, "uuid": "6921cf7d-516a-4841-9257-cc2300b22f0f", "value": "0b44b7c45ede2fb0ac036fb34ac965d2260e9de2fa740.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1603bee4-2e90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690690687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690690687, "uuid": "c6466b2a-4a6b-4abf-9433-a38a6b4ae154", "comment": "Malware payload (DCRat)", "value": "1ed78e34fdd47c224424b8e6b80d2483", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690690687, "uuid": "f0dce7a5-3931-4c24-9112-6952982ae85d", "comment": "Malware payload (DCRat)", "value": "0b6b55c7594f96c3c9e73f3d90544c5ccdb419c1284c3123465368a2a419388c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690690687, "uuid": "55344d77-f30d-4402-b732-d94b36044790", "comment": "Malware payload (DCRat)", "value": "68adcfaf3257beb694bd810a5dbf60e2408828f5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690690687, "uuid": "0aba264e-3d06-464f-a785-c40130bcd6ea", "comment": "Malware payload (DCRat)", "value": "0657902169a8de9a1dba01588e0105f209726b624278076f34948c1f3eab09838e061632a02ddf6109d42bfa9ee374d0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690690687, "uuid": "35ea804d-7084-4293-a10a-331464579bc6", "value": "T1CF16330FADBC8987E4D702FE129D53CF70632344B1EB378A46AAC7549D4318666C9B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690690687, "uuid": "f300e0f1-c14b-4fb5-a3b3-44642c447d3f", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690690687, "uuid": "e9348662-6823-4475-b171-6101dce5fd1c", "value": "98304:7R4P54Z1xtXuPLrd8P0Ppq8t+8Jrij6O08G:6h4Z74PLre0PpqYHiu+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690690687, "uuid": "822338bf-d586-4e74-bd13-90c869cec298", "value": 4263424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690690687, "uuid": "9fd4a13a-518e-4993-a32c-39062318e9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690690687, "uuid": "f113c0d4-b5c9-4125-a334-dc4ea7ff8ed1", "value": "1ed78e34fdd47c224424b8e6b80d2483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5674387e-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686500, "uuid": "260acf8e-4f73-423d-b840-2dceb3b09aac", "comment": "Malware payload (RedLineStealer)", "value": "6557185b26c677609ed57beeb1a4db44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686500, "uuid": "53b05979-99c1-4a07-b211-e23c6885f4e7", "comment": "Malware payload (RedLineStealer)", "value": "0c719a4645b207f0c87729685f0e804d5daa6fa1f4e5ba8dbb61b363cbde2c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686500, "uuid": "ffef9c7e-2f64-4f7e-99ae-dd90e623a2f1", "comment": "Malware payload (RedLineStealer)", "value": "7b5681a7f3519c3aecfd838df38e416d846a122b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686500, "uuid": "7a5f1b92-da9b-44c8-ba6e-86d53a4dbd62", "comment": "Malware payload (RedLineStealer)", "value": "07f8b2b91288cda0be34a73b7498cb643c363fc3100ecce6fc48f47dc9630e653348179fe15ebced9a44d76ae730943e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686500, "uuid": "2e38e345-faea-481a-a4ce-50c7a416bf96", "value": "T174B41212EBE950B3D8B6237058F706D71A367CA29C75831A33675C9A0CB22D4A53636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686500, "uuid": "f2267c17-a80e-4ec9-a65f-d9cfb2e17ce1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686500, "uuid": "80eff628-adfc-49c9-89d4-adf2eb8c0e2d", "value": "12288:UMrly9007ymPcqUxCslw05gBYCZ0VI3WiK34hpb:RyvTPACsrizWVI3KoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686500, "uuid": "8f7b4b98-0a09-43a3-a39f-286f5bf072b3", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686500, "uuid": "1ddad832-5a64-452c-af77-71ba706038dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686500, "uuid": "15ed184f-b3c4-4df7-9378-e35b1fe77762", "value": "0c719a4645b207f0c87729685f0e804d5daa6fa1f4e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7524ed40-2ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690699436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699436, "uuid": "9da63e49-35ad-44c9-87f3-2a401efe678f", "comment": "Malware payload (Amadey)", "value": "bb99c59a8a67d2b764288edb41e9be59", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699436, "uuid": "94143c5c-72ed-4c74-a60c-b86a67b2e2db", "comment": "Malware payload (Amadey)", "value": "0cc3030244a3f1b4143eab652481c8f2027416f582ec434a4c5d11da0e2fa909", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699436, "uuid": "e06b9683-5072-4e2a-867e-65a45d2f8118", "comment": "Malware payload (Amadey)", "value": "642050bb81c52863b50e5082564ecce6f92052a7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699436, "uuid": "5b65c817-d340-48d9-9330-dc623001d0f7", "comment": "Malware payload (Amadey)", "value": "5a5d5c3a747b16497cc270d6261218a3b9e4da2dbeb2404f3046ccb8b5acc3657c9c3eb06213abc904c83af34ea0a486", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699436, "uuid": "e078f5eb-0968-4830-8380-b6c0e7d9c361", "value": "T1F7D41213B6DC50B2DCB9177058F707931B3AFCA299B8567B3359A81A0DB2285A43533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699436, "uuid": "0c90e13a-b9ec-4c0c-a578-d2a462f45625", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699436, "uuid": "535cc441-91d9-418b-b902-3fe072caecf8", "value": "12288:cMr1y90T7NFkpvaJs7dHcfAISsnT/0hhVzumAHOX0htKP:RycjkxiMTsTQsHf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690699436, "uuid": "75e2cebd-7ed8-4601-843d-2d35ac5a5f8f", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690699436, "uuid": "0aa20bfa-11e2-47b1-ac62-64d132f9f28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699436, "uuid": "429ff205-b0a6-467b-861b-361fc41a3690", "value": "bb99c59a8a67d2b764288edb41e9be59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a7679d-2e8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phonk)", "timestamp": 1690689799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689799, "uuid": "cb53709c-850a-4a44-9bd5-f87ddd8f66a6", "comment": "Malware payload (Phonk)", "value": "1db8cb06a992cd74139b8dae45d9d4fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689799, "uuid": "fca4439a-d1dd-4db4-89f7-63fa79e3a7f3", "comment": "Malware payload (Phonk)", "value": "0cc7e1b6fabece5af0b30aa18db0bf4751494c7b426076801e32e1b1ed67ea88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689799, "uuid": "ffedc872-1021-42f9-bc30-482914b759a5", "comment": "Malware payload (Phonk)", "value": "d4aedc38478f366429807758ab2ebad73d7c076b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689799, "uuid": "54a2d36a-8cad-4df2-b24d-59dba0cc4a42", "comment": "Malware payload (Phonk)", "value": "c4b2fa8bbdab1acf4b43a4a0e0d77062c77a8cd61db4e117b6638c0b2d4351cb7c4785f938905a681dada430bdc92b82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689799, "uuid": "80fe1a26-bbd0-44cb-87cd-f882cc52e512", "value": "T1DB25409E3BD71FB2DD6F01F283512B885B14F8DAEBC380E61A9346C9E10D19259BD097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689799, "uuid": "2cf9ff4b-673c-41d4-ae76-e2569ebba1a1", "value": "6144:TGKj+tEXfAq1ZlCaQRJeEg4BA/3wOIHZQx7qWSTQRhlSQnhv72XGY76LSvWPTAq5:T7j+tXkEgb/3wOYmfSb7r4v4m5OdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690689799, "uuid": "ebf0a351-dfd6-4b82-ad84-dd0e60da9971", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690689799, "uuid": "524f82d9-6b69-4e71-998b-709f399fc515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689799, "uuid": "3c495913-a2f2-460e-8f5e-95bcfb151a79", "value": "1db8cb06a992cd74139b8dae45d9d4fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3175d62f-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686438, "uuid": "37d92dfb-77c0-4c69-a843-5f4b127e2652", "comment": "Malware payload (RedLineStealer)", "value": "ac55df1cff03dafb1e41559e4d656e8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686438, "uuid": "461379ac-cb40-437b-8097-57feac2076e3", "comment": "Malware payload (RedLineStealer)", "value": "0e07a24a37ebcc62e68d36c7b6542dd2781c6a3f67116d783e40b17d9080477f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686438, "uuid": "29a04ce6-126d-486b-9ee1-04423b216132", "comment": "Malware payload (RedLineStealer)", "value": "3fbd6e88d7dba34139ee976dc417d6d84845444c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686438, "uuid": "40c7749f-46f0-4bf3-9a54-b8405c2dcb25", "comment": "Malware payload (RedLineStealer)", "value": "7403ba5ff96a80d405e33cf0c906ec44cbabb215496d5919be7c81b7061af54430e1532461ffda06bc5ca4c2cbdf5cb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686438, "uuid": "81b27292-d2ee-4ced-9d32-114822aab45e", "value": "T1FEB41253BBE84133E9B517B028F613D30B3ABCA09A7893676345694F0DF3690A476727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686438, "uuid": "ea6f6bf8-68ad-42d4-9c07-ff0449fcd99c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686438, "uuid": "5034008d-eb3d-471f-8f86-bc99ded36996", "value": "12288:HMrURy90nZPJ32yp+t5QWqBgPseusc8nI0ssWXqJDRIl15N:DymJGyK5yYLus/gqJDR8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686438, "uuid": "0d362be3-148d-4118-aaff-d0918b9767f4", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686438, "uuid": "049507e0-7a82-4a97-b5fe-2c9015e9e6fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686438, "uuid": "524aaa25-6d70-455a-a48d-fcf9548b27ad", "value": "ac55df1cff03dafb1e41559e4d656e8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4580216d-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686472, "uuid": "4ecc7e81-f30d-459e-9432-809c1f877d35", "comment": "Malware payload (RedLineStealer)", "value": "0b9c1fe7a2b623a8ab5db8447a896091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686472, "uuid": "c7a884c4-2429-408f-b5c3-3fb08a0e58c0", "comment": "Malware payload (RedLineStealer)", "value": "0e1d473bb3cdd4ef4e90dd32d440444e2e0f7eed7ce06ceb3be6ffdaed578d73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686472, "uuid": "f7a1ce32-5891-46b3-adc2-295bd28f453c", "comment": "Malware payload (RedLineStealer)", "value": "9b5606b7d8a3594ef75f26a7f0515456e0a2395b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686472, "uuid": "85a162ad-5888-4927-85ea-3b2cf7ecca56", "comment": "Malware payload (RedLineStealer)", "value": "0a4c2dfd7e5c1d2960833765cbb3dbf43e44fb7d242ee9c5b8311e84e91d98d2fc076d731b0ec987da7552fa8bce882c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686472, "uuid": "0a7d01fd-c259-4716-a275-176e9fb51626", "value": "T1BBB41216F7D88532E9B61BB02CF613D30F32BD559C7482AB37859D4A5CB3190A472B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686472, "uuid": "ff4b4191-6288-4105-ad26-f0ab13c87881", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686472, "uuid": "cc3547c7-0c0e-4f48-8158-def275f6964c", "value": "12288:EMr2y90ap/Hvh8uQJjfJAvmU8Zusdj81TSm68UYng:Cy3/Hvh8uwjfJAObZ3dA1TSb8UYng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686472, "uuid": "a58c1cac-6f78-48c2-96f4-67f9c758e533", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686472, "uuid": "3aef69c4-aa93-44f2-a108-568e6ee07a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686472, "uuid": "cc1c2eba-5705-475f-852d-ea634246d5ff", "value": "0e1d473bb3cdd4ef4e90dd32d440444e2e0f7eed7ce06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd926caf-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690709544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709544, "uuid": "ae794b45-3ed2-4ecb-8de5-39c10021ec13", "comment": "Malware payload", "value": "d8ce65a1ad1177fbdba88bbb8dbd2e0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709544, "uuid": "daa9f7c5-7971-4afa-9347-191d02420c9d", "comment": "Malware payload", "value": "0e3c1ad48a3d47e6bfcf2e36cec36a8fba3eb112db69cf75d60d13bb27fcb58d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709544, "uuid": "f679fb3b-6468-4ed6-ab2e-18ac2b3760d8", "comment": "Malware payload", "value": "5bdab19f18ee4f3292e84b05eb7dc5a185af0bab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709544, "uuid": "a6b78a2f-03b2-4216-991c-a04055003ae2", "comment": "Malware payload", "value": "88e139d616b4dafdd8d83a6de7c79f657b590837b9712c22c498a3b36db74d49eb01a39bebe9c192702a894b11870607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709544, "uuid": "c0135027-4442-40e0-a72d-0e53aeab3636", "value": "T16ED6BFC2F7A3C4A6C1030A71513BE737AE316F155020C6A7FBD4BF2A6DB1782665634A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709544, "uuid": "d27f20f4-395a-4b04-bc08-6b5b395db2dd", "value": "196608:sfbmCc+LeTti4tXnNjfzOQbXmlYd0UgT7j4fUBh61Vj:s6Cmti4tXnNjfzOQbXqYzHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709544, "uuid": "b851b3d1-3283-47b6-a9ba-421a2e3281c4", "value": 12947456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709544, "uuid": "1fec059f-9800-4ba7-bb41-f07c89b15414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709544, "uuid": "6e07b776-26b5-4b36-a11b-3d7d29afec7c", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27323.26056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d51972-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685856, "uuid": "248aac52-a0b9-45e4-a797-b28d96770cb9", "comment": "Malware payload (RedLineStealer)", "value": "7404edf08f05c3c7a61099ce45000b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685856, "uuid": "ca96199a-5998-4aeb-80ef-c4afbb48aab9", "comment": "Malware payload (RedLineStealer)", "value": "10894347e879ac56500a50f23d45fb04af2c7322acb8bab267a066824d77abeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685856, "uuid": "f6d0314a-d555-47ac-b36c-201dbb24ce71", "comment": "Malware payload (RedLineStealer)", "value": "fb40dc8b75b64d3b0019b3cb7d52c608d1ed4e43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685856, "uuid": "0644a0f7-d1fb-4ea8-884d-ec900774d83f", "comment": "Malware payload (RedLineStealer)", "value": "24aa4c257f3f1763f1cd66973aacc53503b735f5bc8ad394fb414f6723583e46524b03876bfb88fe7eb068b77aa9b24f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685856, "uuid": "0936c846-88b2-46fa-a6eb-d46a26ba8c54", "value": "T1E7B41207ABDC5073E8F5677058FA16971A34BC526C38933F2786A91E1CB3684A07277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685856, "uuid": "cd5dbc7a-1e09-46a7-85c6-561fb000c322", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685856, "uuid": "e9e73279-5b1c-4691-bc5d-7b345688162a", "value": "12288:6Mrny90uiY6BCIK8DjsyVdMHhL7gBYC+eugrcSv3:lyUY6BbfDdVetUzDugV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685856, "uuid": "dca9ffdb-4d8c-43f7-bd7e-c9786f64a9f3", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685856, "uuid": "42fa7469-eab2-42ee-95ac-4363079b5a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685856, "uuid": "e03e88ca-1eda-4f52-9c29-e2b12d4e469d", "value": "7404edf08f05c3c7a61099ce45000b10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55462fcf-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686498, "uuid": "93b0c0aa-2f7e-4165-8367-05f98c8bc1d5", "comment": "Malware payload (RedLineStealer)", "value": "25f5138f0a4ca862f9339dc41ca9fefb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686498, "uuid": "547f15fb-089b-4ee3-a1ed-94155776587b", "comment": "Malware payload (RedLineStealer)", "value": "10c593e4c71891bc957280913625051d952c21db0228e14f1d77a0c9ec99bb0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686498, "uuid": "8a8fd89d-d833-4683-8f6d-9ffe326456b5", "comment": "Malware payload (RedLineStealer)", "value": "a73f6c464345edfd5c6484b204bc4721fbcaed6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686498, "uuid": "d8681c5d-e303-42a7-8889-0985bee03402", "comment": "Malware payload (RedLineStealer)", "value": "8bbedea8c366dfa3f385ea6cd693c31f99ec1ba6b67bf00b9c257b7624b16439d59af18140df3041596b5b9731bdf261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686498, "uuid": "8baa241a-e80e-462e-a774-5125b4ae9cda", "value": "T114B41213ABD89032E97217B048F703D30F367DA59978D26B23595A1E0CB2AD0D5727BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686498, "uuid": "ffb03629-b551-4b6c-a8fa-ea6bcc51ff2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686498, "uuid": "d79076c2-b013-4117-9714-62edd38b11bb", "value": "12288:FMr1y90qcRy2y69ClQm7z7pUXQdRzpNC:AyroY69nMCQvpNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686498, "uuid": "67d11f10-2c23-4243-9977-358cb38e64bb", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686498, "uuid": "c6bd176e-1f00-4d93-a077-6d2639dcdfc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686498, "uuid": "8f0c4019-f483-49fc-9330-0d422af5cf42", "value": "10c593e4c71891bc957280913625051d952c21db0228e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8996835-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690709535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709535, "uuid": "70a6e9b3-8f61-4007-838f-c168d3b05856", "comment": "Malware payload", "value": "716bb472d167748de14e430b79c1cca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709535, "uuid": "81a2ac04-3ace-4520-b7ff-b7913cb4d3cc", "comment": "Malware payload", "value": "10fb4c731f41126a7c5d6b5aca9f3e17bd47191e5ddf07dd49fe9363b6f8925a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709535, "uuid": "427bb5fa-0413-4d6d-a54d-e8130fb3adb2", "comment": "Malware payload", "value": "aa8d587fe4d433f78c14de2d2d3fd125f0f88cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709535, "uuid": "17f59782-d491-40c7-8017-56ecb9a5bfbb", "comment": "Malware payload", "value": "a349b5ee2f1310f0f54e370c446a926f5cc312063020a739c541db30668e76c67c7a32fcd69600b94de4ceea387d698c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709535, "uuid": "75b5caa9-61e6-4632-bc0e-01ed2d963fbd", "value": "T111230903B28A29F1D07384B4761FB7BF2937A67370319278DAC0EC64972B5C55BB8259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709535, "uuid": "44f7eed0-1a57-45f7-87f6-c89bc8575d5e", "value": "768:yP3nhi58jluy4wuFh0A6k8Z4jwGklmFpe4z73cLFW/:yP338y4wuFh0A6k8Z4jwVwy4z73yk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709535, "uuid": "280ce01d-96fb-4863-a339-c99d2cbb9b08", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709535, "uuid": "1a355791-886a-4d27-aa49-bd6ba010751c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709535, "uuid": "4978cc56-d560-4f37-b590-a73c3bd884cb", "value": "SecuriteInfo.com.W32.Kazy.CA.gen.Eldorado.31159.22875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526f44fd-2ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690710545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710545, "uuid": "c6c4e52a-2bf9-4a42-ae18-9d57887107ea", "comment": "Malware payload (RedLineStealer)", "value": "83a437dc2affcf297c9d7a1eb8974268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710545, "uuid": "39d970a1-abc5-4afb-92a8-aed06e2b76c9", "comment": "Malware payload (RedLineStealer)", "value": "11d97d63a368f3da99e59fa141d1b60eab87f05f9ade1f3a3f4868a6209fb796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710545, "uuid": "00a3a0a9-0ef2-43e5-b2ea-18a9ed2a3dcc", "comment": "Malware payload (RedLineStealer)", "value": "9aaf152c9af10e648d3b75f2ba54e9ac6eb1f9e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710545, "uuid": "c01d07ea-6422-40e8-86e7-e033b04a2d2b", "comment": "Malware payload (RedLineStealer)", "value": "cb0bdcae40793a2f77debfa48a590070e90b9595e0f2b41698b03bcaf9339b884ddeaae9f60809cae1d9fc792362c640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710545, "uuid": "9c780d80-ddc2-4796-927b-b9f8a67e9c09", "value": "T1B7B41207AAE94572D9B15BF058F117C30A3A7DB59D78C36F2642A41A0C735E0A533B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710545, "uuid": "8d831f41-d690-4d0c-8570-53f1f4449f91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710545, "uuid": "4b2c230a-56ec-4d78-9706-10edc594fe2c", "value": "12288:WMrFy90r1g6w98J8CQxkuT6WnG4u+zqgBYCaV5Re1GK:LyEA9y8g2Zz+5RI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690710545, "uuid": "7b4787d6-9657-4bc0-b02c-45956bd92683", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690710545, "uuid": "e39dbd6b-4180-40b2-a9b6-59cc9a6d056d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710545, "uuid": "cf071af9-99bf-4a48-b17f-b605ebcd3a93", "value": "83a437dc2affcf297c9d7a1eb8974268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734cfe25-2eab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690702440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702440, "uuid": "e9dbb8d5-9332-42a8-84f5-98c21f6659e5", "comment": "Malware payload (Amadey)", "value": "5fd4b524c9670da3a94415c8f14b87ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702440, "uuid": "a698121f-cd2d-468c-a1a8-e1c27ef403f6", "comment": "Malware payload (Amadey)", "value": "1260d7901fa193b7f871c60d714d3d0a462a72b606674e7b45f58cd3e1cd2fea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702440, "uuid": "e7fc6c3e-7d34-42ef-89fa-3b39c0e7973f", "comment": "Malware payload (Amadey)", "value": "0a425c0c52857c6229eee7017b20a43d89edbc99", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702440, "uuid": "224bbfa4-eb25-4e94-989e-1796b6553914", "comment": "Malware payload (Amadey)", "value": "fc3b7466375667cc4ead301cbfe1760c2e06b26847b39cf6a39b70faed1cec2c6e025924b1091f8f203c60f53dc1d14e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702440, "uuid": "7fe1ce83-6994-47c8-bdeb-53487b110d08", "value": "T167B40202FBD88037D8B92B3068F607931F3ABDA19974962B27559C5E1C736C0B93935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702440, "uuid": "435fbbe1-9ef4-48d4-ac44-587f1e48445e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702440, "uuid": "cdd64b5e-354b-460d-9a2b-029e7190acd5", "value": "12288:gMrvy90z5UmBCpjlD0CwBw5pFYFhmZuc3Da2/PHeScSfL:/yS5BHCwgYFhE3BPHHhfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690702440, "uuid": "65a1e921-1804-4217-96b2-491b590d7e05", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690702440, "uuid": "c45d00fa-df4b-4079-83c0-51864069fced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702440, "uuid": "111c8791-5b1d-46d9-be9c-d6e4195cbdae", "value": "5fd4b524c9670da3a94415c8f14b87ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef01679-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690701090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701090, "uuid": "b57757e6-9ab8-4d79-86e4-afa4aa121418", "comment": "Malware payload (SnakeKeylogger)", "value": "3e00f2882854b005a81025ce13629ed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701090, "uuid": "5665ecd1-2169-4012-87a1-c31d0c0ab1c3", "comment": "Malware payload (SnakeKeylogger)", "value": "1264d9a78e0a24ec6f515b25b1a83a39d9091ec109d07115daaf17afc16eb756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701090, "uuid": "c33dea86-797e-4faf-94e4-343361d3d4fa", "comment": "Malware payload (SnakeKeylogger)", "value": "017aaab67646c5acccd658eb9d9d8f1955c009e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701090, "uuid": "46331230-d657-4810-8e1c-719b878edb31", "comment": "Malware payload (SnakeKeylogger)", "value": "f55d2a3de02da14d914020436d47650ae3bc36fa4c753c08557e38795a6575e2d9fb0b14a2e68d976f6aaa2839cac772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701090, "uuid": "ca55ecc7-4fff-4fd7-a0f3-41ed95760a24", "value": "T11F84234711D1C897E7B363F01E75D176FBBF22192363C2878B8C9EF669829C25B06186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701090, "uuid": "0a2bc020-afba-4930-af34-5b08da818f8c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701090, "uuid": "2bbef724-c827-4fde-b20c-65a741b14e02", "value": "6144:X8LxBsbFt9Y14A+mTbFaX5XUm81F9lE5so+2fB4Xz1i1Fl4Ast3fGhkMWLD+Xh6c:N4+mTbQXVUmIm5pqSv4AEPGhkMCGgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701090, "uuid": "2322c7b9-4bc3-4384-9980-b16360a2a83a", "value": 372203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701090, "uuid": "cac9721c-4d40-4436-bc08-21f004694966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701090, "uuid": "f4fb8ef7-3ef8-4e9e-a2da-5499dd93a2b5", "value": "3e00f2882854b005a81025ce13629ed0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1e408d-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686434, "uuid": "f7aaab80-94fe-4629-9365-be79403cff20", "comment": "Malware payload (RedLineStealer)", "value": "d6cfcd394e63d8125c16c8e86dc54119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686434, "uuid": "8c6f790e-cd2c-45d6-9f41-dbd3c44bc7cf", "comment": "Malware payload (RedLineStealer)", "value": "1273b2695e35a2aa78c3409f81bcf0a7a96da7f81c1362c07b244331bcfea737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686434, "uuid": "69e3d07d-e78c-4280-8daa-06b6219d6aa0", "comment": "Malware payload (RedLineStealer)", "value": "edd99997e85dabad72d21c43249e224ec86e78ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686434, "uuid": "6de23493-9b6d-4b44-b96e-dce0f0e6b531", "comment": "Malware payload (RedLineStealer)", "value": "a84c66d11bcf423eb534d1cbec34e125659b037397d7f759feed3d3c34d764c57d00a0c2d7d9fcb810ef404162535261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686434, "uuid": "ce8c53e5-b9be-41e4-b23f-2ada2659d675", "value": "T145B41213A3EC9472E9F86BB058F302930F357C615A7443A72385AA1B1DB36C1A97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686434, "uuid": "58d2ad1f-9df7-4f0f-80fe-f1d2a06eadd1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686434, "uuid": "f5495c35-0f08-4612-9a8e-a0d12aedb980", "value": "12288:5Mrvy90fbZwHo9mhKjYD1OKSbFi1vGorNzFr:WyQ4omwjjRenhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686434, "uuid": "2ab47d0f-ae50-4cf1-84c3-39081888393c", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686434, "uuid": "b00be3f3-d53d-4717-b57e-55d579aba949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686434, "uuid": "53f4e5cf-aa3c-4517-b2fb-e625c49930d6", "value": "d6cfcd394e63d8125c16c8e86dc54119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7073892b-2f24-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690754404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754404, "uuid": "9618113e-ac51-4cc7-b4fb-a19ffcc9798c", "comment": "Malware payload", "value": "ec28cbf171cebc52439fd096309d0670", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754404, "uuid": "0d67b1fb-e195-4b4f-ab1a-459ddec373ab", "comment": "Malware payload", "value": "1304bc9af9b32188743e9d749da25212c879ed1e01e5055986565a4e59c781f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754404, "uuid": "847f93fb-ae9c-45b1-b41a-a96ed5c9b716", "comment": "Malware payload", "value": "b3007b81dab1a54bc486d84691af5be12b365018", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754404, "uuid": "c6e2ebde-c4e2-4947-87bf-2425a4001ff3", "comment": "Malware payload", "value": "51c04b213d395b973259ee65dc16161861d40252e6098ad8a6f4734bac83b5ad6e2e1d48ed522fedcc24d7de71ebb890", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690754404, "uuid": "34bdbdc3-3121-4762-9f33-e89b1f42f448", "value": "T161F34B46FB418E03C4C61776B6EF02493322976493EB73069918BFB43F8679E0E63656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690754404, "uuid": "f0dc1066-e134-4180-852e-a5ad2fa67bc2", "value": "3072:PD02zUZKvqbadLNKVdr/6hzA+KIFABq1wbZnJ4/+UeM/9K4Nm:PIVZKSbadLNKVd+tA+0swRJ4/+FM/9d0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690754404, "uuid": "4d3df33f-44fb-4a38-93f8-7d2a41be10f5", "value": 164983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690754404, "uuid": "e0fd97c1-609e-4c2e-89d2-65450816db4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690754404, "uuid": "729ccd48-ee5e-4d7c-ae25-b6fafdbd0467", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b10f6a-2efc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690737317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690737317, "uuid": "12eced71-f37e-4d0a-a67a-1734e90971b7", "comment": "Malware payload (RedLineStealer)", "value": "0f001866c26f3ac895a49f22b04875d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690737317, "uuid": "8c7462f4-8f52-4046-a6cb-d297a5a37d08", "comment": "Malware payload (RedLineStealer)", "value": "1308b3a34213e05626696946ab6604d892d76a0b2a8990c80becb05b69c5c0e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690737317, "uuid": "598bccb7-ff2b-49cd-9fb6-f46e0e97b16e", "comment": "Malware payload (RedLineStealer)", "value": "c93fb072228c2a2040409e8f446eec5edffc7cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690737317, "uuid": "b2f66d8c-f263-4620-8bcc-295cfa947f5b", "comment": "Malware payload (RedLineStealer)", "value": "af03fedecbdf7310d3d5e74ae7d270b726c10c04fe67783783575f6f2a14c44372cbe6b0a3fb0301793e656c69a0667a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690737317, "uuid": "a275746c-4a1a-4a29-984e-776959851de1", "value": "T1EB6409C1238C59DECD8E89F165292E148674D482E797FF537C4B90F41CDAB88BA053EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690737317, "uuid": "d3a2b073-c716-4626-a053-048221fb0ca6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690737317, "uuid": "3574c715-fe5a-4186-a01e-8a693c84ff7e", "value": "6144:O5BqSwxGXTYKLCJyN4BiFE0vIT3TS+mcY1lY1Y1l1hgs21111Y11eY1e1hTwhsbP:+qFGXTeJYfFJz3sWvpB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690737317, "uuid": "d8d50f2f-945c-4a0a-902e-c5416b5306e4", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690737317, "uuid": "ae7a1da5-fbfb-47fe-8ba9-7d9008cee204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690737317, "uuid": "7c249e47-70e1-4451-bc64-2e4be92e246e", "value": "0f001866c26f3ac895a49f22b04875d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a70bc55-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695204, "uuid": "25217bbf-ed2f-4215-bed7-acc928172e0b", "comment": "Malware payload (Amadey)", "value": "69fc047b255fafe5c452f467b1b4187a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695204, "uuid": "d2acee75-e334-4228-a441-e4def65c7539", "comment": "Malware payload (Amadey)", "value": "145c8a2b5afb6acbfd86669a09047a71ff0e4cd3403736a8b5f257b7773e62b2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695204, "uuid": "bbf9be82-f8a8-4aaa-bc6a-65524e5db21a", "comment": "Malware payload (Amadey)", "value": "c2c493677f4ad114aa4ae74bbea4099124cc7eb6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695204, "uuid": "d977cd58-d5fb-481d-82c8-a57cd261281d", "comment": "Malware payload (Amadey)", "value": "77eeb75318895c164a7eada7125136bb8afe395e7ff4fc7f13b95f9e75a487469acc5b577abbf65bcd3a4e3b69b79646", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695204, "uuid": "71a579e3-cc4e-4b07-9a4a-cc63af1afb9f", "value": "T1BFB41203A3E94472D9B5277048F216C31B377C62D9B9936F2381A91F1DB3691A9B072E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695204, "uuid": "c51944ed-21ea-48ce-b090-a7a3199d96ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695204, "uuid": "7a56f458-7b4a-4422-b5c4-fb3e797dcec2", "value": "12288:rMrVy90BRO6GMKIRAcs15T5PXcYAjYHoqQ:WyI2rIRAJtcYFHTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695204, "uuid": "684b6861-2a8f-4be8-89ad-9e587c83968f", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695204, "uuid": "71674d03-d141-4e6e-8270-51d8baf5ff9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695204, "uuid": "82adb654-fb50-415c-89cf-8426bdafc67d", "value": "69fc047b255fafe5c452f467b1b4187a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0456bcf-2e8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690688879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688879, "uuid": "5e465fa0-47fb-4ba7-8987-9be80708c315", "comment": "Malware payload (RedLineStealer)", "value": "598322f9fc835bbe8e560257eb44502d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688879, "uuid": "14928049-4eb7-40a7-af4f-4f9c2edb20b0", "comment": "Malware payload (RedLineStealer)", "value": "16096cb4d1d64413f596ae9b3b9086ce14e319777a66f24a42c65e45828017e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688879, "uuid": "1a8920c6-3997-443d-a9b7-67c99b9051b5", "comment": "Malware payload (RedLineStealer)", "value": "33c4375b48e6d1f47cbad6dc88982f54d507949c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688879, "uuid": "339a1a6e-f9ae-4215-8136-1dcbe9f467af", "comment": "Malware payload (RedLineStealer)", "value": "7ad49814f5426043ba928844d599e4b3951913335c7a151e387f443449aa97b587683617dad7121df2e91573c8a96f31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688879, "uuid": "aebd83d3-ae6f-4e01-85ec-54108dae3dfd", "value": "T125B40202B7D98533D4B42BB05CF613C30E36BC615A78866B3796999E1CB36C4E93532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688879, "uuid": "a67b2f3b-813a-4289-9d74-88b7a07d57e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688879, "uuid": "9f50ed75-3fb9-4343-87a2-f950d8992133", "value": "12288:ZMrxy90jkJx92A4WJS2f9y2hCKItWWM4jWr52zy3:kyIkv92A4WJB9L3qW2E5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690688879, "uuid": "51f46a11-0a0e-4c24-b8d9-37bf8cdb0626", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690688879, "uuid": "a7c3293a-8bf6-4c1d-a63d-7f62af35b19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688879, "uuid": "e44d4e8a-759f-452f-9dbe-807e8f6bbc4e", "value": "16096cb4d1d64413f596ae9b3b9086ce14e319777a66f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e19ad3-2ef2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690732824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690732824, "uuid": "d58456c3-ed67-4879-8086-2c64d60fe09f", "comment": "Malware payload (DCRat)", "value": "24944ebb1daf4504ec523f13aad747c5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690732824, "uuid": "461dc27a-1d1e-4634-b36b-db8d25ff9448", "comment": "Malware payload (DCRat)", "value": "16f60b1759a49fa3332759150943ba2662fd4d5247cc0c6989b9b7f71460cb08", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690732824, "uuid": "037ea296-cdad-43ee-b6a3-3f196099c81f", "comment": "Malware payload (DCRat)", "value": "d576be6c6c4f61e16901b482ef51e1f628093c24", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690732824, "uuid": "e1306574-0115-48e1-9ce2-82d7d9da5933", "comment": "Malware payload (DCRat)", "value": "2a4be144108ca543ec79ed91976d51839b88e665e1b87b752f98466f6b4f80f7a7e945579cebe031f3e97fce04fef3a3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690732824, "uuid": "f071ba43-d3ea-4b83-86cc-5402de90670f", "value": "T19BD5DF427E44CA12F0481633C2EF454847B4AD916AA6E31B7EBE73BE55123A73D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690732824, "uuid": "00c20680-bea6-48b8-bd6c-c7bf8464549b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690732824, "uuid": "fcf6f29a-bcc4-4074-89a0-a55c9e27393e", "value": "49152:Zr2gy9SH4+4zy+ufVA/gEWWTZnAHUkUx6MZxX2bkv/x8RQLu:52X0YC23nAHeX2wv/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690732824, "uuid": "750f048b-51c7-40bd-89bb-473e76ad907d", "value": 2807296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690732824, "uuid": "5cfcaac4-6200-4027-81b0-b0ef6bcfcb62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690732824, "uuid": "a67c9c02-0343-4aec-bbe8-8351ead7d27e", "value": "24944ebb1daf4504ec523f13aad747c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06710b2c-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685507, "uuid": "d7f15ec8-d604-4a35-9547-d4e0039ad677", "comment": "Malware payload (RedLineStealer)", "value": "09b07d9e1a4cd848d2177f72b53e8b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685507, "uuid": "5d36612d-ced8-40eb-ba01-7ab1b15c74f1", "comment": "Malware payload (RedLineStealer)", "value": "17085fc9ee6e1245eca29eb6243cb0b12d4b71cb3f6dd986a900eb7a213a0d6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685507, "uuid": "119c31a5-ce58-4343-9782-92fe61367337", "comment": "Malware payload (RedLineStealer)", "value": "aec704a6b0a2856672dacaf0d4132c5c35230c03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685507, "uuid": "666030a3-f9ae-42bb-a52b-9a6f6ecae890", "comment": "Malware payload (RedLineStealer)", "value": "309c954f16acb20e226de2b872a615ea8dda456bbb63c0399d2b323fdb4c34c65c86e86dad01e3fa7253bd9212c97a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685507, "uuid": "d51cbb26-b805-49e3-a074-02eae8b57af2", "value": "T144B41242ABD98472D8F4277064F702D31736BDA25DB5D32F2744AD2A1CF26C4A83276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685507, "uuid": "e2269998-2819-46b1-81b8-d22ceca95fe0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685507, "uuid": "426f119d-9fbc-42cf-be5b-88f9d1dc1036", "value": "12288:jMrpy90H88ifTWGKmbVrVYJaggBYCJCXuHYzVS:Oy4RifTrlSUnz/oVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685507, "uuid": "8054b3c7-b4ea-440b-8d66-a04286e19fb3", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685507, "uuid": "56129a7e-59bd-49f0-bb22-368a30a0178d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685507, "uuid": "ad9dad24-2d59-4c13-8e22-bcb017cd432a", "value": "09b07d9e1a4cd848d2177f72b53e8b2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972fdb7b-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686179, "uuid": "326d0806-5852-43f9-ac10-3ff5c9de65a6", "comment": "Malware payload (RedLineStealer)", "value": "d9c6981cff53c6ebfe1b0ab740209bc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686179, "uuid": "beffe28a-9fce-47d3-a29a-8c5b148f1dfc", "comment": "Malware payload (RedLineStealer)", "value": "1745eda08f1790c837ca9a24da67c032129ef7a5cff88dca1a62f77e57707419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686179, "uuid": "e3477bfd-59ce-4ecd-8e75-54d1fb80bc75", "comment": "Malware payload (RedLineStealer)", "value": "af2cd09bce61803572a96dbb699fb70ba86d5e30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686179, "uuid": "e6bd3116-6606-45d8-a30a-fb363ca1e549", "comment": "Malware payload (RedLineStealer)", "value": "bc9b6d1d62a72d2a5877194c630dbe7a426079ffd962391237e00eaade024e02882121d67cd1c685565881a0b73d194f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686179, "uuid": "36dee913-5441-4635-9f13-6fcbb6348c2d", "value": "T1B6B41253B7E88033D97917B428FA03C70A36BCA2AD3452672795296F1CB36E4D53172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686179, "uuid": "9747ab88-34b3-4968-ad4f-02724ca0bf87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686179, "uuid": "3a994413-48a5-44e0-8ec2-9ac512493323", "value": "12288:0MrDy90tnod/qnoWrgETEkUI5Ggcvl6IdIK6u7Q:HySoWr0kUI5GtvkIdAu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686179, "uuid": "5cc41958-64fe-4724-a05b-acfb2e861342", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686179, "uuid": "f3e4b5ad-4e9a-47ef-8937-fc229a512fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686179, "uuid": "5af3a7e8-be8d-44a8-ac2d-d1309259b14b", "value": "d9c6981cff53c6ebfe1b0ab740209bc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bd0532-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686442, "uuid": "ec2674fe-8de1-42aa-a9b7-90e88798208c", "comment": "Malware payload (RedLineStealer)", "value": "fc8fc4afe97247ece2891914ec219ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686442, "uuid": "9620229b-931d-4127-a47a-2531c0b16936", "comment": "Malware payload (RedLineStealer)", "value": "179d8940ee8d4d39451ec4db42ad010eba7b7eb76c0d3b18d897be739c72eec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686442, "uuid": "cc1d1266-2f53-4e06-84b9-035c21ce891d", "comment": "Malware payload (RedLineStealer)", "value": "3f28db1eb4f42dde6ee71e298905fb8cf6775888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686442, "uuid": "58858272-0988-4b7b-865e-416dfed64ac2", "comment": "Malware payload (RedLineStealer)", "value": "ac988f5b95e81ef3441296e1b67812a009efe2896275c16f087eb4773145351e41016378028b7af44f32e6a6093b993f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686442, "uuid": "bab84378-ff24-4131-9c79-a671f087b2a8", "value": "T1A5B41213A3E49476D9F50B7098F703931B3A7CA29D74832F238A9D191C73394A93676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686442, "uuid": "5c286c9d-4809-4b4c-bd98-4e431ecbc5cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686442, "uuid": "d44eb0f2-7bcc-4062-a4c4-7e98c166c15c", "value": "12288:XMr1y90OgCUGpJT3BzFs5CNhRkIoqdygBYCAYAo7UAJzjqNi:ey0fwbB5YCNhR1BzhAooAFjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686442, "uuid": "1e33d686-da0a-4585-b14d-ae957c7c427e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686442, "uuid": "863672cf-985c-4be9-b1e2-e67354235249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686442, "uuid": "322a4a0d-4eb4-4c9a-b0f2-38d5c40e5a98", "value": "fc8fc4afe97247ece2891914ec219ae0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2520e6-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686481, "uuid": "c4764ddb-53c5-4c1a-a21a-ed08b0d226a7", "comment": "Malware payload (RedLineStealer)", "value": "169f5c0013549102c72a5d78027f64d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686481, "uuid": "571e0990-3219-4a8b-b3a2-6061c708448e", "comment": "Malware payload (RedLineStealer)", "value": "18318b7d398f56d0ed819b0714a5a3db83f70703b90876413b6fedfe0c24295f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686481, "uuid": "2dff292c-1a33-4869-8293-c5bf15745bd9", "comment": "Malware payload (RedLineStealer)", "value": "4f373f38484e5d2ad2e6cfd94adfedf6e31b3696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686481, "uuid": "5913cd7e-9572-4153-b8e7-628461bf22de", "comment": "Malware payload (RedLineStealer)", "value": "3d5625be07eb8dd17efc43617ac9f87aa0905ee8a2e5481386a942679492b462af6c86b4790966536a92c189697cdbab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686481, "uuid": "9935936a-a7a8-4a8d-9ca6-e5aeebcb9f68", "value": "T10AB40203B6EC9073E9B927B15CF70B931B3ABCB19D25836B2255990F0871294B57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686481, "uuid": "081aeeb6-e4b6-4639-bf1d-f843fbea2091", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686481, "uuid": "761d572f-909a-4ad6-bf48-676e68f69319", "value": "12288:LMrPy90gDeiPxA1UELx7HOWYgBYClOvzMxY:Eypy0xurLx7FzcMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686481, "uuid": "d371167b-42db-4430-8526-d59a0c8f0966", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686481, "uuid": "ce3e5d9f-9853-49f5-ba23-c282dfafec4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686481, "uuid": "2f2d8f14-bf9c-47e7-bb1f-c1bb613abb6e", "value": "18318b7d398f56d0ed819b0714a5a3db83f70703b9087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad751cf-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686454, "uuid": "c42a937c-4611-40d5-8818-12ed0854520c", "comment": "Malware payload (RedLineStealer)", "value": "f3f7bf466ba089c216b28e4784a2863c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686454, "uuid": "1ec81937-0939-4b92-b0c3-7c5bb12d83ad", "comment": "Malware payload (RedLineStealer)", "value": "18457eaa5c8b0e39a050e6d0e1d53103bd7957521ccafe561fbfdb9d96240025", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686454, "uuid": "23af479c-fc5e-4db2-8f67-0ff1d1a57106", "comment": "Malware payload (RedLineStealer)", "value": "5c1ddfde07afea6a886a660afeb5949fc1629f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686454, "uuid": "a84afa25-6395-4a22-8f1f-a359373f1863", "comment": "Malware payload (RedLineStealer)", "value": "99ab17ac5a49c493071117a63495d62ac20964b65bd49f5d46661b6be915eee313900e3e6f031a481e0920a542027720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686454, "uuid": "9a97a47b-97ea-4629-ba9b-6bb11248e6ed", "value": "T191B40252A7E84032DCF5277168F616831E3ABCA61D38C76B2706A95A0DB31D4B87173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686454, "uuid": "1eee1bc4-fb71-4930-b781-9e886b5985c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686454, "uuid": "00548e9c-7285-44b6-8357-bba932b6de06", "value": "12288:8Mr/y90fyCfz1OCagDkpV+gBYC4wOslNW3R3PcQ:7yiqqCVdz08ufv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686454, "uuid": "172eb203-0a24-43af-be4d-4b0e1789c5ba", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686454, "uuid": "b7255852-a2a7-45a0-9928-b1a232c5d9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686454, "uuid": "65180abf-5889-443d-9913-b7d4b2b1f2e1", "value": "f3f7bf466ba089c216b28e4784a2863c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04572ac1-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686792, "uuid": "ddaefe93-c085-4bf8-b823-5e132405db89", "comment": "Malware payload (RedLineStealer)", "value": "f6b37ffefc65d2ed8547e2fcbdcd31be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686792, "uuid": "d4b6cb42-7912-451b-af01-de451cffae32", "comment": "Malware payload (RedLineStealer)", "value": "1869ae95d00347ca04be01b1578c94e0068f539c3dceaaa4c9610b480d6bf694", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686792, "uuid": "dc34d402-6465-424d-92f0-59b1fc0147b6", "comment": "Malware payload (RedLineStealer)", "value": "e5c6953142addb3675c099b6c0b5d96c98e2315d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686792, "uuid": "ad14ab69-862f-4279-802a-333dfa59e94e", "comment": "Malware payload (RedLineStealer)", "value": "400f13cad877ba7624129c2a29e94be517a91c941fa8d88e5923e1599407b602d73f990b64efc0fc9dc76f7605e11518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686792, "uuid": "505e1e70-b3d1-459b-9bd2-70f3e6b9d74d", "value": "T12FB41211A7EC8473DDB917B018FA16830F3A3DA15D7582AB279A990A0DB37C5B53133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686792, "uuid": "9f38ed96-3736-477e-89d0-fc5d63a0df49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686792, "uuid": "efc1ce18-1cd0-41ff-b568-0b67c5e3476f", "value": "12288:6MrCy90R2quG/BfpiExWIuAnWCoSsE7hN5JN6ciD0IeP:4y82qDBxRWCW21N5TcDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686792, "uuid": "1e2ff8da-3df2-477e-a494-8577c25ec000", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686792, "uuid": "3f7a1887-5632-491b-9b8f-48e365ce77e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686792, "uuid": "2c01ee91-0a2c-4c61-8011-aa463b1bb2c6", "value": "1869ae95d00347ca04be01b1578c94e0068f539c3dcea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af33cbf-2ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690698829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698829, "uuid": "55128e43-5407-4481-9f14-193ddbbec467", "comment": "Malware payload (RedLineStealer)", "value": "54e7df4916bf586765164b437794adf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698829, "uuid": "add30f0f-2399-4115-9922-21bb48afcb54", "comment": "Malware payload (RedLineStealer)", "value": "18d03c0fca5d94d0884d8c49cb21bfb831e19925480f3c3cdab30859021a2d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698829, "uuid": "18270985-bfd3-4751-9099-fdb953e27299", "comment": "Malware payload (RedLineStealer)", "value": "bc43b65cac65ca3ae5e2e4b90ad6fe23c47a880c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698829, "uuid": "977c0f35-7018-4803-976d-cc1c027bba6d", "comment": "Malware payload (RedLineStealer)", "value": "34ed74e7367ac9ad9034da8f9e23b6e07b7617b6c3673dd53dee773ba35c9742bb3420e4c6db257effa95935b7016331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698829, "uuid": "c4bae052-fc89-43cf-a452-33d1831e4cd4", "value": "T12FB4121277D88072E9B5677169F212930E36BC625DB4436F378A682F1CB26D0987273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698829, "uuid": "e310a18a-987e-4451-b83a-9b0eeceeb579", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698829, "uuid": "a0a3a943-badd-400f-ba46-7dab738e1c12", "value": "12288:rMrVy90NCtF5mgF7ab0yspnmWrbFiqgBYCIzqXsjVc:KyxfJF7w0yspnboZzA0sC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690698829, "uuid": "66a4a958-113c-4c90-85ff-b6312046b437", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690698829, "uuid": "d8671360-ab6a-4228-8ed2-a137fed63c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698829, "uuid": "4707dcba-9c65-4e13-bbfd-d152d2afcdea", "value": "54e7df4916bf586765164b437794adf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ce5231-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686798, "uuid": "e7074585-925f-4bc4-927a-1a41068158a3", "comment": "Malware payload (Amadey)", "value": "be4c465bbdb38288e96137894f1cb137", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686798, "uuid": "ddac18b8-6800-43c7-9f4d-f0326665ea28", "comment": "Malware payload (Amadey)", "value": "1984500308101a791019acb978621a31530f8564f4afcfbe43fa22cb68dfd117", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686798, "uuid": "1334e725-f0a7-4fc7-afb3-1e451546fa89", "comment": "Malware payload (Amadey)", "value": "25716fe363939adb5b6a4e07588b38fd3405e826", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686798, "uuid": "fd9e75b6-a252-405c-bf0c-db1be7793370", "comment": "Malware payload (Amadey)", "value": "00027ab94ff4c1b30812b5210415abba33b13051a20f0957ff040057f7625adcc2fb397be96393aa433ebe2148f6b7db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686798, "uuid": "05b7cd60-1762-4f26-a53e-f74c42d66336", "value": "T1C8B4121BEBD89071E8F523B059F716C30E357CA29D68876B2786945D1CB36C8A43236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686798, "uuid": "74ced606-f017-40a6-a08d-a96a241a5009", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686798, "uuid": "543d7c68-0f92-4e35-a865-3bf882872ce2", "value": "12288:7MrFy90XU/DZZ/vipDtcyUNUgBYCIELFQDfXL:Syb7ZopRUxz3FuPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686798, "uuid": "61957f35-493d-4aff-bf57-6d1c9f84051b", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686798, "uuid": "8a145680-c709-4285-8a20-f545f5589f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686798, "uuid": "0d7286e8-d36a-4098-aa9a-d670dae56453", "value": "1984500308101a791019acb978621a31530f8564f4afc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63e4386-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695224, "uuid": "898bfb5b-e716-4657-815e-41e66eb030e4", "comment": "Malware payload (RedLineStealer)", "value": "d080dac5a93f38305f89e638d74e40c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695224, "uuid": "6f49df87-bf8a-4a98-97be-e271fa3fc1e7", "comment": "Malware payload (RedLineStealer)", "value": "1a2da7655be305e21f3b54177f438edc6d5e97d527b98712d41dab199bbbd997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695224, "uuid": "23cd818e-17b8-483e-bdc6-e9fda1d8127e", "comment": "Malware payload (RedLineStealer)", "value": "ef18667a19c0f64248fcf64b2b20b039adc4ebf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695224, "uuid": "b2102265-5262-4e0a-b8a6-05894af45ec1", "comment": "Malware payload (RedLineStealer)", "value": "ead20e97014fd7646e5605ee5a7f6321bf2cd39138bcb56fd0ac5c06eaf6bd3b60f7583e5cc2ba7a128818f1ce936912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695224, "uuid": "c67f5543-49ba-4c17-b2a4-7e1b435afd7c", "value": "T18CB41206A7EC8032D9F517B118F727830B3A7C929E78926F2749A85A0D725D4A53273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695224, "uuid": "b64f67bb-d21a-4a33-b9a3-47d7bed4a558", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695224, "uuid": "c0300fd5-9e0e-4201-8380-79ed0434157a", "value": "12288:nMrry9071ddtj0MO8k+gBYCOYj1Q0aYP+PTsJ:8ya1BE8kdz7j11aYgsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695224, "uuid": "8a58d3c4-4d96-404d-8c51-ec5e7ff415bd", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695224, "uuid": "40f1ebc7-200d-454b-a1b9-5500a18954ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695224, "uuid": "047ad87d-f01f-4b44-bca7-90571a41d203", "value": "d080dac5a93f38305f89e638d74e40c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f17649c-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686166, "uuid": "4b7b914a-8414-4268-b4bb-c7826a1032e2", "comment": "Malware payload (Amadey)", "value": "ac036f564bc2eb097955ab4945b3dc70", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686166, "uuid": "0bab10e3-b382-4066-ac3d-9d35d4938fdb", "comment": "Malware payload (Amadey)", "value": "1aaec5fd875ad632f0a2f999791b0f07a4e29d4e54f3bb23e9114ef455766325", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686166, "uuid": "734b03dc-cfe9-4dc8-afba-e692803de287", "comment": "Malware payload (Amadey)", "value": "dcb3c8f605cf6065fc5397e364d35801334b07b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686166, "uuid": "8488edb0-b3c5-466d-9abd-ca07a93dec30", "comment": "Malware payload (Amadey)", "value": "45b0b67e61ffb289060f655370b9d0d5bf9793a6edee3d5b645d13d9adf070320eb65980512e2de605ba47c96673812a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686166, "uuid": "7d38c150-2479-41a8-94ef-98c8583d8645", "value": "T159B41256A7D85233E8712FB468FB12830B36BDA14E34635F27855C5E0C72A90A5B237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686166, "uuid": "73cf9d8a-d377-42d9-a93d-e9ac38d507de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686166, "uuid": "7d156a6d-9871-4c86-8a67-3a717bbc4ec3", "value": "12288:2Mrly90K0O87hFdEFIksLoVK+opNUIII10c3qeuzNB:DylH4dEuks8M+SGI11qeEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686166, "uuid": "46b15fb2-92cd-448f-89de-d2e66a68943c", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686166, "uuid": "19cc1f74-860e-4674-b67d-92406d855349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686166, "uuid": "869fab4c-5681-44b2-a718-a09c2c98f48a", "value": "ac036f564bc2eb097955ab4945b3dc70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77bae41-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685831, "uuid": "631f5bf1-3261-4005-b381-273c74eba246", "comment": "Malware payload (RedLineStealer)", "value": "431fca845fbaaeafccf2c5e4597cf032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685831, "uuid": "87218f55-686b-44fb-b36c-401bf976c5f3", "comment": "Malware payload (RedLineStealer)", "value": "1acc7b516d017abee8fd2f120308e232d8725b9ef9095a784e308353a0704156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685831, "uuid": "3401c478-7bb1-4c06-b25a-f83fdc2f38a7", "comment": "Malware payload (RedLineStealer)", "value": "39dd94cc449c2a457571f711ac73c48f1c2bd0ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685831, "uuid": "678a0eb7-f4b6-4538-af7b-7a3bbcddf636", "comment": "Malware payload (RedLineStealer)", "value": "4c03531593706cfa23c83509156fcaa41a31171d66f445de30ea19396f97ee6b1887552f9436716278fe8619990525a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685831, "uuid": "f327f259-7312-4e75-92a1-7e8e07966897", "value": "T16EB41202B6D94677D4FA2BB06CFA03C31F367DB16C70939B27615A464CB3694A53232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685831, "uuid": "2e49d619-16a3-4892-9082-df666e315ba8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685831, "uuid": "b9bfc41a-1f64-4677-9b58-6636135e6ccf", "value": "6144:KXy+bnr+Jp0yN90QE5h8nHm+8IMxtenEBVkZvpaVEF/seKAsyFc6dYkcGaeCmqsa:dMrty90D+JMxeaGqeNFcEYSaev5VEsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685831, "uuid": "9d1c4cac-df3b-4584-8e00-21a274c9e95c", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685831, "uuid": "b551dac9-ac98-45e3-889b-71e1d06f4a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685831, "uuid": "8f9ae97f-b96b-4924-90b9-7ce578f0974e", "value": "431fca845fbaaeafccf2c5e4597cf032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e2dbef-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686142, "uuid": "d9ddf517-8efb-404e-8807-819104d2030e", "comment": "Malware payload (RedLineStealer)", "value": "91ae6d03b67711050c874a7a0a8101ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686142, "uuid": "c90bfb6c-22bd-448b-bd7e-c8b01da8fefc", "comment": "Malware payload (RedLineStealer)", "value": "1c2a414d51f1d49e08ee1b3138d922a4c1d4ff2461871969dda7a618f32ed7bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686142, "uuid": "f2823ea7-de48-4535-9810-43f3581e37a4", "comment": "Malware payload (RedLineStealer)", "value": "06b1b5ef14986b45cb1db4b3c2f43cddb13b1ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686142, "uuid": "6dde7263-f5c3-466c-8d1e-fc6cbcb30b5b", "comment": "Malware payload (RedLineStealer)", "value": "2724160aeddc31ac2a26cc811601ae969849c1d700f49beb4f9eb9c6f507fc3e9fe82b2e0d267c3a5c87f3641ecda0f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686142, "uuid": "c029514f-6e3f-40b1-91c5-4174b472905a", "value": "T14EB41203E7D89076D5F527B06CF706D30E32BCA34D78A3272759696B58B2684D93232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686142, "uuid": "941b8e0b-a29a-4dbf-a067-34ab384efda6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686142, "uuid": "06f7693b-deef-4aa8-a195-852befdb584f", "value": "12288:gMrny90HGPSO5ZCQw2+RxORdJLbrzXgBgBYC6MUkLN0T:3yAdO54QExORdl7XgKzkkBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686142, "uuid": "3d13836f-7295-4030-b437-d160bbd68658", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686142, "uuid": "9a0f924e-3537-469e-915d-b54f404fdf7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686142, "uuid": "29c81586-d5d8-479e-a31a-70f60a3c997a", "value": "91ae6d03b67711050c874a7a0a8101ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7240ee9b-2f24-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690754407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754407, "uuid": "f02cd4b9-233f-47f7-9692-f48308179e75", "comment": "Malware payload", "value": "2ec70b44cd4db9a172ed3e59b566d4de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754407, "uuid": "b32f9f0f-ff06-42b5-9654-2a76a01cdc37", "comment": "Malware payload", "value": "1cd60a0e6cd485bfb3c80262bf805927ea6601f2a38d8034787c50d59e580642", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754407, "uuid": "abd4de7b-003c-4ab7-b585-453a9ad21b7f", "comment": "Malware payload", "value": "be251c6cc33d738bb1dd610dc99aed59e65a6969", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754407, "uuid": "8fd47d3e-c6be-4fd1-8b5a-57fb0996fcae", "comment": "Malware payload", "value": "e611f11ef3066f3e3ba5513f9a2427d13ae167b05e9b5f0cc3f75ad7073ee74a6a5b0634cd637898bc481729d228b856", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690754407, "uuid": "3e0ef5d9-907d-4674-914c-a42a41bd734e", "value": "T14B733B81BD816D13CAD5137BFA6E01CD332623D8D2EE7217CE126F11B78A95B0DA7252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690754407, "uuid": "cbe0661d-9c3b-4bcb-bb8e-3fc4511b9a98", "value": "1536:W6XgPW5wR1cTRX/DRwbM/bp1xiSBZRLEhcAuv7OwbZnNI:WCgPW5wjcrLzp1xiSBMS77OwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690754407, "uuid": "3122b7cd-ab98-4e6a-b50c-d9e27aeae031", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690754407, "uuid": "045067b8-2dd1-44db-837a-63fcafafb998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690754407, "uuid": "f7294a9d-fe36-4d3d-ac51-fb69a6d81fbf", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3527fe-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690687072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687072, "uuid": "c15fa033-c696-4619-985d-9fc24e0311af", "comment": "Malware payload (RedLineStealer)", "value": "4dc67e15b3e20aa084930ec9ddaeb76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687072, "uuid": "b608b8c2-251d-477a-a3c8-7d9fbdd203eb", "comment": "Malware payload (RedLineStealer)", "value": "1d1758c6cc44abf10fab7d665f25a3e3a7e9cf3f53bebd69ecd43b59570c95c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687072, "uuid": "4c56fb18-fafe-4122-ae4c-d3f948d4dee7", "comment": "Malware payload (RedLineStealer)", "value": "0d3de51b5f304550cc6e1bbbc9899563e7d1f107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687072, "uuid": "a4fabe11-2e6b-4fe1-9192-a028dbe09de9", "comment": "Malware payload (RedLineStealer)", "value": "6603666f925f6592a7cf3eab17185bc74d4d1cd3e89f076f00ca474cda913b1f9e4c3d83fa3f6b8f9d783a043c2f2872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687072, "uuid": "2cf35406-0a51-4877-b409-7cfe12c5867d", "value": "T11FB4125BA7D99033C9B41BB028F707C309367C615E7857AA37A5E85E2C72250A97332F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687072, "uuid": "ca64a5b1-f5ef-4c93-a45e-3e72c84ef53a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687072, "uuid": "d86b9f97-aa3c-407f-9197-262d353bead7", "value": "12288:WMr7y908odn3VNjg4N8xhF+Pdph81ewgBYCnGLpgv/I5d:dyzodnXg4EF+PdpBXzO+Ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690687072, "uuid": "75a31a51-39fa-4b1f-9e76-22869748020e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690687072, "uuid": "d56d4b8f-0de6-4ce1-8147-cafe73ee2f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687072, "uuid": "b0d36683-3962-45d6-8eef-64d6175e8e5d", "value": "1d1758c6cc44abf10fab7d665f25a3e3a7e9cf3f53beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdd1627-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690701226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701226, "uuid": "0e266981-23c2-47bf-849a-23ddb35473a4", "comment": "Malware payload", "value": "e7d8826047b8ced9cd05c8e07cf30826", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701226, "uuid": "a4ffb35a-d96a-484d-a0f7-455988fd967a", "comment": "Malware payload", "value": "1daf66caadb5caa815f0f483f5cfc9daac5951746ad16025da765662723c366a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701226, "uuid": "d71e51a1-44c0-415b-9cdb-e3c3ecb4a762", "comment": "Malware payload", "value": "eb0099d2afdf52c0d33ef006e094ef9f082d0304", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701226, "uuid": "f125b997-97fa-4d17-903f-8bb7184c1cef", "comment": "Malware payload", "value": "f4526db87655f1bdcd8ac4e29bf2484ae903050f9c3bf4063125a6abd3a80f6eee54b6cbe35760e3d6d1deb8cbbea232", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701226, "uuid": "caa745cf-7fd9-4825-b83b-bde629fa700a", "value": "T12EE4231FE97C89C9653E32BA430502A6EB5D66EC4AED6D8F41EC3D53EC442C64DC6350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701226, "uuid": "c3ce5cd1-75b5-4307-b346-812ebd6e3853", "value": "12288:aDZkhsBJcyoleSEY98v2rCQIY5M248cSYJWcN9DH6aJz9CUVGIobMwXHZj:4khsvcLvw2rf2umPHXxCUlobMwXHZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701226, "uuid": "e7eabf52-ba0b-4e39-89da-149df3d60fb6", "value": 704981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701226, "uuid": "d5b5b148-43d3-4056-94dc-b2567dbd6a5b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701226, "uuid": "5d97a0c5-5f4c-4c4b-a9e5-88a5805c0e5c", "value": "DHL867888_factura_commerciale.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff61d40-2e9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695509, "uuid": "6278ced3-8c81-41b0-b0e4-9337eb1d379e", "comment": "Malware payload (RedLineStealer)", "value": "d48adafad5b1f9f7e129b777314fb079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695509, "uuid": "1afebc6f-a533-44f4-82f4-183ca4a22d7d", "comment": "Malware payload (RedLineStealer)", "value": "1dfb7d8d7666ce84baca0539532914e71618edc5230729189b68d2475a5b1c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695509, "uuid": "8436bb71-c8f8-4173-8abc-e9b6007d3ff9", "comment": "Malware payload (RedLineStealer)", "value": "da8f819fd2d2a3e128f68c64f6f876a4338f155a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695509, "uuid": "99ba8817-4417-4f6c-9f62-8988607b1a22", "comment": "Malware payload (RedLineStealer)", "value": "92ed649874ee44ec10e70a1182b24cf43ba9161ed355b47eb303cc9e2e6b871243ffe01c17234653633e26e0c0081f69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695509, "uuid": "51904585-dd41-454a-8dd1-f2f7b1a1c3a7", "value": "T186B41252A6EC5473DCB0177088FA03830939BDA49CB9972B3706996F4D732A9E4B1737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695509, "uuid": "333568c7-fddf-4248-9e0a-d754ccb29a3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695509, "uuid": "0190279e-185c-42c0-9abe-eedf06e5f357", "value": "12288:ZMrSy90ziNz5DhQEViKMnZ/RmP1S3gBYCym+PCgRV/O:HyoiN7QFn+PpzUJRVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695509, "uuid": "5a641ad2-d896-434c-a7d7-4bd4fd339cea", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695509, "uuid": "d20895ab-34ba-4998-bf40-c947400f0551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695509, "uuid": "825903b5-cd0e-4e5c-9b2a-0b0f52a2cce4", "value": "d48adafad5b1f9f7e129b777314fb079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0da557-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695210, "uuid": "de4df11a-c056-4e21-8730-5b5f54428070", "comment": "Malware payload (Amadey)", "value": "f5d5b08236b50260abc14334f88921e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695210, "uuid": "95d737a0-92b3-437a-b939-ad892dc6c4c1", "comment": "Malware payload (Amadey)", "value": "1e1baedc799421e118a9c01ff74d53723fbca15c614e4ce1fc7e2b150115aefc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695210, "uuid": "5dfe9e2d-55fc-4262-9aa6-d2ed5616bec8", "comment": "Malware payload (Amadey)", "value": "2b3e20f00708822c30fa7d0fb1134ef7f9a86893", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695210, "uuid": "b7037490-1c4c-4719-be29-16a2c3c1c276", "comment": "Malware payload (Amadey)", "value": "acbc7c3852ca4f1d7fc2f235f9899a134dada149471450a78afea9ae943901b563c8a49c20cdc6a0dcefc7f49e31a59e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695210, "uuid": "85345894-2b7f-4b41-a306-501ceb84085b", "value": "T1FDD41203ABD88073D8B71BB059FA43C70976BD914D38476B3B85995A4D73AC9683232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695210, "uuid": "a66be0f2-3be3-436d-ad73-0ee4cc296a65", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695210, "uuid": "7f010499-f95d-4062-84e2-16dea5d0a581", "value": "12288:zMrzy90r08vH7zWKnHJ0U0RfYFbCZICfDJ+6gI9eOXEHNlb:QyBkbiKpuJWbCZIwJFggcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695210, "uuid": "c78b69c4-b674-4657-baa5-87f4bccd3a3c", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695210, "uuid": "7d13acd7-9285-481b-b964-bb784bb1666a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695210, "uuid": "1077b055-eed0-4c69-a1ca-f5adb796ffb9", "value": "f5d5b08236b50260abc14334f88921e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5264ef83-2f15-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690747911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690747911, "uuid": "f04e8699-6d35-49fd-ba83-a11d3f0cea16", "comment": "Malware payload", "value": "ede339007fe74df17f40383dbe239e0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690747911, "uuid": "f5ce90b0-8413-4a90-a371-6f94ef76b113", "comment": "Malware payload", "value": "1f7ffb0a6a58be3ea87b8604e61ea0bc5372cfdeabf8f92efab2371e42e45338", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690747911, "uuid": "2a0125e2-0297-4147-9241-ed0719494284", "comment": "Malware payload", "value": "06f3ee169180266cf6b4425eae785dc6295aa7ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690747911, "uuid": "0c7f7160-d91b-45f1-86c5-e8849a745f2f", "comment": "Malware payload", "value": "9d46f78fb0e9098ef3c134134ed7e7c7b8bec6b825e94035abe20b1249fe8e1a4f4bcccbf9cfb54092831a7d3b39a95c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690747911, "uuid": "a95676e6-8032-4ccd-8c8d-c69e843acd91", "value": "T13F3412E011F5C7118A5550B39036EFF8D1D3B4E6CAF0D78A59832B2D5A69E340B7AE0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690747911, "uuid": "8ee9a56b-609f-4b1b-be56-f66956e21f0d", "value": "6144:l03ahoiZy+vUsHvfenYBJq+xTmRclWlV3MOuEz7wn:63ahoeZHOYCaK/VcC7wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690747911, "uuid": "1ee0a92d-f88a-4bd8-b1f8-6a0566f37fb0", "value": 240684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690747911, "uuid": "3a67feb8-6adf-4d46-bbcf-4144c2083d0d", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690747911, "uuid": "c298fcf6-aee9-43d9-9169-4732b15c2882", "value": "1f7ffb0a6a58be3ea87b8604e61ea0bc5372cfdeabf8f92efab2371e42e45338.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b2c68b-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690701095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701095, "uuid": "5fe35333-ee24-487a-865d-b80f9c2b468c", "comment": "Malware payload (SnakeKeylogger)", "value": "61f0c8c06eb896f0960942787f0a995b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701095, "uuid": "e6421d2f-1fa1-4379-9f06-5d3e441ae6b5", "comment": "Malware payload (SnakeKeylogger)", "value": "1fc85be0ecedf0ea672810638fd7cba72f5182501781849c4a5ad7ff092fc4c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701095, "uuid": "beab91ce-cc99-4e3c-ab2f-d62f811d2c3c", "comment": "Malware payload (SnakeKeylogger)", "value": "e90b0bc0e6b4ece12d3d5fabeea1274937196d57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701095, "uuid": "8722da2d-b7f7-48b0-a951-7dc4d5e56e4a", "comment": "Malware payload (SnakeKeylogger)", "value": "212d91ba324a6bc40616b13deb0ebb5af9bed8734749227fbcdf803d55d5d13b65e96353d729cec212a1f4434c4cf177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701095, "uuid": "e086b495-6d3f-49bc-a684-f0227e5bb6d4", "value": "T135D31A1D27F8C800E5FF8A7705B16212C776FC421A2ACE0D5AD2F55A1A7D7908D1AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701095, "uuid": "e4187d54-d25b-4a11-a5e6-0d2c359e6e2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701095, "uuid": "874ea9e8-2af2-4fdc-9df2-79bf753c92b4", "value": "1536:6jdKxVAyl01IZBCq3UgLyYMFUEJJEZomubb/ztT8aVtpiOWBVjN3g0Kcl:6jdK8uyk4q3UgLj3yb7r3wBVjN3gbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701095, "uuid": "fd8fd692-2762-472a-bac7-03f35c0f1748", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701095, "uuid": "6f29c99e-dad9-45d1-bcf4-02840d013649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701095, "uuid": "52d5a45f-b76d-4e56-a6e4-edefad53a3fc", "value": "61f0c8c06eb896f0960942787f0a995b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70431400-2eb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690705441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705441, "uuid": "6d3d6bfa-6c4d-4991-9730-700e3e356d51", "comment": "Malware payload (RedLineStealer)", "value": "5a41bbace914d9256ca4a89d720d0952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705441, "uuid": "e4c58c3d-6655-4797-a2f6-2a877b9afbd7", "comment": "Malware payload (RedLineStealer)", "value": "1fe6ca4f2864852e7f2436b13b70092802cbe67fa06d118eccf34b1555825ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705441, "uuid": "8b55b5d7-f195-4b65-a96f-96b0de097e9d", "comment": "Malware payload (RedLineStealer)", "value": "e62e4d660ec82b1090e41601edff4ebb6799f941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705441, "uuid": "f12fb846-4190-45b2-a252-efd6d822f068", "comment": "Malware payload (RedLineStealer)", "value": "23ffec013f2fa1a7140edc08e34ffa9d67c803bc62d360d870b6088f920913339be079cb0f5fa3ab78171e9a7c2df17a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705441, "uuid": "6a84ad8a-970f-4031-b134-a4645b8179ad", "value": "T156F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705441, "uuid": "19baa503-0e03-4354-8e0a-3720602b6006", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690705441, "uuid": "eace99ba-12ae-4d18-9421-aaded363122a", "value": 35491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690705441, "uuid": "0c03a8c4-7dbd-494c-b7ef-1f122f361710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705441, "uuid": "52f0174a-7b5b-4ae3-b537-c22e7e2d2980", "value": "5a41bbace914d9256ca4a89d720d0952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20649726-2eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690708743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708743, "uuid": "f42fb390-2da1-4d1b-8134-6b75743ebc5c", "comment": "Malware payload (RedLineStealer)", "value": "d741d3f1068ceb2afde415d480ce7968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708743, "uuid": "9342c30b-1d65-48df-9ecc-57ff55940337", "comment": "Malware payload (RedLineStealer)", "value": "21791ceda0b7ca9ef4a060d1642bb33cced9de00af7e5aa4230adb8278c6d669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708743, "uuid": "4ef449e5-6e85-43d6-9800-5adc8f3f6ee2", "comment": "Malware payload (RedLineStealer)", "value": "cd13c2fe926b070a167e9a3aeab01b98700afa63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708743, "uuid": "bbb40404-18ee-4bfc-aad6-5d400a496532", "comment": "Malware payload (RedLineStealer)", "value": "e8f12c3382ddabaab48c54fbc26a6a4815929a3595b27d581278e759853d0707ea9211f3386d6c58b7298926eb17b961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708743, "uuid": "67d93975-0f18-46bc-9404-25df25a95731", "value": "T11FB41213B7EC8172DD761BF01DF912C30A367DA29DB4836B2751A98E4DF2680987136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708743, "uuid": "d3718cf5-bd40-4c73-ad4f-c9d96c8d5141", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708743, "uuid": "55603bd5-fd4d-4ef3-b1c1-bacacaf81fa7", "value": "12288:5Mrdy903IgTWbosV3FmyQlE0E3iSkSQ/1CRF9mj:syLxE7l2GvOF9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690708743, "uuid": "1eb5b429-ae06-4389-bb5f-ffd567c26c40", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690708743, "uuid": "37dc526c-89d2-44f5-a096-3e282fb81ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708743, "uuid": "85165f17-d4f7-4b5b-bda4-b150fe558047", "value": "d741d3f1068ceb2afde415d480ce7968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889f6ad5-2ec2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690712354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690712354, "uuid": "1c4eb466-2154-4d51-ab70-763b59139347", "comment": "Malware payload (RedLineStealer)", "value": "16707a4f6c2ad3d006c4a94345aafd86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690712354, "uuid": "f12853b0-9262-4d6e-886a-b8eb6d7292e7", "comment": "Malware payload (RedLineStealer)", "value": "21aa2ef4cafa682fa998d708f8a668ec96a044d816e2f9ccce3387d7a81f32c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690712354, "uuid": "6faf2540-0722-4cc4-a60e-9a4143afcd99", "comment": "Malware payload (RedLineStealer)", "value": "904461f067e8f19a988895a71dde26519529cb35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690712354, "uuid": "5e410014-1eda-4bb4-b6a3-c534f7fc5026", "comment": "Malware payload (RedLineStealer)", "value": "db3419698041f381572a796031e9874b825cc9447145693b4cfe4aa31eaa5b0568b2030e633bc5138f08e303cc79a7ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690712354, "uuid": "7f6f6142-7faa-4e13-80b6-0466870ed267", "value": "T1B4B41217B6D88477D8B61B7018F706A30F397DA00978D3AE2789D85A0DB36C4A93573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690712354, "uuid": "4f53de64-97ee-4668-bbd2-288413bdb337", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690712354, "uuid": "402a22ff-3335-4f63-9343-e0b56b25ebe0", "value": "12288:vMrfy905IPhY2NMNziEQhkkudDPhSm5wus:QyPP22yz/y3KDPQm5wT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690712354, "uuid": "7bac21a2-2395-4da8-8559-f8cb5defc529", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690712354, "uuid": "b990b9ba-3fcc-4027-9e5b-f419bb9f4842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690712354, "uuid": "834e5980-42a8-4334-aa28-9c42132ca603", "value": "21aa2ef4cafa682fa998d708f8a668ec96a044d816e2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a96ac6-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685853, "uuid": "4699b6a3-06fc-42f8-866e-a12685e0d377", "comment": "Malware payload (Amadey)", "value": "53261b99c986de224265a96deb2ef154", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685853, "uuid": "43a57c7a-3d50-4130-9599-1514680dff5a", "comment": "Malware payload (Amadey)", "value": "23249a373a56f69eb857e667b57f810ae9f984e5ff6f52021a97961f36a4f961", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685853, "uuid": "91920892-7eb8-40be-9195-d15255c9f602", "comment": "Malware payload (Amadey)", "value": "643006b296c2def80782d1500190836a86a90965", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685853, "uuid": "6b090de5-1f7a-4c2c-860d-8a3f448ec3e7", "comment": "Malware payload (Amadey)", "value": "27ebfd49623542246cc8919280f6072567aac5d9e37c7cb41efd094a3e0e124de873dc4c5c19ec1675bf1c07ed6024e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685853, "uuid": "3b8cf9c3-9883-474f-9d36-b129334692d4", "value": "T19CB40253FBD89526E8B027B04DF347A30A367DE08C38A2672B55994E1D736C0A53637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685853, "uuid": "6d3b68ef-24ea-48f4-a2a8-76db29d70f0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685853, "uuid": "b6433204-f0ca-491b-9efb-4477675acf20", "value": "12288:MMrHy908VbiKQfMhiIrvKA213j6rRVQ9O2FSru0:jyv1rv66r7Qo2F10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685853, "uuid": "86020dd9-d26f-4164-a3b4-e94824f7c3d4", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685853, "uuid": "3a8517e5-13dc-429c-b412-e086cac68400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685853, "uuid": "aa8de11b-c338-4126-a743-de0dcf676cb1", "value": "53261b99c986de224265a96deb2ef154.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88761c47-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690709347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709347, "uuid": "b761929e-67c6-4e60-a714-da063ba44158", "comment": "Malware payload (Amadey)", "value": "5fc47ac851b79dce4a45a0c1effaea67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709347, "uuid": "98755166-5fe7-499f-9cc3-16e8db80504f", "comment": "Malware payload (Amadey)", "value": "237f30c9cbb71ea8662ad5b0e5c4d013346829820e511b35b0a8e7e021cfbac8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709347, "uuid": "ba695d62-f9a7-4e95-b853-3ce1e3616fd5", "comment": "Malware payload (Amadey)", "value": "765c7b66ec5be446002e7e5785f810408cd5cec9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709347, "uuid": "b97174b0-5611-4825-8c9d-5816ddd59b37", "comment": "Malware payload (Amadey)", "value": "09e8948fef59640dec87e8d46f71fdd09959ead857f3e366c5aa4a878968fb9533773aa843da17dd6863378de8c37a60", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709347, "uuid": "43291b53-cfa0-4ce6-a9ef-99814ba43b95", "value": "T18DE2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709347, "uuid": "fee54d9f-1603-4e17-9d99-c90ce7e79585", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709347, "uuid": "e459b747-c372-4340-bee3-cdcb51a18b7e", "value": 33311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709347, "uuid": "5eab247b-7970-48ae-b0a2-ed2802391705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709347, "uuid": "fb354d16-87aa-4e38-906a-6b948486e5c4", "value": "5fc47ac851b79dce4a45a0c1effaea67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0838a0-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686506, "uuid": "f516feb3-113c-47f5-9ff9-3a78b0421450", "comment": "Malware payload (RedLineStealer)", "value": "4f981dc69cb62b778bf836044bbdc013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686506, "uuid": "1e84da1d-df09-489c-b3ad-8458c765993c", "comment": "Malware payload (RedLineStealer)", "value": "245a853886540f9639fa4d02dfbc1af89fa6eca95efa68b1eb27b3a8a0550bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686506, "uuid": "5f8fd075-3d93-44cb-9b6a-6f7aa9b45432", "comment": "Malware payload (RedLineStealer)", "value": "6bbb2f7c9f719679e71a089d4ee8747217c1d8d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686506, "uuid": "4d7b22c4-6535-4bd7-ae00-1fcbb09af3d7", "comment": "Malware payload (RedLineStealer)", "value": "8ddedd8b07586f17a12a54e0237d604b35ca203617a8334a12c97c3bd59d3687dadea9b5b3c024aa463b3b5977dbc880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686506, "uuid": "22db4cc7-334b-4004-bdc9-0bca4d000709", "value": "T1D4B41202BBE94132E8B11BB059F307D71A31BDA29CB8076B3795991D1DB26D4B932337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686506, "uuid": "060117f3-0129-4360-bc6d-c084b1388841", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686506, "uuid": "fd528986-48df-4f65-8e7b-1969880cf3a8", "value": "12288:1Mr+y90I9reU0cC5U+dIaAXEVgBYCvGuOMNj6JibN:vydAV5UoxTOzuUUiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686506, "uuid": "7d4ca2fc-1a11-4c24-923b-f60d46f2a6c1", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686506, "uuid": "58fa0087-19ae-47b1-a2bf-3e73f9c455f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686506, "uuid": "d2226057-4b78-4c29-bbee-9d7c713a0b00", "value": "245a853886540f9639fa4d02dfbc1af89fa6eca95efa6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f9261e-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686788, "uuid": "d1b4174c-3034-4e3c-97d9-d96b3c7c4268", "comment": "Malware payload (RedLineStealer)", "value": "c3554e3a661818dfa410d630401d011d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686788, "uuid": "54ef8bb5-cf84-4f20-9f98-d782d776f7b4", "comment": "Malware payload (RedLineStealer)", "value": "25b4339ec8ad9c77f6129928315d8bbbe62542004577a7cc322cd1ffb5bc5163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686788, "uuid": "be3fcb55-4e6c-4eb0-afdc-3ed0275c7870", "comment": "Malware payload (RedLineStealer)", "value": "9539ed75d865130dc5677b0dcf4b8160049eecdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686788, "uuid": "1f8be8a3-d1a0-4e6d-bc4e-5affcbfe63dd", "comment": "Malware payload (RedLineStealer)", "value": "1b92e550c15e859a0021338eb48c51aaa867fb0fe0273ced7bf6a52a3b6cdbbcd7aa831fcd0a5f7b6fc8bcc7537bb815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686788, "uuid": "ebb50148-2fb0-4588-b261-e4897cc6412a", "value": "T199B41257B6EC8077EEB25BB418FA02931B36BC609D75539A3B86581B4CB32D4A431337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686788, "uuid": "d43779a8-38e4-492d-966e-8072c5bb7990", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686788, "uuid": "3180b88e-674b-4c67-86bc-fd4279556509", "value": "6144:Ksy+bnr+xp0yN90QEZQcC8jk7FT77R7ykR/k04WG9FUMj0rA8osscRermE3cjQ21:IMrpy90G5Xl4WG9SdrARcRe2jfJKGJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686788, "uuid": "b61c94ef-b923-458b-9808-bbe52ea05f41", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686788, "uuid": "e8188fbc-0ff4-4fa7-a034-273c6c19ff7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686788, "uuid": "2649a4cb-95d1-41d4-9345-d9b652ee5049", "value": "25b4339ec8ad9c77f6129928315d8bbbe62542004577a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c51b31d-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686483, "uuid": "15e64931-42cb-436b-a9a4-db600e87eee1", "comment": "Malware payload (RedLineStealer)", "value": "d067925973bc56fa893166cf5ecb9f84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686483, "uuid": "a5fd4319-d5c0-433a-9e01-8375bcb6575c", "comment": "Malware payload (RedLineStealer)", "value": "25d88e5f146f7ca6d6c1a47085e8d4724f4cf5079ebef75eeefa8d15699d3785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686483, "uuid": "fd145856-7983-426b-9c54-789228efa3e7", "comment": "Malware payload (RedLineStealer)", "value": "fab218bb2b6b101cd9dd036c58eaa520d97faccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686483, "uuid": "6642243e-343d-4551-9951-3de0175db494", "comment": "Malware payload (RedLineStealer)", "value": "151d73c3f6dd360b230e01ba52143f98cd780f4d7c2b29295d2e2dbd8da4013dae947db83bb469a63a3f224ec82ef742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686483, "uuid": "b4cb2297-ef07-48f7-9103-a68f48312128", "value": "T1E9D41252BBD88477F8B0177058F603C31F31BCA28E74472B2259995F9CB27D5A83636A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686483, "uuid": "b677dc0b-d69b-4991-8703-d756ab16239a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686483, "uuid": "88aab15e-7d60-481c-879d-ed59d6c83421", "value": "12288:9MrVy903d9MXc9bOofkwuoxeH8GvJLzmAuR8AXYfLiwoID:QysNlk7okHDvMAuR8BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686483, "uuid": "7a583f38-4adf-4d9a-b4e8-d5f418e63be1", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686483, "uuid": "9688d2a6-b24d-448d-95fe-31c15c80331d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686483, "uuid": "f72df515-043c-4817-abd4-4907b3af64bb", "value": "d067925973bc56fa893166cf5ecb9f84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2479c009-2f14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690747405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690747405, "uuid": "23434fbe-4808-40ee-853f-07ebde43d598", "comment": "Malware payload", "value": "43660f1c334a18bd696dfb283b095aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690747405, "uuid": "c89ca01a-ebe9-4508-b87e-f134d924726c", "comment": "Malware payload", "value": "265a5ffd91ee9ffc780e221ab78c655c10afb9fae8c870628155108856bc088e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690747405, "uuid": "f0124189-bcfe-4184-9a73-83bd67f11e73", "comment": "Malware payload", "value": "e6c31dacb63cf8873f36408f861ec3b16cea44fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690747405, "uuid": "15c93f33-20b9-43ba-ae09-826957e1c578", "comment": "Malware payload", "value": "2a249d9f55285788e10a691e3c70d9c013fbe155786016839d46b90105fb32afce910e7e6caf53be4cf6ef2131668d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690747405, "uuid": "51fab3f1-b1a5-4eb9-adcb-ff5759871ca4", "value": "T189B4F703BE5F8BB1D2650736C5DA010053B6D24367A7EA0EB58E239A1E43BBEDC53647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690747405, "uuid": "12e48a2e-8307-4413-879b-a0cd6c4166d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690747405, "uuid": "445e9563-3632-465f-8551-5ea206338c16", "value": "12288:f6YdzwT97vkI7Xym6FyfVgjdHqKLVywuV+9akNvaGIA3Z:FEj6gfVgZHWkgG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690747405, "uuid": "018b9f2b-7ff1-4f43-b7e9-5e6d9fe98147", "value": 524800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690747405, "uuid": "ff8c75c2-2cbc-450d-b042-e1775606773b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690747405, "uuid": "4b515ce7-c64d-4576-a20a-b5c012fe9341", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9365443a-2e93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690692186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692186, "uuid": "4aa83cb7-8b91-4304-a24e-7e3d3d32d206", "comment": "Malware payload (RedLineStealer)", "value": "f60b66e5773c31612f62874ffba366ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692186, "uuid": "3a181fc5-7d2c-426f-89f9-c2d6ba31b695", "comment": "Malware payload (RedLineStealer)", "value": "266a670322036a24eb98c7d02b010e418c32d9dec178e5180472d6eae8378b8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692186, "uuid": "cfcbdb4a-7af0-433a-b43e-b65f329921f6", "comment": "Malware payload (RedLineStealer)", "value": "dd51e3d74140710cadbbf7851cbe500596024f80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692186, "uuid": "fa3e8616-5ed2-4e94-8097-cd29de7fc31f", "comment": "Malware payload (RedLineStealer)", "value": "667b251f0412a30da2ffa54257a6086d5461a5993ef36f584a5b693b9b57800e8784cbeceebf1395ab90ef8c8dbfcde0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692186, "uuid": "0cf44d8d-d585-4b49-a3a4-c4a47aad9d40", "value": "T1FBB40217BBD85033E9B563708CFA03C30B36BC525C74926B2755A95E4CB26C4A872B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692186, "uuid": "96c39d5e-02c4-40df-8127-843c1bcc27fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692186, "uuid": "e49353d4-e6c3-4998-85ab-e71f7b804286", "value": "12288:jMr1y90jlfRQnJgL58ZnseeWcgpXxzjgBYCfFQOjLZA9j:uyafRGGl8ZnselcgpXFczNwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690692186, "uuid": "d0604e35-9fbd-41af-b5d9-50751ac91273", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690692186, "uuid": "8ba66966-a317-431e-b965-f72386220718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692186, "uuid": "cf0e06e8-ee69-4530-861c-405c46929427", "value": "f60b66e5773c31612f62874ffba366ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d28f80-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690701231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701231, "uuid": "c0f4778f-1ab2-4ab4-bfc7-ff8dea0fe932", "comment": "Malware payload", "value": "23e167de5db1283ee3c5860c6541922c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701231, "uuid": "fe8034b9-f1ba-43a0-b7cc-f82856b82f06", "comment": "Malware payload", "value": "26edd795be24c7e821f4f91bbd40d4dbcd754507726dbb5ab39bd6fc5d1df02b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701231, "uuid": "f81ab530-359c-400b-9a24-93097192903e", "comment": "Malware payload", "value": "707fdc6eb47bd5a9f905f354002d1443ac3994ad", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701231, "uuid": "4c54261a-f31b-4ff5-b8ea-3e47e70725b8", "comment": "Malware payload", "value": "76d22ce322f6c405b16522c1d2e0e8fa338973d5272e4c4cce9c4232a8f48b2be5a52f8fc833a31aa807fbe9c3c48baf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701231, "uuid": "4058e30c-02e1-4015-8382-19323b638eb5", "value": "T1914148151FEB0324E3F39E7604FA631249767C41EE628E1C00809BC418A1760EC79F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701231, "uuid": "e64c9174-8e50-437b-a20a-ca9ddd0d733b", "value": "24:80J/ByUA+fbxPsdB5KRWQ8ckL1vjGdWKRWQ8WH/qNuXz:8Wv0dCf8j1Sdrf8yMcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701231, "uuid": "a7afdd1e-f672-438e-942a-7b7c5fe363b5", "value": 2428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701231, "uuid": "dddec4fd-bae3-47a6-9dba-97c788109169", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701231, "uuid": "f5548474-b1c8-48a6-b796-343226e573c2", "value": "Rosh-Bandara_CV_Dialog.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c556ece-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686134, "uuid": "0224795e-6b7b-48c9-b6ad-92f68f88e6fa", "comment": "Malware payload (RedLineStealer)", "value": "25e585c66dca807ea17e50f08ca7f103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686134, "uuid": "d7c5262b-46b2-467a-990d-4660e8eb922f", "comment": "Malware payload (RedLineStealer)", "value": "28770edc7ee3ce47ef3149dd78320d356fdfdab7815c477c2f43cad263e82c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686134, "uuid": "dceafdd9-47a5-4b95-b8d6-5e0d57d9dbdb", "comment": "Malware payload (RedLineStealer)", "value": "40ec4bbae61b6db2e6589cf55f5c2bb30e45762c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686134, "uuid": "2985b3a5-04b6-4b2f-96b8-7de7748d3fd3", "comment": "Malware payload (RedLineStealer)", "value": "bf0ba946d7839b53eab372af047f7cfbc83aab29ffe89506602a88e6018016d0327b8eed2cc6251e63516f73c568f644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686134, "uuid": "36cba9a5-edb5-4407-8ae0-d0bbb52464b2", "value": "T13EB41252BED88073D9B52F7098F603D31B35BDA598B8872B2B57595A1C73780B93032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686134, "uuid": "9464c674-68a3-428a-ab84-397e75aac74b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686134, "uuid": "6ef3bce9-4c15-4226-a098-602da3f99e47", "value": "12288:YMrry90zMH1IU5oq03ePFrXZit77534dLnmtP1ygMu4S:jyzBP7lXOmLnMP1ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686134, "uuid": "31c97278-9ff4-4dfc-b45c-86eca52684f9", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686134, "uuid": "ef385c52-69ee-4fce-80c0-b6cc1ba6bef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686134, "uuid": "109cabde-17ca-43fd-99b2-d7d5a52057d0", "value": "25e585c66dca807ea17e50f08ca7f103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365c9e7b-2f0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690745287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690745287, "uuid": "46d2cf63-2708-4789-b413-5d5f9ee8e14b", "comment": "Malware payload", "value": "5c7f9d0b24be08ca274624f012c82510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690745287, "uuid": "16463790-2333-4462-bf23-188f114f65d6", "comment": "Malware payload", "value": "2982f67659fb27745ea81b58ec615894e864ccc3fac375173d7911e6018f01e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690745287, "uuid": "75b940f5-055b-43d9-baad-5bb3b6128470", "comment": "Malware payload", "value": "760f0cea24d347c00c590bfb1ab1ff59263dd45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690745287, "uuid": "c1a31984-f5da-4852-9cef-c8463fe49644", "comment": "Malware payload", "value": "83e60d66e40f71784fe63ac2cff1c955333a08b95efec02a0ef8ddada8e5db08a0fe83876f376e962120214ebde4a782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690745287, "uuid": "f5745d4e-6497-4fcf-9893-f3c1ad371312", "value": "T17A44293911A144ABC8A99E35BF4BD8C131166EE401BD944F3FB75E386BC24938DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690745287, "uuid": "a577c97f-ef40-4af0-8932-b3c199efe9a8", "value": "3570242e73e70cc1e0d2107cacdb13d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690745287, "uuid": "b7599d32-262d-4541-a1a2-87fb901a9c16", "value": "6144:E1ym+lc0jWtxg3FSwC76VtloLQnfbUyz24q9wS7+:g2lrsxg3FSwC76VfHp2/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690745287, "uuid": "379d8705-759d-4cc7-948d-f3bc80185071", "value": 258080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690745287, "uuid": "7eb44b72-fd87-49cb-822a-1facbb5495b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690745287, "uuid": "4238c656-5161-43a5-9569-0067c4ba9eb8", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043de996-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685503, "uuid": "e3d0ef81-2ffb-4227-a39d-edd7795bbfef", "comment": "Malware payload (RedLineStealer)", "value": "061504de2e82c8ab737bb4bb75cbf7db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685503, "uuid": "39409f96-04ec-43ff-8276-e05422fa355d", "comment": "Malware payload (RedLineStealer)", "value": "298bbb72d6de069a621bb5f685a5a1c9fa71125a92ec15407ea5ad9c68034d4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685503, "uuid": "e99644ed-57e8-452e-9070-6a7b24eb633b", "comment": "Malware payload (RedLineStealer)", "value": "32ff6a5f67cb3f58630b720cfc65e190bf77d8cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685503, "uuid": "c31b258f-33f2-4643-85c8-c4cdfb13710d", "comment": "Malware payload (RedLineStealer)", "value": "791682f1f4bc4c3cb87886a61bd5ea44b50b974a561a9032ca718ebb6dd5d5759a99d86350a683f52c98dd7b8d3cc305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685503, "uuid": "3111eb7f-6c66-4f00-a5ec-8fcbef9c0f1b", "value": "T1FAB41217ABD89437D4B52BB028FB02831F31BD6158B8536B23469D1B4CB26C5B8B6737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685503, "uuid": "25f1cd5d-27a6-4871-a6e7-5e6e0392f25d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685503, "uuid": "c6920500-07fd-48e1-930a-ab4d79b49a78", "value": "6144:Khy+bnr+Fp0yN90QEqoScMq6oU1iVDQTMK/MBMnbRAdHJsyY1QvS55owK1dmvegg:/Mrty90wtvHidQZ/nok1uWmHmwPL3TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685503, "uuid": "31874884-a83b-444e-b60c-e79c6a347143", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685503, "uuid": "7cb303c3-da04-41bd-bc27-219dd2af1812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685503, "uuid": "a95d65c9-8883-4d21-b802-c297b8d4d559", "value": "061504de2e82c8ab737bb4bb75cbf7db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c387f33-2e9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690696415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696415, "uuid": "7199beec-aadf-4dd4-9457-2fc21ffd8ca1", "comment": "Malware payload (Amadey)", "value": "f78b321e92a0e77399cc27df446d90a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696415, "uuid": "10698410-7572-4b2d-b341-a17154834c52", "comment": "Malware payload (Amadey)", "value": "2a7ccfbb9da9427fa0762557dad748775dd1f5b1f5acde1810e96316fae62711", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696415, "uuid": "5ccc3937-a6e4-48dc-a460-a1656c7f304a", "comment": "Malware payload (Amadey)", "value": "fb5abca16a1bfc97bf97c4f139137e3ad7a184e7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696415, "uuid": "bd9dc47b-9530-40b4-b7d8-b68af7ebe0f5", "comment": "Malware payload (Amadey)", "value": "62b50795c927c772e2941761ea0cde96b6d0062cc4654922915708c382225b6092e39f763ef924f1d585922aef259465", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696415, "uuid": "667b0d08-4938-422f-8a68-b2aa49aea705", "value": "T189B41213EBE99175DE7A23B418F203C30A377D668D7883AA2706595F1CB27C4A53172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696415, "uuid": "f990d676-c0ae-46e6-a99d-114ee3a481fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696415, "uuid": "426bbe3c-25ed-4986-b998-df080c92e4a8", "value": "6144:KUy+bnr+wp0yN90QEP9XWp1mrVGI57N7U2YCAENNsrV/ZyyDEG2mzjNmLntF23YU:AMrYy90J5WKbPAENNM3EG2mutEopqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690696415, "uuid": "dcab62e8-1586-45a2-9e83-eb092d5d4875", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690696415, "uuid": "6194d431-6551-4623-b970-2e8cd3e06c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696415, "uuid": "ab9370a7-dbf4-411f-bd8b-5308a87dfbc9", "value": "2a7ccfbb9da9427fa0762557dad748775dd1f5b1f5acd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115bc727-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686814, "uuid": "2b1f5b06-3dec-4774-9a89-0ccc3fd91113", "comment": "Malware payload (Amadey)", "value": "e1a9145f8908f16c44d0695b10a1855c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686814, "uuid": "5b88518f-4dd8-4882-81e7-8fe9cf199938", "comment": "Malware payload (Amadey)", "value": "2b6afe34d17351c5b56a703f9b9373e14944cbaef48efaeaab00df7f237b1040", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686814, "uuid": "b6aadc38-ea1c-46e8-bb2a-762a44742940", "comment": "Malware payload (Amadey)", "value": "8a41a8df7532f8c96c083059701841aeb3c44a37", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686814, "uuid": "f1ec7510-e3c2-478a-8126-35db56dd81ef", "comment": "Malware payload (Amadey)", "value": "c4b52808bf3996d4d600eab0fb8bd028fffb56f4ed7511a91a330150453e2763337f36422a7b332cfe3b29ca71d9c65e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686814, "uuid": "1bc39555-f7d3-46fd-9f0e-88de5edb0a59", "value": "T1EDB41207BBE89476E8B62B7058F313930B393CB19974836F2745A85A1CB37C454B276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686814, "uuid": "5a074d8f-fd48-4edc-ae3b-95557353bc31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686814, "uuid": "aa6a6bf8-1427-4ee1-9456-6a606cdb76d0", "value": "12288:WMrBy90xvtmfdom8PcpTDOL0fe9dqaV20az57SA2Yf:/yzoDQ+HqaVazYA2Yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686814, "uuid": "7fe8508d-a2d4-478b-b3c1-abdf50cb7a69", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686814, "uuid": "2b309eb8-416c-498a-bf42-03fb47dca840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686814, "uuid": "c989c04d-ce1c-4fb4-afc4-0803bc97f32f", "value": "2b6afe34d17351c5b56a703f9b9373e14944cbaef48ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16f3c05-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685847, "uuid": "cc31de9b-b5de-416e-a997-21892fc00427", "comment": "Malware payload (RedLineStealer)", "value": "475f169d0a9d913af2f17e8b0f773bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685847, "uuid": "30254148-3460-49d1-b444-459b0e174957", "comment": "Malware payload (RedLineStealer)", "value": "2bcf826093ea9eada0040d1e691659270f987cd3e3c08431cab778476eea98bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685847, "uuid": "1520ba19-6fa9-48c1-9bde-ce9b758a1509", "comment": "Malware payload (RedLineStealer)", "value": "71725f5283f0f3965de8af8756bc6b6b01bd8039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685847, "uuid": "9f79fd21-64cb-41fc-9544-3e0a8e29f659", "comment": "Malware payload (RedLineStealer)", "value": "39139c4c8e643a4fc212b95da775d4a43e6bfc17a9fc90930be103acf7b1da608500398cbebd6a9f7592f41ba5d3f933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685847, "uuid": "5c8008ea-ca52-4816-91c1-fecb7e5c4878", "value": "T1D2B41202E7E58436E8FA177048F743870B367CE1997C536B7B82A81F1C72A94657173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685847, "uuid": "9c4a2148-a26f-4fac-bff9-a7d55b22694c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685847, "uuid": "8a7228a4-b08e-46d7-bba4-71958f78b989", "value": "12288:YMrUy90Y/tcHX62nfQDdqmmK3yB6KvAKtC:Myn/tcHXlnfcAmmK3yFv5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685847, "uuid": "6fa31959-fe79-48bc-ae91-5826fab52340", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685847, "uuid": "0aaabe01-4b5e-4531-bfcb-54441e222162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685847, "uuid": "00e45de4-2fe0-485e-b866-ae3eb67638bc", "value": "475f169d0a9d913af2f17e8b0f773bd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68305ea-2eac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690703036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690703036, "uuid": "45dd0685-da71-407f-adaf-572fb9bc59a9", "comment": "Malware payload (RedLineStealer)", "value": "f64eba922a999f7e0360bde4f321cf0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690703036, "uuid": "477dcb5c-bcf3-4486-ae2e-1f6b9dd2ce80", "comment": "Malware payload (RedLineStealer)", "value": "2c0be4804eb65d2d60b166bfc3b416cd786c4d80a3d7f0f5cb4e006a940d7a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690703036, "uuid": "8d7d23c1-8025-4de5-8633-d93b3ce2a868", "comment": "Malware payload (RedLineStealer)", "value": "492e6162051aa4669922866bf15168b1cbc35db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690703036, "uuid": "e8c854cb-e0b4-47ab-b24c-afe4db93e5d4", "comment": "Malware payload (RedLineStealer)", "value": "13e0cc63f97914cd2422075e6a668e5afbe75bb9209fe6e6d7f1599e92738273ca2602a272c8d36f2ba71e4efa380705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690703036, "uuid": "938580c1-bd1c-40b8-97da-b057c44da5e4", "value": "T125B41257AAD84163C8752B7068FB03831E3A7D625D78C72B2746E94E0CB22D5E23177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690703036, "uuid": "f9ed338f-6f19-4a90-bad2-b4a5e0540889", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690703036, "uuid": "2bf346b8-99b5-4de5-8033-68b25a1b41fd", "value": "12288:fMrJy90Tr9WhgiSiYU3nJsdln1sbddC1MfaNy:uyuNiYOsdHspdC1MCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690703036, "uuid": "40576516-72f9-4557-a7bf-1b511cd15e9d", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690703036, "uuid": "a71de061-02fe-43f3-a77d-8360a365ff88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690703036, "uuid": "f3f89c59-fef2-446c-97ff-7f2797c4fc54", "value": "f64eba922a999f7e0360bde4f321cf0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0831989c-2e99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690694529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694529, "uuid": "4ce3cdbd-eec3-4baa-bf81-f8a8658516d1", "comment": "Malware payload (RedLineStealer)", "value": "23030879c25c18e122b25ee0561fdedd", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694529, "uuid": "b873acb5-601f-4729-8511-509e41b798b9", "comment": "Malware payload (RedLineStealer)", "value": "2c241dbf7d6559d931cd0b31912a836c2e3fd012f5393df7c363273b7d645211", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694529, "uuid": "a4c8079e-2399-425b-859a-af0a06d33b2f", "comment": "Malware payload (RedLineStealer)", "value": "cdf78a445f7da418847ab6f2f5104a546b529fa2", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694529, "uuid": "eee1bfbf-4cc9-41f4-a3ed-caab7afcf08c", "comment": "Malware payload (RedLineStealer)", "value": "06b2df986a19b4e3d2ec15c9ca25a0d8b4b9e92373afc0b849115d063d74aac76ab124f94b3fb960b3cbafdb23119c93", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694529, "uuid": "f78553e3-ff46-4d27-a9c8-ce3ab25d2818", "value": "T1A2E63341D39C3BA8BE13F9E265DC21C4B52586380F6116F2B37B0229E788ED15A747F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694529, "uuid": "c483fd57-ec25-4f79-9a40-0d896f4d973b", "value": "393216:y7ve28JWda/k0rQ3D0PcJjG4cgjbCB7a4d5jB:y7t6V80rQYPcRxbCB7PB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694529, "uuid": "dd8e2485-a1d8-42d7-8f96-5fc5aa58a731", "value": 15117054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694529, "uuid": "69651577-4c1c-4883-a015-171e82acbcfa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694529, "uuid": "c9ca1886-415e-4a14-bed5-99d55b2690f7", "value": "m\u043ed menu gta 5.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654995dd-2f0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690744937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690744937, "uuid": "f3a2849b-0a37-45c8-a78b-f15a40b66347", "comment": "Malware payload", "value": "e282559384e253ecf0874ed1fb1285a1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690744937, "uuid": "b716e12b-68b3-4719-b159-f4db735d2254", "comment": "Malware payload", "value": "2ca84a00c6aa9f406f6eae854a8d33b5b264e0bbc0aed676acc29d066b5c2826", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690744937, "uuid": "038699bc-a5f7-442f-80ea-535b2efc3df7", "comment": "Malware payload", "value": "ec67ef5feefc9b160094affbb5470d00ab471770", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690744937, "uuid": "0adef8ad-d41d-4513-884e-25ffcccbddfc", "comment": "Malware payload", "value": "0b3545bf85da1d9c7904d742b8bb4c9cbf546d0bf7664e3e1401551f723fb592a83ada171866d65d534639a01b5339a7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690744937, "uuid": "1cd9f4f7-f6d1-4417-86dc-2ddb2e148928", "value": "T1CDF3A73736009331C14607368A6FD3E58F29AC5B8F6B1127359AB35D3F7299056B7AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690744937, "uuid": "75e3a0f8-570b-4a16-8b05-c376c794ac6d", "value": "384:iHpe4ZvJXK7gzFM7WuQnsnoXgZs+5BCq26yy3M5BCqPN:Zmxa7gBMyulDCUyWMDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690744937, "uuid": "d737a282-054d-4103-a037-63d7e9e8af9a", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690744937, "uuid": "9c3e8685-4872-4c16-8713-7de35d85b8bc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690744937, "uuid": "9c67cf58-5e11-4bcd-aaf6-7a98714072e6", "value": "2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0776bdb-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695214, "uuid": "a6c1c017-88e0-403d-9a2f-d3028350a097", "comment": "Malware payload (RedLineStealer)", "value": "86035c5e0b669e9e8b6b5f69e3706728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695214, "uuid": "a71614ca-21b5-481e-9033-f23f7d358e33", "comment": "Malware payload (RedLineStealer)", "value": "2d1b049aecefdf3c16df6a880e5e321ee178190a8d22c58ddb23abca8fb32ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695214, "uuid": "9796ea49-f91c-4580-8b3c-6c2f97cb2f02", "comment": "Malware payload (RedLineStealer)", "value": "04435263f2c5974b7aec6f848d40231cfb38cd7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695214, "uuid": "4afe0a23-d887-4e21-be4e-4b37a7ccd5b1", "comment": "Malware payload (RedLineStealer)", "value": "40bf0f094dda2efc6ffc9732307115ac2481b8aaeb45158e0a3d1731eeab95c0ab8cebff296339fa8137d48a74a5960e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695214, "uuid": "213cc43e-a7b1-4c1e-b9dc-88e19a807370", "value": "T122E41253ABD880A3E9F817B058FB1B831F317DF16C344357278A95DA0C725A2A87176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695214, "uuid": "af630969-7e51-4a70-ab02-4bf6e1c4cbfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695214, "uuid": "54f6f9d0-abdc-44a2-812f-c647c78fff2a", "value": "12288:XMrKy90wS9WTTO2idn11xiB39Hofq53AIa5y4+XXewdZcZL3F:Ryo2idol9IHIqtohdZ6L3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695214, "uuid": "0b283b62-2955-4d56-ace9-fd0644438891", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695214, "uuid": "bbe4963b-5704-4c24-843f-35d1bf68c52c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695214, "uuid": "fb786acc-d5b7-41ee-93a0-9d8c2841e2fb", "value": "86035c5e0b669e9e8b6b5f69e3706728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8aa8f7-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685814, "uuid": "85a73c72-62aa-47af-909f-0abf7b040010", "comment": "Malware payload (RedLineStealer)", "value": "03f1f294cb8b25d7c215c00dbfdb37e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685814, "uuid": "90f3ee04-5f08-4384-b426-7b39ef6adf69", "comment": "Malware payload (RedLineStealer)", "value": "2df07adfd00a897d0493126b23758538477394de0b339990fa1f515505e17344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685814, "uuid": "68b7b2fc-9ec9-4c08-9c27-c62e67d3236f", "comment": "Malware payload (RedLineStealer)", "value": "aa5926ba70d164b0be2543268a3057a78e695186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685814, "uuid": "9982f5ec-9be2-4d13-8c6f-30a03ee233f5", "comment": "Malware payload (RedLineStealer)", "value": "d0e48430526a3810788075fc3ea777cb263feec9d095d36c4e4bf14825adad66a38205e8d0791e1c670233b21a9a9093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685814, "uuid": "43b0e488-4ad6-4c2d-b586-2f9907be4c6b", "value": "T13CB41202A7D890B3D9B51BF015FA1BD30E32BCB21D7887372746985A5D72680E6B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685814, "uuid": "d8fa27f5-4203-4caa-9bff-322f6892b891", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685814, "uuid": "87c700b4-94eb-42d7-b538-b837aecf0ead", "value": "12288:zMrxy90YjOWsS575AAyop1IgBgBYC3KaIPupofN:yybjOtaAAr7Uz6aI3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685814, "uuid": "6c60611b-17f4-46b2-9a41-bd247b433e53", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685814, "uuid": "53c0e6a4-727c-4894-afbf-74cd08e196ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685814, "uuid": "edd2e179-f22c-4be8-b49c-3d42f0eedaa0", "value": "03f1f294cb8b25d7c215c00dbfdb37e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820f8c48-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686144, "uuid": "6b44c3e8-fb2b-4460-9a13-47a2b4796318", "comment": "Malware payload (Amadey)", "value": "0083f34dcf70f570bde0df00787825be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686144, "uuid": "0c0395ff-4874-4d8f-964d-2ff854b396e4", "comment": "Malware payload (Amadey)", "value": "2e0da2a8f5c80423c991ff7cef54ed6f44ca9c78ccfb34d80e9a7c13bbe97ade", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686144, "uuid": "83fee6de-7843-47c5-a09d-ad5656256f4a", "comment": "Malware payload (Amadey)", "value": "2cefe1bb0a0dd1a8e846db234b3210193c03ae83", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686144, "uuid": "365244fb-0ac1-414e-a549-a73d2f8b3f59", "comment": "Malware payload (Amadey)", "value": "d373aa1757bb608a76db92361221578b20a17fdfe0bcee4eca3c86acca6c00ab0fe39deac8e2a48362dd08946d1e2ad1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686144, "uuid": "08357cf6-b560-4cbc-ae25-21101a7964c3", "value": "T12FB4024397E48572D9B517B008F716C30E3ABDB2597883AB32896E5F1CB3584A97133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686144, "uuid": "ff5450e0-36d1-48d7-a0f2-8482d4ded63b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686144, "uuid": "a81ca9bc-74a1-48f2-b4eb-ac70803a36c2", "value": "12288:IMrZy90s10OuGu0LdlkmKI+6cVeV9iFJ+0lT:ByLqOuwLdOr68eVIGOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686144, "uuid": "8dbda41d-dd76-4919-b52b-28cd7bc87db3", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686144, "uuid": "071d2c49-20c2-47b7-bc99-44624aefea0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686144, "uuid": "d8565f66-a727-4fd3-8e99-2c30e50d3fce", "value": "0083f34dcf70f570bde0df00787825be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e1f6b2-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686444, "uuid": "bf263159-9921-4eb0-a7aa-a3e2d8901f39", "comment": "Malware payload (RedLineStealer)", "value": "e4b638f3617148203f51b2a624561f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686444, "uuid": "7eeba38d-cd13-40e6-9161-9eb69e7eac61", "comment": "Malware payload (RedLineStealer)", "value": "30c9280810b3635965acfa14e28f8a7ed6bf05f61872bf187d20f613258aa876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686444, "uuid": "f3cc99c5-a345-46fd-8f78-35e1275cd180", "comment": "Malware payload (RedLineStealer)", "value": "d6cef74fca1cc76444625b2b5b7468f2b5a6d426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686444, "uuid": "7e356753-3bc4-43ef-bb6b-a17c3b51e2f3", "comment": "Malware payload (RedLineStealer)", "value": "1c3f19939937d85e1d955fb2e41d3ed5c2e892bd0285747f5bc2d475d939f2b7cf4cc99fdfbe6fc37cd6065c688eef39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686444, "uuid": "41910eca-c8fb-4c2f-b9e7-7a0c1362384e", "value": "T198B41206B6D84073EDB517746CF607932B36BC634D78873F2389A95E4DB2594A83232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686444, "uuid": "13ad4868-bbd4-463b-bbf4-71d54028b51e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686444, "uuid": "8b696a27-30b2-47b1-a996-4fca815f331a", "value": "12288:UMrDy90Eo2KVMBVjvt0cETyQ+2tpPz+SgBYCTAYrfGU81N:Hy2WRtrETNpvPz+hzkYG1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686444, "uuid": "950b3679-ac03-482a-be24-ab5a463fdd31", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686444, "uuid": "9ed6cb06-27df-433a-b45a-b6e18092c438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686444, "uuid": "5066d309-ab18-4349-8b1a-7fb0663cd86f", "value": "e4b638f3617148203f51b2a624561f0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6bfdda-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695264, "uuid": "255512aa-57d1-418a-ba06-162f2e9392aa", "comment": "Malware payload (RedLineStealer)", "value": "ee8e7204f9df20abfe3f2fbb39d4241e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695264, "uuid": "d88e6e67-9deb-4042-8584-14dff93e59b7", "comment": "Malware payload (RedLineStealer)", "value": "3196856f2fefe9411e88b223a0ff85d9bae6c1fdc519da2e13005ce04c847e6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695264, "uuid": "f32434d3-aeaa-4d83-b2c7-1e2c3955b152", "comment": "Malware payload (RedLineStealer)", "value": "2d30663deb692ac6b64a95c04cb09e9bd847efd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695264, "uuid": "2b5bc3f3-e023-4ed5-8ff5-31203bf7e841", "comment": "Malware payload (RedLineStealer)", "value": "3b878d49bc983ab6fe58a7e7a6a6b54d0e3faa0266f092d94a3b61c18d58cac81c3a871c851db9f2c8dc5feed6377e0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695264, "uuid": "195a67b2-903e-412c-94a6-ce48240ce5e9", "value": "T1B5D4121A7BFC4537C4B11BB068F707C30A323CA15C7887763A59985E1A72694E932B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695264, "uuid": "136ce830-6b60-46f5-b905-ab8b481d87c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695264, "uuid": "aa2c1679-f4e5-4d38-83a9-f3c3ca0fa287", "value": "12288:WMrny90IYqRMWwBEF3dzHFQPdRY2iDLzgqqBf55iMQP18SeMxqFC6SO:Ryb4WwMdjWPdR/kzIBf55ANdeAqo6SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695264, "uuid": "04e514d5-850b-4aeb-b48e-6723f884e92e", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695264, "uuid": "edd6545b-3014-4d43-988c-ad7af044a09b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695264, "uuid": "96f2233f-1e97-4a26-8afa-093e8273ea25", "value": "ee8e7204f9df20abfe3f2fbb39d4241e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2263020-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695244, "uuid": "9ccdc39f-15a3-44c6-9f60-543c8d05408d", "comment": "Malware payload (RedLineStealer)", "value": "e555ba402d26b73b4862c31bebf6a4c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695244, "uuid": "4964d25b-8a8e-40ca-8d89-3d90cb5f3f00", "comment": "Malware payload (RedLineStealer)", "value": "31ce5c05b8ccb9a1fa2f3f83f0bcc093b907083f6d6203de1198a63e600874e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695244, "uuid": "5f4fa665-7186-48ff-baa0-937a99f80f07", "comment": "Malware payload (RedLineStealer)", "value": "186e818baad8da1e9fa109ab0d0b365a2d6fd281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695244, "uuid": "d0c070d7-53c7-4ead-9b29-58142f2543ab", "comment": "Malware payload (RedLineStealer)", "value": "e7fe8d897d1642952016be55032e1148a0749576d11a76db0f0482f93413aa0ac4b4d70ad738668c7969ddbdcbd4d7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695244, "uuid": "ab98a077-2292-42c6-9090-0521416045e4", "value": "T10DB41206A7DC4532D4F61B706CFA06830E36FC625878876A6746A85A4DB37D8F13272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695244, "uuid": "43447c15-401c-4ea8-94a3-19c1bdcac1fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695244, "uuid": "512df779-60ba-4a13-8963-2d25fb61577d", "value": "12288:CMrBy90UgY0uRgn/sgEUH2KpGzLCgBYChYh5tsF/Sno:Dy04g/sgWgGzLxzKfiSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695244, "uuid": "34b51dba-ab82-4bbe-96aa-2e0867d3be16", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695244, "uuid": "60372f0c-0a25-4230-8cd9-bd1b3edeb2e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695244, "uuid": "808189fe-af2b-4b38-b6fa-99513553687a", "value": "e555ba402d26b73b4862c31bebf6a4c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea8f99c-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685816, "uuid": "a5377784-906e-49d7-bf72-60c5a279168c", "comment": "Malware payload (RedLineStealer)", "value": "2c3a9c333524ca6453049d64bedab237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685816, "uuid": "ea73ead1-490c-4c17-b543-eb3d2ee7f64a", "comment": "Malware payload (RedLineStealer)", "value": "32815ce8b38acb06c4ddb8c7922dd6c5d466de24b2e214ce05cdf47c2e2d515b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685816, "uuid": "6cc16fa3-6910-4b78-a38b-0e4e6c41b3e2", "comment": "Malware payload (RedLineStealer)", "value": "644741cc2becc8a8e5899b21d8f05a33cee89f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685816, "uuid": "1dfb9a41-d40b-46dd-9eea-f9b26903a2b4", "comment": "Malware payload (RedLineStealer)", "value": "5267165dedc079abf0e760deb614cb92f00b7008be7a28cd49e308e53587f71afc7e96ea91c904eea29cc92d1bfbb0ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685816, "uuid": "bb8d7d89-31fa-45f0-89a2-c6bfe904bf58", "value": "T18BB41212F7E84577ECB92B701CF642D70F35BE5298B0929B23552E4A0EB3595983232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685816, "uuid": "0b61394e-d14a-4edb-bce0-b1593dd8c8d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685816, "uuid": "d249b074-2fe3-4a0c-bc88-6215a2b20132", "value": "12288:+Mr9y90dBY/LUXFtkFHdnSBS1/blIl1Bxk2z:bymYzUX0FHdQ8lIns2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685816, "uuid": "06833cbf-0fa9-4539-82ce-a3b31a948653", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685816, "uuid": "2a6d3012-e2ce-4a70-b461-eb9875ad9050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685816, "uuid": "31a6aa49-b17e-4e30-9e04-a5d785355701", "value": "2c3a9c333524ca6453049d64bedab237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb3edf3-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695235, "uuid": "2cc77359-8926-4e59-bf1c-d7c9f1394ab4", "comment": "Malware payload (Amadey)", "value": "656978218cc842c85afb79cd8f6ee63d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695235, "uuid": "8bf72ab6-1def-420b-a19f-329e1de9787d", "comment": "Malware payload (Amadey)", "value": "3377fedc80565206bfbada25601781baec5bbcd71f666f425d572de7495bea58", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695235, "uuid": "9cc9702e-7fef-4d2e-8a88-f20c68f521c8", "comment": "Malware payload (Amadey)", "value": "d86a1cb39da50a9c61f5b740d450c8fefa640e2d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695235, "uuid": "845d5e1c-b4ed-4a9d-8053-fa72ebc3646a", "comment": "Malware payload (Amadey)", "value": "3d5f6b690e3b05a4a371b0bef9536ba9deeef7fdf2b62c5d2f9909224e926bbba6a5dcfdc4109075ff4f44598a586745", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695235, "uuid": "ee87539d-e600-470c-9e05-e27103b046a8", "value": "T110B40212A7FC8137D9B527B04CF342931A36BD909DB5932B3356B84B0CB2591967236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695235, "uuid": "962595ac-5825-4a90-913d-b357214140d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695235, "uuid": "5b6db362-b8f2-491c-b4dd-c786321eb5a3", "value": "12288:AMrly90KDvZBic/gxOf+Du/jXRtJOekFMhHQgFDtyK:VyzRziKIeKzuDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695235, "uuid": "8cce4607-d2d0-43fe-9af7-4da5964922c7", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695235, "uuid": "e90127ab-9d70-4a82-8eda-ee07aa740128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695235, "uuid": "4a0bd25c-6280-4075-b6ae-c4b9d1443f84", "value": "3377fedc80565206bfbada25601781baec5bbcd71f666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea633867-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686748, "uuid": "08995a7e-e56c-4804-83c6-f8ba19b3788e", "comment": "Malware payload (RedLineStealer)", "value": "8280c967c3e3c8e0c3d6dd8c09925e60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686748, "uuid": "ff9d5e6e-0a9e-4638-af6c-63661ed51f62", "comment": "Malware payload (RedLineStealer)", "value": "342c2114e4af96aeb33c9efc14591fb2018c00af9a7b504353c4859b1f99489d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686748, "uuid": "62c1f8f3-4eff-424f-b167-57187432c595", "comment": "Malware payload (RedLineStealer)", "value": "9208aad415a40498d84d8a9295348cf0efcb2fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686748, "uuid": "21062799-0073-46aa-b432-96c3382e4b3f", "comment": "Malware payload (RedLineStealer)", "value": "a8d0fab2403b26bb871c94d65cc3400259689890ea6649f8ab0de6a9b74ee571821ea101b1724ec124b3671eea8e19b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686748, "uuid": "66b71b71-c3fa-4b5a-92d1-f7e9caa1e910", "value": "T148B40253BBD98077EEB61B7018F606C31F3A7C918874926F339558490C732A8A67277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686748, "uuid": "232a8562-1e12-424c-9560-e9f78d2e52e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686748, "uuid": "492456dc-4cd1-449d-aa46-886b3dea5ecd", "value": "12288:WMrNy90uV3lj0azLETvl2WHa09R88apv:zyr1j0azLSlpNhaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686748, "uuid": "fb99bd30-7773-4149-acbc-4c1835985adb", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686748, "uuid": "896bf78c-7d57-44cc-a973-6c11bef1806a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686748, "uuid": "5b2a7c6f-1b1b-45ad-bbe0-d747fe4a1917", "value": "342c2114e4af96aeb33c9efc14591fb2018c00af9a7b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5054ba12-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690701093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701093, "uuid": "bac60e59-18d8-4b3a-baff-3610c6755f34", "comment": "Malware payload (AgentTesla)", "value": "2ddcce92e53835b4e1b55f584e146145", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701093, "uuid": "e3ff9aaa-db10-41da-b6eb-0d7d4aa5a930", "comment": "Malware payload (AgentTesla)", "value": "35b4ab12ba039e181a02fba0241d4cee8a70f9d3d0cca2e1a53d67dc91b20d44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701093, "uuid": "5ce80bd3-519f-4fea-a236-78207b49b8ab", "comment": "Malware payload (AgentTesla)", "value": "4170fe84a3392a5ea583f49c2a1eba2d193c2c5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701093, "uuid": "8126d539-b751-41e3-8106-6f55f68ed93e", "comment": "Malware payload (AgentTesla)", "value": "8341b280098c4c612e84d6eff6ad165285b3d61302acf2f485baee22efe6d987636cc8a3327fc5e4171a886e573cfb7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701093, "uuid": "0b0c3f65-3ae9-47cc-85ce-b45c26e810c3", "value": "T12FF4F091F26C5FABD47A87F90821D10447F1BB6A203CD6495DF2B4CB1276BD20E86E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701093, "uuid": "d02f45cc-dc02-418f-b50f-aa6eedb39088", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701093, "uuid": "57174784-d8c5-4269-9ee1-f55d0b117552", "value": "12288:J2gjjMUxRJmmlqwcLwlvMkZuLOP6N2YHdRqHoG4bXnuQK+L:J2gjjMUjkEUwCkALOaR9uoDrdPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701093, "uuid": "5cb7481a-750f-472c-98e8-f23493e182cb", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701093, "uuid": "d0ec1562-afe5-4b1b-94e9-ad3fbee3f680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701093, "uuid": "6ff5ff2a-37a1-4f85-9eae-85e2c3556159", "value": "Purchase Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424e6418-2ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690709659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709659, "uuid": "155de438-4b3c-4151-8a91-d3e03c43cfce", "comment": "Malware payload (RedLineStealer)", "value": "bdeeaeb7d54b910020e6caa1b1f25bfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709659, "uuid": "78e6be97-f0e4-402f-a0d1-d1d7b0cfe745", "comment": "Malware payload (RedLineStealer)", "value": "36710a07d346f012248b70c20b106df2f039e8519eac852507ee4bb83a82dad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709659, "uuid": "1d294f45-c2b9-4934-b8bd-ed2fec2f1248", "comment": "Malware payload (RedLineStealer)", "value": "20c5f400668e715b6a2844f2d6ad595ba2e6e914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709659, "uuid": "7d344b97-12e8-425e-b540-e96a1e30c2d0", "comment": "Malware payload (RedLineStealer)", "value": "3069f74ce784f84f0c972d0b8f68beb4ec0a24671f054892b06734c194acc5eeade555fce0c3dc4bae03ca44021779b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709659, "uuid": "d52fe067-310c-4b27-ac0e-bec672e0c8e6", "value": "T104B41253EAD98177E9724BB048F702C70F3A7CA288748BB767415C1B1D73A85A93072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709659, "uuid": "c114aa72-feb3-4728-be40-f0dff4985dc4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709659, "uuid": "f8d2ecc6-8e95-4448-b5d2-e2c76e7f611f", "value": "12288:yMrzy902Xybs+ruB7rmvdXGu2/UAosF6:pyjiAZ7CvOHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709659, "uuid": "fa4a7e98-c030-42ae-a6ef-300359e7a0db", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709659, "uuid": "4b58a242-7515-46ee-ae18-2dad623661e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709659, "uuid": "dfb85e74-3176-423c-ba7e-90517903b94b", "value": "36710a07d346f012248b70c20b106df2f039e8519eac8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6ec994-2eef-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690731718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690731718, "uuid": "148f9390-ac74-4f43-9113-70ff2fdca445", "comment": "Malware payload", "value": "7215ee9c7d9dc229d2921a40e899ec5f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690731718, "uuid": "9b205a3d-0a8d-4377-8bfb-faea75eba0ce", "comment": "Malware payload", "value": "36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690731718, "uuid": "cfa744c3-d53a-4b58-a536-c61cd1eddd05", "comment": "Malware payload", "value": "b858cb282617fb0956d960215c8e84d1ccf909c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690731718, "uuid": "729d0662-de37-4322-bbf6-a8b12b95cd6a", "comment": "Malware payload", "value": "56cd53d48102c914e48813b23c82e168faac72ea78df8f9d88b6d7c4a20c0b9d42c67c9647560cc91031a2bd559a1a2b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690731718, "uuid": "2ff93830-f656-48c8-a05f-e7853d83dd92", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690731718, "uuid": "a6b77906-3b6d-4f28-97cc-1ad35fea498b", "value": "3:F:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690731718, "uuid": "d29e974d-8f61-4bd1-9bb1-0123b7f6c801", "value": 1, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690731718, "uuid": "381caa62-381d-4300-8eea-f16d599803cf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690731718, "uuid": "e100187d-ca1c-4616-a132-a687064f4865", "value": "F-231-95028.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be01685-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690701112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701112, "uuid": "7183445d-b9da-4f00-af0b-9a82a243f0a8", "comment": "Malware payload (AgentTesla)", "value": "55fc32962e39db7656bbe1ad037e8b1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701112, "uuid": "5b3b7bac-8bf0-411e-9e93-0a221e68b2c0", "comment": "Malware payload (AgentTesla)", "value": "36d6236643a73c701aef7b1d6f4dc51a33248eb45c7bcfd0a5b39a3853cd6eef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701112, "uuid": "73684aff-46b0-471c-998a-7ac9b0d28ccf", "comment": "Malware payload (AgentTesla)", "value": "026b100ce8903961d67f9bd3a2d43c8991212c2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701112, "uuid": "fa9e604d-96b0-4e96-84cc-c868ce8d6d9f", "comment": "Malware payload (AgentTesla)", "value": "894c64e5a5ad66d0d3f360378c9868ab86b6d127e2c30302b77991b79ea3eb450946333fca82a254711d097d077defec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701112, "uuid": "cf62f845-04b6-44da-85b8-fdbe5cdb07dc", "value": "T15C65F103DC048B83C40D83F47E431DE94F1A7F0AE89A7DDB11527F9B3A72A62896A55D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701112, "uuid": "075cafcb-cc9c-4325-b069-f788029c4024", "value": "24576:7Eu9VNZyOw6V51nDZyyw6VEViNhuuvvtDDEoLhGXQwngZsigpcjUCxwek:7EuP+6V51FC6VoiNhv3tfQXXnAgWjvxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701112, "uuid": "244c24fd-95b1-45c9-9c1f-2c1122aa0efb", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701112, "uuid": "a8106a3c-ab11-44fe-9b82-977a2fc7749a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701112, "uuid": "0683ae1e-717f-4c64-bf1a-31d799e5b192", "value": "QUOTE REQUEST PO21019612 2807.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e07d74d-2e7e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690683104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690683104, "uuid": "0905a2c4-83a1-4eb5-bc8d-a115a4ba4e11", "comment": "Malware payload (Amadey)", "value": "2eb651b7ffac06bf0020d124b0dfe63f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690683104, "uuid": "e9f609b4-8bd4-4e35-b70e-681d21975ae5", "comment": "Malware payload (Amadey)", "value": "3729380d1821ace5f830cddec1306020d9797d8d9796575d89e23eb67cc39e33", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690683104, "uuid": "fd6e2a56-9729-4c5d-86e4-cb557b492037", "comment": "Malware payload (Amadey)", "value": "8ce3eebb757378818a7b3c59dca3863aca6e725a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690683104, "uuid": "7eccf734-f921-45e2-a509-b9edc8eda71c", "comment": "Malware payload (Amadey)", "value": "0b2e3cf0b32a08cacc17c0c7a3506273bf8bee15a7f67d4ef77124afebf4ee68e4b8fb9132c0ebe82335eebf57952548", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690683104, "uuid": "d036e9e3-6be5-4bcd-bd53-1405397fddcf", "value": "T196F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690683104, "uuid": "f823feff-4592-4b6e-ad29-51a7979c5a22", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690683104, "uuid": "7770fbbf-78aa-4751-b3b5-ed707ff5ac81", "value": 37319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690683104, "uuid": "c2dd4d27-4186-4352-be61-f3875c794b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690683104, "uuid": "16cbd6a5-0eda-424a-973f-980527b9ec62", "value": "2eb651b7ffac06bf0020d124b0dfe63f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab89626-2f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690741939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741939, "uuid": "5c6d4fff-12e2-4b4e-a0a1-3116a3bfd954", "comment": "Malware payload (Mirai)", "value": "61c0f99c9304052d1440883fb16c19fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741939, "uuid": "8f01896e-ac3d-4cd0-8848-24ff94d84546", "comment": "Malware payload (Mirai)", "value": "37373cfe73cc0457548b4d6e0f90949981c4feba45595784de871a1898761b75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741939, "uuid": "6acb97a5-4263-4e90-bb45-6a4ad9b2e987", "comment": "Malware payload (Mirai)", "value": "c7d953d409398cbe1c6336442fc96fffbe5a182d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741939, "uuid": "53bb9a6b-9f37-4872-b8b1-722cbcb5b7f9", "comment": "Malware payload (Mirai)", "value": "6ded9fe86868a83487c0d39fb9264b0bdc87c4194551489c7349a883456b47540429e3804a63c19ab1116d2358a91af3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741939, "uuid": "334b7774-4476-4e0a-b406-82345a03a8ac", "value": "T121234CC89643DCF5E81505752077FB328676E43A116AEAC7D39DDA33E826E02E6072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741939, "uuid": "5e11c269-a921-4f90-8fdb-6dc6b342e48f", "value": "1536:pk7Ldbvde7LQS56ypEHwfWoL1pJ30Yahz:pkdjde7L1tp5fWMfJknd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690741939, "uuid": "c04a6ddc-5a1b-4e5b-bb04-831706678333", "value": 50012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690741939, "uuid": "e797d297-6d11-431b-bea5-c2a681278906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741939, "uuid": "06e52317-2a81-45b4-a333-fba8f2645b11", "value": "61c0f99c9304052d1440883fb16c19fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e63a22f-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686460, "uuid": "d2899a03-690d-43c4-b0dd-5724ed5e45d5", "comment": "Malware payload (RedLineStealer)", "value": "e6e49c963c46191fe885e4f175707eef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686460, "uuid": "2ab9c76d-5e58-4b83-afde-39cfd7e3dc63", "comment": "Malware payload (RedLineStealer)", "value": "37dd6fc40bb48c87d8b81a797b453386fe85fe2fa84429eda34490cdd39eaffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686460, "uuid": "5f69a235-203c-487e-affc-1df858d4b7fd", "comment": "Malware payload (RedLineStealer)", "value": "35e795239b16de18a969cfb98b92eb40ef6de516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686460, "uuid": "25634cf5-49e7-4192-9ec9-9d2bc767d582", "comment": "Malware payload (RedLineStealer)", "value": "ce8f6a905a2031213c37c03c8b8eb27ccec8b603b11d5d5816eec2f83d3ea87b6db0bb3dd88be5794ae7e3aa7e0188fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686460, "uuid": "2eb92d3e-33c4-40d9-b945-9276205acafe", "value": "T196B41243EBD88072EDB517B095F602931F39BCB58D74465B2B84581F0CB3698B936B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686460, "uuid": "2af728d2-c7c4-42c6-a5e8-f8b048fd5748", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686460, "uuid": "4623a5c6-6b69-4691-a9da-a938b8bce46a", "value": "12288:PMrzy90Qd+I1Q0V1z5dq61FPDWNbknz8ToXYCdwTvAWT2O:0y0+DX1FPyNb08UXY+G2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686460, "uuid": "1b7c2a59-748e-4e65-99fc-bb2662d43fce", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686460, "uuid": "8a28dedb-a9e9-4a04-9d1f-9e7c016f27b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686460, "uuid": "9f5c141f-d815-4b17-8473-2963eadb2df0", "value": "e6e49c963c46191fe885e4f175707eef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52215d9a-2e9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695512, "uuid": "541c0970-5751-4bf1-bfea-e73f3cb86557", "comment": "Malware payload (Amadey)", "value": "de08f7516e91080f3c4cdd0dae557340", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695512, "uuid": "1045629d-a9f8-4465-8e74-181ce8bc21cf", "comment": "Malware payload (Amadey)", "value": "38786085276646686ec48cf1e115c0e7ad85c1ff168febc2513d602bedde4f2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695512, "uuid": "77196360-4b9a-421d-8938-1e26d94af0c4", "comment": "Malware payload (Amadey)", "value": "d1b09420e1cb3370f05d710c3af99688ff33383e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695512, "uuid": "dfc0f222-de98-4f96-96da-8fa2c726beb4", "comment": "Malware payload (Amadey)", "value": "c91bc8464bf85448a6b222a27fc17252106423dfef3d38ecf59cdd97406154aeea5984517629dbf9d514de9e15010ce9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695512, "uuid": "76ba6ce5-c92c-4461-801e-bff6d0ea336c", "value": "T174B41213B7EA5136D87403B01CFA02831E36BD629D70936B3B81995F2DB36D0A93176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695512, "uuid": "389573f7-11b1-429d-9dfa-43794cb8d465", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695512, "uuid": "1ce85c6c-b444-4b13-b9a1-d55563701901", "value": "12288:ZMrly901N4HapX2Rrqu7lbnFS3oYdMq2Jv:QyM67lU3oKMq25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695512, "uuid": "b1a86f3a-bec0-4b83-b0a4-ddf4818f10c2", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695512, "uuid": "36b3c175-6e71-48e4-b8b7-39d000871ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695512, "uuid": "0a425740-5519-4a05-8e78-63f082bd1535", "value": "38786085276646686ec48cf1e115c0e7ad85c1ff168fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84626e6a-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686148, "uuid": "4a560f41-1791-406a-b4ea-1b710355332b", "comment": "Malware payload (RedLineStealer)", "value": "a108f7d47792cb8c605a702363ba1870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686148, "uuid": "8d9f77ee-cbb9-4c23-b2aa-255bcf6d9eaa", "comment": "Malware payload (RedLineStealer)", "value": "3888e69a25ddcddc3af5a054ad68753e851c7d457323578bb66f3397d826a060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686148, "uuid": "08389338-9a55-4a43-bb0a-319652d91c69", "comment": "Malware payload (RedLineStealer)", "value": "1d005b4537eda1aef19b755701a31defbf39818e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686148, "uuid": "2dfb4448-5bb8-4224-b291-66d59bd24723", "comment": "Malware payload (RedLineStealer)", "value": "86a38b883a2a8979313f2737b459eb7e5432a81d31b6646b64120564902a0972610d6e6a0faf2b80a377321396f41e75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686148, "uuid": "07ca0494-22db-4c3b-a86a-32d43bea11d3", "value": "T16FE41252B7E54472EAB127B02CF653C30F35BCA19C74A76B26805D9A1C73299A530B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686148, "uuid": "3ff31983-a9c4-438f-a767-17599758ca75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686148, "uuid": "08e45eeb-41fc-479e-a353-2909a6576638", "value": "12288:EMrKy90n+lbnFvSHm5gtsfPmbbUSUy23DbsVTEp6U87U:OyaMxvuXUDXTbspDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686148, "uuid": "99ea396a-644e-449f-a438-6c685fc69715", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686148, "uuid": "269784a3-be48-42ef-8e39-2ca0828b9872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686148, "uuid": "b0d9de4c-bed0-4370-8cc7-701d0bce13dc", "value": "a108f7d47792cb8c605a702363ba1870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9db2fd3-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690709538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709538, "uuid": "9c8754d8-7c69-4c2b-844f-972f1f62bb59", "comment": "Malware payload", "value": "845dc3c27655016a043146b96912b71e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709538, "uuid": "3edac9f3-2901-4757-a6f1-5291c6f4a4f6", "comment": "Malware payload", "value": "3985a1d3730edc09a6e965bc0c872dfdd61eeaafbbed4e8c59a747a552e63515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709538, "uuid": "91064526-69e9-49d5-92a6-f77f2b27ed29", "comment": "Malware payload", "value": "f56e71119a9982420427fee65b8cfd08cfd6850f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709538, "uuid": "90d27f46-7b3d-4a09-a8b4-b1d9c5f541ec", "comment": "Malware payload", "value": "9a5a88f5a425c96a9fde3a1b89a650832a2306c9b5737fb7357f979579d84c1ef74cf2ed250e09a8a12ca7bceb77e86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709538, "uuid": "4c2eb83c-46f3-4056-ae99-451fada52073", "value": "T1C003E703B147D1F1F45B05B40AE6BBFE9272D271520E129DFAACDE149BA7B1532286D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709538, "uuid": "2fd4d946-7dca-4f68-a623-d84a4ccba6e9", "value": "384:Ii3k7vdJXMb9mh2FMqBJGZoZnLoIdqRIua6Rv97x99tgeJbOdV79:zwdRAdBpxhHGv9Jtge4dV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709538, "uuid": "2ec59b10-61f2-482d-9404-5a25854920f9", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709538, "uuid": "9935bea7-576c-4074-910c-23c9e569417f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709538, "uuid": "7e6063de-d649-4474-a2a0-1d12d9daab0c", "value": "SecuriteInfo.com.W32.Kazy.CA.gen.Eldorado.7949.8884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8094e95-2e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690697025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697025, "uuid": "0bf67719-83e4-41b5-bb6e-9c638d65969a", "comment": "Malware payload (RedLineStealer)", "value": "3114b648bcad1568d355375eb5b1b0a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697025, "uuid": "583ebeae-446b-40af-84c9-8ead5e65b32e", "comment": "Malware payload (RedLineStealer)", "value": "3a3c7f675f38188d8fc3f9ae25f9260c0b23495a8148b44825f14c66c039c02d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697025, "uuid": "1c215934-7914-4abb-bf2d-60277096001c", "comment": "Malware payload (RedLineStealer)", "value": "d40825838802b4d2849b37594fb0d9ee3c0bce84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697025, "uuid": "e36b016d-d7dd-4f86-b9f0-5197cbaae0c9", "comment": "Malware payload (RedLineStealer)", "value": "48648421fe00c6217a3ac87f84c515d68c3a5f0e2f05e0980341c6236f79b04896fc25b9e2d105eccd995aeeebce4141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697025, "uuid": "e3cbcb1a-0f99-45e4-bdfb-82ebd7517643", "value": "T1B8F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697025, "uuid": "677fc601-10c8-48d5-801f-49fa26d319f0", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690697025, "uuid": "9628382c-4de8-4e54-9d72-f000c0d0eeaa", "value": 37360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690697025, "uuid": "020664ed-7ce2-4bed-ac64-aaa6b5077156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697025, "uuid": "dc03a896-59b0-4141-877e-7337ff319303", "value": "3114b648bcad1568d355375eb5b1b0a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2277f309-2eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690708747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708747, "uuid": "92e95ff0-5262-4ccf-989d-049752eb7238", "comment": "Malware payload (RedLineStealer)", "value": "3d20bfd48da8e82f29fcb71ffe2c01a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708747, "uuid": "ed62b7cf-e85b-40cf-af40-9b759e378115", "comment": "Malware payload (RedLineStealer)", "value": "3a83ed4aed4fb3441f833c97a92712ebf8be89284d846e816710a6ff3808f65d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708747, "uuid": "92d071bf-4d83-4973-a5cd-f3f40ef3da69", "comment": "Malware payload (RedLineStealer)", "value": "5277445a9714666a9ca84216cda511383a59f20b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708747, "uuid": "de202b25-db8f-4bf6-9b10-9e11903ad376", "comment": "Malware payload (RedLineStealer)", "value": "24c54944748ac2c2c697ccd3ae34bc09af9ca24f9e15628cf44262458ed5f7334431dfab00e10e1dc58e7d04dbd63a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708747, "uuid": "bc005ba8-f51c-4fb7-bb32-044ebaa86c1b", "value": "T17EB41243E7E8A4B2D8B60B742CFA07830F367DB45E34425B1285D96F1CB2A84E971767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708747, "uuid": "41ef25d9-8fdb-45d7-93b9-6e4c55d96711", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708747, "uuid": "2f054066-9101-414b-a4a1-4ab7027462ee", "value": "6144:KCy+bnr+fp0yN90QE5KDUPFq2ghHfMlzNY7IwYRGSHyf4mkvcjhJ+ys56WY7Vbx8:2MrLy907KDj2G8sQGSHE1jL+ya66p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690708747, "uuid": "b7f74143-0d93-4c55-8855-a6c7f6cc8b95", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690708747, "uuid": "d60bfc0f-50ea-4137-bc2a-e9754f5341d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708747, "uuid": "9cdccf7b-fa19-4c54-b286-30061e2f7349", "value": "3a83ed4aed4fb3441f833c97a92712ebf8be89284d846.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed276262-2eb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690706939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706939, "uuid": "a4ef963a-7439-4a55-94e1-49e09e7b30fb", "comment": "Malware payload (RedLineStealer)", "value": "5f6a5f32f00e5e047d317e75692ddaf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706939, "uuid": "2736ca7b-2bb6-46cd-9554-8bfe1288eb51", "comment": "Malware payload (RedLineStealer)", "value": "3bb1c5b98cf87dd2d7b70d753c355bf001cb3a394b20fb3e3fc64911f69aff92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706939, "uuid": "53cf2c95-d4cb-44fe-b816-98ca2f052c27", "comment": "Malware payload (RedLineStealer)", "value": "47f2cb344a17f13a1a46453a178ede56fa68716f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706939, "uuid": "f1ee0834-6b57-41ef-aba0-c9ba38d8e1ff", "comment": "Malware payload (RedLineStealer)", "value": "6fdead34bf462945a623a53dafb7af1ec90bb5918c3178c8bf060cac1a6c3fa4a84436d34d941c4008a040f8735f8762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706939, "uuid": "a3b4082d-8eee-47d5-843c-ac2590f38de3", "value": "T111B4121272E88073D9B16BB064FA03830639FCB25C75836B1655AC9E5EF26D0F57632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706939, "uuid": "c0f07f4a-e52b-4e60-8070-a2486a23bec9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706939, "uuid": "4c966658-2805-4325-87e8-e8c6359bba48", "value": "12288:/MrXy908AQN7SYqMeD7EzdbqcA2gBYCTgVZ5:4ynARYqn0AVzUP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690706939, "uuid": "6b7b5813-3799-46ae-9bae-4d18f88e79ad", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690706939, "uuid": "8be8cbcb-a924-495d-b159-3576df24f7ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706939, "uuid": "aff080f4-c7de-47a1-b123-fb74c51dba2b", "value": "5f6a5f32f00e5e047d317e75692ddaf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b559a8-2f32-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690760634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690760634, "uuid": "a3c76e8f-e9cf-4eb5-93cc-849e6fcf39ac", "comment": "Malware payload", "value": "adf9116108a2fa2dee0c1e90dd0dc65c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690760634, "uuid": "72b2544f-3c6f-4c74-ab9e-baf9f6c3a740", "comment": "Malware payload", "value": "3d52a2b78248dbe975c25d9b8a82f9883c7958d71f74703db70fae39de4b4c80", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690760634, "uuid": "455d0666-d2b9-4707-9934-930d39afaf5c", "comment": "Malware payload", "value": "6630f93305177532b1e0de45e89b93527f0dd52f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690760634, "uuid": "68dc2381-c419-4c24-9be1-e71218c54d67", "comment": "Malware payload", "value": "c4e5d95093814edda6ad54954f9f74bb403e27bef99e348d9f98965f761d29a5821ce5aa057d7d90a8df86f3d3b85213", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690760634, "uuid": "cff8fc82-fa7e-4c18-9a2d-e54337c4e961", "value": "T186A6BF53F379452AC4BE8235B97B277027358E25AA825B271204F5383F731DEAE497C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690760634, "uuid": "24e9594a-aa55-46ba-9a3d-e6e56737d0b9", "value": "196608:EyCiBtZXjui8N78CsHVkaDV4fQ+VKQD1EeUq:EkBtZXaioc1kRfJVKQD1E5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690760634, "uuid": "d81ec3a2-efba-4259-87f6-392362b9e265", "value": 10033611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690760634, "uuid": "1efb45be-209d-4840-92a2-8de6477fac2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690760634, "uuid": "766c991c-00ec-4a0b-8b79-21a0de7bc271", "value": "com.android.chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772f1b56-2e91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690691279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691279, "uuid": "b50a76e3-0694-47bd-9add-66d6c6e24ca5", "comment": "Malware payload (RedLineStealer)", "value": "a8599a43480fb378e48a5a2980cf46fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691279, "uuid": "ee415250-2036-421d-933b-d8260bd3e51a", "comment": "Malware payload (RedLineStealer)", "value": "3e2a21be8089e9c8e4c8288faefd3103a23b748226e502bbc091969dc5293e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691279, "uuid": "575b61c7-9bb0-42f4-a339-de5df62699bb", "comment": "Malware payload (RedLineStealer)", "value": "8100bef7ed56971a2bbc0c5951d319b1f263f9c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691279, "uuid": "4bf8611b-8430-41ff-a784-8e7f97798210", "comment": "Malware payload (RedLineStealer)", "value": "3866f9d1390afabde553992761a2e1147c575964d11a2af3995b896bc840fcd66c57c101591df899e00c7a14e5e4fa2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691279, "uuid": "8cf247d2-7f3f-4b28-a3b7-9c5eb6d8f288", "value": "T173B41212ABFC9572DD751B7058F602931E32BC616D7883A723459D9A0DB3280AD7633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691279, "uuid": "22e2aaac-7f02-462d-bc67-f7fef8c31e9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691279, "uuid": "143f0b53-d382-49ea-953c-35792bdfac47", "value": "12288:KMrTy9096vXOcN/Cl3HXeSwggR7MenapfxFpiVk0m:5ydPOcCl33SFMPF8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690691279, "uuid": "b747b2dc-1d3c-4bfd-bf12-e426f4f0a759", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690691279, "uuid": "7ee584af-0d9c-4295-884e-98f1df16e7f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691279, "uuid": "403190a6-9316-449b-8626-43d85ada10c9", "value": "3e2a21be8089e9c8e4c8288faefd3103a23b748226e50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7222958c-2eab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690702438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702438, "uuid": "38017063-1f18-4946-9cc2-886269b44a29", "comment": "Malware payload (RedLineStealer)", "value": "52c9fc1f5743b7baa951490f1a01b721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702438, "uuid": "3a7997e9-b387-4db9-8fdf-a56b3a301d28", "comment": "Malware payload (RedLineStealer)", "value": "3e83fc8339b994723c3c13c52b8940c1db372c228f9393f03a98074bfccf810e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702438, "uuid": "6d72f12e-e599-4cc0-be62-46065f13f921", "comment": "Malware payload (RedLineStealer)", "value": "190d2223e234db37721bb2324d383419aa73aae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702438, "uuid": "2a2cbe8f-144d-4b1f-a712-0a39f07e733d", "comment": "Malware payload (RedLineStealer)", "value": "86531babc3b7febd18a5caba9e284f8180c805983fdc0e917cc76ce26bb5e037caf6e02b2710ce9450895be97bc6110d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702438, "uuid": "7bccdf68-46a2-4f15-a1b0-92f38da89bbc", "value": "T1F7E41213B9E88476D8B513B049F702931B35BCE28E71D74B3B4A6D2A1CB2685787077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702438, "uuid": "b2a06394-4807-4b2d-8740-ca28e0b3064b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702438, "uuid": "48ab82bb-0ae9-41dc-82df-d89573e08c88", "value": "12288:sMrFy90lv+dyDw+Vaa0u777r1R8JD005pjBdWLfNIYneyKVz7:5ys3x0a0g7FR8J0tNXjUz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690702438, "uuid": "8f483443-d9f8-4982-a55a-b7e7eba69f3b", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690702438, "uuid": "4cbc726b-7b46-469f-9254-6904d6299a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702438, "uuid": "0d50b22f-124e-4202-ac7a-91eac084cae4", "value": "52c9fc1f5743b7baa951490f1a01b721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e56e2c-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690701209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701209, "uuid": "defb7422-3b82-42ba-913b-2cf74e12e0e4", "comment": "Malware payload (Formbook)", "value": "ad4f2f6a656a68a65377a5192a3a3a3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701209, "uuid": "bb4a3631-b3ba-4337-9104-16b79491eb36", "comment": "Malware payload (Formbook)", "value": "3ff320e3607b1dfa12d8a8fdc4e4b8b34368cd47d848e39f30cc4d260fc612f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701209, "uuid": "4b3850c5-cbf0-49df-be39-c4123c81c020", "comment": "Malware payload (Formbook)", "value": "e0d41cd0405b1c65fa33a6b4335c3c677a8e04df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701209, "uuid": "3b574da4-db1e-461c-b3ec-29d41c3e0a68", "comment": "Malware payload (Formbook)", "value": "6f02bc8034d568c4ed264ef48a662272a6f7ffefc7cd0f5da98ad45be10446077d7038e882d1cfe8f68ac4c008f9f123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701209, "uuid": "f23cf54f-cca9-4511-a81c-bd516280c57f", "value": "T1EEF4DF41E228CB6AD4B64FFB4825D174E3B2BB6E512CD2091DF37ACB1172BD10946E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701209, "uuid": "640e12d0-ec1f-49c1-9f9e-1828dec21b58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701209, "uuid": "9af69c93-dc63-4123-aa8b-71d16edc968f", "value": "12288:nsHrgjj1NswMg7U0FXCnO7uxCRWUsAL1DjQoA/C+vHUm:nsLgjj1Nqg7rZCn8uCRp1DjGC+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701209, "uuid": "462c40c2-4828-4891-a6a2-4dc3c38caafb", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701209, "uuid": "4f5aae32-b00e-4a48-baa2-fec44023dfc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701209, "uuid": "77e88475-ec4c-44e7-a866-240f658fac89", "value": "hesaphareketi-01.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0680bfa8-2e9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695815, "uuid": "7eec8d72-506b-4d7f-8f26-88ef36a6734b", "comment": "Malware payload (Amadey)", "value": "2abc9f3c23dbc2c9f08adeed0eea3cc1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695815, "uuid": "afff5d18-aa21-48aa-b6ac-8d2533b4f896", "comment": "Malware payload (Amadey)", "value": "418e46975a54d4af45d9b3fff8ff952facf0e81919a889f982906cebed9fc81c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695815, "uuid": "decee99f-18f0-46bb-828d-85344ab73808", "comment": "Malware payload (Amadey)", "value": "4bc3afa480e17e144dd5156be028c5f3628316be", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695815, "uuid": "ba3fe6fa-ea55-47fc-ba0a-71a3028d93dd", "comment": "Malware payload (Amadey)", "value": "f54d06ad9cf5b35d5cac329447386ea00bc2fcabcc92e9ea7ab2082ead70d820fe52986073dcb3b9464dd60bf106b4be", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695815, "uuid": "0682bb50-a0e6-47ab-94c4-2db30f68e8fb", "value": "T1A2F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695815, "uuid": "b2df4aaf-c6ea-4e84-9a25-9ef3ad044074", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695815, "uuid": "465c0dd7-44a6-40cc-aa50-ea6ae62fe524", "value": 34756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695815, "uuid": "fdea9e91-3209-4986-ad57-8d6f50240b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695815, "uuid": "5359fa47-e6a7-4e97-8d58-3a661e660628", "value": "2abc9f3c23dbc2c9f08adeed0eea3cc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9092f4-2f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690750294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750294, "uuid": "1e45233f-b52f-4471-8ba3-6075b978eb46", "comment": "Malware payload", "value": "37a9fdc56e605d2342da88a6e6182b4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750294, "uuid": "07380b61-d09e-4476-8e08-bebbad368bc8", "comment": "Malware payload", "value": "422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750294, "uuid": "d511ef87-229c-4cc0-82dd-a68d551418b1", "comment": "Malware payload", "value": "20bc3df33bbbb676d2a3c572cff4c1d58c79055d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750294, "uuid": "fbf91de3-dd43-4711-a202-c0c7c7f6d2ea", "comment": "Malware payload", "value": "5eaeb54c4a1e59a0fa3b697094190d4adc8019045598238a888502c3d856857f0395a639738b7bb5fcbd089d3e47a54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750294, "uuid": "20d4c258-65a3-4f93-9dbc-cb2b11b436d8", "value": "T1E6760221A6246D01E45FBB37C3CB47A563F680B71722F90959EAF6E80605AC36E173C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750294, "uuid": "0dfd5b1f-7be6-4234-8bf2-e4ac346acc20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750294, "uuid": "e1b14b5e-de90-4d09-b8a3-a54803a805e4", "value": "196608:rLQ6B/XKUDz9NoUXJzUWi7MYjBVvo5/UV:3FlaU/9NZXJZinjB9oxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690750294, "uuid": "9df568d3-a1a5-40c0-beee-9aaf3f5388a7", "value": 7278080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690750294, "uuid": "fe8f6384-ff78-4beb-9fce-476647733d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750294, "uuid": "d8baff0f-e6f8-4c64-8f4c-d07953208e9a", "value": "XWorm V3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcc02bb-2ea0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690697629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697629, "uuid": "0101b1f5-ac05-4922-bab1-1fce644f7b67", "comment": "Malware payload (Amadey)", "value": "0c3e7f3165ded0c750b0cc43553df8b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697629, "uuid": "0d9daeac-2bd8-483e-8447-1a5d2088b8c0", "comment": "Malware payload (Amadey)", "value": "4234c8e9334cff55f893da7c53c37c8ffd68751cbd8d0d567b6151e1fcbee232", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697629, "uuid": "30ef74db-b5a5-4b53-be55-09561d0b2cda", "comment": "Malware payload (Amadey)", "value": "39d127582e6eac6c6555d7cc67a2cede51d04ed6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697629, "uuid": "b3550b38-d342-464c-a7de-93ee8f57a387", "comment": "Malware payload (Amadey)", "value": "9886666344b7d63a45a105d9287a6fa0fca08fce7dc02be1137b0d5e7c05a4a7503b7089b777859390be939261de2cc9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697629, "uuid": "088bd764-dcdb-4f72-b6a3-ed373d4a6b3f", "value": "T120B41213A3E88432E9B51BB018FB03830E367DA24D79C33A37956C5E1EB26949572777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697629, "uuid": "c9729977-0d15-4bdd-99b7-fe7369650f12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697629, "uuid": "ef74c479-1847-4542-b3ba-2cf992b1010a", "value": "6144:K9y+bnr+Tp0yN90QEKc62ANHl5+NeY3Sl/NS2vWYA80Qa1J5lYCm++o1GZhmQd+i:XMrPy90GVsNKl13OK0QaI+BGXBBPq45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690697629, "uuid": "2eb01e8d-7e0e-4091-8837-7c76c25de666", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690697629, "uuid": "a194aa23-891b-4494-849d-bd34c8bd6456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697629, "uuid": "7526a423-6a8a-4c2f-aabc-e681b510f4d9", "value": "4234c8e9334cff55f893da7c53c37c8ffd68751cbd8d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b377344-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686132, "uuid": "5560dbca-aaf3-42bd-b68e-c369db90332c", "comment": "Malware payload (RedLineStealer)", "value": "71f2684469384b6a0e0640f18001a46f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686132, "uuid": "b4215a34-7301-40b7-90ec-ec1b2c7f4afb", "comment": "Malware payload (RedLineStealer)", "value": "425205a3f246764fa53b2740aafea893e85eb2632fd4a109ce253b8440bfa5a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686132, "uuid": "cb4c5c72-0116-4f66-b574-e3c43c4a2dd6", "comment": "Malware payload (RedLineStealer)", "value": "361c952508eb5983246afd65cd82d1bbacd0df31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686132, "uuid": "c2eb1a95-1d52-4ae3-bbb2-78dd5bbd6adc", "comment": "Malware payload (RedLineStealer)", "value": "d525d6a544bf631824587a3e506b303edc20c7f2006bdab2b129bd89f250162b53669e2b6993adcd02d14026a599b10b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686132, "uuid": "6995d915-9275-4202-9ee3-56dc85f54b90", "value": "T182B40203B7E85473D9B52B709CFA07970A36BD769D74932B2746A94E4C336C0A47232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686132, "uuid": "870d0df2-622f-4a03-9097-e8da2db43246", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686132, "uuid": "3f351ef7-ae10-431d-bba3-a4d4c4f84005", "value": "12288:HMrry90D3iwLkXiJHjvO0k2Y+/UWRf3fX2AMYGjHK+K:IyUSwgXavbjTFqnHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686132, "uuid": "59129c78-6c02-4acc-b1ad-b9a45bb1f670", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686132, "uuid": "70015890-a116-4ded-a5dd-c3995575e0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686132, "uuid": "7b672e20-65b1-496e-aaf0-7f9249ab06ee", "value": "71f2684469384b6a0e0640f18001a46f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7ae494-2ed5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690720335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690720335, "uuid": "54667275-93dc-4fbf-99f1-017d43c1cf4d", "comment": "Malware payload", "value": "8d3b3d5b68a1d08485773d70c186d877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MESSAGETAP", "colour": "#F40F5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690720335, "uuid": "a801f6b4-5d2e-4d24-86b4-0cdb4b8dd223", "comment": "Malware payload", "value": "427a0860365f15c1408708c2d6ed527e4e12ad917a1fa111d190c6601148a1eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MESSAGETAP", "colour": "#F40F5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690720335, "uuid": "0345a10a-5410-44e6-9430-f61a47ea10fa", "comment": "Malware payload", "value": "4f9e53344a4863b38789663fd3a826c55fc51f75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MESSAGETAP", "colour": "#F40F5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690720335, "uuid": "b9794930-cc53-47f8-ad09-83b200f6cc75", "comment": "Malware payload", "value": "48619768368fcb7fcba0d8dd16610754eed3cb7517cbd34c48247aab8443caa28e5d53bfc5d240f8a6e560496a6d00f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "MESSAGETAP", "colour": "#F40F5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690720335, "uuid": "749f5a2c-c932-4e69-b6f5-e96b1fc88c60", "value": "T1F4533A43F88224FDC085C9348ADF1278B477F026A521793B5649EF372D51AE05F5AFA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690720335, "uuid": "4641fc48-a3b4-485c-a078-bfaa8db0f97e", "value": "1536:R8Z5h1bmyQXChclXeBXJVOXVD+3a7RRxBPsl:a5S7CAXYXJVOXVD+QRbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690720335, "uuid": "0eced2bf-d0c4-44bc-a60c-1b73670dc626", "value": 64504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690720335, "uuid": "9bb5d352-587d-4bee-8c33-63b8f6d6d81f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690720335, "uuid": "335de433-312a-4b7a-9e26-5ccac311bdff", "value": "427a0860365f15c1408708c2d6ed527e4e12ad917a1fa111d190c6601148a1eb.elf.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23120c27-2eb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690705741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705741, "uuid": "c23ad489-1ad4-46c6-86d0-e593042e7eda", "comment": "Malware payload (RedLineStealer)", "value": "8815263dda360abdf28c960c0b5cd2dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705741, "uuid": "dcd1eaa3-9cc4-4a50-8f21-9318f51a4a4d", "comment": "Malware payload (RedLineStealer)", "value": "42867987bb68a6bbf9e59fcccfc893c3bac18ab570790bcd7429f35e967d8d29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705741, "uuid": "d8b8408a-1033-458e-9890-894026669242", "comment": "Malware payload (RedLineStealer)", "value": "a8b8bbb7f855633ed361ce83742d4598ab41937b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705741, "uuid": "2fb94135-1159-41df-adb8-fcbc82052da4", "comment": "Malware payload (RedLineStealer)", "value": "b89c2b3fb805c850df566b8931abd524c17457644ff209a3b29f7ddff7e98eb45fe67895a9bca47b5a315a2df7339cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705741, "uuid": "e00ecb72-40c1-4db3-83dc-400fc4dd0e2b", "value": "T14CB41203F6D99433CDB9277018FB07930A3A7DA49D74C36B2255A85E4CB27D8A932727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705741, "uuid": "21d05014-26eb-4b17-bdb4-2ae8d39b428c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705741, "uuid": "16d95576-65f2-48fc-9c26-e0d6ec2e2b30", "value": "12288:wMrxy90XdfUVWkJpLqWjGKWsUdqZGj8rtcsnil7g:RyqfMWqbj90qoj8RHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690705741, "uuid": "9162dd15-acb6-4bf7-ae27-3d00541213f2", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690705741, "uuid": "45af13fa-6ee5-4e4c-90b8-1860bf8413b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705741, "uuid": "fbefaa99-864a-4c96-93ba-db9faa3f68a0", "value": "42867987bb68a6bbf9e59fcccfc893c3bac18ab570790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9956960c-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695202, "uuid": "2e3ef424-d1e0-465e-b49c-c383f36e32b8", "comment": "Malware payload (RedLineStealer)", "value": "688175a314d28711a6affdfdf23cc46f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695202, "uuid": "39f029ab-daf0-41ae-b7f0-aa4f08f6bafe", "comment": "Malware payload (RedLineStealer)", "value": "42d2c0eefba5ab00871ce20a02c0853761de38457829844aaff625e7e2f8296c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695202, "uuid": "5703a7bf-d23e-4a5a-8d9c-a5c74cf9dd38", "comment": "Malware payload (RedLineStealer)", "value": "e1d0932e157dc56280433be6613e81b372585be6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695202, "uuid": "fe7f8f4e-93a6-42e8-b781-bdb651dbecea", "comment": "Malware payload (RedLineStealer)", "value": "875bf987bda6d1908e99f5a4714f06a862b45b86ece6c8c299edb1d25b02fdba100d037b627a83b81bb40bdf475541ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695202, "uuid": "f7c3f802-f459-438c-8533-01bed8fa239a", "value": "T1FBB41242ABE59032D9F137B048F705D30A3EBCA19D7897572B42994B1CB27D8E53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695202, "uuid": "29fd6d22-8123-4e7a-acf0-d4444c51df2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695202, "uuid": "cf65f8af-e630-4bca-9363-310891ba5b05", "value": "12288:QMrXy90O70Es8JUMDkms3rgBYCg2/mcf+Pic:Xyx0t8JUA1ukzpJf+Pic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695202, "uuid": "1419ab4a-3269-431c-9556-e33f6f71fb09", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695202, "uuid": "a834ac6f-799b-49f7-bfd3-b7b268b1e264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695202, "uuid": "6ce24c72-d655-4839-897a-782ec13c8a37", "value": "688175a314d28711a6affdfdf23cc46f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e0710f-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695255, "uuid": "9230c6d2-5fd1-4704-86fa-78d5d6b8d9e5", "comment": "Malware payload (RedLineStealer)", "value": "da474f1c5f4a43533e6c444a3f6b4dc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695255, "uuid": "91f9b4e1-8e12-4344-bbfa-8aa780526a20", "comment": "Malware payload (RedLineStealer)", "value": "433526d46ef49970e5c298747cdaa64496e45fbb4a872c850885e5a2ceadc6b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695255, "uuid": "a28c9d5f-4afe-408b-b74d-6e703729d31b", "comment": "Malware payload (RedLineStealer)", "value": "2e4c1ace0ba38e95910c0af480022fc407c35eea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695255, "uuid": "71fdc344-3cb7-48af-b5eb-281b23b6e60a", "comment": "Malware payload (RedLineStealer)", "value": "50005b70ea927f1c8d184f467b065376be04f78906c81e1c32be3d9ee0d2dfe3f385ef8c5b709811bed0ce66e868e884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695255, "uuid": "45cb8763-0330-4aaf-bef0-0cd724f41208", "value": "T1F1B41202A3E84536E9B41FB06CF747831E367D60AC7883A7239A994F5C73294993572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695255, "uuid": "9e3e7dfc-2189-4385-a35c-71ae5e8807f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695255, "uuid": "a745f62b-96dc-4127-8bc2-67c30ab2e839", "value": "12288:6MrSy90nFDMIF+VdTUzNb41zS/FA10aP/p58Ehn+r:4yKvF+VdgF4Cbc/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695255, "uuid": "186c2315-605c-495b-9d0e-33c8cb1f9db3", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695255, "uuid": "a150a195-4362-4d23-bd1b-17384b32cdba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695255, "uuid": "50b60ba0-9a0e-4132-b5c7-ec9d571453f0", "value": "433526d46ef49970e5c298747cdaa64496e45fbb4a872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d69ad6-2e93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690692192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692192, "uuid": "93e4832b-bdaa-42ee-9c6b-8c423f0baba7", "comment": "Malware payload (RedLineStealer)", "value": "8c5f0a86d24e743721749ff040e9fec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692192, "uuid": "8b122700-f6a1-4f88-a13b-72c8aaa4e45c", "comment": "Malware payload (RedLineStealer)", "value": "4393da84c84d32b0d45a627c90967314cbfc39ee4943e2d340a972588861e39e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692192, "uuid": "ab71b5de-791b-45a5-b919-fdffbb5c73a5", "comment": "Malware payload (RedLineStealer)", "value": "f4c5231aa2476e8172b11b82db84e0df5ec13e35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692192, "uuid": "ca963fa7-4d40-4494-b190-aa7a70215cbb", "comment": "Malware payload (RedLineStealer)", "value": "8d8f1078a617b6c21a36cd66bd3015d4e33a5b085c09f499d11a0a54ccb3a9e38ef0fdb69b3a691bc9ceb9eef7b2ba19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692192, "uuid": "0740571f-e78e-4b59-9d85-32970c2fbd40", "value": "T159B41213E7D88976E9B827B058F622C30A3A7E655C7492AB3392191F0DB22C4E535727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692192, "uuid": "0bfa3a9b-1f62-49cb-8870-01c5b085258c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692192, "uuid": "b0f8dca5-f27c-4a9a-a29b-079cbb086a98", "value": "12288:JMrNy90puEj4iu40NFIj2FWzlDRpGzRhvrxu0v:Ay6rElBNFeIWzDYrxu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690692192, "uuid": "fcc5e47a-7db5-473e-8d19-aae00dc55ad6", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690692192, "uuid": "b80cafae-fa9a-4358-b4dd-c1fd7f09c937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692192, "uuid": "e179f48d-cc4e-49be-9386-1e5683d52651", "value": "8c5f0a86d24e743721749ff040e9fec8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22997c8-2ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690699995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699995, "uuid": "c23e1fae-902b-4209-bd07-292c928dea4c", "comment": "Malware payload", "value": "7fd797256471922b83e03007deba70f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699995, "uuid": "750ba817-e78b-41e5-ac6b-4fb9e642312f", "comment": "Malware payload", "value": "454b2c41ffdf411a8836d2d3cc17c83677cbf1129669badd808322288432c3a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699995, "uuid": "dd8c93e5-d7fd-4395-b4d7-29731932c6d6", "comment": "Malware payload", "value": "6de15fea9d6b034e8a9ef444aad705212e4b3f09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699995, "uuid": "0561abf2-4e1c-40dc-baac-d5c8c9dfcb2c", "comment": "Malware payload", "value": "349464e49a86331e0c853ae0fb476309d387855530d7035f9f5f6a15dab51c31bf47aac10ce2c830acfc6823ccefb615", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699995, "uuid": "8c80923d-5266-4262-b24e-d197bb898075", "value": "T1365402223AA0D433C4919431056ACBB1776FB1709FF985C773985B395F306E1BA7A31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699995, "uuid": "6198288d-c3ec-4bef-a83c-3c69ca6cc1f8", "value": "bd602befe882eeaba679a3ca3aa4c30e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699995, "uuid": "526e1431-455e-4575-a001-765c730cc620", "value": "6144:spIasKsLW7rAUz8nlKf8iIu30kxz737OMIobBgFWfff/wCPx/Pk:VKsC7Jz8nAjIMxzrCvobBgUIaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690699995, "uuid": "e6679bbd-9a82-477d-b28f-d05b77ec0308", "value": 289324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690699995, "uuid": "244ba1d1-906e-4abe-9af7-78217f43f8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699995, "uuid": "bac22f8b-98dc-4df1-ae3d-e2f5c5d4d25f", "value": "7fd797256471922b83e03007deba70f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a41599-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686760, "uuid": "e809ed9e-5574-4c52-828d-69e618c437e5", "comment": "Malware payload (RedLineStealer)", "value": "66d1329e24b91f7324a7b26d78ba7cf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686760, "uuid": "2618e040-1cd2-4056-a77d-0a5aef619d4b", "comment": "Malware payload (RedLineStealer)", "value": "465091438527807cb298203387d14308d71e44353d08c725779ee3ffdb94aa43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686760, "uuid": "ff8adcad-5aa9-4fb3-b410-0b8f5aa6df67", "comment": "Malware payload (RedLineStealer)", "value": "4e266e1dc79693dc6677bcb2583b735352e877ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686760, "uuid": "251e0840-d952-4c91-88e5-e2938606f6d2", "comment": "Malware payload (RedLineStealer)", "value": "6f81979e19b80fc284cb6b04fdbce565528016494cf1ae834bd4e18626039ee372ddc61410ca3b877f3ee25f8f9fba97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686760, "uuid": "4b2387da-9e08-4df8-a6bc-6b0237a6a2b6", "value": "T100B40206A7EC8433ECF56FB024F612930A3ABC905D74939F2766A95E0C73691613277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686760, "uuid": "bdbc15a7-5128-4807-8db2-9a689b05c947", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686760, "uuid": "7d104e06-8b71-4220-998a-4538819be011", "value": "12288:LMroy90hPCrF+6VIZcwXxAGKYfkBJRWGb:byoPCrFpVRwX7XkbYGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686760, "uuid": "6331fde2-b831-4f8c-a83f-b31044bbcab9", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686760, "uuid": "4f787ed2-3cee-468c-9bca-44ecefa373fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686760, "uuid": "84dbb8b6-ddf0-483e-b54d-749337351d34", "value": "465091438527807cb298203387d14308d71e44353d08c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc66f9e-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690701115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701115, "uuid": "683f6079-732a-48a2-83f5-929efe08cd39", "comment": "Malware payload", "value": "b017dd53bed8dd1f5e55238e0260c641", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701115, "uuid": "d869b2d0-1d5e-4be3-b1ac-a6e68e4f3d3c", "comment": "Malware payload", "value": "47017a7cf76709e432cce531f255160674c17a6fb0f349bb0e31477f4abfcffe", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701115, "uuid": "cded38c1-be93-4bdd-80b6-6fe9307135d8", "comment": "Malware payload", "value": "4b963a0ddbac64adb59cd3fe8a599aa77ffd3241", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701115, "uuid": "a211a730-2828-457c-a6de-9234ceabcc64", "comment": "Malware payload", "value": "f7aae35b6ad8dbcf5af8355d8e811baeb94340dc14a20e24534e7c8cb42bdeda280b140d3de291ed7cd300cf0b2eae18", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701115, "uuid": "a44cd12f-33ca-4731-bbb4-f0ac84ae703e", "value": "T1FA65F103DC00CB83C40D83F47E531DE94F1A7F0AE89A6DDB11527F9B3A72A62896A55D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701115, "uuid": "228bc596-b2de-4a3f-9211-1433cc1243e3", "value": "24576:LBu9VNZylw6VUEnDZyQw6VEViNhuuvvtkDEoLhGXQwngZsigpcjUfRwKg:LBuPR6VUEFk6VoiNhv3tsQXXnAgWj+RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701115, "uuid": "7e359ee1-bfee-4af5-b707-17f2f335f051", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701115, "uuid": "c870e787-68b4-4a9d-9491-cf453c2ba44f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701115, "uuid": "7d9a7e62-c1c1-4e3c-954f-8c0137f67d99", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304cc248-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686436, "uuid": "b782c411-3194-4d34-9d09-735610cfd094", "comment": "Malware payload (RedLineStealer)", "value": "5b866e43c87528ad4ad044cd91876e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686436, "uuid": "d87a21aa-3513-4c64-b29f-dd50851f609d", "comment": "Malware payload (RedLineStealer)", "value": "48d21454abb66b5ee444f9777b67853f8f2a93cb4d07c01f214b0bb13ce48bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686436, "uuid": "51b34d75-2802-4695-8808-b793c4d735ee", "comment": "Malware payload (RedLineStealer)", "value": "534902250c24aeadf5e4ce8dc7c27d83a0617fc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686436, "uuid": "112cff69-3ab1-4ebf-b65c-c16a6e7316b0", "comment": "Malware payload (RedLineStealer)", "value": "f6d9ec1c48d2429246c6232d57352a82e17263b689883196514bd402eaac9e0debd04907f27db1662e0c09695832ecf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686436, "uuid": "5b695d88-1ba7-4562-945d-1b9594405b45", "value": "T110B40263B6FA4032ED7A17B05CFA02C30F377DA19964435B3386694B0D72AA4693573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686436, "uuid": "54d381e5-43ff-49f6-a5e4-30cc2890bbc5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686436, "uuid": "7b5f62e5-6a4f-4bc0-b7b5-1b4f980cc437", "value": "12288:YMrFy90rGlxicgp+wsH39SCBSnsV1PDNgHTIi:dymG7ic/wsHJ1P+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686436, "uuid": "1e80d02a-652a-4d98-84ae-628079efeccc", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686436, "uuid": "33c1604c-d13b-4ef9-8076-48d541e036ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686436, "uuid": "275a7a94-6339-4ff8-a721-e8613b6dcf14", "value": "5b866e43c87528ad4ad044cd91876e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541914c0-2ea2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690698522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698522, "uuid": "d067f6ed-1661-4e8f-94b4-cdc07469a745", "comment": "Malware payload (Amadey)", "value": "38b554198d374311c5067f6b49a4402e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698522, "uuid": "d0ca12f0-126f-45aa-a9a5-8a671122f7f9", "comment": "Malware payload (Amadey)", "value": "49c4cd6d39ca352a83c4b7b2347c5da510c8b8ebe3e4c2b2c5809bf06879a5b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698522, "uuid": "cd311def-d371-4afe-81ce-ee9a7b66719b", "comment": "Malware payload (Amadey)", "value": "f616bdf05b52341f63ad67b2572f63445fd0ba94", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698522, "uuid": "f1a75a3f-0598-4b2e-8139-2c065805a08d", "comment": "Malware payload (Amadey)", "value": "883404fac05d1f8d8a3e7cacffa28ecbfe1dcc0fb3960faa767ffb166bf9266e007ba383b09a68192af97db7375ff39b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698522, "uuid": "d7c92a6d-a67c-4991-b08a-0f9a6d434508", "value": "T125F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698522, "uuid": "a00ee9cd-c48b-42c1-9635-41d8620e38e3", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690698522, "uuid": "9d21c422-82f7-4871-affc-3457d11e0006", "value": 37557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690698522, "uuid": "b0ce5f24-13ba-4951-bcdb-b8d457569584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698522, "uuid": "5187e362-7448-4d7b-a95d-61501e6ff1ee", "value": "38b554198d374311c5067f6b49a4402e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8f47f5-2eae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690703930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690703930, "uuid": "2dcfdea3-7969-4ae3-a469-ce45720f11bf", "comment": "Malware payload (RedLineStealer)", "value": "eb78b5c4ac2654808fd49bbc644880be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690703930, "uuid": "59685ff2-ec22-4a19-8179-9848677e3a64", "comment": "Malware payload (RedLineStealer)", "value": "49c54445b73d54acf7afb5e4a1b35073162dcb0ad39c1b768e89d31527e514f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690703930, "uuid": "a6104fd7-0883-437f-841e-3d47d9cc3f52", "comment": "Malware payload (RedLineStealer)", "value": "d19cb3b47d3f6cda30563b5854b8ba4ec7fd75e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690703930, "uuid": "50d921e7-1e90-4295-8897-851b934b06ab", "comment": "Malware payload (RedLineStealer)", "value": "7975ed2a7ab66906cb9330748b090f857c4c9d3e3f29fb146f261ec7ccc7597fad5a550c17b9b8e66aa32aebe61ddb48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690703930, "uuid": "7044f219-07d6-4ba4-94bc-c322800b4c2d", "value": "T1D4B41202E7E99173DDB50BB01CF612831F367CA26D38936A22575A4A5DB32D4B23173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690703930, "uuid": "aa96828d-ef89-4c7b-9604-67742bedc52e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690703930, "uuid": "c169e898-676b-44fe-9900-a5ce6e092f7b", "value": "12288:7Mrxy900EPArmLpPNAO/gBYCoyHEeZVUxiD:WyFEP8mLp2O4zB5oxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690703930, "uuid": "351056fe-b5ca-4683-abad-a05b628dc13f", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690703930, "uuid": "b5e64a7d-c949-4c8d-8118-8c36270fb2cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690703930, "uuid": "65053ab8-0ce2-4a97-b2e6-f5dbb87709f1", "value": "eb78b5c4ac2654808fd49bbc644880be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d08e31-2e97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690693685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693685, "uuid": "e6b77e88-8ee3-4201-8fca-032f56ca7f37", "comment": "Malware payload (Amadey)", "value": "4b9a2c82dae5a6747c9b6a635874fe1b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693685, "uuid": "9a3e953d-c3d9-4c98-9bed-ee142ebafed7", "comment": "Malware payload (Amadey)", "value": "4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693685, "uuid": "ef4adab0-c05c-47a3-a172-df3acda6772f", "comment": "Malware payload (Amadey)", "value": "16849642f7562fb28a7c57493ede6dc14e71e423", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693685, "uuid": "6ecc8842-d861-4760-9920-c3af3609c915", "comment": "Malware payload (Amadey)", "value": "c8b90a5d50d916dac374379bc0e251e789d9f88bd27f0a5c62cbf7cf61173afbbed4df7ca383a56d92ce19bd1027f620", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693685, "uuid": "540f2322-b295-413a-9142-b6334b93d4bd", "value": "T1F6D42302F7F48472D8B62BB104F713D32B39BCA2887893572745598F1CB1B98A57972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693685, "uuid": "186e4aab-2c72-4c2d-85fd-b47c157fb455", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693685, "uuid": "3d0b3112-40f7-4371-a66b-291474887900", "value": "12288:iMrNy90KItLD9U6csc0Wlc5ao392/gTlYQbOH8t4MhxphtwML/:XyhAlpcw391pjOYFrjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690693685, "uuid": "a48dc66d-1521-4dcc-a0b0-a4a9f6648a68", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690693685, "uuid": "e754f9ff-a402-4ed6-a973-bb97243cc45e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693685, "uuid": "8fd02e08-1888-4c12-998b-c9d268fa74e1", "value": "4b9a2c82dae5a6747c9b6a635874fe1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d7f27c-2eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690704248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704248, "uuid": "39a3c86f-808f-4ebc-8b83-5e193dc3da7b", "comment": "Malware payload (RedLineStealer)", "value": "6978bcf0d97cb3e385d43f7ca941b34c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704248, "uuid": "a6648b8e-71d3-47b4-bbe8-e3105cf44068", "comment": "Malware payload (RedLineStealer)", "value": "4b7e032f26aaa84336104f5ad52897d8595498fecf224e134d76a9498f553cf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704248, "uuid": "1c1b015b-c285-4e10-88b3-e0ad5864812c", "comment": "Malware payload (RedLineStealer)", "value": "197f93292e7df2f3b7ad3b965cc249fdf194adb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704248, "uuid": "4bfd9650-1075-4bff-9bca-b6470fb7d1b6", "comment": "Malware payload (RedLineStealer)", "value": "679b278b09285baadaea120acd71f651973a5952b5e0449b51fecbdba5d91588fcbccbfb5cc3277aafa853cbafc1be6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704248, "uuid": "c3ee7949-0cbf-4b67-8e64-203a7724551c", "value": "T1B3B40243ABDD80B3D9F917B45CF703931E37BCA46938876A27465C9909722D0A8713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704248, "uuid": "229a1a3a-faee-4454-b991-3fc7570d30a4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704248, "uuid": "a91ef759-dd21-4d81-bba0-2939abf6bfad", "value": "12288:xMr4y907aUWWnfZMqpcQAGb5KXhNP3wWKkPVm/v5l:ByUa+fW1kb5Knv4kP8/v5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690704248, "uuid": "2aa96f77-2546-4f5a-b019-7eaf473d56d0", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690704248, "uuid": "03529ae4-cb8f-4614-8c2c-bbc74962c7f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704248, "uuid": "8a0272ba-ed3a-415b-a1fe-f51d90a6b97e", "value": "6978bcf0d97cb3e385d43f7ca941b34c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896819ea-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686156, "uuid": "82b5655f-c4aa-45e8-b0ae-7630acaf148a", "comment": "Malware payload (RedLineStealer)", "value": "8b6640380ee21c51e0766166c923337d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686156, "uuid": "40b41146-620b-4e63-a0b5-dc0ab26c69a1", "comment": "Malware payload (RedLineStealer)", "value": "4c7b60c89d08b0bfc85b250c51d9eb0d6d5e5fe6f20364953fa407a1bef57257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686156, "uuid": "898e3455-c512-4111-9f5e-0ca815b46ee9", "comment": "Malware payload (RedLineStealer)", "value": "4ce549beea2037a133cd45a62b01db2956454b15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686156, "uuid": "c087b088-8a0a-4dc3-8a68-6c4c59234b8d", "comment": "Malware payload (RedLineStealer)", "value": "56558bc096fa9290d07e995d38ef6fa8a24181b7b75162c0da4db69beba0885e83859cd72b60c65ddffeb719502f513c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686156, "uuid": "134a78e1-4186-4798-983b-c0490f103cf1", "value": "T19CB40202BBD89023ECB113B158FA47431F367DA19CB5936B26C6990F0DB27C1A57672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686156, "uuid": "b295fdb1-bc17-44ae-859d-73c623eafbcb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686156, "uuid": "9f918f87-c553-4337-9a1c-628b7ffa4b08", "value": "12288:dMrpy90z0OgMyYcAq00bA0f6wMgpIxRFJxgBYCTG45wexou9W:gyZAwBhMgp0R/azVKvoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686156, "uuid": "fe971313-f36f-45e9-be01-14aa1d03e480", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686156, "uuid": "705bde62-cf55-47e5-9fc4-c9698e375e0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686156, "uuid": "7ff3d81f-c4a7-40b8-985c-bc7ff048b376", "value": "8b6640380ee21c51e0766166c923337d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c893c20d-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685833, "uuid": "778d4d38-d7ba-406f-a729-745d2ae199a6", "comment": "Malware payload (RedLineStealer)", "value": "45dab7d11fae298e89dc4d2e5f79a8d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685833, "uuid": "96074b5e-6c9b-4548-95fc-59e985bddd26", "comment": "Malware payload (RedLineStealer)", "value": "4d7a7f5cdc50f7fe23d02387e829cbd11105677ed126f4e47dc404fcdd5633cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685833, "uuid": "df9af1ce-7f6c-40f0-8316-2f7afcf507fb", "comment": "Malware payload (RedLineStealer)", "value": "b04e1a9c586fb957d86064409838b8147777c26a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685833, "uuid": "4d1ffec6-27d9-4bdc-be13-82799cbf8599", "comment": "Malware payload (RedLineStealer)", "value": "87b431e32ba300c3299d6c6176a3773af418a7fd54f3c7c0a508f12e8c24d744f30a5c2290872b7fad9d5682e2bbdddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685833, "uuid": "25ab5e4b-b28b-4d19-9420-a356d76dd66c", "value": "T19BB41217ABD84073E8F92B704CF902930F36BDB69D34476A27866D4A0C72690B97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685833, "uuid": "b122ae94-ca4c-4bc3-901c-fcba09712a7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685833, "uuid": "63e5d2ae-e341-4868-9ad4-7b6200b954b7", "value": "12288:wMri3y90UeUbR8Qx7fRr63NSLs5ZHFK8zlccm/LzW:0ynheQxD5s9zlcFLzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685833, "uuid": "563247e2-63b3-45ed-8e5f-0dbd269cb0a1", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685833, "uuid": "27f7546e-464d-41f3-9afd-0e3c1b0c615d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685833, "uuid": "4bae722a-2c89-4f85-a11e-e1bab2f4c210", "value": "45dab7d11fae298e89dc4d2e5f79a8d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5911d5-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690687074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687074, "uuid": "250fa5b3-2d26-437f-af4e-be427d180cc4", "comment": "Malware payload (RedLineStealer)", "value": "875196fc12a6ad563aaab2fd1c4d3008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687074, "uuid": "91129957-7c5d-4016-8e44-beafc640747e", "comment": "Malware payload (RedLineStealer)", "value": "4d8f6dfd687d34801ce398040c027995f7171d6864a46ff3c372f1149dcbe1ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687074, "uuid": "4259e1f0-c846-4c6f-8b6a-63aa8733f5eb", "comment": "Malware payload (RedLineStealer)", "value": "e4ac3826e03b35021886af70309c536dd6855ed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687074, "uuid": "519241ac-e70e-424c-9546-5871b30d5362", "comment": "Malware payload (RedLineStealer)", "value": "f183ffc39136fc11d4661682a342d3af678226890c7830419068a53cf34907061e23aac6a9d62cb857c858a17ee3a452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687074, "uuid": "936b857d-98a9-4490-a3f2-e7b2365917d7", "value": "T18CB41213FAE88576E9F513741CF613C30E36BE619C748269329A5D4E0DB36A0E636327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687074, "uuid": "72d4246c-0c0b-4af2-857a-c1d508f4106a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687074, "uuid": "00791496-adb2-4a46-89e1-efa0c79c994a", "value": "12288:yMrcy90L3HVMKJZBDt9eoswSSyjH1a2tiq7tak78BW:eyI3ZVDt9VxuDIk7AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690687074, "uuid": "6d4308e0-9a2a-4d13-966e-5d490aaa0bf1", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690687074, "uuid": "4e57b295-0ef3-4484-a049-c605ca5a5e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687074, "uuid": "7009dc3d-773e-44f7-96e4-805a4be7556f", "value": "875196fc12a6ad563aaab2fd1c4d3008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc64fa9-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685818, "uuid": "60c898a7-45a1-41ba-b9ed-7bc09ab0893c", "comment": "Malware payload (Amadey)", "value": "304e399aba970e3bcec0f6c52c12d884", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685818, "uuid": "62fa890e-82e1-4c04-af5d-b8179d9be72f", "comment": "Malware payload (Amadey)", "value": "4f6db3fd2ecc2725783be3cbdea352e66fbb4666f1410ce5fb8c57ca98c162a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685818, "uuid": "ca652ef0-847c-4c31-a4d6-ecad94223413", "comment": "Malware payload (Amadey)", "value": "57ad4e48b1ae9194306ff744971a0a2cea30d34c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685818, "uuid": "53044d32-9545-4d87-b67c-38932ff1114d", "comment": "Malware payload (Amadey)", "value": "6d704878974dbaa73abec3a55eefe9c1780895666492490f2204604c6f91dca279402928c26170d6a89f718bd62399a1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685818, "uuid": "f165cf97-80e5-4d4d-a21b-7db891423188", "value": "T111B41212FBE48433DCB527702CF617D30B36BCA1A978A7672385995A1C736949D3232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685818, "uuid": "fb92bd67-b8e3-436c-abfd-10617800185d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685818, "uuid": "b1b6f392-9da6-4259-a8e8-f51f0cb7acd7", "value": "12288:lMrZy90J8hrGgstp0QjpZApdu/bPZX2dSYGtorE:QyE8VG9iQVWTuzP9pQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685818, "uuid": "0911c730-dcb1-434f-9733-3acd92c4a4f6", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685818, "uuid": "b0055a11-13d9-48da-8fe7-0236a4e0a6c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685818, "uuid": "9a9ffa21-9689-4fd9-8a9a-0996867e2f61", "value": "304e399aba970e3bcec0f6c52c12d884.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac2367a-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685836, "uuid": "5cdc2116-66f9-40c1-9427-6185681c632e", "comment": "Malware payload (RedLineStealer)", "value": "418f9d68cdb34666792e123ee08d8c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685836, "uuid": "285cc639-66e2-4be1-83c0-c0dc20e354a6", "comment": "Malware payload (RedLineStealer)", "value": "4fa2f547319258a1a874c8f126ebd328f11a187fbbb343b2440fa73bf6d40dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685836, "uuid": "f61055ce-17d2-4763-aa8a-3d1b12d6f53f", "comment": "Malware payload (RedLineStealer)", "value": "416e41e1ecf930326242dc29af8e253c18b86ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685836, "uuid": "987294e8-be9e-4a2a-a20a-8fdd00e2dab3", "comment": "Malware payload (RedLineStealer)", "value": "9b83625321f3fee42eea44c419d8ffd2b5fb85cdbd321e0b3e5d338b93ebcb0e42cdc5f773c2401845660f804faba6ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685836, "uuid": "df48c31a-1c2c-4b0b-afc7-7efecef3e232", "value": "T101B41216E7D8C532D9F527F118F622931B36BCA54CB8822B3786951E2C736C0E97172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685836, "uuid": "64674d8a-6ef5-49be-814f-e71983fff7dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685836, "uuid": "639aa750-5c74-4b98-9b0e-d2b9dbc98656", "value": "12288:SMrHy90n0UUfT0GiT4gB/hdGogBYCgEtpSyshweww:FyNlTfwVHazBtcyGwe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685836, "uuid": "45166568-170c-405b-b247-4fc51377067c", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685836, "uuid": "6b987ab9-64fe-44a1-a3dd-b10627590097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685836, "uuid": "d6f9e59c-9ef0-4c85-909b-930d4a1e216a", "value": "418f9d68cdb34666792e123ee08d8c6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b97b8c-2e98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690694290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694290, "uuid": "4ea4b340-6863-432f-b7cf-7a17b8b38ccb", "comment": "Malware payload (RedLineStealer)", "value": "94940fac5cd795cbe0fd8c46b9e6538a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694290, "uuid": "8c83b460-5fe5-42e2-8316-cf7b253d5aad", "comment": "Malware payload (RedLineStealer)", "value": "51534a562b3bf5bee9dd673a1de2bddabe1b02f3be4e15e743d1d9d7342740d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694290, "uuid": "ce1e1860-12c5-4ddc-b83b-3626772c99b3", "comment": "Malware payload (RedLineStealer)", "value": "f1f1223e204b9ed6a7d34b159f727137b2681b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694290, "uuid": "81007df7-01e6-4d9e-9370-9f5b546c4887", "comment": "Malware payload (RedLineStealer)", "value": "2ce250f0f96c9d95a019eeee1c8dd1056679ad1f2ca682ad756f0f58b8997efb22857882ccd329cd845d3c70f76e6004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694290, "uuid": "49124bef-a012-483f-badb-94661acddbe8", "value": "T174B41216A6DC5073D8B12B3158F207C30F36BC924D75936F2789994E9DF22C9A87236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694290, "uuid": "0dcf5609-d0ab-49fd-965d-6b0201bf40b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694290, "uuid": "b1b69c74-c21d-4173-a1c8-b50ca3f99387", "value": "12288:gMr3y90PuuTccL+YmGWMOXu5IXF4hs2gBYCVmqIaHif2JTP5ZYe:HyiYHv5XCIXF4hsVz4UHif2j5Ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694290, "uuid": "b911e7f3-75bf-4fde-b4d0-03c2b2ea3141", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694290, "uuid": "37575e48-9d5f-4d6a-96c7-e223cea13ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694290, "uuid": "40eda309-8aa1-40ae-bd64-aa64eb072a09", "value": "51534a562b3bf5bee9dd673a1de2bddabe1b02f3be4e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd34170-2e99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690694891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694891, "uuid": "dfcb09bd-b22c-4f07-a81d-c4dadac402de", "comment": "Malware payload (Amadey)", "value": "0e054a56a69f1e344e5ba9912fdb385b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694891, "uuid": "4469c106-8ed6-4d53-b476-f677480f0e34", "comment": "Malware payload (Amadey)", "value": "517b7a6e5ff57790304577097c24ec1d41da2d460bde72216b6afdbb7701f7f1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694891, "uuid": "0c85f469-b7cd-4e83-b5bf-a1ad4f9e61d0", "comment": "Malware payload (Amadey)", "value": "b206f9ab77fb96e2c00038c7fd7e7b98734c05d9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694891, "uuid": "f6fce8a1-db48-400e-87c5-f436804ae52b", "comment": "Malware payload (Amadey)", "value": "706f945a704fca389d1a5dc78cf45125c61ae6f0aca931eb3c5605b80485297f0dac3b827c6fadc709ae69eeb2f71211", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694891, "uuid": "d2a494ab-b092-4a0c-b36d-7e09c9754ac9", "value": "T1C6B41207FBD88176E8F467B028F613870A367CA18D74871B178AE95F1972AC4A13177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694891, "uuid": "efa4f091-4eb0-4251-82b7-f8c401b81c17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694891, "uuid": "502758d7-de71-477a-bd3c-7642f43dfa5b", "value": "12288:6MrXy901lI6XxC8j+g9OixAeGN31HPTp+1m:tyGlNjAVNZPTp+1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694891, "uuid": "993fb94b-5e59-4a3d-b1f6-5ecdf25b6ed7", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694891, "uuid": "f8e4aec8-e107-4a09-91ae-8262d7690a78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694891, "uuid": "54148523-eed6-4337-9e54-4bbfc07cadc5", "value": "0e054a56a69f1e344e5ba9912fdb385b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556c9ae7-2eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690704537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704537, "uuid": "cab75ecb-1972-42ca-8c46-4e2f3aef3244", "comment": "Malware payload (RedLineStealer)", "value": "0bc5faf0e7fdbd7657e543edd6737f85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704537, "uuid": "ac949355-d754-43a8-9cad-e913c89c41de", "comment": "Malware payload (RedLineStealer)", "value": "51c9916d6f5b5ac66aa9b7e4343b3d5a2fa54d57996f9b7bb0d4b18987afd8bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704537, "uuid": "1923be12-1c00-4205-9f6a-4933ff06cc05", "comment": "Malware payload (RedLineStealer)", "value": "10b8a75b664245ec610d52ff93e6018790e0f029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704537, "uuid": "28ea93ee-f2b4-4a61-b567-753965afb995", "comment": "Malware payload (RedLineStealer)", "value": "75e2c1a8da31313212a95dab821ac56c392d88446a55371f51471bdc5a5f3ffedfa9fe639a16fe233813281ecea38678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704537, "uuid": "8513b8f4-5887-4288-931c-ec451afe5fd0", "value": "T1BAE41243F6D88453F8B02B7084FA12AB1B7A7DA16E74C71727C9AD4B08726D4A43177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704537, "uuid": "217f0b3b-2e0a-40f3-9d5d-8bd5367e6018", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704537, "uuid": "041cbd02-aa3c-4d43-a778-5286bf11dbad", "value": "12288:0Mrjy90oZo0FV0/keZ9Ni15Iv6aCt3JV7i9wQE4Ytm4Nqz/EjCPyZ:HytFjs9NiOCI+Qotm4NAdPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690704537, "uuid": "71ecb869-b5e4-4211-86c7-f72a4ba6fd39", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690704537, "uuid": "2d77badf-e97d-4776-ae64-faca39202f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704537, "uuid": "89119da2-d969-4563-adc1-ee333aaccb65", "value": "0bc5faf0e7fdbd7657e543edd6737f85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c70939-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685855, "uuid": "b571e388-10ff-462c-83b8-f5bd0e2613a8", "comment": "Malware payload (Amadey)", "value": "6c756b136caaead9b8d018d6c073f4eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685855, "uuid": "f837e934-00ab-4bbe-97cf-0e078474832f", "comment": "Malware payload (Amadey)", "value": "51dd373f035c219e335403408086da7cce66c654d2b1343aafbcf061b5daa632", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685855, "uuid": "47e47cc5-9ba2-4eb7-9cf2-0966259b37db", "comment": "Malware payload (Amadey)", "value": "538ff4b8c3d2745b89f2643d46e0b135f7908337", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685855, "uuid": "2307c7be-6226-4bd6-ac66-2fd9db099163", "comment": "Malware payload (Amadey)", "value": "840c5a8f2c1e189830e9f7869249dd069eabb7637b6df6a9cf21e5ee91a5afffd3d51bb98e4dd15d89eacc3b52663547", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685855, "uuid": "e258f021-9393-4063-958e-5f5f0b969c13", "value": "T14FB41253A7E844B1C9B06770A8FB06D71B36BC626938437B2305595E1CB26C4EC7636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685855, "uuid": "f0016adf-3ebf-477e-ac00-0ce499d13eb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685855, "uuid": "2f2471b8-3002-4d16-b11f-6a8307de7e17", "value": "12288:2Mrry90Iuov/qCSaDLq7SFgazh5EgBYCTMDIv16:lyBuixdLOSnTLzQm16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685855, "uuid": "3f07b8f9-f07a-40d7-a75f-5e185b804415", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685855, "uuid": "27bf58d0-4ed3-45e3-b50e-5932290f3735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685855, "uuid": "09709323-d1b4-40aa-8180-0ee9460220f1", "value": "6c756b136caaead9b8d018d6c073f4eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a26ba7-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686502, "uuid": "ad54b9da-e205-4c34-9ec0-e6ebe5f3edaa", "comment": "Malware payload (RedLineStealer)", "value": "5ff1fa9da507c1cca838d82ca3ec5a3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686502, "uuid": "92ea9f02-59ff-462f-b9bb-39e0a227b1b8", "comment": "Malware payload (RedLineStealer)", "value": "5216437e3f11aa892f3fc28c98e317d9285593320a225cd8b4fd972698c32e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686502, "uuid": "8941000a-55f5-4569-8055-729de4dca6ae", "comment": "Malware payload (RedLineStealer)", "value": "ec6cde5a609c1fc3088af868ed52e525ef920c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686502, "uuid": "99e2116c-798c-4942-a19d-3b5cfb8bd4dc", "comment": "Malware payload (RedLineStealer)", "value": "863dec5a2d9de84338ae2844556bc2502462e587bef1255b063048cb3165e31610639ab1a6ad8a864b834bdad9aec2fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686502, "uuid": "fdf3db78-794c-4840-a3d7-10bd7e56f5ed", "value": "T1CEB40203ABE59423E4B5177058F705830E32BC629DB8533B774A984E0DF27D9A93276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686502, "uuid": "b2f30181-8ebd-4948-b383-319333ad4f84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686502, "uuid": "70636276-bb29-4cc1-bde0-622747d88c85", "value": "12288:jMrhy90Jl+CGgGaUhLhIorjHr46YhK/gBYCSPgtnxlKY0embG:Wycl+qyzbYhK4zWMqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686502, "uuid": "7eb7ea8e-3ae7-461b-b1d3-b634762542af", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686502, "uuid": "b330733d-53c5-4363-aa23-c1b0ebcb475d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686502, "uuid": "22d3d6c4-18bc-404e-9c05-82585c4e1d5a", "value": "5216437e3f11aa892f3fc28c98e317d9285593320a225.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee221377-2f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690750320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750320, "uuid": "2f7284ef-c849-43d4-8472-16b327806d39", "comment": "Malware payload", "value": "971cd0e08332f5bdff531d8a360f2f60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750320, "uuid": "3758db4b-590d-4f4c-8274-f1422499b499", "comment": "Malware payload", "value": "52634ade55558807042eae35e2777894e405e811102e980a2e2b25d151fde121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750320, "uuid": "de390d4a-f768-42cf-a4d7-ff64a06bfb8a", "comment": "Malware payload", "value": "1feb60ea2021efa641566b05d8f8f140260e7418", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750320, "uuid": "4527aea5-28a7-4aad-9450-4b0af5c4867d", "comment": "Malware payload", "value": "c7a550b1a66a4ce13037459acc53e2f88d22cd0ca960b64a5ea1ca4367c0a5bf962e016217893cfa6a2ec15937a5126d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750320, "uuid": "f936c067-31c5-4789-98a6-f1d241aefb6c", "value": "T147F26D087BE4831DCAFF2BFA6973A6010274E5039A13EB4E1DC8456E6B33B8189417D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750320, "uuid": "231afd1d-58c3-4c61-8b45-f1efe76b274c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750320, "uuid": "63efc838-2019-45e2-b849-52dd1e479f99", "value": "384:Ogg9j00WbqxAMTayV5N+5maFZZL3CRpJm3/KNm0E0VgtFMAmNLToZw/RZCvK9Ik7:IB4QBTOl3Ck3CNsVFQ92VOMhbuvl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690750320, "uuid": "1d934c1f-9218-417f-a424-5803c0da8081", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690750320, "uuid": "875a452f-3d1c-40b7-8a10-c2bcaef2803a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750320, "uuid": "5bc51fa6-3263-4a9a-aa0d-9bbd131b8ff7", "value": "xwormwithstart.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd516fda-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686780, "uuid": "b523f208-0c6a-42d3-8141-417772b4342f", "comment": "Malware payload (Amadey)", "value": "ac30982e2d08d590352b016868c511d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686780, "uuid": "b942ca39-2116-462a-b948-115253f0b44f", "comment": "Malware payload (Amadey)", "value": "528ad26e229ca77419fe017d6ba085c582d2651a2626ae59242cb65c0befe4c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686780, "uuid": "8e603a7b-711f-45d3-92ab-02c460614d3d", "comment": "Malware payload (Amadey)", "value": "48258c70326bdb704223c0c2181a512af6bb8014", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686780, "uuid": "2b2d2958-f30b-45ed-af83-ad8c25e9f699", "comment": "Malware payload (Amadey)", "value": "ad89b0177353eb3b12e7a2830536ce2b6f46ff6e63f646f1fd781643a4e951a1861e107711f037b1d4c07bf25fcf3ff6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686780, "uuid": "119dce87-ecf8-4f95-b1bf-348a558fa1d8", "value": "T197B41292A7F84032E87917B01CF613C31F76BDA19874929B23589A4F1DB36D1E4B172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686780, "uuid": "98d39522-063a-4052-a63b-26f713e04dc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686780, "uuid": "0f8a2e85-e11b-451a-82f7-45975e7984c0", "value": "12288:7MrVy90qC/GFiw9eNBeT176SLpFSr+bQLHEH:2yPEGQQKBeXXSryqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686780, "uuid": "e4daf029-6a00-4def-b241-d9f367a192da", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686780, "uuid": "b5fbfd07-ff0b-471d-b3bc-f3ecc98cec5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686780, "uuid": "7f2da801-f604-4846-a514-f60f2354d3ee", "value": "528ad26e229ca77419fe017d6ba085c582d2651a2626a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0975c2a6-2ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690698826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698826, "uuid": "e562d3ad-ade3-46a0-b3c5-6140d87ad9a2", "comment": "Malware payload (RedLineStealer)", "value": "b17d298d77974d1c4ea6ca29120aa8e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698826, "uuid": "0f09ccb5-ffa2-431f-b6b9-548723dc69f4", "comment": "Malware payload (RedLineStealer)", "value": "52f0436b9a312653c1df1f1e7065828a46db3da8d780c7c2f140358b8ef7d299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698826, "uuid": "fb2bbd57-2b26-4c1e-b752-d17daf9edb41", "comment": "Malware payload (RedLineStealer)", "value": "3eb24d81a75b7dcfb61afb777af0cf478af10188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698826, "uuid": "2578a662-ad81-44e5-b0d7-30de40f22d66", "comment": "Malware payload (RedLineStealer)", "value": "349425168e26e72d841f4df6072505409b8b9718fe43a78f0e28f9337df635a9aaaff7c9c1c0eaae1babd4a7e2d7a13f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698826, "uuid": "141a74fe-2f3c-4b8f-bf14-69daff708835", "value": "T18CB41213F7E88473E8B62B7058F603830A3AFDD55D3593672B55AC9F0862684A87137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698826, "uuid": "2331b1db-1632-4ff7-bba1-e0c0e3230cad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698826, "uuid": "2e66b13d-5792-4864-91d8-ff022f800a61", "value": "6144:Kdy+bnr+jp0yN90QEH3avjT7kW6nZNfeu6WNxbXpH/iSii+29zlA1vOAiQruzi+u:XMr/y90wSvt6jivYu1pCY7Xq1l2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690698826, "uuid": "ee738f72-7dde-48bc-bfa4-faf9ab436d77", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690698826, "uuid": "e7ef5f72-7f7a-43bf-bfec-63fc6fb245e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698826, "uuid": "afae967b-eec9-41e7-9acd-e772f2e9efee", "value": "b17d298d77974d1c4ea6ca29120aa8e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df9a76e-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686432, "uuid": "eb880bac-a639-48c6-a4d6-68894ab9c2c0", "comment": "Malware payload (RedLineStealer)", "value": "cb4f8155764450b714ef6d7746648383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686432, "uuid": "643452f0-4fb9-4bd4-8386-370bee11029d", "comment": "Malware payload (RedLineStealer)", "value": "5373aba206bcbd861f4ce743b44d0bcb8f4968b73683cc9aa85c0dd51dd31164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686432, "uuid": "02ef034d-d29d-4d20-bff4-b38d5985705b", "comment": "Malware payload (RedLineStealer)", "value": "55ca11f5e66db628b05986ff2ebd40e023bb0cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686432, "uuid": "c31445c9-c927-4d97-90b6-2644de90d3ec", "comment": "Malware payload (RedLineStealer)", "value": "ad01e7d2e15b9b642c93c9b6760445148b30f2bc0e22509fdff97975175b13badc837d4e3768aaf4c91bc65b8aaa76cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686432, "uuid": "22844938-a337-4a97-aa38-e7f08277f677", "value": "T1DDB41252B7D95076DDB11BF048F603931A35BCE2AFB8837A3710949A2C325D4E572B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686432, "uuid": "5853840a-4237-49fe-8607-54ff391433cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686432, "uuid": "cdd6935b-dffd-40fc-9f72-3d75d8030019", "value": "12288:hMr/y90TnajMSFflI4bzmLGvA1LZgBYCBIBlcz:uy4najH4GvbzuTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686432, "uuid": "666e93ad-5a2a-4938-868a-f1058aa5a6ed", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686432, "uuid": "9bd88808-24bc-434e-96f4-299e9d22ea3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686432, "uuid": "25b7276b-d4f0-4753-9a5f-d5460c48e429", "value": "cb4f8155764450b714ef6d7746648383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2872ac01-2ecd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690716917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690716917, "uuid": "7970a354-1c45-47bf-8413-0126eb63c76a", "comment": "Malware payload (njrat)", "value": "aa91557978aa60bc7bf9d84471e119d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690716917, "uuid": "0febc24f-e602-4557-b01e-9049887bb379", "comment": "Malware payload (njrat)", "value": "557f48ca00803c41434f3e01286839df2c69253244b5e67bd16b02c260a4a28d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690716917, "uuid": "38d56674-da06-465c-9551-5f1bd5eea7e9", "comment": "Malware payload (njrat)", "value": "b7dd12b6219cc1157c91c1afc913b138cc170b66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690716917, "uuid": "3e5f5888-379c-4b5d-84c8-7b5102c18f89", "comment": "Malware payload (njrat)", "value": "5e100721a0fb5f6a6770ecf8c723502dbccf6f3bb346f61025de8c5c4d334c326d61d7088f54d36796c5181ea271d4ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690716917, "uuid": "19888391-f399-401f-a24f-baf7469f04a3", "value": "T1B313D78CB694E174D5FF8BF1B4A2B2890B71A017A902D30F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690716917, "uuid": "e9d245c6-6e61-43d6-af7d-ca8d46491fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690716917, "uuid": "2a999538-ab1b-4c32-8d85-42ac8f8745e4", "value": "384:yZyzSg98NaIyrLPb3cWESES6ik7azsIij+ZsNO3PlpJKkkjh/TzF7pWnk/greT0k:A4ywFrzb3cP7QuXQ/oh/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690716917, "uuid": "79c0d16f-4f35-4f65-9967-8130cd250012", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690716917, "uuid": "584b7c57-f978-4410-a99a-7a175ab84b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690716917, "uuid": "22aba13f-42bd-4a1f-97eb-7a3523541b1d", "value": "aa91557978aa60bc7bf9d84471e119d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e313b2-2f27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690755618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690755618, "uuid": "88a885c6-f7a1-4f21-b9ac-3cf2131fb54f", "comment": "Malware payload (njrat)", "value": "12a54d5f1cb206522046fb09ca6dc460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690755618, "uuid": "e43c2e48-fbb8-4e83-96c5-ce5eaa36b641", "comment": "Malware payload (njrat)", "value": "562e19c3874e4174fe8d0d57b2d7a7d9698fa3dc3797e952172f77049c010ef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690755618, "uuid": "6bb4494b-e22c-4a73-afd2-9f203fc9819a", "comment": "Malware payload (njrat)", "value": "0d70fede18c256d02ca4df8f82419a1c2c5ad4aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690755618, "uuid": "88c30994-0931-496d-bbae-76c07724f26f", "comment": "Malware payload (njrat)", "value": "872d1c0539a003fda6727e4e317cbdfac2fdb2abff1b5e02c3b34cb0207707025d8116084e2e4d3d53411494b3fb8518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690755618, "uuid": "33d36054-5179-4f65-a2e8-2ad5fb19c306", "value": "T14513C78DB684E174D5FF8BF1B4A2B2890B71A017A902930F99F154D94FB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690755618, "uuid": "85bc52d2-59e1-4d68-a980-dac1bc50f313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690755618, "uuid": "6c659707-0afa-4046-924d-6be994cddcc0", "value": "384:6ZyRFIB+oyiBdV86gEj8LIuDzQIij+ZsNO3PlpJKkkjh/TzF7pWnauRkreT0pqf7:Yy+IlifVPYZuXQ/oU+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690755618, "uuid": "633a4ddf-e0e8-4766-b180-928d321d21c6", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690755618, "uuid": "c75bb368-bc40-428f-837a-826f3ed4b289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690755618, "uuid": "18a176de-0598-4354-8ca3-6d7ce5d37d66", "value": "12a54d5f1cb206522046fb09ca6dc460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e734899-2e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690696714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696714, "uuid": "a81f8c2f-2d55-4840-a17f-af55c133fb27", "comment": "Malware payload (Amadey)", "value": "4b6da72936ba995bf7933fa76190698d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696714, "uuid": "38a75aed-072a-40ca-83b1-37c2c5cbfdb8", "comment": "Malware payload (Amadey)", "value": "5648d5e223fb909d98d018d94f235668a92d62a6e689c17187b3a920c2898c0a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696714, "uuid": "4b074e8c-6060-4591-8139-9cc71fed19e7", "comment": "Malware payload (Amadey)", "value": "e6d9b8d99063d1fc02c2936a96eeceebf9d169eb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696714, "uuid": "8d88fa7d-118f-4dcb-9577-5ed86a92ed54", "comment": "Malware payload (Amadey)", "value": "4de3a22061b50f809b4cfe9c30502db7a2e03f813ef5c27725b5c886e9be5005e455f78927bd0065d53614f72ff9b774", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696714, "uuid": "79acca67-8830-48d7-bbd3-58e4d4370ac8", "value": "T1E0E4124227D89433C9F127748CFB13830736BDA06A78836B6349A96F1C736C4AA75767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696714, "uuid": "905c71d0-06de-44cc-8144-ea700f69aacd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696714, "uuid": "a761a41f-58a2-44b3-97d0-39d248305c33", "value": "12288:VMryy90I/lnWw7tB4qM1ioLaKrryTWT7lBJ0t+n5:DyTnoqBoAsG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690696714, "uuid": "73a4f69b-ccbc-4cb8-b7bc-446a61cb334c", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690696714, "uuid": "17020e40-6b3a-4412-99f3-002fdb0bbc43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696714, "uuid": "c26b1cfd-79c5-474a-a7b5-bbedf3b8d965", "value": "4b6da72936ba995bf7933fa76190698d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd14a640-2f15-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690748144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690748144, "uuid": "5f3aca40-df1f-468f-a8f5-715d019a4c80", "comment": "Malware payload", "value": "421cc164dae34ba0e1cba196906cf70c", "object_relation": "md5", "Tag": [ { "name": "AgenTesla", "colour": "#8C1495", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690748144, "uuid": "36cdb5e0-7893-4bfb-9e9a-ebaa9ea87db5", "comment": "Malware payload", "value": "567826580e2347d386ac8cb6d6c8bd541679f13335db51aa702d67e2cba22a83", "object_relation": "sha256", "Tag": [ { "name": "AgenTesla", "colour": "#8C1495", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690748144, "uuid": "a411a3f7-8272-4696-aa51-8ed186510b80", "comment": "Malware payload", "value": "41599399e807248ea11a47e2a96a493feaa4b783", "object_relation": "sha1", "Tag": [ { "name": "AgenTesla", "colour": "#8C1495", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690748144, "uuid": "d9a87de6-2f6b-4f8c-b8b3-e72a84f2e3ae", "comment": "Malware payload", "value": "5c5ee14fd54e740e9cbc7651514de3ac3f8fa9143304481f448385de454952c68a235b8aaa2732b1564e8c303ef41b70", "object_relation": "sha3-384", "Tag": [ { "name": "AgenTesla", "colour": "#8C1495", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690748144, "uuid": "ff2fb967-923b-4824-8b27-2ded87dec3ef", "value": "T1EFF21A537E5A92B0C9ADBF3BC5A782120375E5A26523DA09744F234A1C03BF7DD4AB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690748144, "uuid": "c7a50562-09ec-4760-9100-740ca2b914d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690748144, "uuid": "26edee9c-cae0-4b07-83a1-2870ce8f8614", "value": "768:vrT9qDHxZLJLsh4S4k+tzmGTEKTPtaTSeqEvfb6lcU:VqVZLJLsapmG9lWb6lcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690748144, "uuid": "da3d33bf-5913-41e4-9b9b-064d64ba4db7", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690748144, "uuid": "8fd06dfc-c4dc-4ed3-ab3f-0c0dc4f91932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690748144, "uuid": "003f76ba-8698-471e-8636-5859c0f6ecec", "value": "PAGO DE FACTURA PENDIENTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929337eb-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690701204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701204, "uuid": "bba4ee4d-cf6d-4a6d-895a-8b8641d02a35", "comment": "Malware payload (AgentTesla)", "value": "a4932df30061d5db227616aa67723bd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701204, "uuid": "cb599f09-7f2b-48cc-a3f6-a6df9bbf8c21", "comment": "Malware payload (AgentTesla)", "value": "56e7882d65c94c148143f65ee5edb3fda87fd6e5a0abf1b838d1fb1517019c14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701204, "uuid": "a988460f-5fa3-4c03-b68c-f1b34623d60a", "comment": "Malware payload (AgentTesla)", "value": "29752775ad508b474968c2dec68632bedce60ce3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701204, "uuid": "e3633ae7-ca26-412a-82ca-2e5fc8f4a63c", "comment": "Malware payload (AgentTesla)", "value": "274d844429bb49f0e286450b4a25898823f51c1b426ea8d174638757b661d4ac1eae91e6edd4fba709b13a89b290de0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701204, "uuid": "59bf725a-f66d-400c-8a35-87478a94b8a3", "value": "T133256ED1F1508D9AEC6B06F16C2AA53015E3BF9D54A8C10C59AA7B9736F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701204, "uuid": "7012ee0e-3a7d-40f7-8210-22a56e6b0ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701204, "uuid": "ea27640e-5f9b-48f9-94c9-ec0f0969e2bf", "value": "24576:3CgjjZc7taBFIMk7GQZc4/Mo9UE7VTQch:XotaBFIXSAPVT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701204, "uuid": "c5d60637-1b92-4e26-93db-4ce124dab994", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701204, "uuid": "6e800d4a-4992-432d-956b-f05af9301ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701204, "uuid": "67e1b551-0b83-48dd-a212-a351ef578d55", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7337abf8-2ec0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690711459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711459, "uuid": "0b42cbd0-94be-4a27-bfd8-d8a571b0d47b", "comment": "Malware payload (Amadey)", "value": "feac1334b153c316701853b4ad171039", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711459, "uuid": "3a027c47-7c1f-462c-a0d1-37189505feb7", "comment": "Malware payload (Amadey)", "value": "577a13c84272da226e58c74d1595fa6f32cb9169f2543aee42be7fca489c2d97", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711459, "uuid": "0e1be0d1-e66d-4296-be07-8fb9aca8ffb2", "comment": "Malware payload (Amadey)", "value": "cb0c5c21518a8da481593f05b8895a4117d3cf88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711459, "uuid": "19caac15-abd4-442d-a9a9-aefc97fefc91", "comment": "Malware payload (Amadey)", "value": "f7bd98e4f90097850bd95acb453c74b17a51faa45f49f6952a571f9e412ba0a0e0c996a558a3a05f1414859d028bde06", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711459, "uuid": "aae7bb44-4222-41a0-bf4a-903bcb55e307", "value": "T115B40212ABDC80B2D9B217B168F702D32736BD56AC34832B6745DD1A4C736C8A87176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711459, "uuid": "0c0e3c9b-0ecb-4f8b-a3ee-078f4bc54f4d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711459, "uuid": "1a503864-b3f8-4dd5-8a00-652f8fbca5d4", "value": "12288:bMrby90Yxo352UgiGt8Tf6u1CdVgBYCVfCmxWM:Iydxa4UVhr1sdOz0mUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690711459, "uuid": "320a2855-7688-4da8-8a90-6f413408ab7f", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690711459, "uuid": "19d2b069-27f3-4533-93b7-7338b1b7281f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711459, "uuid": "30c427a4-fa83-43b1-a0bd-11d91c8a47bb", "value": "feac1334b153c316701853b4ad171039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80dce6a-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685805, "uuid": "f5340b92-a696-4801-86c7-9267b8318f1f", "comment": "Malware payload (RedLineStealer)", "value": "0194a7d8ffb716ba3909787c22dd83d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685805, "uuid": "13617d04-cb53-4408-b823-fea005c08506", "comment": "Malware payload (RedLineStealer)", "value": "5794834904020f0613be65c8efb14eb5b1d48beccffb657300a610b14aea514b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685805, "uuid": "092ae614-cd05-441f-aae2-863e406f2774", "comment": "Malware payload (RedLineStealer)", "value": "73f2c3b2a8b6cc14f94cf08576c6b918b90e976d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685805, "uuid": "f28fd9da-ac6b-4a60-8f25-7b9c2cace0da", "comment": "Malware payload (RedLineStealer)", "value": "f32789c0423cc7b25c4dc5cc9f869f4fbdad9901ae936be406a74ce1c25c59bf21512f9d96581af75a03d5f659145ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685805, "uuid": "b9349303-6e76-4126-8e55-9ad4854b2943", "value": "T146B41293A7EC8062D8F91B7018F612D30E367CA18D74427B23859A5B1DB36D4B835B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685805, "uuid": "fce6ad5b-4412-46d2-8077-939f137310b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685805, "uuid": "7f70aaf0-fdf0-4ad2-819f-6bf994c0984f", "value": "12288:XMrVy90AfaXAIx0kg5YcUsDUSNSQ/NgozcKcZO/atN2:yyzfaXj0k+DtwPbtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685805, "uuid": "7b1ec168-efb7-46cf-a56e-06d300d41ad6", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685805, "uuid": "294aaeba-d8c0-483c-b8a6-4e929be57c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685805, "uuid": "f5d088ae-d10e-4639-8b0b-4def0b8b4711", "value": "0194a7d8ffb716ba3909787c22dd83d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920e3f42-2e93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690692184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692184, "uuid": "3e963dbf-4ae3-441f-9741-3e7faf921108", "comment": "Malware payload (RedLineStealer)", "value": "b562c5eca1421d1c4c20202bb876cb20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692184, "uuid": "f617794a-d7db-4af4-8fb7-b28504339d49", "comment": "Malware payload (RedLineStealer)", "value": "5795640bb92282865ec6a64fa8e222338482f1fe8dab0d61f6afd9297810b9f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692184, "uuid": "2ebaccc3-9b8f-4c1b-b489-2acd6255e6e0", "comment": "Malware payload (RedLineStealer)", "value": "923b9ddd4ca3a0f2a7dbead30edcad1e939d2b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692184, "uuid": "27a88521-19b4-40d7-8bf8-0b06d9685d5c", "comment": "Malware payload (RedLineStealer)", "value": "5f82b3305a2be8ac4640d22847a0caf9673a6795cf23b74b6fcd4aaedd25c4340f497555d04d86c682600b6b3ec353f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692184, "uuid": "f913852f-5f31-4346-b95b-14862961b08f", "value": "T157B40103A2E88572DCB61B705CFA03931B39BCA15DB8537B3355AA5E1C722E4A935337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692184, "uuid": "4a1704a3-13b0-4aa5-97ed-b70304b44c05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692184, "uuid": "68b8a830-3d32-482a-8469-584c18b712da", "value": "12288:3MrBy90ESBA9d0zomaEipxdJMdSKY1/bNYRVQmfQ:yyBD9Cz18xdqS+XzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690692184, "uuid": "ed2b9921-6800-4d63-8b17-e81baf814e46", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690692184, "uuid": "bae32ad9-2cc4-457d-bbe4-0fe6d15952cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692184, "uuid": "1524801a-c17b-46a2-87c7-a1d21fb4f583", "value": "5795640bb92282865ec6a64fa8e222338482f1fe8dab0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d52dd3-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695227, "uuid": "a57014ad-e521-4dad-bee0-d761b9909c24", "comment": "Malware payload (Amadey)", "value": "b4789013a2edb3269755f8149de98dc5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695227, "uuid": "92d4b49e-4e62-44ef-9426-c215be7d5eea", "comment": "Malware payload (Amadey)", "value": "57e39dfaaed141734cb6bd16258ce629e067f7552b9b35526fa95ca047183965", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695227, "uuid": "a7d8851d-ab21-446b-81ad-019162bcb4dd", "comment": "Malware payload (Amadey)", "value": "f590ef158c9c43c0b884a608f33707685b2124b6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695227, "uuid": "f7d5f0ec-d606-4ea1-bc8d-d6e73bef1c2e", "comment": "Malware payload (Amadey)", "value": "bc6796ae8c7058c2dc5e4bc4ccb9b203723df8911d519bdad0b8a032b09429b312401977f818b85702a52ea3c4acd6bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695227, "uuid": "725697a2-a240-4fcf-bbe9-93e5a48b3be9", "value": "T128D41263E7D48032D8B92B7119FB02530E37BDA29C74631F2752A95A1CB3AD4643637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695227, "uuid": "f58d056b-faec-411f-8acc-b7386d5cc16f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695227, "uuid": "46610ce1-2517-47bc-b5ab-43219eed6add", "value": "12288:TMrny90mlrrVRFpi4YTEkIIhPWfX0vj0lF7spxL/Mguuy6r0Y:cyx9r3ib/TsXrKaTS0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695227, "uuid": "3bf308aa-2784-40ce-b85e-a3c9bd0d0fe7", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695227, "uuid": "c13c687e-97ef-43e3-902d-b5829a8f632f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695227, "uuid": "a38480bc-aa10-4cc8-ae7b-52d45960539f", "value": "b4789013a2edb3269755f8149de98dc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06acadfb-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686796, "uuid": "020b4316-c6cc-4669-aa71-13ebe1d12d50", "comment": "Malware payload (RedLineStealer)", "value": "a169d234e0bc539cbb219d9b77ba9bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686796, "uuid": "55c7621e-e742-411a-a7f2-eff6cf66bec2", "comment": "Malware payload (RedLineStealer)", "value": "58b0414612b916c5bac79d45807bb2cebc32d9884ec099860952ef758d337c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686796, "uuid": "ba490344-5cf5-40d6-b66d-415702bf7455", "comment": "Malware payload (RedLineStealer)", "value": "5088031ad6fa8aea565feae9ac0b915131daa2fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686796, "uuid": "b96fbad9-7c37-484d-81c5-f9478523412a", "comment": "Malware payload (RedLineStealer)", "value": "3a884753260ad3231bae19fc5967742dd0062f652665b5000e116ad9ccc8933e3f5b14e93b1f559f69b88f82a69d9d7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686796, "uuid": "1fbbd89b-ae97-461a-a853-362367a9d975", "value": "T13EB41257ABD454B2D8B467B0A9F602D30B37BC668834836B1782895F5CB36C4B872737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686796, "uuid": "0d0bf01b-4e08-4c80-9cb7-e2094da0bceb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686796, "uuid": "ed739a0c-5680-4ea0-aff8-96945964db85", "value": "12288:YMrRy902j7K78bQ2h3vgI3SdhKRtUY3jBhk2gBYCFWaRy/Ji:pye4b8wgKvaVzcaRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686796, "uuid": "0a976c58-5461-4a08-97cf-24d5bfd13bc7", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686796, "uuid": "3ef1403f-4b69-453e-9d69-61bb4bd9c8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686796, "uuid": "b3b268da-9558-4a13-8f05-eac5d2bb4bf5", "value": "58b0414612b916c5bac79d45807bb2cebc32d9884ec09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20051b01-2ec1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690711749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711749, "uuid": "1096a991-9d2a-4b5a-b55a-1688f34cb27b", "comment": "Malware payload (RedLineStealer)", "value": "7d00c0bb91a337cf6c953f319d457dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711749, "uuid": "bdd75c69-83ba-45fd-b38e-0063a7329093", "comment": "Malware payload (RedLineStealer)", "value": "5a2e261636f9c810db5d221f9e1da740101710fe26b06ece9bea826232778a53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711749, "uuid": "a939b2c9-5e18-4536-b352-7496f4795803", "comment": "Malware payload (RedLineStealer)", "value": "7263199a3272669d127807f036f89d064a2e7956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711749, "uuid": "e5d8fcf4-de83-4aa5-af10-4b38cfec5166", "comment": "Malware payload (RedLineStealer)", "value": "a837174cb0e0622a0cf238f3cc12bec2027f6270633a05443a43b61c607dd36abcbc6dc013cccf65002cf6701207c929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711749, "uuid": "6405e1c7-83cf-45af-99c7-eacfbc292370", "value": "T132E41282A6E844B2CDF24B704CFB43970A327CA15D78873A2781AE5F4DB3594A572337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711749, "uuid": "fa18ba6b-e897-4d8a-8707-8b59f434e49a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711749, "uuid": "08f1d5cb-e00f-4169-b1b9-fdfa020f292d", "value": "12288:UMrpy90KXAiLJdTDmxSpxqa6sYMnMLkvLoFRf+UozBXEX:lykizTxWa6slMwvLdBzBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690711749, "uuid": "ea3180ae-7c46-49cf-ad48-a91bcee13b2d", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690711749, "uuid": "a787529e-c3a4-4898-b2b5-64e653c2948d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711749, "uuid": "cd6393a5-c1a0-44af-956c-36a58c608950", "value": "7d00c0bb91a337cf6c953f319d457dbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a3b0af-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690701229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701229, "uuid": "ed4b5292-64ba-484d-9fe5-d02df1be6fcd", "comment": "Malware payload", "value": "f758efbdef50de7e366d63bf3de15c05", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701229, "uuid": "cce8700c-c8f5-4a91-ae6d-245e53eccaff", "comment": "Malware payload", "value": "5a913bd302e961c677b2cc66afce102569929634c4c46384c004a4964b848a4f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701229, "uuid": "a38ad426-fbfe-46f8-aeb9-64a2d95f4272", "comment": "Malware payload", "value": "7245cb0c58d25e4896252581bc88c1fc53a02e6b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701229, "uuid": "84be0f9a-b7fb-4866-9038-bbcc03b70f32", "comment": "Malware payload", "value": "b92dc08f9d30913a1510d88cf2547038c34fecb40d09ab699c3cb35fd57f7661152993e0b0f34d99ed61fe469bcceaa8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701229, "uuid": "6e70d55b-d012-4f8b-aa8a-00bb149520d8", "value": "T107E423DF4996C26FD8B394F6E12DBBA0635B6C12032CC79FCC3976210971E693A46472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701229, "uuid": "98365403-3ff4-4899-96de-71355612c1e6", "value": "12288:3gzG/i0m/RX7nydn0VfjjyplGH1AFQsWt/Ru6dbb0y/StSn2zH:+Y9IRLVqplGH1QQ5A2b440H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701229, "uuid": "3c1c1d82-d1e2-4ae7-87fd-8169906c1dbe", "value": 657191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701229, "uuid": "42a9448f-bd02-4330-a3bc-15a877a43aa2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701229, "uuid": "923029f5-b53c-4dde-93db-271b26814120", "value": "Nuevo Pedido Vitro 203AS-010QA.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54e6297-2eb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690706040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706040, "uuid": "3b422371-83fa-4677-8180-05484fa2536b", "comment": "Malware payload (RedLineStealer)", "value": "509d99b1fc4daf3de1e9cf26931ce4be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706040, "uuid": "e8980f85-75bc-41f3-8d69-ae11056e681d", "comment": "Malware payload (RedLineStealer)", "value": "5ab0f543d93a04cef116341be75c2ff294ebca358e6cc5472a70ee38d3325855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706040, "uuid": "9ba3e2f3-3ed1-4ca9-affb-8b8f4aa72983", "comment": "Malware payload (RedLineStealer)", "value": "92266cfcf86ec19678bd08447bc8f109deb0d378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706040, "uuid": "27f525f3-042c-4b4c-a722-1aa19d1005c8", "comment": "Malware payload (RedLineStealer)", "value": "844e22433d4dc589853a04b7b0dc19e01018d04fe613adf591b03c9e1b22a1193eaf71c112c2e895442b2e99bc383437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706040, "uuid": "a5b903ae-2159-4056-bd09-3723a4899caa", "value": "T146B41241A7E49432DDB527B498F613C30E377D72ADA8937B2785985A0C732C0A97272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706040, "uuid": "15a6c27d-9d67-4a06-96d9-0bce8c2076b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706040, "uuid": "e886dc3f-2d77-4f04-be83-6c6d9c647321", "value": "6144:K+y+bnr+5p0yN90QEL9UZnCOq8nNS4m+Wa7S58JOuMUr5yHz0mJ441r:eMrhy90B9E3qQNS4mjul/MYMHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690706040, "uuid": "518d0c24-85a7-47b0-942e-1a259a74f6d1", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690706040, "uuid": "21f29484-bc8c-4d05-a9fd-c39420b59c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706040, "uuid": "171df0a8-ef74-46c1-b27a-8713d4f1ee2e", "value": "5ab0f543d93a04cef116341be75c2ff294ebca358e6cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07860dea-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685509, "uuid": "3d776958-ebe5-4473-b934-2623e629683a", "comment": "Malware payload (Amadey)", "value": "25e2ba0b451e093fa9514de45f114c1a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685509, "uuid": "bc219b3b-cff5-41c2-a478-00aa2f3bda38", "comment": "Malware payload (Amadey)", "value": "5ab581aff2cac535f537e830ce52cf1f96fb29370bd68645bd7c37e035ff6487", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685509, "uuid": "e12d7029-f9de-4321-a6df-896f7d78d3bf", "comment": "Malware payload (Amadey)", "value": "2fbf15dd85cc1d55d9c8919903f6decea7d13a89", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685509, "uuid": "dec96aca-271c-4d1c-b8cf-7855786b367e", "comment": "Malware payload (Amadey)", "value": "3195eb2567a6d7aa19cdc29549126f0054a5857489d7da6f678183515b21154cee7643caf22dbc98c8ad89586b7f9813", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685509, "uuid": "f3022d5e-821d-4ab0-b5a5-bef61a5cd528", "value": "T1EBB40247E6DD5022C4B52B7049FB02930E36BC92C969836F23965A9E1CB36D0F47177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685509, "uuid": "2bd6ab52-1027-4550-a1fd-aee6382d9a49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685509, "uuid": "e604db08-7257-4f5e-99a4-05cc84863f5b", "value": "6144:K8y+bnr+Fp0yN90QEmo2N7+mB4rZ9t0B6Bh9GZcrcoeagT8D2cmKPPzQITeSTe0F:EMrpy90i6xGZycysbKPMIT1Teg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685509, "uuid": "3cbd084c-618f-4e36-b74e-6515cb0fae4b", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685509, "uuid": "b8161f33-99a6-4664-9829-29d316d7af33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685509, "uuid": "f3d24766-72d0-45fe-8cc2-7b0f83f3eaad", "value": "25e2ba0b451e093fa9514de45f114c1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbda5b2d-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685838, "uuid": "56bbc856-f6f5-4629-951e-7be7bbd7d8a4", "comment": "Malware payload (RedLineStealer)", "value": "364734eab73eb7bb3c41f77fc08fb164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685838, "uuid": "e2eac324-66a9-4f54-8b6c-92b3b865e299", "comment": "Malware payload (RedLineStealer)", "value": "5bb288dac2d0e6b705e9106bf0060131df80dfec67eb730b89915e77865fec54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685838, "uuid": "4e387906-4928-454c-90b1-3121fba74a63", "comment": "Malware payload (RedLineStealer)", "value": "15e288ae38927164519867e9a5827f8cea8b4eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685838, "uuid": "bec5fad4-fc00-43c4-8e75-ecf8c090cfad", "comment": "Malware payload (RedLineStealer)", "value": "f7a76c56ba5eff66a021fba24ed2b943ccde1ea36264a7e408792fc8227ac7af4bb4b468bca7a90ecbf5b4c1d89bc0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685838, "uuid": "c2244e0b-3998-4319-a472-6ede2ad7437d", "value": "T1A2B40262A7DC8173E86457B09CF702930B3A7D629D38836B2749698F4CB35D0A471B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685838, "uuid": "88e84a74-0928-47b4-99c2-08bbac2ad635", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685838, "uuid": "9c0a40f7-9ef1-468b-91f4-3d1bb94366ae", "value": "12288:aMrsy90NbjyFOoVZAnw9lUVfBCNjzDGR6Rxvq36h:Gy8v4OoZ9lUSGRmqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685838, "uuid": "0d73cdc2-4248-4714-aaad-dad1d307cbd6", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685838, "uuid": "323343b4-2ff1-4376-934f-d2ee820c9db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685838, "uuid": "7ac359d9-6246-495f-aec3-161dede9fff6", "value": "364734eab73eb7bb3c41f77fc08fb164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd39ec8-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686808, "uuid": "fa2230d5-8b5b-4085-9aac-ad43a6488148", "comment": "Malware payload (RedLineStealer)", "value": "e28037f967e4ec0154cb80e6e5dc7587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686808, "uuid": "745874bb-4edd-4987-8a25-994be6e489a8", "comment": "Malware payload (RedLineStealer)", "value": "5c1cd4e36b49de1f5bc48867ec481355dfacd00c09aa1afddfe617021a57ce0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686808, "uuid": "30016cbd-292c-4998-ba88-f2c5cdb82e86", "comment": "Malware payload (RedLineStealer)", "value": "c8bf1ff513f40cecd9571b631c90fe5f4bde5d67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686808, "uuid": "6f033dfa-9066-419d-9be1-20dfdfe87db6", "comment": "Malware payload (RedLineStealer)", "value": "dbf97a980666102eb0fef6c2bf16de10e175da6364bf3c225ed722ed85f278b977d078766e6ba0148c0f28e15289fafc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686808, "uuid": "ca45dbdf-1813-4dac-a891-cc6cba3baf91", "value": "T1D4B41203FBF99136D9B657B0A8FA02C30A3A7CD19974436B33559E1A2CB26C0553277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686808, "uuid": "f3cf05b7-3c87-400e-8e9e-74e7669a72cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686808, "uuid": "19b0dd63-a7e4-4e52-8b50-f5f881a83fcd", "value": "12288:OMrny909SCn//g7e4Vyi6Qgff0NSA51bU0:xyxCn/IdyXffoXXU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686808, "uuid": "9b400aa0-193c-4481-9e01-18407c295738", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686808, "uuid": "03cd41ce-1ca3-4206-b8a1-1367c3ec6511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686808, "uuid": "652392ae-34e3-4879-b3ce-245f9bd1ad7d", "value": "5c1cd4e36b49de1f5bc48867ec481355dfacd00c09aa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674f128b-2e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690693400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693400, "uuid": "847d9158-27f3-4195-813c-9e4d3f0674ca", "comment": "Malware payload (RedLineStealer)", "value": "e8a5038ae2d47eff076c12f3c0e562f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693400, "uuid": "0a8292e4-30de-461d-b4ac-4c0a1eaceda9", "comment": "Malware payload (RedLineStealer)", "value": "5d1b40b7d6c6b9db9cb0185e803a78fe681991e4dee1e7f4edcaa7f75b934796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693400, "uuid": "39dec309-bd79-4c2e-9937-9ff3ccc8a79f", "comment": "Malware payload (RedLineStealer)", "value": "c1c7e24d8f2d77375400f19a9aa9f9ecf326ec5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693400, "uuid": "b770f779-dc06-42e8-a7b7-705b3dbf64f2", "comment": "Malware payload (RedLineStealer)", "value": "b5fc047656f095d21b52780208785a9201563338d79dee44a94c67f247d3bc794d55f2b8ee9a400fef04f9b343cda642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693400, "uuid": "30274523-bc68-4d42-98f6-df9bb0b5b14a", "value": "T193B41202F6E94273EEF5277118F612970F367C619DB443AB274AA94A0C736D4D831B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693400, "uuid": "d802e8b0-586b-49a7-9daf-88538de24f2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693400, "uuid": "2bbb5356-a7b2-40dd-89cc-d6a0697d6eb8", "value": "12288:JMrxy90AHubCcb+MKTajLBB4h3D2+AqDS5Sj/liiDcY/5QYX:0yW1b+MvA3/SsZR/5rX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690693400, "uuid": "99168b24-e500-4966-a159-39c159c0aaaa", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690693400, "uuid": "e90018c4-6fdd-43ec-b4d7-f621fda0e98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693400, "uuid": "a1540c1a-f756-43da-aef3-442639ccd627", "value": "5d1b40b7d6c6b9db9cb0185e803a78fe681991e4dee1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d36175d-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686458, "uuid": "496ae7cc-6c07-400b-ad3c-1a72fef6b9d2", "comment": "Malware payload (RedLineStealer)", "value": "04a6c2b77ee939b222f855fde1cb00d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686458, "uuid": "77d940fc-c775-4e9e-ac1c-d3c639cbc081", "comment": "Malware payload (RedLineStealer)", "value": "5fbab5e96e1127107183ffce712b24131834386e43e15474d48006173d4592c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686458, "uuid": "82127a92-d452-4fe2-9f16-488b55796cae", "comment": "Malware payload (RedLineStealer)", "value": "14c8226f720fd6979e4edf2b1fa065e9cff59867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686458, "uuid": "f3bd0edb-41e2-4a40-822f-78e8adea82fc", "comment": "Malware payload (RedLineStealer)", "value": "dd5854a13c3f0d6d2689fade17c09b7dcedeff563a46d694210914456b776510fce1b1becae55363417094d069afbb43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686458, "uuid": "076cbef7-bab2-458b-b8e5-c4541a4e6584", "value": "T13BB412A2A7E88033E8761BB028F712930B35BDA05DB9532B37555E5A0CF36D4653273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686458, "uuid": "0368e2ad-c04f-4049-be92-ff7ff4af7701", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686458, "uuid": "a0f005ab-a024-4be8-bcd5-9c4b1ec34d95", "value": "6144:KRy+bnr+Xp0yN90QEDMXXuyQkB6Zu7ObKIHoFVvJ989hN0Dn64dmA2yr2DN8kKjI:rMrHy90CHqOyuK+kO9WhNgn2McN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686458, "uuid": "06dc687f-4a1c-4781-956c-f648805059a2", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686458, "uuid": "68e209a0-d877-4cf2-9f66-319fc68c7b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686458, "uuid": "442b03ee-5107-42e9-8298-164314d1ad0a", "value": "5fbab5e96e1127107183ffce712b24131834386e43e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94eb9cb0-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686175, "uuid": "35d3cf69-a6ca-4760-a01d-9bcf9389270d", "comment": "Malware payload (RedLineStealer)", "value": "d731f4d43038fee62312a8321ce5a5f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686175, "uuid": "618a2c4c-3b8c-4118-8950-56ccaea6d26a", "comment": "Malware payload (RedLineStealer)", "value": "5ff4038bb7d8b406e4c2c8f93898225ac0f969e6ab1c9dfd231b77d15b417417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686175, "uuid": "391bfa7a-1e47-477b-8781-5a0417493821", "comment": "Malware payload (RedLineStealer)", "value": "f53fca13f13bc4a7fa25f421ae2db2688562f8cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686175, "uuid": "482b3ee4-ab45-45bf-9dab-4fb0774653f0", "comment": "Malware payload (RedLineStealer)", "value": "d933b611790606bf10a9318d5f658c0eda0bf0fb70ce9da5a53ddc63087a7409725e4ecc0ff0de54a020b7d1eb22441c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686175, "uuid": "9078ad26-f956-40ef-8cd9-01f89190e49f", "value": "T1A5B40207B2D84073D8F667B068F706830B36BC625D34D37E275A994A4DB26E0B87573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686175, "uuid": "045f5c5b-2b82-4d1c-bc65-3a2478086e1f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686175, "uuid": "c4ae6396-de1a-4e80-98ae-bfa20af6be3b", "value": "12288:zMrGy90c+omaQBRZ+8F/bgCd1zAxIfgBYCDGyUjqwTtH:5yjJmaQzZ+8zU6Yz7Ues", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686175, "uuid": "b39f6ddd-cd2f-4021-a0d1-84d67dae6279", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686175, "uuid": "fe822ad8-6c5e-4166-aaf1-7bc0eb305b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686175, "uuid": "c3b4d62d-2eb6-43c5-b4a2-ddfdee90b3b0", "value": "d731f4d43038fee62312a8321ce5a5f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6740635-2f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690750280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750280, "uuid": "212730ef-cbc3-49c1-bdb2-28dd520240ba", "comment": "Malware payload", "value": "6a92d6ed9cafa2901371412f36783912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750280, "uuid": "75f02c5e-b3e4-4ed7-b748-fc3f87605efb", "comment": "Malware payload", "value": "60782165f5bb1099f28bb39ea3150ee08a6281701f1ee647b00a4220d36d1640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750280, "uuid": "3f510fab-518d-4037-a324-0ee7bc802837", "comment": "Malware payload", "value": "f78187925c4f2e2fcdab69c7bcba3207b282dae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750280, "uuid": "3fbcd95e-2c22-4c40-adb9-4e89b5da7119", "comment": "Malware payload", "value": "47d349cd01ce8bc385ba97e0335cec48720edeeab2eba0c809730d2140abaca5e709441695cf2671e3e15a2e0695d301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750280, "uuid": "8f1ead06-1291-4467-b621-719a1e25fa15", "value": "T11A059C966684C607E97642F0B821A0F461FAFC0D9212D29F7CD8AE6A7BF73009770757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750280, "uuid": "739a87eb-a0f4-438e-bbab-4f3dce958cfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750280, "uuid": "5fc48038-0d86-44c5-896a-c3faf5367bb3", "value": "12288:VpsSuP9wtsXSVps/9+JevZysdZqh6RSgfAibD/0ae2DyaGqMeNx/EzZgNZNWXw6Q:XpW9DSVsevGz/yZg9WXw6Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690750280, "uuid": "e02af6a6-752c-4260-b81e-6636925926f9", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690750280, "uuid": "438ae438-9575-4db9-9d0f-4ef2535ab08d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750280, "uuid": "c20b4456-6e84-431f-b750-546f728618c5", "value": "WSHRat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e4c462-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686763, "uuid": "02ef0787-96a5-4bbc-bbcc-4e0413fb3af1", "comment": "Malware payload (Amadey)", "value": "8620054cf89e85d62a962fcd3b9e4f22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686763, "uuid": "aceb96a5-6c4c-4f5e-9aec-3395844db589", "comment": "Malware payload (Amadey)", "value": "60bd8216d4a9fbc46e70133efe71dd0d46594f52df0eb029f311513936c09e4b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686763, "uuid": "4af99296-f9c5-4cf6-a751-ca2975d87f88", "comment": "Malware payload (Amadey)", "value": "b8193d0c5504c1840d58eedef9f2199642e0acd6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686763, "uuid": "dfe31d0d-9ac4-4c1b-b410-de4513aa6724", "comment": "Malware payload (Amadey)", "value": "7ebf50b54d019fa5f0ebd60a2b9f288560ce2f49fda8efe9f10fcb08aaf97f3fcd163adb07c248e1e3ea1cfedaf79911", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686763, "uuid": "7948c8ca-3d05-4b97-955a-3a6bfaf0292c", "value": "T10EB41243BAE45133EDB51BB414F613830A36BC620935D3AB23556A9F0CB3AD4A876737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686763, "uuid": "3aef36b3-4754-4d88-a81f-94ad6dcdb355", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686763, "uuid": "f76a6fc1-55ee-44a6-b0b9-e6e074c42124", "value": "12288:qMrfy90lrq8mQ8NhPlElqxONJP+4O6ZEFgq8c3M:VyvPNheqxGJPOKwTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686763, "uuid": "714d3a6e-7ffe-4887-a3a0-25b24610910e", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686763, "uuid": "88a87720-e48c-4667-b3ff-6446a7cd6540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686763, "uuid": "fe5c4387-b609-44ee-841b-c3a5dc2a179a", "value": "60bd8216d4a9fbc46e70133efe71dd0d46594f52df0eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44676e83-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686470, "uuid": "2d0ee68b-3f41-43d3-8d62-0245a384d577", "comment": "Malware payload (Amadey)", "value": "e8244184ea9d0a16363049b2ba872658", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686470, "uuid": "d929bcab-8407-413e-bad6-7b3631d45c4b", "comment": "Malware payload (Amadey)", "value": "6133ecfff746f9447f5d490d2585ebd05e30316d84f42726b42caaaefc801f75", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686470, "uuid": "cde57e6c-ffa0-431f-90bd-7240aac83963", "comment": "Malware payload (Amadey)", "value": "fe0610022d49e31f07f6c366b52bb16ac4a6c48e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686470, "uuid": "84f33690-3b70-4a84-a64c-a8689dc03e5c", "comment": "Malware payload (Amadey)", "value": "c44f8fc282cd9133dcaf38b5d7053a0d16b20d756e75a60ec247a15901e6b5bba1cfe9e3a5256418ab06752a61e4bddf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686470, "uuid": "598d7c01-dce4-45c9-be92-a99a54dee87f", "value": "T194B4124296E99073ECB117B099F612831A317CB16C3CC73A2386AD5E5D726D4E93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686470, "uuid": "5ef7ce77-2347-4f8a-b002-69ac5367f248", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686470, "uuid": "e19a94e4-c0dd-49c4-9459-46ae1ed2b772", "value": "12288:ZMr5y90wFkttwTYtNpSCUB/u6MMgBYCIGCpM5H:AySkT6NpSc6KzYM5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686470, "uuid": "bbf7c276-dbec-4bce-8db8-985784da266e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686470, "uuid": "71a63edd-49b5-4800-b632-bc74c48a8b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686470, "uuid": "0a82ea52-c053-4a7c-ab67-9051b117ec60", "value": "e8244184ea9d0a16363049b2ba872658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbba7ae1-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695260, "uuid": "2c3b948b-7425-49df-9e30-80ffca18b44f", "comment": "Malware payload (RedLineStealer)", "value": "01c633862bb0d30308b8e2a8f59b8ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695260, "uuid": "93f1071f-e635-4da9-b915-3d9106ea928e", "comment": "Malware payload (RedLineStealer)", "value": "621c2959940c7b3d0a4af095ac6d4fa5564da884a3c0be1307ef1a2077db6b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695260, "uuid": "e302b773-e12c-4a8f-9d5f-763614055055", "comment": "Malware payload (RedLineStealer)", "value": "fd5982ae506c2176d9c929ec183867a8021cc5d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695260, "uuid": "173786c3-0c7b-4a46-90f0-50a761a6cb89", "comment": "Malware payload (RedLineStealer)", "value": "4016d37813582904282455b4bfde5673b8cd701a384d07eb606df255c9e7f3bd06e11b8b0098a6a743e3bd52e4d7f3a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695260, "uuid": "33125e99-4204-4363-9fa5-6b47eda3533e", "value": "T107B41216BBD84072ECB9637058F303931F36FEA55A7C031A2694984E0DB22D8B5757BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695260, "uuid": "adc39a17-a40e-4a9c-9c6c-12b041db35e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695260, "uuid": "150610c2-7a96-48ff-978d-66014426ca43", "value": "12288:AMrDy90Fak7xbYddjj4ijbc1Ga/EHwXDaw:zyV8YP4inc1B/EHaDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695260, "uuid": "65657cc8-e546-400c-a7ac-4a3dde6d1028", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695260, "uuid": "760dfce6-5b9f-4f61-8c67-6228b432ed4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695260, "uuid": "ab3117da-4fa9-42f0-a75e-8f89f01c2233", "value": "01c633862bb0d30308b8e2a8f59b8ea0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96130b02-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695197, "uuid": "575ee65e-4eff-481e-bebf-cc996fb2918e", "comment": "Malware payload (RedLineStealer)", "value": "23e903249f121d66155c8750185e326f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695197, "uuid": "23343ceb-a3ca-4897-ba0c-56f648141566", "comment": "Malware payload (RedLineStealer)", "value": "626162d39116e7f3bad10bf42e4b6830919e6e8d430c7de5f25f8ee25a134063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695197, "uuid": "9e77172e-b676-49c7-bf6c-2a0705af4c4a", "comment": "Malware payload (RedLineStealer)", "value": "fa7a448ef45da8740781000f9a181beec6f9a147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695197, "uuid": "8857fce1-4f11-40ca-acb6-13ca2464f5af", "comment": "Malware payload (RedLineStealer)", "value": "65113b6a36d2ab5783f2d04ed763672210e99c16ba89dbf52b8e2c2227b5e258ce273abadb651f2eead872cc873b48b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695197, "uuid": "48547032-153b-4de8-8b94-c49cacd24f7c", "value": "T14CD4124297E89433ECB417B068F302D3193ABCB19D79932B1B899C9E5CB2344A5B5377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695197, "uuid": "cde5631d-1e0c-4ed4-b103-60d9cdfa687a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695197, "uuid": "0b20f55a-cf28-46cb-b827-cf6065412a5e", "value": "12288:7Mrny90oY+NuIPzI6RMWMP6DQWK77sRg9i4V+R3OQheDBmSikKcrDMI:QyHHk8zI6RMX6DQV77s2IiUV3hI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695197, "uuid": "d3070968-c318-4494-ad70-689003268411", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695197, "uuid": "fd4364e2-25fe-4ba9-a7ad-156ec45fb46c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695197, "uuid": "efb5c42a-eec1-4940-946a-5ea952f4eea5", "value": "23e903249f121d66155c8750185e326f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc20452-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686140, "uuid": "a568213d-4023-4a22-8da3-48b1e0e8563b", "comment": "Malware payload (Amadey)", "value": "8aceba987aac25eabf59eb3d33bdbb7a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686140, "uuid": "fbcb9e70-cfff-4b0d-b579-c16a1a6ab999", "comment": "Malware payload (Amadey)", "value": "642edda905124306441970759ff8ec8c6f658b27b2b3ff904b2f72fb24f79c2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686140, "uuid": "93d55f9e-9e5f-43fb-8c30-ad5ec1d0a55f", "comment": "Malware payload (Amadey)", "value": "02094ad02818351a82c91e271e95b958f668a8e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686140, "uuid": "8eee20b8-6638-4fd1-86c5-041bd3e1b1d5", "comment": "Malware payload (Amadey)", "value": "29a1a510c8c9893986cb94cac4d4994c40d65c046a5a12d904a34c68b60bcf80bf3e5d1d32bc5ff196cdc2b599fc4890", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686140, "uuid": "67c401a7-ba62-4cb5-8957-3cef12d38ca0", "value": "T13EB41216EBE88473D8B52BB058F202C31B367D616D34C76B67C5685E08B2AC0B972737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686140, "uuid": "a6cd7fd2-4ce3-4078-ab71-ef5461664ee5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686140, "uuid": "154de487-130c-4c43-a344-b136b4e855bc", "value": "12288:5Mrry90Mm20Op3Mjj74M54AkNUj2TmX4e9:aypSH4MXGUj2mX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686140, "uuid": "670ed820-17ee-4943-9dd7-944644254b2c", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686140, "uuid": "8b9205ef-d17f-4683-8c9d-fb37f9d801b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686140, "uuid": "f09e2b6d-0bf2-405b-b014-66d1bc764654", "value": "8aceba987aac25eabf59eb3d33bdbb7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65f6402-2f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1690750253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750253, "uuid": "b326efa0-c732-4b32-8075-d2490bfb330b", "comment": "Malware payload (NanoCore)", "value": "e90ceaec77447822d7f270651eee9b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750253, "uuid": "2800d121-6666-4b93-ac25-3443ecb460bf", "comment": "Malware payload (NanoCore)", "value": "64313bb5dc0a33db500e8c1ecaa88a0dca6caa507dea4fe62cadcc3b125c87d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750253, "uuid": "5734e627-2316-4958-968e-9023ce5227a0", "comment": "Malware payload (NanoCore)", "value": "33466abb7a4f23df13d2b44dd0c0bdd82e8e6182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750253, "uuid": "debe96bb-c6e5-48b4-a167-c5fb612e677c", "comment": "Malware payload (NanoCore)", "value": "032a93e1aae2e6cbd1f6b5eebb92cf76bcdbf218fd95c171449674dc0221fea40ac3cdedc18fffdc4968437272e84f67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750253, "uuid": "16acd4f0-5a62-40f2-a02d-c761a8cbcca0", "value": "T10614CF5537A88A2EE2DF86BD712206129778C2E3ADC3F3DA18D455B78F627E106071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750253, "uuid": "f7b2ee19-cf03-4cda-b3c2-fff84b2859f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750253, "uuid": "c27d2e9c-6d56-447e-b935-e2ddf640e898", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIG7YxWJpgYWvuGNhgZXT4fZjOc:sLV6Bta6dtJmakIM5MxlYONGZXM15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690750253, "uuid": "a17ed44f-9f27-41e0-81a5-2be567b6f059", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690750253, "uuid": "b3572662-65a4-4747-b4de-aa41c5dd6447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750253, "uuid": "9f6685d9-943c-4822-8af1-cf83ee9cfcab", "value": "Nano7594withstart.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba476c54-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685809, "uuid": "2b3a62d5-ffa3-4219-8f9d-d732ac6a2861", "comment": "Malware payload (RedLineStealer)", "value": "0ab5504e6fb8b050168548c72a2a1a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685809, "uuid": "1705d7c6-fd32-4954-a85e-ec628a22f140", "comment": "Malware payload (RedLineStealer)", "value": "644ed3dbceb6a83f2b6b71d655f1a52270b37a6fb7fc69a6cfdf1ab1fc9a7c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685809, "uuid": "d34ec43d-4a87-4e47-a08c-7ac78ce29ff1", "comment": "Malware payload (RedLineStealer)", "value": "ffb78739cb6c20779187338b10407bf8492a7a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685809, "uuid": "c907f7e9-e250-4eaa-8088-b8f483dc2e8f", "comment": "Malware payload (RedLineStealer)", "value": "e417777aed2c93e84c2c11909b2442ca91a33b66a93408ee85a6787a926681851a82cab449a39e5437c80a0d10717ae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685809, "uuid": "48f49494-e121-4418-8f54-03f8cb01ade3", "value": "T15EB41213BBD88137D8B11B707CFA13431E36BD615E78876B1749685E0CB3A98A632727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685809, "uuid": "67932969-b46b-4603-9d03-352c1db1cdbd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685809, "uuid": "daadd00d-e596-4a67-b3ef-30c2629e26b6", "value": "12288:KMrfy90ezJqbwx9Pmshp9dNSdJPJcZO3gG0YtPj5:dynJ3x9PmYpReJPJc43tPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685809, "uuid": "95b539c9-539a-436f-9b4c-3430d61fbfeb", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685809, "uuid": "19cba4e6-727c-4b47-9e10-2a4d8580cfc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685809, "uuid": "2d079b7a-c0c4-4155-8b89-2b0a28c715e4", "value": "0ab5504e6fb8b050168548c72a2a1a30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5587b3a4-2f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690741904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741904, "uuid": "4f526ccd-1032-48c0-a68d-ee619701f0dd", "comment": "Malware payload (Mirai)", "value": "6b8afaf1814cae6053cdbc72371ba3ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741904, "uuid": "556b7843-c8dd-4d74-8fff-445d540ca48c", "comment": "Malware payload (Mirai)", "value": "65b2348417007ce6269bc0c0df437adc47328415eb851e1b74c4ba6eb1e52ce1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741904, "uuid": "f02e4cf2-1ea5-4b39-8b94-ad7bd950111a", "comment": "Malware payload (Mirai)", "value": "de0dff1bdb1cdb45a883c27aa66b0df2846b28b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741904, "uuid": "03c69834-e071-4c7f-b762-3c44189ddbd3", "comment": "Malware payload (Mirai)", "value": "266d186c608a74639390c5e3a4990a1597c35c0f4b949604dba2ae210484c6660f1ffcfabf2d707903102b05342584d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741904, "uuid": "e8c419ed-8415-44f6-8960-bdbfdaab6e01", "value": "T12643F695B8819A13C5D423BBFB6E418D332563F8E2DE3207DD212F11778A81F0EA7A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741904, "uuid": "e823f466-596a-4e45-823f-2991f2d897e3", "value": "1536:y8F9heka5mzPSL8Xfwihvt5SJ6q6PsFGE1:y8F9hBPP/xbS2sFJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690741904, "uuid": "9079e699-86f1-4d6f-aa6c-e08397bd8e86", "value": 55200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690741904, "uuid": "b75c3b2c-a64c-4253-a696-0930213f4b02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741904, "uuid": "63bcc59c-d380-4f64-878f-e7c9585ab09e", "value": "6b8afaf1814cae6053cdbc72371ba3ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfce5d7-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695237, "uuid": "71334c85-ef98-4861-8fbd-1f42eb7e7463", "comment": "Malware payload (Amadey)", "value": "745a05008874a46dd2cd6c178966149e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695237, "uuid": "f4bd62be-84d9-4e70-b588-92180eb8374c", "comment": "Malware payload (Amadey)", "value": "67a233f4b49fe000c8dbd7ca49be85fd7bfa6dfda6c8f16ff760ede9a699b220", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695237, "uuid": "c1e1036e-f7f7-4308-888e-432d6b5f4729", "comment": "Malware payload (Amadey)", "value": "49cbb28b6f57650039de723e513d6b0bebe30395", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695237, "uuid": "4df85eb3-9bfd-4465-b33a-9661a0c0f8f2", "comment": "Malware payload (Amadey)", "value": "4b2aa655027e47ddbb24fc77e1165ddf9f058ab760327e08f8f5d949a2dc32fbc56203c8d552004f17a16a45de68d5d0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695237, "uuid": "8bf0dae0-24ed-4c92-8abc-199e688badd9", "value": "T1D4B41253BAE8A173D8B52B305DFB03831B35BCA289B4C35B23865D5E0C72A95653077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695237, "uuid": "38bd419b-65c9-46cf-ade3-954da44558b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695237, "uuid": "7ca29fb5-998c-4233-9dda-5f584639770f", "value": "12288:AMrfy90kXIQrhy1BMWN8RgpkaneCbOy0j:PybF1hWNC0kaDbOyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695237, "uuid": "4ad9612c-b05f-4588-a733-7050d9fb8049", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695237, "uuid": "88d0c434-a2be-48f7-9e7d-b5645ad26b56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695237, "uuid": "bbdd85eb-7883-4278-9cc2-ffa0978db0d0", "value": "745a05008874a46dd2cd6c178966149e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541e00b5-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686496, "uuid": "88be80c0-6118-4ecf-a13b-29bb20d8f6f1", "comment": "Malware payload (Amadey)", "value": "31e68df96baf82c75c697f28e8f7744d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686496, "uuid": "0e479757-4e94-4b39-8bd6-2bec258f98e8", "comment": "Malware payload (Amadey)", "value": "67c9bafd7e4c9cbcc48a82964e54345542d4f01c513691dfbe3c111fbe9f4d02", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686496, "uuid": "7a11959c-4ca4-40ea-b501-ae26c74f1e5f", "comment": "Malware payload (Amadey)", "value": "74de1b7ce67e2ca09c89e9424396b102ad3acf77", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686496, "uuid": "bce0ec25-998d-49d0-ae3a-bfd614dd852c", "comment": "Malware payload (Amadey)", "value": "f1935308d9236fdff05b1dbae84df0d536ef6f069f8eb9a8940ea248d9c3ff9bff365d980b754243f7713ea648a3776f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686496, "uuid": "f7f3f51a-7fcd-4e81-93d4-f17c5443220b", "value": "T1A3B41213F3E88173DDB927B028F203970B35BC615974936B2356AD8A5DB3694A431B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686496, "uuid": "656a3fa4-550c-4af2-a2cf-e8c0eda0e6ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686496, "uuid": "a8dd61d9-bca4-4d51-8c0b-21dfb37a0c16", "value": "12288:BMriRy90acxfEWr7xSzQmfIQSCSi6VPDE81mE9l:7ydcxRSzQmfICV6V7E2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686496, "uuid": "88b642f0-9c1a-4597-a31b-a9838b53656b", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686496, "uuid": "69fc3952-cf0f-4f73-ad57-2d90c5a09cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686496, "uuid": "cad0d8d3-fa66-45f5-945b-adaaafed5b61", "value": "67c9bafd7e4c9cbcc48a82964e54345542d4f01c51369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8684a4-2e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690696716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696716, "uuid": "79741145-eaf9-4f5b-a63e-3bc013630dd8", "comment": "Malware payload (Amadey)", "value": "304a5b4567c0d0be82803f9105d5fa39", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696716, "uuid": "acf288d2-ab6e-48bd-b2b7-589e5a242734", "comment": "Malware payload (Amadey)", "value": "699bfc597d56fb4ed7153a5a4fe2851361b9e27b9b8c3109277f0c5a54afbe1d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696716, "uuid": "5a4497bd-ad36-4609-b8a8-5bbff9aad1e6", "comment": "Malware payload (Amadey)", "value": "a919586040a1f12db5fd80f938a8804940836609", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690696716, "uuid": "dfe90f55-256a-44c5-9bbe-648e291ce998", "comment": "Malware payload (Amadey)", "value": "f14669c091461af77fc749cab1d876b99a9c6b0040b98f6d25edbfece94fece3d05e60e99af38fd0998b56ff4128a062", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696716, "uuid": "58db4550-4453-4263-8a92-8de736441d47", "value": "T1F1B41206E6E88576D9B517B05CF713931E3ABC709874439B338AA95F0CB36D4A13272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696716, "uuid": "7a7407bc-97ab-499e-9013-359cab27a260", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696716, "uuid": "8f3a67dc-b122-4ae3-8d4f-ea39f25d00a2", "value": "12288:UMrTy90Q5hM4tG9jl9zVEL3SeN/MYvpBuV6Mqw9g:3y/heLzmLi5aXMqw9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690696716, "uuid": "d2dc3e94-fcf1-4bf0-a043-04fbe809d319", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690696716, "uuid": "53856cd5-28bb-462d-b52c-717c2a200610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690696716, "uuid": "d301f36b-4e14-433e-bcf3-29ebfd2219b5", "value": "304a5b4567c0d0be82803f9105d5fa39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420af7e6-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686466, "uuid": "2efaf5e9-4b1d-4e8e-83c1-aa77638ebf31", "comment": "Malware payload (RedLineStealer)", "value": "ed96216f6ba767ca49b5dddca0d112f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686466, "uuid": "f0077678-fa8b-4434-b50f-bf9dc1c5264b", "comment": "Malware payload (RedLineStealer)", "value": "69b1ab21ae2e3dac8e177c7e1341ff058f756f72d80bb0ea1ecd3a2abdc0cbd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686466, "uuid": "01cdc7ad-59b7-4ca6-9f26-ee6c51cb83c6", "comment": "Malware payload (RedLineStealer)", "value": "397a49121c2d8c30823f6bfc085bde2e739f8ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686466, "uuid": "a0991482-4904-4295-abe0-aed3ef5f6f12", "comment": "Malware payload (RedLineStealer)", "value": "9d710c0b67833005f15b4154c8c709f448d2694a64c494fbdb7e9661c1b944740d7a2a35936ab2fff4caf5a182ca7cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686466, "uuid": "3f04dea4-8a61-4548-9d40-74d9eb742748", "value": "T10EB41207E7E5A072C4B5677158F602930732BCA24DB8C35B2B866D5E0C726D4AA3673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686466, "uuid": "cdfa5652-0307-48dc-80ba-84a6d7a534cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686466, "uuid": "9432538e-22bb-4c81-9580-8b7d16b720b6", "value": "12288:0MrRy902PjQRUFjsFUJ0gBYCNHSpBdwo:tyXEIwKbzGbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686466, "uuid": "ecbfe287-68d4-4355-a829-fc6665ccd1a3", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686466, "uuid": "16a858ee-7d74-4fba-b598-baed39164ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686466, "uuid": "372ad37d-83b5-4909-80c9-ee87ec6dc211", "value": "ed96216f6ba767ca49b5dddca0d112f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03fa0fb-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686758, "uuid": "9d962609-e4ae-4209-9cc7-b5902c08de05", "comment": "Malware payload (RedLineStealer)", "value": "5682b91791643d3dfb971e73404ab379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686758, "uuid": "2af7bfc8-d552-4f44-8bbd-4815dc5143ba", "comment": "Malware payload (RedLineStealer)", "value": "6aaedb8c5af95f09144febe2101174034a8561a471f02f7e284827595429949e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686758, "uuid": "fd1fc3d3-cce6-4cad-ade0-0967362f77a7", "comment": "Malware payload (RedLineStealer)", "value": "f13219f9ff78bfa43d8fd67a8effa1941153c207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686758, "uuid": "4b20757c-7328-492b-9bfc-eb3c793a0b54", "comment": "Malware payload (RedLineStealer)", "value": "407a85ef77584a76ff18f5eec4726bf3d3636cf8a310e265c399ee747aea9c25b7c71780ee2fd18a8db0fc7001bf6af5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686758, "uuid": "8bac7d1e-e926-4879-8d79-14deada49b98", "value": "T1FAB40203A7D88036D8B52BB068F707830E367C614E7893AB27926A9E0CB35C5B575377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686758, "uuid": "d13343c4-02e2-4a92-98a8-fcbb91c51a83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686758, "uuid": "48c65def-2f5e-4a82-bf1c-a1ffb17841a5", "value": "12288:vMrXy90Aym0LydErmwj1VopBrtZIuvlzuK4Bz:AyGVydEKIuvlzKBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686758, "uuid": "f58ce503-ca86-45f0-952b-321d29bf0006", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686758, "uuid": "a9fdc347-71d8-43e7-9dea-fc5774f8635e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686758, "uuid": "386f9037-b811-4cb1-b405-ad523da07113", "value": "6aaedb8c5af95f09144febe2101174034a8561a471f02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c6bc7b-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686786, "uuid": "ddf8029f-1fd6-4245-8b61-1a1d3774daed", "comment": "Malware payload (RedLineStealer)", "value": "6f97b6b174ba7da1650ea9e197f5ef4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686786, "uuid": "4efe4aff-e488-43ec-8c1b-96d7de417282", "comment": "Malware payload (RedLineStealer)", "value": "6b24567d8bdfe8d8838e21f4c119e892339a133a1ca5e50959796a9ac1fe2a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686786, "uuid": "14c08435-7f56-46d7-b1a3-868f6a6c45f4", "comment": "Malware payload (RedLineStealer)", "value": "7a1a1e8f00d35a0273cdb9d9410e30a440d41e47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686786, "uuid": "587e8c42-5f3d-4dd2-88de-631d7991e323", "comment": "Malware payload (RedLineStealer)", "value": "26dd931cbd5edb663630e4e37224542b180499a0f83d9b6a9e91a217f7f35cd1a84fab2f0aeeb946a4f9df4b786039e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686786, "uuid": "d6360c4d-cbee-4a30-a6a4-d40c0bfa2047", "value": "T1B8B412479ADC8032EDB5277014F60B930B367CA65874C36F2756D99A0CB3AC4E97236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686786, "uuid": "930ead7d-5666-4249-8b33-5e376e5f0e74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686786, "uuid": "05a53160-f214-46c3-b319-56db20ac1e8f", "value": "12288:gMrny90DCbLMMMICR5oHjETUgBYCIdeW42xAw7:3ygO3MICR5DT7zXWa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686786, "uuid": "7a9385c3-6354-4c85-904c-f8fd54ea5c47", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686786, "uuid": "37f012f3-d27e-44ff-9d94-42a8ace000bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686786, "uuid": "a6e0e45d-29da-400c-bd81-7a7f668b0cd3", "value": "6b24567d8bdfe8d8838e21f4c119e892339a133a1ca5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2527ea-2e6c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690675475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690675475, "uuid": "d60ab4d2-f20e-4a40-ab5a-0b0761090af2", "comment": "Malware payload", "value": "10c7ee13095596db99cbb124e5d2740d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690675475, "uuid": "5c8e13fc-d75f-4d06-b3b5-c07e0db8a460", "comment": "Malware payload", "value": "6b398b459b6906e7fbd0cc3eda7d04ffcd1fd36bc4019389b982250832bc6ff2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690675475, "uuid": "ef926278-7569-4f5e-a86b-50d5c0328aca", "comment": "Malware payload", "value": "fb527e1b645426c41abaf29bab53aad390d871c9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690675475, "uuid": "877fb822-f2ec-4f15-b64c-671f0c22fceb", "comment": "Malware payload", "value": "7a702163e373ec56a8d7757c1070417cbd47f0af91959a82d44ead67513f9546f38c8261a0cab61a1cf170eef0c91742", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690675475, "uuid": "4a295529-05f1-4cad-9ba2-868b59f5d738", "value": "T171E52383F72B686BC932C0333985573B50595C64CE46B78A3994B3AC70FBDE84B852D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690675475, "uuid": "29b04cc7-0f23-4c10-97a6-b1cc0911eec6", "value": "98304:YDpc4Kv2nSmX4jR9d8VrMBOm5YM0JUzHhLm/:YDpc4KvjmY9WeAVOzHhLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690675475, "uuid": "696f38e5-c370-4fec-8f73-1e9b5e596828", "value": 3277505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690675475, "uuid": "bdec28ff-eeda-4c7a-82bf-69eeeb21cb4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690675475, "uuid": "f3e5006a-74b6-4075-ac30-c8eb70da4e9d", "value": "SexyGameAPP.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616549bd-2e88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690687377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687377, "uuid": "df257ddd-b59f-4271-afac-74fa41a682b4", "comment": "Malware payload (Amadey)", "value": "586ba06aa9f218730528895ef68821a4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687377, "uuid": "04ff5928-9163-4400-8be7-6583d21fa39c", "comment": "Malware payload (Amadey)", "value": "6b8dc4eeece38cdda6cf0ce0f4dc8ea383e31974c4cc3ef6652ceeeafae350c5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687377, "uuid": "681255e5-0509-4910-ab0d-8beac828e306", "comment": "Malware payload (Amadey)", "value": "10bb1f69174d2b9a972122a09165e7dc2fcd51c5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687377, "uuid": "2f0bf5d8-eff2-48eb-8f83-054c6ca2cf6d", "comment": "Malware payload (Amadey)", "value": "4a9b310cd0639fdcf2f7acd6a827c757c36d0b688261386f96608300725ce87105cbf0203df56289bc4cbdcb72f4f36e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687377, "uuid": "ad5d1208-2cf2-4ed8-8bb3-da8c04176676", "value": "T11FB41256A3ED8133DDB467B019FA02C31F36BCA24C39935B1686AE4E1D732C4A57172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687377, "uuid": "0939de8a-84dc-4fd8-bb96-8156454767d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687377, "uuid": "aca7501e-03d6-4377-8a62-7e16c3959079", "value": "12288:QMr+y90bPGoauT06CveVquuVlSr4+8Sx:+ywPGBuTC+cVlrWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690687377, "uuid": "1439e5a6-5caf-4f52-927a-65696d4401f2", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690687377, "uuid": "5414c83d-3055-4f03-bd56-39b5a64d2b4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687377, "uuid": "48e6051a-16e0-4308-80f6-c0735b3e76e9", "value": "6b8dc4eeece38cdda6cf0ce0f4dc8ea383e31974c4cc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8da7776-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690687068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687068, "uuid": "a358c055-560b-4bf2-ba99-fa4af602d680", "comment": "Malware payload (Amadey)", "value": "fe880fe0fa40640b42ad8107f0f67a21", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687068, "uuid": "59bbafb4-1768-4ff4-90a3-32e761fa8d8b", "comment": "Malware payload (Amadey)", "value": "6c41dc3e85b407580767e0d6a03d0e57d977a66c085b6f35a8651c3cf8e01142", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687068, "uuid": "137e894a-69e7-4eb5-9c46-63def32f3331", "comment": "Malware payload (Amadey)", "value": "fd71ce921fe85e3454006fcf95441867d93b1016", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687068, "uuid": "397588ec-eefc-4541-9c54-1b198077cb16", "comment": "Malware payload (Amadey)", "value": "09b6a621c0143a200e2c29b820b6f3205d49a30a83864cd12cabac0ddae393d44a7ad8627157c6d0c02f10987df21aa8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687068, "uuid": "3aa54664-a913-4559-9314-b7b1a22d8825", "value": "T159B41242E7FC4035EAB91BB46CF613D31B3A7CB15878525B3746954A0DB36A0A433B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687068, "uuid": "b6636f05-6e77-4391-88ed-a477fd4cc0d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687068, "uuid": "a3b8672a-f6bb-4d82-a9c2-143681ebd557", "value": "12288:wMrfy90YZ2y2YzY/d6kbh9NOFA9wSBkcD86NGdknUf:/ynRM16kFyGAcYSUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690687068, "uuid": "bc1875bc-f578-438b-a4ca-ac57ae98c4e7", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690687068, "uuid": "3694b1c7-f469-479a-b627-5c5166140c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687068, "uuid": "ea511133-1445-4dae-be69-9d46695e9576", "value": "6c41dc3e85b407580767e0d6a03d0e57d977a66c085b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f91aa9-2e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690697024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697024, "uuid": "579e74e2-a5ae-4582-801b-04cd7acbd93c", "comment": "Malware payload (Amadey)", "value": "94c529d90b2e3f87b33def37302de4dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697024, "uuid": "199dd237-133b-4571-84c0-ebb1997af3f5", "comment": "Malware payload (Amadey)", "value": "6c928bd9b2a26d06d65d9c422eec41a41743a6a31b2bade89c0a672ab7656da7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697024, "uuid": "9318a700-7b2c-4e2a-a568-e62f3e122c06", "comment": "Malware payload (Amadey)", "value": "7f88d3468008be48ff26370270df5f71b1897670", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697024, "uuid": "5f92c07f-5bfb-4414-872d-14f89ef8bca2", "comment": "Malware payload (Amadey)", "value": "8035df031ae674ae470f23e2d82062015b4479d71cc8c563132e22d6c8b62bf9a6a00130dd311ca83760d3c0783eaabb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697024, "uuid": "8445d564-84b8-446b-907e-19db256f8858", "value": "T1E4D41303BBD84071ECB123B05CF747831B39BDA09D745B971B84AA9A1C72790A975B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697024, "uuid": "8654cf44-7769-4bac-ac75-99f5f631f07c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697024, "uuid": "7178417f-babd-425f-b01d-3df24c5eb6cc", "value": "12288:xMrTy90XTvjqc7nZnjGiDhGPMbO4SeUbBAbiL/+pL+hX9O:KyAjqcZjjDhAMb43ibmAL+V9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690697024, "uuid": "7b40deec-f041-43ca-97a3-6a780c314f3f", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690697024, "uuid": "559e6f16-8f9c-4ce8-ba65-4f2d31864ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697024, "uuid": "70ab4e01-58a6-426c-9924-202c360ad6e5", "value": "94c529d90b2e3f87b33def37302de4dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74ce805-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695253, "uuid": "0277c3e3-977a-420d-bece-50b0e17d3f9b", "comment": "Malware payload (RedLineStealer)", "value": "6fe1d0b7a3903ba8c46a8f5ca2e157b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695253, "uuid": "08152cf6-5a79-49b8-8fac-835205530f9d", "comment": "Malware payload (RedLineStealer)", "value": "6ca9deba3935f63b9aac16abb57e4ca733b57024a9afa21a0a0aa9953558b2da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695253, "uuid": "8d6fbb23-057d-4dfb-ab47-1527b06a6895", "comment": "Malware payload (RedLineStealer)", "value": "68d6c5366b38e2a7a35b37fc1926968388d75cbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695253, "uuid": "9b7c047d-ca63-42f5-9db6-d4ab7fe50c50", "comment": "Malware payload (RedLineStealer)", "value": "5a9f8c832defaf4ab549210304377edef227a82ff2c48aa3f6df62ba1d2c27669d6245310d78188907c27c1a06c5dfe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695253, "uuid": "3be291fd-c4df-446d-8ede-ca4c771a95c6", "value": "T14EB41262E7E84672EDB527B05CF702C316327C91AE66936B33456C5B4CB29D4B43133A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695253, "uuid": "572e447d-5846-401f-bc25-62b4c308c794", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695253, "uuid": "7a8c2fec-8572-41a8-8bc6-f8a8ae4d1076", "value": "12288:UMrfy90HGgrx4bUOkl72tsll/yIP9MS5gMBGt2gBYCWNodn:zyrmx8UOklXlNyIPNMzVdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695253, "uuid": "3c35752b-a2db-493f-a5bb-deced9937941", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695253, "uuid": "332326cd-e7a2-406d-b1c0-17958735c143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695253, "uuid": "457ebd0a-6c43-4ea8-8de4-5efb82644c2f", "value": "6ca9deba3935f63b9aac16abb57e4ca733b57024a9afa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff99add7-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686784, "uuid": "597cfc33-3007-4fee-b2a1-7cc26770489d", "comment": "Malware payload (RedLineStealer)", "value": "7f2c081879009f2973bbc7547d8ece79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686784, "uuid": "1b6b9b32-b9d7-4d5c-b993-96f171b18b98", "comment": "Malware payload (RedLineStealer)", "value": "6cdb2c6c858fadb414b107a0750855e0c071bcf5e593332e727e1fe26ef1eea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686784, "uuid": "8a7113bd-9d96-4d0c-935e-c366de6e76d3", "comment": "Malware payload (RedLineStealer)", "value": "0f70d1366f8d668559913f24ea5c17aa5ab316af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686784, "uuid": "d75f3270-723a-411c-a4a1-242501a71473", "comment": "Malware payload (RedLineStealer)", "value": "a78bcdaf31d36341a2e882e4779bb8e63fc9a53bd7c232433680cf5dbbaeaac6846100b4e79f9995cf3499dc7d36fd17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686784, "uuid": "53c892d0-48cf-4556-9cdb-c2068e2fc239", "value": "T1FCB41212A6D89523D9B617B098FB03C31935BC2699B8C39E3744AD4D0D722D5E9B333B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686784, "uuid": "32023273-dad7-4b02-818c-90d765fea1f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686784, "uuid": "939544eb-6e17-4409-8405-cf871d85c263", "value": "12288:8MrZy90nDujODYEdxjhJytnOch6UEDxgBYCYQGeIZ:Fy+ujOxJytnZUUHzvGLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686784, "uuid": "a0b0a074-2e43-46da-9fec-0503cab88c9c", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686784, "uuid": "a42c1c31-3b1d-4070-b172-a73409889a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686784, "uuid": "e5506253-24f0-454f-b5e5-03efebd305b2", "value": "6cdb2c6c858fadb414b107a0750855e0c071bcf5e5933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fbb68d-2e91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690691277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691277, "uuid": "59ab50c8-c4aa-4bf5-b786-9ebfca0572e6", "comment": "Malware payload (RedLineStealer)", "value": "19c4e7be04d54363ef9aa200aa0ed9ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691277, "uuid": "1fb1a64e-b2d3-4669-b095-e058d5e61950", "comment": "Malware payload (RedLineStealer)", "value": "6cdea64ca90d22f4dfcc888c1501a1d3804a273f57a8a26ccf899a7fa729d412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691277, "uuid": "ce4f7ba3-6814-44a9-8407-9b550ab4680b", "comment": "Malware payload (RedLineStealer)", "value": "65e3d72d5495a1a9f9f01795f6f2b33c83807fb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691277, "uuid": "9a7506d7-0bd7-4d0c-8d1a-620b52daef4f", "comment": "Malware payload (RedLineStealer)", "value": "eae9de7e589760c7107f4c2f08186fa0c70065e0e81aed9b3f103eb4398825c27d27a7637333ba8994d3c942a7ed0609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691277, "uuid": "3b9e2175-28a3-4806-af77-58d3065f2731", "value": "T1A1B41243F7E48472D8AA27702CF612930F3B7CA15979435B33856A1E0DB26D4A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691277, "uuid": "c5f6bdf6-2466-481d-a7c9-38908ad02edb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691277, "uuid": "4c2a0e3b-8cf7-401d-83f3-6d576099a2f1", "value": "6144:Kby+bnr+ip0yN90QEhkJrHS/rpSR6xQfHjtYhE8k7KCOFt+fbJBmMJeE0vz8brQf:xMrmy90jf/FNQShEUt+fdVefvQb0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690691277, "uuid": "fc1c85dd-eebe-45f3-8cbf-a786bf0c9307", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690691277, "uuid": "3034e7bd-4652-4a19-903b-d0287d9a7dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691277, "uuid": "80d0c23e-39cb-47ca-811a-3c4b5acc2b66", "value": "19c4e7be04d54363ef9aa200aa0ed9ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f30885-2ed4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690720221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690720221, "uuid": "0d0858ee-243a-4eb8-ae57-443887d9bbab", "comment": "Malware payload (njrat)", "value": "ad2ed16ab7cd516c9c2c99c524b5081c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690720221, "uuid": "6cb1ce4a-47d1-4d1f-a370-27a4cf72f48d", "comment": "Malware payload (njrat)", "value": "6d26e923d1656ea020b1d60bf11f3c532d80a28f1e1ab2895cba6200202490c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690720221, "uuid": "8f0072b1-4f7f-44bb-8a0d-111c1a3a0612", "comment": "Malware payload (njrat)", "value": "da1105a560950c513cf4db8cf9e9a0d375c77f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690720221, "uuid": "2613a92e-e454-4e43-853b-98c77dcaf856", "comment": "Malware payload (njrat)", "value": "288e468af2faf71b3f00b122dc7474af498bac883a0e83e0800f1a7f34f530c3075dfceb5f742df9bc64ab3b7b67c6bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690720221, "uuid": "bf4405c6-ee38-4a68-b12a-4ad097e2dafd", "value": "T1F013E78CB694E174D5FF8BF1B4A1B2890B71A017A806930F99F154D98FB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690720221, "uuid": "ad0eadbb-b2db-4db9-a9af-e40a7da855a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690720221, "uuid": "193ff409-be28-4aa3-b8eb-3abfff84c9bc", "value": "384:h8ZyIQp3VarE8yTB1fqrkMwEnwDai0+TzEIij+ZsNO3PlpJKkkjh/TzF7pWntP/l:h6rC3MY5TnfqrxQDVuXQ/oQP3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690720221, "uuid": "dc9a4a22-497a-4961-9000-ad73200d211f", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690720221, "uuid": "02a98c75-42ec-4ef6-b05e-a01bf50e46d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690720221, "uuid": "cca9cd2b-27d2-4f8f-b676-f3d95502e720", "value": "ad2ed16ab7cd516c9c2c99c524b5081c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48da33b7-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686477, "uuid": "38329513-34f0-4497-a513-3188eb31e5a5", "comment": "Malware payload (RedLineStealer)", "value": "cb4aa4969de75b12d8c7f3faec229a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686477, "uuid": "9826aca5-8d90-4a08-92d5-6805fa46f091", "comment": "Malware payload (RedLineStealer)", "value": "6d59a56773e52c78f0c0c13563fb04cda994dd6e0ac86e0c4fcac77878a0755d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686477, "uuid": "460cb51c-4766-4cbc-9ddd-e96ebc56a3d7", "comment": "Malware payload (RedLineStealer)", "value": "5afb626171be284bcc9ed7235c15ffb3c7f4457d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686477, "uuid": "e202a858-3d44-447d-96a3-1186c7a58236", "comment": "Malware payload (RedLineStealer)", "value": "3ad3ba282064c0a29d274dbfc578c0e9fccb6fa40a0614826113140a0705eac8b73f6c39c71f9af4fa62b62d6dc73469", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686477, "uuid": "6c4e7867-c7d4-4b25-8bdb-0edcccf87dcb", "value": "T1FCB41242A7D98136DDF517B068F713831B327CA1987992AB2386991F0CB36D0D9B1B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686477, "uuid": "953091bf-34d0-4bca-9729-5ecaf640a329", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686477, "uuid": "7754bc7e-724f-49c6-9ad0-7e4fe3098968", "value": "12288:FMrOy9009/GfMydUXoJItb2XtSHuJyLKPj4y+lpwSuHO:nyn/q6HCXhsj9uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686477, "uuid": "f4c20d37-eda0-4e7e-b917-bb4f0672109d", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686477, "uuid": "5c8c810a-e4f9-4536-831e-66270757cc5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686477, "uuid": "8f04dce3-05fc-49d7-9133-cf60c897305d", "value": "cb4aa4969de75b12d8c7f3faec229a81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c430591d-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685825, "uuid": "11fe89c5-0cd5-4f02-9397-cfa2c1cc770d", "comment": "Malware payload (Amadey)", "value": "1da2461d576ffce40888cdb56f3f58f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685825, "uuid": "59476a64-5b9b-40b1-bef4-8e21efe34708", "comment": "Malware payload (Amadey)", "value": "6da9cb0590a01c527340a0ec456ae8cadfb31986c7874e06561318715a3dcc34", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685825, "uuid": "a8b01e74-ccb3-4646-84d1-45916fe635b6", "comment": "Malware payload (Amadey)", "value": "d68caa6b3b620693259274a26fbd49131d91f7e1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685825, "uuid": "98f4f899-7d42-4270-a1c3-d82f9cf0d400", "comment": "Malware payload (Amadey)", "value": "3aa7552de0d6d9b4c111f4810f472ff52fcce95abdb083a7b2cfcf8763336b8f2abbe84a01e659dec4c6360321abc7af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685825, "uuid": "75ea51e8-4566-4910-98f1-e60593bf55e4", "value": "T12EB41205AAD86073D87517B024F603930B36BDA26E38835B270569AA5CB36D4B97273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685825, "uuid": "4c57aae7-1903-4e00-aeb5-d680062890ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685825, "uuid": "1ee827ab-a810-4eb2-b457-56b616209311", "value": "12288:wMrdy90kvVuU0uRBh2aGfT+bovTZgBYCLS2eeYwhESZm:9y3T0uRBhfuYo+zm2jYOESg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685825, "uuid": "4cac4f55-0c10-46e4-848a-1e935e4247ac", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685825, "uuid": "c38532b4-fabf-4ae8-af81-aef353efeb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685825, "uuid": "ca9b863b-82f2-43b6-9b84-9f1567eb2e39", "value": "1da2461d576ffce40888cdb56f3f58f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715bbcc6-2f24-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690754406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754406, "uuid": "cdb591d5-2aba-40ac-9675-5531d74b9c76", "comment": "Malware payload", "value": "5bf759e73f1d1b7441c99e42bf408fab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754406, "uuid": "86a2af41-21ff-41af-839a-3dfc4fb90682", "comment": "Malware payload", "value": "6da9d42ffc8bc8aea31250dd656b573acd9e198eedd960593bb06ffd946cd061", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754406, "uuid": "55626a5b-6424-4e30-b0c4-ba56e1c716d5", "comment": "Malware payload", "value": "50cff7476cf369027d895cb1708c58f610cf2545", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690754406, "uuid": "7786a24f-165f-49ee-8c88-da0d2238d956", "comment": "Malware payload", "value": "c86e8b819c0ec3748892866c3ce6b950d3f2d12b6065261e0746b325976adc8a5ddde4c7413a6d69cabf73275219f35e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690754406, "uuid": "ab967d8b-ffbd-4eca-884c-d8945c0abcf7", "value": "T101733907BB8194FCC05AC174076BB139F463717E0239B2A66BC9FE27AC4EDA04E6D591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690754406, "uuid": "41f75fd7-ca5b-4bc3-adac-5f343c65aa65", "value": "1536:vvIySYVqiWs4k5mNPU6N6rCTCDqfPRM7/g3/lhbipPrjnIcq9wbZnd:vvIyrqiWVycs67TyiQ/IlhwTjnIlwbZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690754406, "uuid": "fe8e9769-04a7-41ad-90a8-413508a7ff50", "value": 76000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690754406, "uuid": "932748ef-b33e-48d1-a55a-45baa2bd58f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690754406, "uuid": "e325dc6e-5e65-4641-8fb1-1fb50150cf66", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875af3c8-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690709345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709345, "uuid": "a998e68c-df1d-4a09-bffa-3dcec00f5c7c", "comment": "Malware payload (RedLineStealer)", "value": "5fa3557102d4401a68eaf267dc293160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709345, "uuid": "12a48d49-0c92-49b9-adb5-719461ecc27c", "comment": "Malware payload (RedLineStealer)", "value": "6e0d5486bbb74259d577fb0a9e6613d520d8da5531b7235401fb4adab3b238ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709345, "uuid": "e3834cff-6fa3-49b4-a935-43a2061cece8", "comment": "Malware payload (RedLineStealer)", "value": "8592aa9a803b3d8b68a71ede5e1fdf518754c859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709345, "uuid": "c1fdbbb1-2516-4179-bb1d-4ce610073816", "comment": "Malware payload (RedLineStealer)", "value": "2865bfdefd178c623770778dd5fe372674706d7113991a3b0a138b83e456009bef3c67a82c080da82e2157b616637de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709345, "uuid": "8dbe8097-bc70-432c-81cf-a35eab1e6617", "value": "T174F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709345, "uuid": "29fa1e36-b7c4-42db-9a1e-370cd2b0ec1d", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709345, "uuid": "3e97003d-2d42-414a-817d-cbdc3414ebd5", "value": 37242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709345, "uuid": "2240857d-9efa-4427-878c-dda6c79a4b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709345, "uuid": "51da0907-ea6a-4ef1-adf3-2cc6cb498a6a", "value": "5fa3557102d4401a68eaf267dc293160.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf1fcee-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695208, "uuid": "85d0b501-007e-46fb-8887-78d8a5c0091b", "comment": "Malware payload (RedLineStealer)", "value": "14371586ce411aecc86cb254dfaad384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695208, "uuid": "9d1786e5-08d6-4552-90dd-6d3e1f94805b", "comment": "Malware payload (RedLineStealer)", "value": "6ea75aea14d5d4b47817a83376e04cfd17637309fc929450e7b7541d0df38eef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695208, "uuid": "572c1baf-2756-4142-a596-8e5b977f1f8b", "comment": "Malware payload (RedLineStealer)", "value": "ffcc8dc53ed12e892a4b7f91330a53b210d0b4b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695208, "uuid": "17919bcd-6b6f-4565-a8d6-e30899b9a0db", "comment": "Malware payload (RedLineStealer)", "value": "3281cc471ab1bdb9c7414e506538e80471a95e75d34e43d3a0afc9eeb907b4e1b9558ac03ef13b17216f83ec43c75dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695208, "uuid": "27fb73e3-cec8-4abf-804b-f263cb9455ad", "value": "T1F3B41202A6ED9031E8B657B018F600931336BCE69D7887BF3686599F5CB26C4A53173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695208, "uuid": "378280e1-f9d1-40e7-a187-4e50f4684004", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695208, "uuid": "8d0d824a-eca5-4150-84ac-191e524a3da2", "value": "12288:iMrry90ywkCo0I/1Rn7z8nCgBYCPOfFBQ5A581:ZyvV9R7oxzW4AW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695208, "uuid": "2cf257c4-ace6-42af-8f1c-8afa5e3a2164", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695208, "uuid": "9f4aa3cc-be79-4c56-9be7-9de6e16dfcdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695208, "uuid": "da464f59-09ae-4e8c-b975-7bb9c70fea16", "value": "14371586ce411aecc86cb254dfaad384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ea5f33-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690701201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701201, "uuid": "587001ba-5e77-47e7-aa5e-404ddae342a5", "comment": "Malware payload (AgentTesla)", "value": "665d158acc400088502628c7b670e8d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701201, "uuid": "026c7322-37d6-4592-9149-46b4ce85a0fc", "comment": "Malware payload (AgentTesla)", "value": "6f417ed94d121bb0379a9ce8c0465c503b998bcd2c0df5021c0ee595901aebca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701201, "uuid": "91ecd5d9-6111-43cc-8e2a-76ee1513d758", "comment": "Malware payload (AgentTesla)", "value": "ec4929ccae8bd00916b7e08965a537fe08de96f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701201, "uuid": "c4842822-1922-447a-86a6-09c35f22f5d8", "comment": "Malware payload (AgentTesla)", "value": "4883827d9ecd5a154395973f1fa5053b4b89cd7de09cf705223d2c5be8860889d674a2592d50a6e70245bf4fd4790eff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701201, "uuid": "28511c50-a022-4d9f-bb7c-e1d6721ab2f6", "value": "T198E4F051E2681F67D83A93F90821910457F6BB6F612CE70A2DF7B4C72176BC10A46F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701201, "uuid": "db54ae8e-33eb-4ca1-b964-59989a512d78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701201, "uuid": "4150c9ed-1d29-4bdc-92d1-a6c62d1df20c", "value": "12288:IengjjRA7csKB8DaZPJj4ueQdC7x0b7dWoKP3QoFBcZWXfSR3RTv5OsOREKA:IYgjjRA/haZPJb47KbxGPx6Q4Rx4eK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701201, "uuid": "991e966b-3182-4c8c-90b6-1d6ee9f95f93", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701201, "uuid": "ed49ec66-117d-4e5c-964d-a1c00cfcdb33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701201, "uuid": "2ff03374-fc67-4779-bc74-3f8657de1b63", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603d7817-2e8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690690382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690690382, "uuid": "c820bcf1-ee46-49ab-b428-2f94a667015c", "comment": "Malware payload (RedLineStealer)", "value": "c8aac05824d6beae4f5db7abd7141451", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690690382, "uuid": "17c7aa71-3c21-4461-90a5-186bdd1403c3", "comment": "Malware payload (RedLineStealer)", "value": "6feb99bfe4aa40608c1a4e549c169771b26302998a4730f9b551e996e8b863aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690690382, "uuid": "331dab7b-0ed7-4d72-a9f5-85919b0ce0e5", "comment": "Malware payload (RedLineStealer)", "value": "dfdb624a38b2e33673d468dfc5abe637d0f39bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690690382, "uuid": "32738861-65c2-4a83-a00b-aa1c067bf9a6", "comment": "Malware payload (RedLineStealer)", "value": "54a89177c602d8e7522599d4ae2d6f4bbf793f5a147bbbf429013b5de6b7419b2b5b4f3916d71ab50306fe11b2f54021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690690382, "uuid": "985235dc-1789-4f46-92ba-2d0d7c6860a4", "value": "T197B41256BBD84073EC7127B01CFB16C70E367CA20D78876F1759A95A28726D4A83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690690382, "uuid": "a43c632d-ea9c-4a81-882b-8d80233535f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690690382, "uuid": "826fa352-caa0-4304-b724-7d81c6baeafd", "value": "12288:gMrLy90fGfcLETXnLIVQxRE+hk2anNsgBYC7Tmrv44T1cZ:byzcLEj8QxREYjuNzvjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690690382, "uuid": "f3d6b2bf-a239-4ce9-93fb-5116b453a25e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690690382, "uuid": "9262e626-ee21-47aa-a860-69d4576c2c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690690382, "uuid": "a24f301a-91bc-4f6c-919d-65c9a27e23bd", "value": "c8aac05824d6beae4f5db7abd7141451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4733c753-2e8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690689481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689481, "uuid": "0aa0aa35-4141-494d-96e6-8477156f2e5f", "comment": "Malware payload (RedLineStealer)", "value": "190e9c9bd7a729729f3b6e2f4376199a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689481, "uuid": "76236fa2-8150-4faa-85b1-77c4ad96cf43", "comment": "Malware payload (RedLineStealer)", "value": "70f3868e48dbe0fabc663b262c6590a9158d5a809b5cde07884fe952854de347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689481, "uuid": "48c42692-a1e3-4022-97e6-94b0a679ce02", "comment": "Malware payload (RedLineStealer)", "value": "a6f20ddac019829393ae1ba24663db33c2567bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689481, "uuid": "593065da-077b-4a5d-a4c8-9541f05f5524", "comment": "Malware payload (RedLineStealer)", "value": "5904120080996c7a60992857124aaf850b2bcfd0d7e5f7fa7e0fbdbae737afae5a72b2644226bb3b82ffa890bfc5b1ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689481, "uuid": "1daf7d2f-3e77-4565-90e7-2f56dc42d1c2", "value": "T1E3F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689481, "uuid": "9bfa1d00-b883-430c-bb51-54d5b6ab7106", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690689481, "uuid": "056689e0-31d8-4baa-9bcc-ee392838963f", "value": 37001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690689481, "uuid": "3568d230-9709-4b84-8ea9-d3c3c32c3a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689481, "uuid": "95d96938-a823-4940-852a-140e5142e4e7", "value": "190e9c9bd7a729729f3b6e2f4376199a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9d944a-2e89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690687670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687670, "uuid": "43b54c18-7720-471d-941d-7dd6487190e8", "comment": "Malware payload (RedLineStealer)", "value": "4ab7f178296f4e4dc60cdaa2c6c57da3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687670, "uuid": "92b4014e-626e-4ad1-96dc-d69f593c3b46", "comment": "Malware payload (RedLineStealer)", "value": "718ee7e07d1e85ada7d2487ac92a7a38035264f9146c6c9ece9d47fe7b893159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687670, "uuid": "1204836c-8795-42f2-adfd-a14bcbf0f3b7", "comment": "Malware payload (RedLineStealer)", "value": "3c1ffc4be88c39ef5cb2bc1e0c3e04083cf1a83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687670, "uuid": "a01eabab-9ff3-4018-bb3a-e4a984823b37", "comment": "Malware payload (RedLineStealer)", "value": "143afc4342f09e3ecfd9ae85c6b8159667209f0f095c5b2353f06038d5d2dbfd8d629410e70ba1d845a7234b3f7846b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687670, "uuid": "8b47c006-a7cb-44ec-bc4d-9655ba1d029d", "value": "T11AB41242A7CA9133D8F657704DFB03931E397DE158B4872A278A9C4E0CB2BA06536777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687670, "uuid": "f8535ba4-6ebd-422d-8372-52ab4f6d1232", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687670, "uuid": "315091c5-3054-4bdf-b922-4dc3560abb36", "value": "6144:Kpy+bnr+/p0yN90QE0cQjMzxw9xAjiklSPmfgy48ZIpV5rnVb0cJj5XTvZoaqWxM:DMrvy90KcZw8j9bn4nV355tojeU5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690687670, "uuid": "2f7036e1-5ac9-45fe-8ead-aa65d6090bfa", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690687670, "uuid": "46e0b402-3056-4993-b982-8b12073e29cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687670, "uuid": "273b0469-ed55-4512-9f49-3c7f48bea9b9", "value": "4ab7f178296f4e4dc60cdaa2c6c57da3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fd0808-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695230, "uuid": "30297020-4f73-4077-8eed-ea7e0ae146f5", "comment": "Malware payload (RedLineStealer)", "value": "c9b0636855ba459a08daf2c30a944430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695230, "uuid": "bf348a71-0fea-43ec-8cee-e959a89f9165", "comment": "Malware payload (RedLineStealer)", "value": "72a7b9d8fc85a277b3e6426c4cc235ee08639625c01ff76737c2d38148d3eff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695230, "uuid": "eca6797f-f103-40d8-85b2-bdcf140f98be", "comment": "Malware payload (RedLineStealer)", "value": "cf802890ac55100498a9636f3aeb9cb3e416c7c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695230, "uuid": "bd823f81-2a29-44ed-ae6b-4aa2bdf303a9", "comment": "Malware payload (RedLineStealer)", "value": "a1745c723df3afbaa154d074c41443c78838e13566870eea1bc1d9987dcb8aa5b9e9f493a1abfd42ed6b8d74dadcbc14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695230, "uuid": "7714d695-f8d0-4ef3-a326-e6e9e8fc6cf2", "value": "T133B41247ABE44073E97427F05DF202D30636BCA29CB8976F1786A55B4CB22D4E4B173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695230, "uuid": "1e0535fc-277e-4131-a867-e5e92b99fe87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695230, "uuid": "8ed92d74-4e6a-4500-b3fd-91428f2d67b3", "value": "12288:CMrVy90C7afGHFwUi07T3KuRAynE4Qwuv+gBYCsLaVxW8L:3ydiGZDZnLXMzxrW8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695230, "uuid": "bf59e300-ed51-4098-8555-7448ae82ab5a", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695230, "uuid": "71fe974d-b412-401d-8f1c-300c2dc41618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695230, "uuid": "c5bd1b45-65f0-4cac-a478-fed13f3e5b18", "value": "c9b0636855ba459a08daf2c30a944430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c88f49-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686153, "uuid": "210d0622-37ee-44fd-8588-3bc5afb3ee1d", "comment": "Malware payload (RedLineStealer)", "value": "864f711242be0d8d00403408e200e31e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686153, "uuid": "e90c76cb-669b-4170-b0ba-ff1e4a8174e2", "comment": "Malware payload (RedLineStealer)", "value": "7331ea12d6cebf5f1aa1d13a1a241d82610f7ab2e33cb82e5f06f3e152e479b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686153, "uuid": "a439127d-fbaa-491f-babe-76914b4870c2", "comment": "Malware payload (RedLineStealer)", "value": "b4212d0160603b580dd235ac34ff702f41ef6bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686153, "uuid": "f6c3de40-33cc-4c24-935b-824aadab01d3", "comment": "Malware payload (RedLineStealer)", "value": "1e5c43e86d79998643399750e4a1adc243f418419296d13b8d318b64ded05444fb2be924475fdb22be3ff2c36f0ae708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686153, "uuid": "908efa00-8ccd-4187-9b26-14ea77ad5cc0", "value": "T119B41206A3E84173D9B5677059FB13D30A347C959E78932B238AA91E5CF26D0A632337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686153, "uuid": "246ed4f9-7700-465a-9269-7b196ade7c95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686153, "uuid": "18950bd4-b2ec-40fd-bec3-d1a398116976", "value": "12288:7MrJy90enRYjYG2/Lp6Y114H46ysqxBgBYCcVpFY:SyvnRo66YPrsRz+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686153, "uuid": "130a588d-7e4f-47f8-90d8-813ef7bb4578", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686153, "uuid": "02d9d6b0-0585-411b-ad86-bdee5f7a738e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686153, "uuid": "0042a6bc-3c8c-419d-a3b5-f6730cac6fe4", "value": "864f711242be0d8d00403408e200e31e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1bf02b-2f0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690744950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690744950, "uuid": "5eea2bbd-20d1-416c-a938-8b9d6357b182", "comment": "Malware payload", "value": "5885c6b29fb1e8ec086f384413cdd608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690744950, "uuid": "df5ed4db-e5aa-4f72-96ef-e11c23ae961f", "comment": "Malware payload", "value": "744029ef4e0f78f921b558a69135ee090ec59494b5feda8de031861a681ba897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690744950, "uuid": "a3bcaef5-3380-479f-9949-32eafbaf2cee", "comment": "Malware payload", "value": "62c8c65d792d253d415ecb5c1700d6dc553dde09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690744950, "uuid": "f81e0a1f-9f3e-4b19-bd04-a3ca30f11721", "comment": "Malware payload", "value": "ed1d6f33337bfe2f322442bad90a1c6b6e6a32defdf951922368218ac12d91d5b3e7ae448b2572428b6220bdd745011a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690744950, "uuid": "7881d139-5955-43d3-ba6c-202dfbcc10e0", "value": "T192E1B51337184EB2D87C153C46E3BDA771484E392F3B42728D1803173963224B9F0D04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690744950, "uuid": "2051c179-c9f0-4a0c-b8d0-0696652c11a6", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690744950, "uuid": "f72dda9f-42a6-4979-8df3-8d5e83f89778", "value": "24:eFGStrJ9u0/6FlWNPnZdkBQAVwaY/YKZqBeNDMSCvOXpmB:is0CWNrkBQ9twDSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690744950, "uuid": "0cfec4ed-11be-4283-9fe8-a921cb86b112", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690744950, "uuid": "c54ae5dd-0ccc-4364-bede-72d5250e48b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690744950, "uuid": "197ee2e2-117c-4c5d-9fa6-a29d32211c92", "value": "shell-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab938c40-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695233, "uuid": "41bd3326-64c9-4cc7-9cbd-5bced98a1a8d", "comment": "Malware payload (RedLineStealer)", "value": "cd3df8dd094c4b120c05390c101fbf6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695233, "uuid": "50c894aa-ae2d-40c1-b0a1-8bc1aff62e0f", "comment": "Malware payload (RedLineStealer)", "value": "7486c56222d2cb70051eaee98c6c4bca0c35641ba22bdb6e96d4bd0c8722a30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695233, "uuid": "bc9da6e4-1952-408c-8d9a-bf904cc73199", "comment": "Malware payload (RedLineStealer)", "value": "8657b228f228ad9772bda1d89150c2fd229ae84f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695233, "uuid": "0a2ff210-27d8-40fd-93e4-423bdf849782", "comment": "Malware payload (RedLineStealer)", "value": "d2b106d4461c1cd940f250a6e8a801ed9b7afaaf538216554bf82d2f75bba4ca85850046d756e2ea8b5440346127e1d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695233, "uuid": "02e75a57-10e5-422e-8666-c42afa21b304", "value": "T155B4022397E98072D8B11B7168F703832B32BCA26974937A37559D1B0D736D8B47336A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695233, "uuid": "f207dad6-c7cd-489a-be70-6bab0c46c3e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695233, "uuid": "9198c3b5-cb3d-4a9b-8e5d-cb2b7f6b16c8", "value": "12288:vMrpy90l8WBmggatYagKG1dnGDhYXgBYCiYj0CXmMY7H:iys8WBmgBG1dGDewzZJmjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695233, "uuid": "aaa0a5c7-ec01-42ac-84ce-e779480b4eae", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695233, "uuid": "ea613424-b7b7-4ed6-a377-7d25d386d60c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695233, "uuid": "a1d8f089-0967-4c2d-acd2-aff7a5a3ab96", "value": "cd3df8dd094c4b120c05390c101fbf6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede9a545-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686754, "uuid": "416150f7-0a7e-4343-8ed6-d2ce6cfab3bf", "comment": "Malware payload (RedLineStealer)", "value": "788d92f47b212e2049463dd423a5dee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686754, "uuid": "b1a7ef0d-7d31-44d9-a9b2-44958ce27ebf", "comment": "Malware payload (RedLineStealer)", "value": "74991b8b0544fa500ea5cb196e746fa3f4d98c5d0623c46470044b2710b5da38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686754, "uuid": "31d4bb01-7666-455c-be55-291c8ce3dc4b", "comment": "Malware payload (RedLineStealer)", "value": "ec638a326f621c2ac72199ddb8e02affffe0dee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686754, "uuid": "5b3e7b9e-baf7-4a6f-8f51-4184f24d6774", "comment": "Malware payload (RedLineStealer)", "value": "a60e2daaf4db8f587a00673471f4f8523e9e52e29797701469ec661e7c14498e319605c939cbf3fbc7b16428fa4aac41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686754, "uuid": "490ca048-cff6-48b7-aec6-678d3cb99b94", "value": "T150D41282EBEC8136DCF673B19DF302930B317D616EB0876B2645696E0C72A80953675F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686754, "uuid": "8aa4668c-b65c-499e-81c9-faff16c225bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686754, "uuid": "9be7d213-0226-4b4a-b22d-51cde3169702", "value": "12288:/Mrey90DQanCnYpz9L+2CBiMx5A5nF9npy7OsW6f/g9EcqOEluM:FyKPC8zBBE7jcF9py7OsW6ng9Ecq5uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686754, "uuid": "f1d00d3d-c38f-40a7-bc74-8bfa08eb280a", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686754, "uuid": "98a14997-38dc-4402-b166-cf841d588a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686754, "uuid": "5fe4734b-24c4-4c85-a544-90f6ccc96b51", "value": "788d92f47b212e2049463dd423a5dee1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93927a8-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685807, "uuid": "f8e58696-1f12-4051-9c11-fb83d3bfb721", "comment": "Malware payload (RedLineStealer)", "value": "1cd832065cfeaeb7de5bf0b2a13844fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685807, "uuid": "60ade460-7bac-4558-a25e-1893eb8e93c1", "comment": "Malware payload (RedLineStealer)", "value": "74da107ff454cc439f9ba472e062a812c958b991b311906e1f224bc3e477d5f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685807, "uuid": "7b738b9c-6f86-4389-bc33-bec3a5be0d10", "comment": "Malware payload (RedLineStealer)", "value": "99cf055f93648ceb8dbacc4fdba133310e6ea7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685807, "uuid": "67128922-0e11-4cc4-b550-08cf87a490f6", "comment": "Malware payload (RedLineStealer)", "value": "b32601234dab8965e412e0aec8429159197f451bbcf6fd049b4ef90855d26881252712a2952efbdd44da1e4a17c9f4a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685807, "uuid": "aa79995a-3176-44f4-b3dd-64bc77ffb83d", "value": "T135B4125297E98473D9B41B705CFA07930A36BC929A78536F23855E0E0CF3AC4A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685807, "uuid": "d94335b1-d5dd-458e-a77f-32ae3035670d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685807, "uuid": "19fb2da5-361e-445f-afd5-8f2f9bdafb89", "value": "12288:lMrry906OL/FjIVQXRUZ0iuRT7pgO+9/We8jLgw:yyc/GVQBUZ0iuVve+Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685807, "uuid": "98f63657-fcd6-4156-9dd2-ebd847f19416", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685807, "uuid": "dffd6112-f6de-4fbe-a67a-be6fd99dd96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685807, "uuid": "39630a2d-5004-4358-88b8-d30d14ba6dda", "value": "1cd832065cfeaeb7de5bf0b2a13844fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287a577f-2e8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1690688570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688570, "uuid": "650ede8f-3a64-4aa0-8ac8-0d7c150d9975", "comment": "Malware payload (Spambot.Kelihos)", "value": "57bb01c8c20234485ee85d08a319992d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688570, "uuid": "065b24b8-8628-4332-bb1e-bbda91fe49e5", "comment": "Malware payload (Spambot.Kelihos)", "value": "7518c37ddea835db69a3e6f349688e76353ee5b5cff90ce572b22af0b9110763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688570, "uuid": "a1a4ab6c-4439-4e0a-9d85-1e340e026769", "comment": "Malware payload (Spambot.Kelihos)", "value": "b27bf7faa47073c2f8b0198a6dbc9151b4eaa8df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688570, "uuid": "77b25a60-7ce9-4815-ae33-01cb3a96757c", "comment": "Malware payload (Spambot.Kelihos)", "value": "76a5bcb0790bf92476871290ce22e96fa258e972d78e533b9deb5399dddd543d0bc9a32c42fee8128afac9e90e6fcc89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688570, "uuid": "0c842304-0a54-43ed-9ed3-95de71cea43e", "value": "T1FD44293911A144ABC8699E35FF4BD8C135166EA401BD904F3FB76E386BC24938DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688570, "uuid": "9c0cf993-d407-4477-8eb3-42aa88b36263", "value": "bd9fd923e8ae560e3acb8972357b00a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688570, "uuid": "f94aaa50-54f3-4656-9fa8-6046eabae5c9", "value": "6144:LjVkfelc0jWtxg3FSwC76VtloLQnfbUyz24q9wS7+:txlrsxg3FSwC76VfHp2/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690688570, "uuid": "7e65ea39-68bb-4004-9db7-7c038a715023", "value": 258080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690688570, "uuid": "3eadecbb-cee9-4c80-85ef-11415041dd0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688570, "uuid": "c0a5b722-465a-4e3a-851b-4ff0bfd23d12", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12812264-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686816, "uuid": "1e44c0ba-7ad8-47fc-908c-1a2f7aeec91b", "comment": "Malware payload (RedLineStealer)", "value": "9274464cd54c1be94a4f7bf60942f698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686816, "uuid": "83d2e3af-56e8-4737-9b78-6108335ad639", "comment": "Malware payload (RedLineStealer)", "value": "75a3b3f4f5dc78aefbe926e379a82829ab2d330079c08e9df919152aa2c2052e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686816, "uuid": "17f2f6c2-0c09-4451-a34f-c2e393813621", "comment": "Malware payload (RedLineStealer)", "value": "2b68fc03c82ebcafbb2dc28ba1258d40517d2b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686816, "uuid": "a41546c1-d8b4-4658-b1f2-81af3163e918", "comment": "Malware payload (RedLineStealer)", "value": "55859b47cc46d9617e62fb2ec76f4134714537d6b3566517f527a8c34c037644a5af4ae784a990589d1a3fc59138dc6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686816, "uuid": "22a564dc-eea0-4601-8bb8-1ca50a18eb24", "value": "T1B2B40202A6E44032DAAB2BB018F607C30B37FDA09D74975B36959E9E0CF3694A571737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686816, "uuid": "e7748d8e-9e4b-4b4f-becf-2580bee243a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686816, "uuid": "31288851-5130-4417-be6d-34e6dbe7c6ee", "value": "12288:eMrRy905Y1qpFrzPS6TnWOsJ1FV6AqUtsU5gJ:vyWXz1lsx0plUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686816, "uuid": "d775e39f-1039-4221-8256-55a8059f1b6c", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686816, "uuid": "ad421644-9df1-4e53-b083-0db1ebe09977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686816, "uuid": "c4dd0267-57f7-4555-bf0a-93b2cc966145", "value": "75a3b3f4f5dc78aefbe926e379a82829ab2d330079c08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccf54ad-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686162, "uuid": "a27b7726-795b-42cd-b672-9f5014a08ce2", "comment": "Malware payload (RedLineStealer)", "value": "b2f3580dbfc8e0ed5b1251acf12c6c5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686162, "uuid": "c3df796e-adf6-473e-be7e-4a4681c1318d", "comment": "Malware payload (RedLineStealer)", "value": "76329bd07e020bffb47562d31bc4fd2f5973a0c2ae6e86874f86f9ee4669e366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686162, "uuid": "7e3eb562-1dee-44e2-8b8f-bcfe1d90aaff", "comment": "Malware payload (RedLineStealer)", "value": "feb8e6ddffaf9ce48e861f64f53c21957c38be3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686162, "uuid": "d9e1ec6a-2b6a-433b-9d59-d6480d0342b9", "comment": "Malware payload (RedLineStealer)", "value": "a4ff8bea0e4e1e33a6446facea72e46d71a90c9cc651759e07ddfdb5fffc7f54e3a0526fcf96486acf9a1ee01a3bafdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686162, "uuid": "394bb302-3eda-4fd4-8c56-d4aceadd068b", "value": "T1E3B41212A6E84136DEBA27B018F217831F333DA15D38925A3789AD4A1CB36D4F532777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686162, "uuid": "68daaa5c-de5e-4f7c-8762-e56e54d4094e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686162, "uuid": "5fb60491-bcd2-4f68-920f-8b6610d9deaf", "value": "12288:yMrOy90phLG5f2TF/1NL+KJARigf1qrPYUBt:UycjTF5GMzYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686162, "uuid": "c52eba04-82a3-42be-b21d-00df33fa248c", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686162, "uuid": "5331421c-4c6b-43cc-888e-a59a3decad0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686162, "uuid": "a38384ac-287b-4d0b-a7ac-a01da9a6eda1", "value": "b2f3580dbfc8e0ed5b1251acf12c6c5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b815dd5-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686160, "uuid": "56fb93ce-04f8-437d-a954-424f1bf27920", "comment": "Malware payload (RedLineStealer)", "value": "aae583518e5d763e05881120cae08e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686160, "uuid": "1e9d6459-755b-4785-a4d3-cb474ce93b4b", "comment": "Malware payload (RedLineStealer)", "value": "7667f3dc5e1a97d383a26a6fde433fea11e93ac485eaea5247a08f9d6ed51e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686160, "uuid": "e72d0c47-5ebe-49a2-90bc-0c2d9e8d1902", "comment": "Malware payload (RedLineStealer)", "value": "b7753d53d0642ebc83b335ed706d67acece67ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686160, "uuid": "d0d78734-cb56-4298-ae62-9e641c13ccea", "comment": "Malware payload (RedLineStealer)", "value": "af82d8410d4a30ad104fb5f0308df55d7b28acc27aa04b8dc4c78e5564abc5b4dbdc05896c63b3193dc52365ae27ca3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686160, "uuid": "2e455821-57d6-40bf-881b-992b4261988c", "value": "T137B40212ABECD473D9B11B7058F607830A767D715D78876B2386A90E0C73B81A87277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686160, "uuid": "5b064280-95ca-45c4-b856-ae128c1acfe7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686160, "uuid": "d312db5b-11b9-47bd-83c1-c2fb0e38fe12", "value": "12288:JMrFy90O57FXYLsUDgmt2tXC6Km1/dV17y7kRqS:Ey99aDgHtXNbVV1mkRqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686160, "uuid": "f0f5a2f7-2446-4970-85f6-796196537feb", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686160, "uuid": "4ff258de-e1e7-41a6-830c-a715af3385bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686160, "uuid": "57e5bb10-d8e3-4e7b-a892-c68f415f3aae", "value": "aae583518e5d763e05881120cae08e7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d917a334-2e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690697027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697027, "uuid": "65421357-6a95-4f66-8723-34fbb796270a", "comment": "Malware payload (RedLineStealer)", "value": "32528036d53be119e13793b7881efdfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697027, "uuid": "65bd40ce-5258-4045-bbe4-b5bffec34fd6", "comment": "Malware payload (RedLineStealer)", "value": "76abd3c5b4b24b7386647d081b0b393986455795d1641dc49b18bec2f12df326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697027, "uuid": "afeeab9a-8535-456f-aa15-eea1a4e1163e", "comment": "Malware payload (RedLineStealer)", "value": "e82ab1496dfeef0a48e50f7e01689fc4daa64525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697027, "uuid": "9b0d4d3a-2a43-4fa0-a98e-144b07629186", "comment": "Malware payload (RedLineStealer)", "value": "94ab1bc01b490163df15c7fe4daa60e8b956c6b5f38d0845d7017409c08aae26a571eef5a093fca071242c8026839195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697027, "uuid": "46004fc4-5387-4732-a602-d66d76ebeddd", "value": "T191F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697027, "uuid": "c6783631-3197-4cae-aa43-f8839d12eef2", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690697027, "uuid": "9a43e87a-f7b9-41f8-83f4-457d2a968264", "value": 37372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690697027, "uuid": "149b0e95-a70d-40c8-ad61-b0ddc34252db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697027, "uuid": "ca936fc3-d4b9-49ac-a9ed-6221bf65e571", "value": "32528036d53be119e13793b7881efdfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fb29a9-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695250, "uuid": "13b7a9b3-3fde-4aa4-b520-50c194a22303", "comment": "Malware payload (Amadey)", "value": "4d5230b1ffe04ee303bccb921d21ebbd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695250, "uuid": "8e4ba5b1-7469-45b0-9dde-f6d6507e741a", "comment": "Malware payload (Amadey)", "value": "76cf21b17afae0101b203273a3a1fa702c1590ca5026df4497465645f1d9b810", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695250, "uuid": "a1c452df-eb66-401c-accb-578bb1832b41", "comment": "Malware payload (Amadey)", "value": "5e60a17a93be95d244fed575044d4d3c1b3abfe9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695250, "uuid": "4aacf0a8-c172-414b-9b5a-1a0756aa35fe", "comment": "Malware payload (Amadey)", "value": "dd49272e15fa267b041ff48c240f329b50b99cc45da9df636682892db967a4dc491210ac86068aae5f0e7d7ba9591df8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695250, "uuid": "238ebc6f-d6ad-4df8-bdec-d3df572cf1a8", "value": "T1FEB41203FAE88533D9FA27B05CF706830B367DA18C75D66723855A5B4DB2690A67032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695250, "uuid": "91067538-54d4-4416-9f35-e1bd019a1978", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695250, "uuid": "567eef46-4dc1-4d21-962d-ba67f7a15630", "value": "12288:tMr7y907GPdpGTTjGwcBjd8UW86rB34ODf:6yJt0Imf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695250, "uuid": "237db803-7f24-40fd-a610-41db2739531f", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695250, "uuid": "6b439452-bc3f-4396-b61b-f53daf145aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695250, "uuid": "b190645a-4e55-4416-b513-2d065ff704ac", "value": "76cf21b17afae0101b203273a3a1fa702c1590ca5026d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc1d441-2f31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690759819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690759819, "uuid": "d7b5479d-59d8-43b0-b5cd-dcad5bfa0ab0", "comment": "Malware payload (Stealc)", "value": "083338c9d7fc76f545b0791e75df30ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690759819, "uuid": "5ba66c39-401c-4e71-8366-c8aa85deec87", "comment": "Malware payload (Stealc)", "value": "78aff71e97c42a0151e6352169a345e0b31af296beed8d3bfe4145b451fa076d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690759819, "uuid": "d674c922-e58c-4e62-aa7e-bad29603d968", "comment": "Malware payload (Stealc)", "value": "587f9af9bc312833e51e351d40921319fbba79fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690759819, "uuid": "3375bd51-d2b5-4617-99cf-41c70c2b8268", "comment": "Malware payload (Stealc)", "value": "0500f9029d811c91a54d652e0e2b7bc0dd481365612c4421e519966a48fc17a67cc1abfbb1edc678b67f42de803a2dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690759819, "uuid": "38725d41-a1bb-46e1-81d6-4a7618f071e3", "value": "T14EA483538392910AE25A273CC06F967551162F3039128F761644FAAAFF3B7F389277D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690759819, "uuid": "d1213c3b-ae17-47c6-8228-14ff20a97747", "value": "726799edc06918ce38ca573709739038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690759819, "uuid": "742b4d1a-6d18-45dd-95bb-4011a07cdd93", "value": "6144:UCgPKv0H8w1oqVHh3pVevnJJpIYQpNKWPD9c7/wasc1i03xMbXPWG:/AxHF6q1z4nJ/lQDK6y/F7VMbXPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690759819, "uuid": "88a8f921-1d8f-42b3-9caf-9bd0a6e7328d", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690759819, "uuid": "89656728-0a0e-4512-9eef-b50aaada779c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690759819, "uuid": "581b0a80-f15c-473c-8c42-49d99aa94d99", "value": "083338c9d7fc76f545b0791e75df30ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942e7550-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690701207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701207, "uuid": "d3e895de-94dc-4337-86a0-943db21ca733", "comment": "Malware payload (AgentTesla)", "value": "57f2fff2cdfa92ceb7ba77802a1ee21c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701207, "uuid": "726e25c7-3722-40e4-855f-42eb703eaf9a", "comment": "Malware payload (AgentTesla)", "value": "793e60744aa163e0da636233df2fc83f43d447cddf4a89b28ff15a0ca95e69f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701207, "uuid": "f6af4ab0-70f1-46dd-9aaa-7f6da3e3f63d", "comment": "Malware payload (AgentTesla)", "value": "f1c3ec71afd393cd0bd15ff1d8333e33041fba2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701207, "uuid": "e644687e-6eba-44f5-bd8e-0b49b876db6d", "comment": "Malware payload (AgentTesla)", "value": "f25f499700e77904cd2e95c796f403d4856105e97eecf9042de19f2a09f100d9ebe69154b16c625a2d26a8e96395f151", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701207, "uuid": "d6db7f9c-c23f-4625-8127-59b79ee63c83", "value": "T1FA256DD1F1508D9BE87B06F16C2AA53015E3BF9D54A8C10C59AABB5726F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701207, "uuid": "840fb863-dd5d-4eb6-823c-4a02a7a6eb1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701207, "uuid": "bd2e505e-0660-45c9-9136-1fc82ad1d030", "value": "24576:xLgjjoz3uyjzUuAFAAhmntVwAyS+KbSv:ckLZU1dwVw2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701207, "uuid": "783cc99c-5d59-45cd-9058-3bed3653c68d", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701207, "uuid": "6e118d9d-f3ec-4e2e-8919-d70a24b30ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701207, "uuid": "f16f6c5b-c3cd-4ff6-a800-23ab8877fda3", "value": "\u00f6deme kopyas\u01311........pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f1a64b-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685858, "uuid": "6688f07e-e529-4e21-9491-d7ae84d914c1", "comment": "Malware payload (Amadey)", "value": "78a0b28a64e6bdb2e0c241419df5c577", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685858, "uuid": "7883f3ba-6192-4df0-986d-6ab2fb6d6d45", "comment": "Malware payload (Amadey)", "value": "7a13a83670c11257ac702b0eae826d377573790b5b0f7f014497e523185ba4d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685858, "uuid": "38512a9b-3cbd-4df4-a9a0-a405342846cc", "comment": "Malware payload (Amadey)", "value": "1da63f4679cf0fa9c82f40bc1ead243ff949416e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685858, "uuid": "f7e6759a-1967-4a93-a331-3f22543ab0d9", "comment": "Malware payload (Amadey)", "value": "ef740568d81beb26647090842916dbfa9fedcc0a353d4475c32c12d682b0b02c4f338fbe1c71ffecec1c15ca2336a551", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685858, "uuid": "c88a8b1f-4dec-4160-b050-44146e3e4950", "value": "T109E41317AAD94172DAB1177054F307C30F357CA28DB8867B3B987D4909B25D0AA3277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685858, "uuid": "b60939a5-6ef3-419d-b513-8d4a950798ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685858, "uuid": "e64a6816-9084-4501-89a1-057ef14dc559", "value": "12288:hMrvy900yM42aK06vdcyLgZfSBs8/nOx5W2QEg:2yiwaK0mKyLej8/DV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685858, "uuid": "789ec5b2-555e-404b-a561-9b4b54d342b9", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685858, "uuid": "e3b7ab5a-b20a-45c6-8f94-a468d5a2d886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685858, "uuid": "adc75527-ff12-4b3b-94fe-bb90e1554791", "value": "78a0b28a64e6bdb2e0c241419df5c577.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d325ed-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686491, "uuid": "ad2fd98a-4c7d-46fd-9a1b-fe04aef9918f", "comment": "Malware payload (RedLineStealer)", "value": "4a03a737daa108e08ef98656298a48e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686491, "uuid": "1a372819-cc9a-42d7-af1c-3ae42f84e768", "comment": "Malware payload (RedLineStealer)", "value": "7abae1afe25fb4f9a1543205972cd1fd2d8019bacbe17c4632117ed3f0411841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686491, "uuid": "bec95aad-b126-436d-a32b-a80ac78b3c56", "comment": "Malware payload (RedLineStealer)", "value": "f2d47faea7046ba4978c98f4c5623b64825386b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686491, "uuid": "3365a20c-513e-48d6-953b-79deed0ca52a", "comment": "Malware payload (RedLineStealer)", "value": "252630326fa4d7eaf268c83540efad20410c34054487fe51af1ea46050c1bec403e10f9a5a9cb43c0571d32c2b105ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686491, "uuid": "b4b89f0f-db75-4e91-a31e-81bfd27b5109", "value": "T14CB41207E6DC9072D8FA03B059FA17971A357CA05D78872F2795A85B0CB25D8E23273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686491, "uuid": "a47af102-508f-4c63-b69e-942149798466", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686491, "uuid": "9e91a762-ab34-4a46-b371-7702a8aa81ad", "value": "12288:YMrsy90dCz/ucHbmxlDgt5lZO8jkgBYCTtLYk7punOR0:0y6C/ucH6DgtU8jrzpckNWOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686491, "uuid": "25ce3811-3729-4054-80e6-bfeb9d81b7fe", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686491, "uuid": "4acbb74c-66e2-490a-b961-2fdf29c451dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686491, "uuid": "c54dc766-77c9-4573-88b7-7c035f77ab7e", "value": "7abae1afe25fb4f9a1543205972cd1fd2d8019bacbe17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb64fd18-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690709540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709540, "uuid": "5dae4f2d-14e9-4de6-b487-1c5a7e20fda9", "comment": "Malware payload", "value": "d627cb1caf7eea7f27fc87f58cf75e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709540, "uuid": "1234fb9a-d41a-48d5-8ebd-fe8f2a967799", "comment": "Malware payload", "value": "7afcdbf26bebb2b771f1975adfa355367f2dff5adeeb69e7304c159ca111f40a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709540, "uuid": "2183aecc-34d0-4cd4-92c6-b995fab04614", "comment": "Malware payload", "value": "a9c5f9fbbcd2a090a67b5210bbe39bf1cf5b9839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709540, "uuid": "2baff56b-0291-498f-8808-c99eb0ed309b", "comment": "Malware payload", "value": "b9d7c17ff78fd6a5ffda0baf9bcaf1921644d552600fe948f2db683a54feb09528788e564051c4516daad91afbe6c8c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709540, "uuid": "e1e26326-f003-4ac9-b0e7-0e4860a0dac6", "value": "T16FE39E1276D18470E9634B3E18F4BB111A7DFEA25B7088D7B39840CC5AA13D15BBB7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709540, "uuid": "d01685d8-d345-497f-a930-c99f8ec1495e", "value": "6a6ae8cd4b1d9e8103143c90ed0aa3c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709540, "uuid": "f14a9e35-8efa-4a19-a759-330a506f38a3", "value": "3072:FAuH+XCPF6h+2LQeXoZPbF01Tm5Z4E4piq:FA0QCK0FZzF01K5b4piq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709540, "uuid": "69bc84a5-fd73-4c31-b673-6f211b0b0eff", "value": 152808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709540, "uuid": "8ea9f583-f941-4089-8360-4a34acfad3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709540, "uuid": "6a2abe34-0257-47b5-ba41-bb911702d9d4", "value": "SecuriteInfo.com.Win32.Trojan.PSE.M62GXR.392.23569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d9edfa-2ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690710850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710850, "uuid": "3501d7e9-0a85-4c57-8235-d4f2191aeded", "comment": "Malware payload (RedLineStealer)", "value": "9b7ca994ed909aa4e3f85ee19873a625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710850, "uuid": "3e2ab1c7-8968-452b-994f-5f71c6fdbb59", "comment": "Malware payload (RedLineStealer)", "value": "7c2f8456e7c1b735e8f507d162e962ceb3dc02f9a38b441df03f6a88f20a36f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710850, "uuid": "4857a238-622e-4405-a9aa-aba454f51942", "comment": "Malware payload (RedLineStealer)", "value": "67939d81fb2945313dddb9c095ff4a88e31165b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710850, "uuid": "c5b1d94c-4c47-4127-a7b7-6d07c2269904", "comment": "Malware payload (RedLineStealer)", "value": "3b85283cf80f1f3fcc0837bba3f416b201f1de1260cb631780115d4a40d4b066d46b2a4df4bf53e3f3689ad4a33e0377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710850, "uuid": "830814b4-6e3c-4418-96a6-598e006b5db4", "value": "T105B40212A7E49437D4B1177028F703D72F36BCA1AD3853673756A8AA0C72681A87673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710850, "uuid": "d576ed7a-3084-4cbb-b0ce-ae603e157f1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710850, "uuid": "8e8a4a14-c5f3-454f-9414-df574df11f16", "value": "12288:4Mrjy905H3O/PnbyON9IIjGJn/kGuCbN:byM+/Pnb/N6IjGJBuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690710850, "uuid": "27e1aca5-830d-4da5-acf1-22d6ba8373f2", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690710850, "uuid": "ca5902b6-99de-4233-9d37-50f38852b007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710850, "uuid": "6222693f-4127-47f3-8fb7-1c4a63a16ff5", "value": "9b7ca994ed909aa4e3f85ee19873a625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f1f3bd-2eac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690702735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702735, "uuid": "ec77a724-7c32-4d49-a006-fe3884b496c4", "comment": "Malware payload (RedLineStealer)", "value": "e5f0811a3a5f1e8da32d8c52fbd4e002", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702735, "uuid": "1a4d330f-a726-4396-83ae-d04ebe0e4be4", "comment": "Malware payload (RedLineStealer)", "value": "7c600b8d7a390d26d1dbf170cdd39639e60dc6a915a803e7d47a861f4f6f5a7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702735, "uuid": "05e2a96e-74f5-45c5-96a7-f0f93d15ec7e", "comment": "Malware payload (RedLineStealer)", "value": "20cdc998713431db175f18ff2dbfd8d3c4dc4ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702735, "uuid": "f0add301-cebd-4fc0-b778-102668dcfb1c", "comment": "Malware payload (RedLineStealer)", "value": "1e57f4524829ac2297c27f0dbc5d291b64edb36b8ae737f1bbda8c2dfa1db044ee8aeaee3f1fb6dab96c8d1c22234948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702735, "uuid": "efbed681-a442-4725-ab33-28c0ec4d8ede", "value": "T1F3B41217AAD98073C8F517B069F702871A39BCA21D79937B3345E9AB1C736C0A53172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702735, "uuid": "6daeed7d-1f92-49fd-9000-f970adc5138d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702735, "uuid": "d405eccc-5158-424b-a3a2-b123d1736851", "value": "12288:bMr9y90w4Rt9/+qUqk40Lrfh3Zgty+OgWcgBYCQapT6jnRuoV:GyN4ROqUqGDFZgt6gWDzF6lvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690702735, "uuid": "a8666b77-f9e6-4f76-bb2c-7061a9fb1048", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690702735, "uuid": "9183de62-396f-4e32-9b7e-f839f3c3032b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702735, "uuid": "c306a74a-2096-42c6-a157-2df30832f76b", "value": "e5f0811a3a5f1e8da32d8c52fbd4e002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d901ff2c-2eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690709053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709053, "uuid": "9089579d-c9bf-4caf-8a07-dcc4842c0cf5", "comment": "Malware payload (RedLineStealer)", "value": "e49e7493bb752af32f5801babe0b70b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709053, "uuid": "d3e38f13-6ebf-4cd9-a678-682903ebbb87", "comment": "Malware payload (RedLineStealer)", "value": "7cd2bc10d2359643b49fd7f91cd64c1b5b1af7bd579279fce3c0581f60f474b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709053, "uuid": "ced31d74-16d8-4671-9d4f-1182be76c715", "comment": "Malware payload (RedLineStealer)", "value": "45313345b5ae1cd1342a61389cde980ca84e9ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709053, "uuid": "56aa5c08-2ca9-409c-927b-868fc0a7d5de", "comment": "Malware payload (RedLineStealer)", "value": "9968c74c8c57647fc95d8a36fee83e7052c5073c83569e2e9371ed1602336141ac939b0cb8127f7c15da56649af05869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709053, "uuid": "eae1b436-268b-4712-9b21-25b9d2fcb6b1", "value": "T16FB41253BAE98073E9B623B064FA02D31B367CA15C7483AB23515D5A4DB33C4A17637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709053, "uuid": "9ff6a89a-f43e-4b2a-a87b-c047709baafb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709053, "uuid": "3f1fa7fd-dda3-4b91-be26-75e8516281d9", "value": "12288:3Mrby907vbZpuKEHOGuOLRYZFOp4chmn0UVN3BWwZL:kyezCOGunFOacy00RBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709053, "uuid": "cf68c0ef-8829-43e1-b5ba-5674a9b0c649", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709053, "uuid": "b7036696-255d-49da-b6a2-19a5d49de5c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709053, "uuid": "10b2ca57-110d-4182-8c4e-5bb241ab2237", "value": "7cd2bc10d2359643b49fd7f91cd64c1b5b1af7bd57927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64e61cd-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686768, "uuid": "adc9b6a0-069e-4554-af72-8c5f22f7ce4e", "comment": "Malware payload (RedLineStealer)", "value": "7dd8510da08b58883d4b3082af290c5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686768, "uuid": "044cee8e-a0c0-4e05-a72b-553c6ae81d0a", "comment": "Malware payload (RedLineStealer)", "value": "7ddeda2e3bde145fdf37adec48a6bf6ce8c05a03a2588e38a24673fe110f5f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686768, "uuid": "091fc61a-06ac-4184-87fa-949cb65abde2", "comment": "Malware payload (RedLineStealer)", "value": "54c35daff8de5b277cdec9bb1fc17b179365831c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686768, "uuid": "d8933221-b395-4df5-bfac-de016011b60d", "comment": "Malware payload (RedLineStealer)", "value": "5a88e417972f083035ebfa7232c06484f93e2eea874fca573b9c9d93d9f04130da29d916d1fcea0098fa48f908860608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686768, "uuid": "3ee32a08-fe11-4db0-a026-7d8e592dea8a", "value": "T1B2B41203ABD89423D9F1277165FA42C31A38BD628DB4836B2395AD5E1C732C4B93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686768, "uuid": "919a83c9-88e5-4472-87a9-08aa522a5ed5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686768, "uuid": "f2cbb0ed-83bb-45e7-abaa-e1edc8ec6c1b", "value": "12288:0MrWy90d9rEunVLKTh4eevG6wgBYCR2IUZlQm3LyMv/6Ao:6yQ9ounBwh4eeuOzQznpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686768, "uuid": "3df20231-f075-4dd1-9ff5-f633bd07c4cd", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686768, "uuid": "bda3e0bc-e2ca-4970-adb5-1d7581564399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686768, "uuid": "0587bd92-85e7-48c2-ba12-b2882d600025", "value": "7ddeda2e3bde145fdf37adec48a6bf6ce8c05a03a2588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d160dd0c-2f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690750272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750272, "uuid": "09f55aac-48af-44c3-aa1d-14371d5257b4", "comment": "Malware payload", "value": "8a470899a6ebb2299b54da55ad3897d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750272, "uuid": "9328a1b4-f5ee-4eab-bb58-91127831d19a", "comment": "Malware payload", "value": "7e160f885fe15d7f5b67e3d321c1bd8240a63bb80c8156f604829f0cbadba313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750272, "uuid": "f4d6fc54-7604-4517-819c-661e730401ae", "comment": "Malware payload", "value": "1ebafddb262fe912641e260fcf407907ca67fb74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750272, "uuid": "1206a08d-56dc-4c32-a248-d7932d18c3c4", "comment": "Malware payload", "value": "ef9620d70361ee8afa069d3aff0f8f68178939d4560097b3c7fdcb7718dfd28becca5ba9a0524d54bed073e4a7b2c5e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750272, "uuid": "12008001-8eea-4eea-8c43-fc834282d24b", "value": "T133F501517BB0CD88DEB213F9612102D99A335D0B6102D32ABCDEF46D2F1D60ED956AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750272, "uuid": "84462d83-c291-42b3-a4c9-b9cb89debd82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750272, "uuid": "e68763cd-7f62-494c-abf5-4756ecdb5691", "value": "49152:SMQyNFL4gSeOzD5rbhdU7bSVziW+Gz/6Sq5ms7Otvx2mAmMm0pFZMpTBkRdFFU2:NL4B35rbhCkiStvx2GcFZM1BOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690750272, "uuid": "9fcd4f9e-9909-4d02-86da-13b7ad689285", "value": 3630080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690750272, "uuid": "4b99a3a1-a6d9-4a49-8eef-ffce3f3ea90a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750272, "uuid": "e8c80720-db39-4d87-8709-6d334b77fb99", "value": "WSHRat.3.4.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b066095a-2ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GurcuStealer)", "timestamp": 1690699965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699965, "uuid": "ba467306-51d3-4dc4-804c-c94d78e01084", "comment": "Malware payload (GurcuStealer)", "value": "3cccb0426afe6bc0ff4dfc4a071e46d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699965, "uuid": "5f3a05fd-4462-40d3-bba7-45862f6f1677", "comment": "Malware payload (GurcuStealer)", "value": "7ebed8205611f34363bc35484fdfaba6da74b5de9e9c1128041bc9cb6e232664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699965, "uuid": "2a531914-b7b8-4510-9e54-d08f7df91f9f", "comment": "Malware payload (GurcuStealer)", "value": "31273d47ef275f8c2fd537806bff7bc1e95f7060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699965, "uuid": "dc8c4127-fa2f-4297-99f6-8bf6d24f1e29", "comment": "Malware payload (GurcuStealer)", "value": "4d1e6728be19a4645062b065ffee32149b544ef0b6702d1e963bc1f0070d13627ec26b690dbc9d75cf6a22950f72c398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699965, "uuid": "97210733-6ab1-4fe0-a4f0-ecdb6d9a4484", "value": "T16EA46C43A2D13D54E9258B729F2FC6E8760EF6518FC9BB6632599A2F04F10B2E173701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699965, "uuid": "9290bc3b-debe-4ae3-b561-e429f5e03bba", "value": "432f9474f351967236c075f6f3bbd792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699965, "uuid": "1c53748b-d6d7-4e1f-ab31-f7ef83b38c41", "value": "12288:9uiy8Y80UbUMg0HqBNYzM8H03kKuIZHv:9/ttFg0HXTH0zu4Hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690699965, "uuid": "bfdbf0e6-6532-4921-b749-dcfcc24a0e3b", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690699965, "uuid": "c864da19-7ee5-4800-a32e-37c0de7521d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699965, "uuid": "a4d390be-feed-4c4c-90aa-0a8de84b6846", "value": "3cccb0426afe6bc0ff4dfc4a071e46d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef9af53-2ec1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690711747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711747, "uuid": "7d8504e7-2f11-4232-86b4-a14e39582255", "comment": "Malware payload (RedLineStealer)", "value": "67c5501399522a583f06646b179b3979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711747, "uuid": "8da4b627-6243-4b77-ab5a-de55189918d1", "comment": "Malware payload (RedLineStealer)", "value": "7ecedf9ac2b8319627f17aa01eb9b9b23cd88b6278dddc664d63ae19d8c1475e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711747, "uuid": "b2861e32-e340-412b-b3ef-632566101ec3", "comment": "Malware payload (RedLineStealer)", "value": "6b48f668af993ca877f706b6bf1cf48a597bcee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711747, "uuid": "4fb938c0-90d6-4cac-8f0e-8cb15345d2df", "comment": "Malware payload (RedLineStealer)", "value": "da237371970118726136b05ffb2eca1de475448ceee8a229027fd62873a8633cc10a822108ae45ac7b61082dfe0414d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711747, "uuid": "60c74d2f-6fd5-4e30-95ba-fac42edcde4b", "value": "T1B9B41213ABE45272F9B613B524FB03830A36BD614D38932B3B81595F1DB3290D97672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711747, "uuid": "460bf60c-83d8-4106-8e79-0c46ac68c361", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711747, "uuid": "ab3d7515-d258-4ae9-ac13-2459873c5998", "value": "12288:+Mr3y90DEVGJivoGEpaDw9NvVjTuw9PaI:5yy+Gke91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690711747, "uuid": "419de129-48e0-4ec8-b683-2a44cf6526be", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690711747, "uuid": "27ff1291-767a-4ceb-ab96-649c56e10f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711747, "uuid": "3d906904-3ce0-4309-952a-7f98a3c7aefb", "value": "67c5501399522a583f06646b179b3979.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52cd3fa-2e99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690694900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694900, "uuid": "39b755f7-f2b5-4549-baff-ccdca86bfe50", "comment": "Malware payload (Amadey)", "value": "48a5902b786f498acc5fb0969e4585b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694900, "uuid": "8460eca0-cc9d-4f8e-89e9-a6dff4ed78bb", "comment": "Malware payload (Amadey)", "value": "7f38b764f01c4ec3678a854a1fd8bded693e0833bc1c3024df29094031e73339", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694900, "uuid": "1f938080-004c-452d-84eb-cfc18b83a4d7", "comment": "Malware payload (Amadey)", "value": "5ecd5a09d59bef2e0dc6869310c6db064a79f740", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694900, "uuid": "502ec2f8-871e-4a47-ba18-6e83f328c28e", "comment": "Malware payload (Amadey)", "value": "32c4f8a32f8cf2277a75965f4812cefd4a5cddac8c9fcfba3bff94aa386537c4a31f8891d333c44bafc1f120928c715d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694900, "uuid": "e287d5bd-97d2-4ae5-91c7-980ba89472a4", "value": "T18DB41203AAD85076D9B617B09CF703D30F35BDA26DB4921B268598570CB27E8B53236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694900, "uuid": "bbb4fb4e-e345-47cb-9a02-31cec3ce662b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694900, "uuid": "ad8997de-30b4-499e-8362-6318ccf7cddd", "value": "12288:7Mrpy90dy5bpun4FU3mAw82zgBYCnDXARof:2ypbpuMx82MzDiof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694900, "uuid": "13de7da2-cb6b-4cd5-8691-6c7640adbe75", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694900, "uuid": "928e8cc1-7105-44db-9312-021e103cd5fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694900, "uuid": "7854254e-81ea-44e3-a8e2-09a150af351a", "value": "48a5902b786f498acc5fb0969e4585b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ef878f-2e79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690681000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681000, "uuid": "04394b2b-eacc-4a24-8e7b-e9dbafaf1f5f", "comment": "Malware payload (RedLineStealer)", "value": "4bbdcbd91933a5ad5a76710ece1a1b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681000, "uuid": "2fe78e19-491f-4d6d-b3b3-db889abfd3ba", "comment": "Malware payload (RedLineStealer)", "value": "7f6cf0824887306dd32752093672d3b5f3187783b212f6cca30cf83833b1f40c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681000, "uuid": "7a563fe5-433c-499a-9485-f11f9b65811c", "comment": "Malware payload (RedLineStealer)", "value": "4ada36b09478465bc23738694b8edc25d636b66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681000, "uuid": "924e065f-f4f1-4fe0-a49e-9f75291ff7c1", "comment": "Malware payload (RedLineStealer)", "value": "8d40e432538f76c377799ff8496f6088cd89762889732ce48bfe4a303baca5a4b24d828a243d03a3861e629569483518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681000, "uuid": "0600ab34-22fd-4a78-8ff2-b7e9b2bda96d", "value": "T1CAF2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681000, "uuid": "ef07a27b-a716-411b-b9cf-d08ab4a1e8ca", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690681000, "uuid": "a3eaee86-7fcd-4bd5-ba6b-56f65a9b0362", "value": 36265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690681000, "uuid": "9275490c-f1ab-4215-b043-863450a1cb49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681000, "uuid": "b3442238-1c6d-4d57-933c-629ca94afc81", "value": "4bbdcbd91933a5ad5a76710ece1a1b08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7348ef-2e92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690691582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691582, "uuid": "a340ce31-02bc-4cd6-a4f1-9a4cf4419c26", "comment": "Malware payload (RedLineStealer)", "value": "038a8405d1490028f21f1592204b9f6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691582, "uuid": "9359bd5f-a480-4dba-af70-068bddfdd02f", "comment": "Malware payload (RedLineStealer)", "value": "8066eab384edf0a508aa8afa7a58a0e4ac398f5844a9ba73954b0c346ecfc84b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691582, "uuid": "a52d7855-f0be-4c49-a412-e9cea0d0fe3e", "comment": "Malware payload (RedLineStealer)", "value": "ff21fcddba9588a9c7f625025901b34c2a5d1472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691582, "uuid": "5750d521-2c85-4796-8f71-4c8aa99008c6", "comment": "Malware payload (RedLineStealer)", "value": "30d61574a66df1cabb5e171ddf41b35c060b4eab036a564442234b952094d1c12d167127d2ccb1747807c388fc338c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691582, "uuid": "9132486b-daed-4db9-969d-f0100afe5d15", "value": "T1ACB40202B2E88073E9B557F059FA02830F3E7DB29D6593672356994B0CB1AD0A97533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691582, "uuid": "b35ba3b8-a729-4cb3-9e33-15f1db1aedd4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691582, "uuid": "209a35ce-e0af-4012-8a18-d9f7d96f4d9f", "value": "12288:zMrBy909xrp3jOJdWrmnRp0dc8Zop58ncY:yyi51SJdWIB8KIn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690691582, "uuid": "161cf5e8-5c36-487d-88af-d66cf439c027", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690691582, "uuid": "b2f98cfb-5b1c-4d83-a6a5-ca6b0b25267a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691582, "uuid": "418eeec0-677a-496a-bcaf-63f8d3d6bbfa", "value": "8066eab384edf0a508aa8afa7a58a0e4ac398f5844a9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91c27f3-2e94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690692786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692786, "uuid": "43fbba0c-ceb5-4e1c-b2fe-4ec9bbeb28ef", "comment": "Malware payload (RedLineStealer)", "value": "1d3e1e8fa629834d2390bb9fa85396b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692786, "uuid": "22d74a64-79cb-4466-b1e8-c0785b06663b", "comment": "Malware payload (RedLineStealer)", "value": "809a44cf0ca78f3ee2ba68f093d96b913a6689e655edfbbfb7ddaf9925180cf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692786, "uuid": "ccda1108-e3fa-46a7-96c2-bdc2dafbb282", "comment": "Malware payload (RedLineStealer)", "value": "be1596a9fe21fe924a6bed9a5ac0126d747171e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692786, "uuid": "288c91f4-8d0d-4290-acc3-d8f8df502153", "comment": "Malware payload (RedLineStealer)", "value": "902d36afdac1ba0a1c21a3d1bd5ece29921fb4510a9dcf01677337d54131234f5b15e98b6de266c8a349f9e595b0c3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692786, "uuid": "356f3be5-2a67-424c-92c6-6b3b1137fc5f", "value": "T16FB41247A6E85133DCB92B7158F706930636BC674DB8861B2342F95F0CB2690B97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692786, "uuid": "8429bfb1-8ad0-4dd0-a01a-113f6741c644", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692786, "uuid": "4aa6b7fe-76aa-4ca5-b0df-1f2e3a8c87f2", "value": "12288:RMrwy90GcvgIiQv0w8FJGz22T0egBYCAx7L6GD6:BysoLQv0wN2zo2U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690692786, "uuid": "7fc1171d-d5cc-4d43-935f-04812443bf96", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690692786, "uuid": "a916b7df-5496-4aee-8741-237b217e1a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692786, "uuid": "d75dabef-93b7-477c-b822-6ea13aa18836", "value": "809a44cf0ca78f3ee2ba68f093d96b913a6689e655edf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c25aec-2eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690704246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704246, "uuid": "dba4be59-ff4d-4ab2-ab51-5e9af4e32229", "comment": "Malware payload (RedLineStealer)", "value": "879ce51cd2e10073f2875280a73c4af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704246, "uuid": "9fcc3ba2-4380-4d25-bae2-107871d75ddb", "comment": "Malware payload (RedLineStealer)", "value": "820fdad665b19d5c17a4ab8604f8fac33a60608ebbf82af577f73491b07d745f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704246, "uuid": "6998263e-47dc-4e69-a340-1441159f4265", "comment": "Malware payload (RedLineStealer)", "value": "ed38bb21104e34c7e0dc2d1cfce477d9e423488c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704246, "uuid": "3203a9c2-15ea-4261-8fbf-a7c43bb81bbb", "comment": "Malware payload (RedLineStealer)", "value": "98e6a5e909ab146aad6d750b4379693f25552173a745d9b24cb2ceb542734988347b9d3b6d5a06fa3f3f9aee422ab04f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704246, "uuid": "39949830-789f-42c1-b211-d4df7c7cefc8", "value": "T111B41206E6C5A073D97527B458FA06C31F367CA22D78427A278618AF4CB37D0A57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704246, "uuid": "04116552-e9ba-44f7-85e6-2e2911ff6390", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704246, "uuid": "dd2b67a3-6668-4504-bdca-7c89365f02db", "value": "12288:1MrLy90DhdStw7uPSaAgBYC4oiBO6wxhb:ayEhz7uPRzfHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690704246, "uuid": "438155ec-46b9-4642-b431-96769629236e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690704246, "uuid": "252ed808-d967-4606-bf21-9ea68f53e52d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704246, "uuid": "6d577721-fba1-4f37-935c-559d45a74cfe", "value": "879ce51cd2e10073f2875280a73c4af7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d280d503-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685849, "uuid": "9956f0ab-f760-4b54-bf9f-24a7c490c3a0", "comment": "Malware payload (RedLineStealer)", "value": "79aea754a9374dea438fee13d2d71a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685849, "uuid": "70f7f9dd-4568-45d5-95cf-627d2eeb95e5", "comment": "Malware payload (RedLineStealer)", "value": "82b58413553904727c7370e55f9049da9468b1710d8e2d826cdc1eee8979b51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685849, "uuid": "69c92539-572a-4d83-a9af-d2c156840d8e", "comment": "Malware payload (RedLineStealer)", "value": "daaa3abb240ac148d008b787d743acd2c250906c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685849, "uuid": "d2583a8c-1d50-492b-9a12-e6083998dae8", "comment": "Malware payload (RedLineStealer)", "value": "09dbb77db7d86adfe55291ce6fd19bd767412a96a2e343a3f7cc630e0c078f0c48657d4e7e319ea731f84217a360697d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685849, "uuid": "edcaccec-c783-49d3-a070-6cbd6548e44d", "value": "T128E41262E7EC8173DDB617700CFB42931A36BDE50C7CD3761B86995A0CB2A94247272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685849, "uuid": "8517485e-9cd5-438f-9025-670653430596", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685849, "uuid": "d0f13088-bfcd-4ce0-a3c0-2cfd033a3ad8", "value": "12288:mMrFy900F8JBMCu5kE7/r0pHalz/I5YChvKACakB0y2e2eN:Ty89jp6lw7xwaC0y2e2eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685849, "uuid": "4f9a5ce9-2970-4936-8b68-223ec7b7a3c2", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685849, "uuid": "dd5cd512-80df-405c-8380-6e3ec26178a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685849, "uuid": "ea2b1475-2381-43d1-a129-5c39b14fe527", "value": "79aea754a9374dea438fee13d2d71a7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b86f683-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686804, "uuid": "625922a5-d875-44fd-9f8b-034bdb8723eb", "comment": "Malware payload (RedLineStealer)", "value": "c7a0de3c6918d71cfcd6665368530440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686804, "uuid": "1296370f-9416-4530-8309-a29dceace8fe", "comment": "Malware payload (RedLineStealer)", "value": "836a63fc92781714c7c305653f8379ccbcfe34a87bbcc0cd312081bdb2d897a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686804, "uuid": "46ac88f1-5662-49f1-b8a2-579890ff17a6", "comment": "Malware payload (RedLineStealer)", "value": "3a1bb9b7c0c5e63f4c894eec659e1f1563444dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686804, "uuid": "2d7ede6f-f78a-4ca2-b87c-2bfcf624775c", "comment": "Malware payload (RedLineStealer)", "value": "321249cf1d171d350c0017c9f3bdd02f0ae13f505882b6e8f1226f15fb0a3c673415d96021a140e7782ed5a9d1f07527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686804, "uuid": "dea39fb7-a790-4d3c-8d1a-f2732e97e900", "value": "T17DB41216B7EA8072E9B527B058F506930B39BDB25E74532F2385D91E0CB27D4A43273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686804, "uuid": "7d3c5ac7-4cbc-4a03-aadc-36f296c9d81d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686804, "uuid": "e56d856b-8154-4b72-936b-2f4074c45d55", "value": "12288:gMrZy90I6nfhg6E79+edBQ6gBYC2dmVgoGb2l:Jy0Ja/uzemqog2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686804, "uuid": "7df6bae3-8cfe-479c-9bf2-824a9316e911", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686804, "uuid": "238f1da4-f2e8-4925-833d-53ba2d8658cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686804, "uuid": "e713fb99-f572-4909-895f-6a5401b2de53", "value": "836a63fc92781714c7c305653f8379ccbcfe34a87bbcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65ee7f4-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685829, "uuid": "7895cfb3-8872-4ed3-b167-77924e896f86", "comment": "Malware payload (Amadey)", "value": "250b5ef4caa8be0fad357003570d4a8d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685829, "uuid": "376973d9-afdd-4ab7-99ea-11069286d0cd", "comment": "Malware payload (Amadey)", "value": "8473a2406a6decb7e14be4462a3b8c735e6863e9207ca6e1f8a617d63d766d35", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685829, "uuid": "8812be28-36ec-4638-9c96-09c9cd9f0412", "comment": "Malware payload (Amadey)", "value": "5eebf2e740ff79a59ea84413894221afb3253008", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685829, "uuid": "4acebe7b-12af-4eb1-b38c-b30c71bbff77", "comment": "Malware payload (Amadey)", "value": "0a947eaedd03889f6b3115f20f0fbac329bfebd282fe21c0bbb6b94c8db409f9f78123224c14a1596de6f15e7d20f537", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685829, "uuid": "35cb8cd2-5498-4bd8-9cfb-0ce93d12d08f", "value": "T169D41212A7D45123C8FD3B7098F686930A36BCF19E78439B1B51986F5CB279090B63B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685829, "uuid": "f477c220-bf9c-45b1-9311-3e2dae79cd40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685829, "uuid": "30f89177-6028-4629-8b15-c028f8e3c2f7", "value": "12288:kMrHy90BOZrzdtAPoQgY8zgGuC8v8IgHGgPqjH8wM:7yrZjAz+uCjGgPl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685829, "uuid": "58517f32-12b8-43e8-9b4a-b3f069055fb7", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685829, "uuid": "2bbf92e8-e5e2-494b-aa77-42edfe9f4855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685829, "uuid": "67147bb6-6deb-4e56-985a-56e8a3df2854", "value": "250b5ef4caa8be0fad357003570d4a8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58de8543-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686504, "uuid": "852682c1-4d99-4f59-baab-d248ad4218ba", "comment": "Malware payload (Amadey)", "value": "5606cd96aa9eeb6f7a519c3e063d6bb8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686504, "uuid": "9454cf20-a7b0-4e75-aec7-a1f6252d318d", "comment": "Malware payload (Amadey)", "value": "861016fbe62be8c0a3dcc9a1764a59b126c657029485a0ef400fd732d798ad2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686504, "uuid": "d4e3a538-43e1-470b-a3e8-6ffaea67d7f6", "comment": "Malware payload (Amadey)", "value": "658c5de5d45b8dd0655cd0ecb51f698dd2192795", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686504, "uuid": "882c7cb1-234c-4a33-aa31-fbcd0b52a66b", "comment": "Malware payload (Amadey)", "value": "50b519c06e86c2c73f54533423b18b0fdb9a70199fc3836d7244153597dd7e34735b1b1fa0afcee075e72b91db3c5069", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686504, "uuid": "105b1ef3-36c2-4ace-af6d-dc7b4902e191", "value": "T12EB40257A7F94432E9B51B3029F603D30E3A7CA59C74926B23621C0B0DF36E49975B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686504, "uuid": "11a73712-9cca-4109-8f10-f529481edff9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686504, "uuid": "519365bd-80fa-4a23-a947-9ccac090886c", "value": "12288:aMr5y90x7siriQuVNRHdlpMoDxtXca7SJSS/F+j9PHw94:7yqsCuVnH7dzped+Rvwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686504, "uuid": "f581c7a7-57d2-4523-8bb5-96653288f3d5", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686504, "uuid": "00dbab4c-27c3-4e78-8cb9-d19d2c96a36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686504, "uuid": "9399c939-8968-4952-ab1a-95369e53e95e", "value": "861016fbe62be8c0a3dcc9a1764a59b126c657029485a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ecacfc-2e99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690694893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694893, "uuid": "3c413470-74c8-4eca-8532-9bc275113e40", "comment": "Malware payload (Amadey)", "value": "2a7f23232b8f044ea328836dc8ed8f04", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694893, "uuid": "75d69ccb-cc5a-4c21-8c07-1aa0a65c4be4", "comment": "Malware payload (Amadey)", "value": "866fd70c2c4ec5e9244a3b702ecbf2d0e388e020adbd263c422b13f3759eb884", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694893, "uuid": "cfc50870-059a-4d90-adf4-d37f0d46ae7e", "comment": "Malware payload (Amadey)", "value": "479ec262f874f2dcfefca2368858f798c26ac571", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694893, "uuid": "8e5aacde-5223-4878-a51f-44cf8d4cb950", "comment": "Malware payload (Amadey)", "value": "a3b5d8ee09e9542c10861b9cba08f7be29f78d09485d482282d9e1a82e441de66c6bd4bb3b93c23e6e9d7e7ff8aff31c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694893, "uuid": "0648398a-3198-4f8c-ad47-3afbaf93de59", "value": "T104B41206AAE98073D8B51BB064F606E31B36BC516CB5837F2714994F0DB2585F83A72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694893, "uuid": "eed243df-cbb0-4484-9a19-35e294ed9cce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694893, "uuid": "8ca0167d-efae-46a4-85fd-1e1c71639859", "value": "12288:mMrVy90cP8Ftx4z8tRvBVWhi1gBYCIivzV74s5:ryO4zcxBVWcuzNp740", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694893, "uuid": "97acd72f-2b02-4ebe-bf0f-b2b88b71f4fb", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694893, "uuid": "a5ab02e9-656a-4ffd-8fc7-1c76ac9207b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694893, "uuid": "85c52d68-5841-497c-bbf3-4b5924682474", "value": "2a7f23232b8f044ea328836dc8ed8f04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76c05ba-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686770, "uuid": "c6562279-7428-4f36-bccb-964585ea755e", "comment": "Malware payload (RedLineStealer)", "value": "98973331b69ad8617665b96116c6d516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686770, "uuid": "dece442e-3c1d-4b18-bcdd-5f2974b7b793", "comment": "Malware payload (RedLineStealer)", "value": "8707a3277b6408bdd4da798b17267a890c3a22e534c5fa8bc8e7a3814750bf1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686770, "uuid": "e1d2b5d6-e33c-4772-8bdf-c5a3b0d59bf7", "comment": "Malware payload (RedLineStealer)", "value": "cfb64519cd4f9ec1d6e8156cfadfb0c00a4d34ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686770, "uuid": "e86d5e13-1da7-4ded-935a-a7fd709f9c1f", "comment": "Malware payload (RedLineStealer)", "value": "5820f6d015fc034aebac1867f28f0b3e1a6ccb8a1228375c11d42788858f667623385f586e698485aac6e8bbcf0c489c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686770, "uuid": "1c008169-032c-4459-bb61-5df3d5ddccba", "value": "T1F3B41222A2E48432E9B527B01CF713930F357D726C7493A723999C5A5CB3AD4A57233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686770, "uuid": "ae87f423-b12a-4a5f-ad4f-03333be2e506", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686770, "uuid": "d37a35bb-b193-48a2-9c70-d0023b41de7e", "value": "12288:GMrly90RRKzoXCgcy0aM8qY3bqVp4CNmRmv6W7kh:LySRXqRa+YA6CV61h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686770, "uuid": "d2d30023-c6bb-45ce-9353-d06339759215", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686770, "uuid": "a182da9e-5c0e-4f6e-8b66-741b99157b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686770, "uuid": "8b2224d1-7192-4607-89c8-bdba9ffa69ee", "value": "8707a3277b6408bdd4da798b17267a890c3a22e534c5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942c9267-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695194, "uuid": "f163e18e-3408-4c4f-acbf-845ae1f1c4d7", "comment": "Malware payload (Amadey)", "value": "2b6c245db1871a1f01231a0edc782397", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695194, "uuid": "5961201d-c805-4959-bb9f-76747c41541b", "comment": "Malware payload (Amadey)", "value": "870ad87a52fe06b12d6d3e1811b39861ad4e32aae9c14a178aacdaa72eb3f1ce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695194, "uuid": "45131d7d-b830-4c73-bf2f-ea2aba2f9a2a", "comment": "Malware payload (Amadey)", "value": "8b15ed9202beb4f75e16dc473b5c4b2a0b926632", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695194, "uuid": "a52c0c3f-a8da-45ef-9270-e202cd028ea2", "comment": "Malware payload (Amadey)", "value": "74d95605f50f3d877118f0a15ec679024b2e4a69f66ba80a1c5949c618e262adfd26c1f1a741bfbd11dfc88d7445cf31", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695194, "uuid": "e14fb7ca-5eb8-4380-b7f6-e73906de4c5f", "value": "T103B40202EADC8027ECB92B7558F703830F317DA19C75932B27856D4B0D72B95A931B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695194, "uuid": "0630252e-712f-4536-8efc-3313217dac40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695194, "uuid": "8bbfdd0b-541a-44ea-8cc4-27ce8fa6432e", "value": "12288:wMrby90WbUi31eM3djC7nbxAxIvDSAQ9Dt6g/XYmn4:7y4aBC7nbZv2Z1/XYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695194, "uuid": "86efef4c-e367-4d06-975a-b2938b88aac0", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695194, "uuid": "f0ff9569-cbfd-4bea-a8d9-474cb99b8069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695194, "uuid": "91a55452-fd4b-407c-851b-9ffc7c1c422b", "value": "2b6c245db1871a1f01231a0edc782397.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef721772-2ea7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690700930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700930, "uuid": "c6f04e01-b65a-4685-8249-c28f88c3c05b", "comment": "Malware payload (RedLineStealer)", "value": "8f660d10191fa8d19263c5443e88f87e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700930, "uuid": "6a04e3c1-2994-4efb-9525-95d3fa7f8fe5", "comment": "Malware payload (RedLineStealer)", "value": "883dac9b806067bd4715ce5eba1c902b268d3ca86a5bdb0238e56635ac9861f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700930, "uuid": "682c0346-21fb-4880-ba14-90a770ff075f", "comment": "Malware payload (RedLineStealer)", "value": "046faa43b54409d781767ac048b9f48b825561a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700930, "uuid": "66bd97fb-5ee6-416e-a054-3e83965ba77e", "comment": "Malware payload (RedLineStealer)", "value": "9bda9f6973623232cea72173bee5af847e83cfeaff626ada73bc963daa0eb90cc3ddb9c4b87727b315ec73ff5cc7c056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700930, "uuid": "bcaa0658-7e98-4420-9344-e0e6b7e384e8", "value": "T18BB40253A7D85173D4B52B7068FB02CB1E357C919E348BAB2391695A4C723D4FA3232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700930, "uuid": "5d75dd34-b95a-467b-bea4-57f7979202a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700930, "uuid": "57be406c-2cd5-43c6-8a0f-ec8f62b757a9", "value": "12288:HMrRy90f2POIgZWmEgt3R+3IKigBYCaqN3Od:Kym8nUWmEgtBYLRzzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690700930, "uuid": "70e72ac9-9e58-4f00-8dbd-51466a5a9fe4", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690700930, "uuid": "fcc229b1-b5bc-4e01-b7c1-f1fad540fa02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700930, "uuid": "efd331bc-387f-41eb-890c-9e1b703ec111", "value": "8f660d10191fa8d19263c5443e88f87e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0714ab5-2ec6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690714112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690714112, "uuid": "e264859d-ed88-49b4-9f96-5f04d773d648", "comment": "Malware payload", "value": "d89c574b4afdaadfd345177dd8f5c177", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690714112, "uuid": "e350338d-803b-402b-a25b-b9657e765ab5", "comment": "Malware payload", "value": "888d65beb655ddb6be11304c0d39a5582be8afe4491c4ad01e8d8b2560fde551", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690714112, "uuid": "ee0aed20-9ee0-40cc-91d3-bb44fa670375", "comment": "Malware payload", "value": "b71bb2b208e77351d38d43c654292dbc59beb7ae", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690714112, "uuid": "365c6b25-e4ad-4fca-b554-552afbff709d", "comment": "Malware payload", "value": "a38c76a899ae66dfbdb27d8c8dd280fd7edb13869491155af3de967a06a1412e766709af77aa8cc04d260475a8f23e69", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690714112, "uuid": "08955f69-2aab-48d5-b53d-959244476bf9", "value": "T1C4C296817F71F88558E8D0F98305150A3BBF2AAEE613F68FE9D1950A41651F11A1BFC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690714112, "uuid": "8a8c6ff9-f8d6-4051-a4d2-cd486e5de86e", "value": "192:cys0iL7rP42QaCpDjqbsO1mZG26IQRWnBqMD6nXTBU:Ls0UHP42QrJhG26enBOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690714112, "uuid": "478c58e9-551c-42ce-8c06-aae708d308f5", "value": 26355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690714112, "uuid": "35c95c5a-a5a8-49e1-94e1-f683159ed046", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690714112, "uuid": "98cfc4da-0528-4b43-9580-7f952305b3ae", "value": "lnvoice-1937478797.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708729de-2eab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690702435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702435, "uuid": "d3b58b44-415e-4d8b-9366-de8c5eaf5e8e", "comment": "Malware payload (Amadey)", "value": "3017bddbbf1547bc27a45675b85dafb5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702435, "uuid": "cfa70a70-c70f-47e2-8eba-4baa75d1eeb2", "comment": "Malware payload (Amadey)", "value": "891b378643685b406333ae495f1a64a123c8f2c68e40e577890a8df81fcfddcb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702435, "uuid": "d434b441-077d-4651-b543-67a231ae87a4", "comment": "Malware payload (Amadey)", "value": "60b21a981776cb5b963fd55ac436c65d6a36e7be", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702435, "uuid": "6a815bfc-1def-44c4-a440-2f8896cff042", "comment": "Malware payload (Amadey)", "value": "bfcab63c8a804e3a5c9090ba5b3706e1d43eb43c495d9a5e19b51a2fe127af5ffb798db5a7ec301245b6e47f2cfd4d1a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702435, "uuid": "37378f9c-3b49-4323-a227-724b145dda51", "value": "T178B41211A7EC8173EDB5577018F602831B32BD729971827F2B8A592E0D336D4A536B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702435, "uuid": "47a17b90-ffc2-430d-908c-86b1592d2eab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702435, "uuid": "ca361bc3-4e73-4f43-8782-89e2a49ce540", "value": "12288:SMr5y9074KiDuKX2B4EsDIX1IYTYQIM9C6YS:LyEAUBcDpYTYQIMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690702435, "uuid": "17a684d2-4a2e-4d84-93e8-fdbe3c675f92", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690702435, "uuid": "1b42e6ae-3e54-4b32-8172-ad458d96e9e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702435, "uuid": "741c1b27-3895-450e-acbf-edea96b49ab7", "value": "3017bddbbf1547bc27a45675b85dafb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e322c155-2f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690750302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750302, "uuid": "b30bab1d-a085-4d6d-9e6b-47eec8de9de5", "comment": "Malware payload", "value": "4bb12f4544cae3bd757015e45e37f010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750302, "uuid": "1c014f57-4e0a-4a8a-bdc7-b336e78acdf2", "comment": "Malware payload", "value": "8948b34d471db1e334e6caa00492bd11a60d0ec378933386b0cb7bc1b971c102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750302, "uuid": "2e636313-fc01-4fac-814d-d04b90426067", "comment": "Malware payload", "value": "962d1f0f298820be8acf91c2f7df7f4501a09ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750302, "uuid": "69bbfce1-d768-485f-94bb-f10796f705f1", "comment": "Malware payload", "value": "770f05e37bf5ddf6e3e53c52db5821f64192b292940b881c5d9c5a9b61019ee47847e91c11d514a343cc109b94834cf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750302, "uuid": "a96dcfa7-3dcf-404b-be33-c8cd23cd1b6b", "value": "T147F23B487FE4832ACAFE2BF529F2651512B4D503EA13D75E18D8459A6F37BC08D013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750302, "uuid": "fa12344a-ed45-4c83-a380-fa30b04837f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750302, "uuid": "1f516564-131b-4811-af58-6c140fbdeacd", "value": "768:L4fK1pDGkptwyZScCBSUapNgq1/U/fZl+BcgxeAlTF59iUUjO9hESURK:jDGkptwyZScCkU4rpUXZcB5xeQF59i3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690750302, "uuid": "e642b598-a5cb-4be7-81cc-d688867c27d4", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690750302, "uuid": "48da252c-cb2c-4be9-883d-a897f6cee41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750302, "uuid": "a1b853e4-2ec1-4e49-8c4e-a5699c11de93", "value": "xwormnostart.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef76d05-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686810, "uuid": "302112fa-f880-4935-bdff-6e910e8c0f5c", "comment": "Malware payload (RedLineStealer)", "value": "bd5822e89cb9558088ca8e1a71568e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686810, "uuid": "b7332b7c-5bc6-4945-b6cf-9a752fa7984b", "comment": "Malware payload (RedLineStealer)", "value": "8a2030ab42311f4aba39b4d236c1f73b9ed7a0c93de9d483f4b6426f066d0015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686810, "uuid": "bbc5b4e8-3984-48d0-ad09-163d907eb032", "comment": "Malware payload (RedLineStealer)", "value": "5b6856814087bad3a9f809ed608b17d8bb66f7a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686810, "uuid": "ca4137de-15fa-4e6a-84bf-9a4d631f5d82", "comment": "Malware payload (RedLineStealer)", "value": "53e0876d89efeb9551e05ed8133de28f4e6ac4cf0738a5cba0256102ffc0d5e06656030a7e6c870a277bbffa4a89a0f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686810, "uuid": "2254b366-fbe1-4f2e-9fff-dfbf59ae7854", "value": "T1F5B41252FBD88131D9B917709EF703C30A31BCA1AD348A6B378199095DB26D0A97773B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686810, "uuid": "17ec10e3-8384-413d-a158-0070ebedaba7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686810, "uuid": "d3dd3602-fbd9-4817-a280-d2c46b02c94f", "value": "12288:EMrvy90YSFEENQZuT0SjD/qdHuC0Pe+aQC8dHioM:TyFCuZuYSjDidkePMHid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686810, "uuid": "f29bf295-3651-4a9b-8923-254f745e620c", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686810, "uuid": "c22bceae-5590-4877-b996-482eb9bc5891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686810, "uuid": "85ceda86-8ec3-4c87-acf9-235de0491dee", "value": "8a2030ab42311f4aba39b4d236c1f73b9ed7a0c93de9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2733b4-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686508, "uuid": "fb14238c-3398-4cec-88cc-acf325b8372f", "comment": "Malware payload (RedLineStealer)", "value": "5cd4923d4c47b809a8d6cbef283e3302", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686508, "uuid": "0f30d5c8-e17a-4096-9cb8-e8ce3b737de6", "comment": "Malware payload (RedLineStealer)", "value": "8d466a3a5837f1ae5ebdfa1e95cc8738c30aae9fbf1f20107a7d306cb5cb6043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686508, "uuid": "238ec3cd-7da1-4c58-a354-289948eb11f8", "comment": "Malware payload (RedLineStealer)", "value": "c22382826f3646b12555e020692716472d307aab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686508, "uuid": "e9ccd722-8798-4b7a-9c7d-2299ec5e39fa", "comment": "Malware payload (RedLineStealer)", "value": "2dccc634d379a77cd5ad3aea0ebb5405307787884fe1955965cabcb4114fcbf99163ea934d4dbfe3acd631c675a3dae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686508, "uuid": "3e52edb6-f645-4d35-9ee0-0068b6f320a0", "value": "T17FB41242AADD4452D5752B3058F74AC30B3A7CA29C78973F3389A94A0DB36C1B47277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686508, "uuid": "a51a77e7-37b1-4be5-b3e9-f1502d1695bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686508, "uuid": "2a9179f3-73fb-4922-b646-8425ee7da9ce", "value": "12288:MMrey90dxJ2eaX3WoruCDrvP3TYDAR2mvjpbRgBYCRFMBoHPjGoR:aya2eaX3VjrYD8Dtb6zYiLGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686508, "uuid": "84f20347-4421-4e69-b8c3-f91308f1e3bf", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686508, "uuid": "0e90e0ac-f94c-4533-b3e8-b9d417da81df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686508, "uuid": "937598be-f65e-4d14-977a-1819c7e9346b", "value": "8d466a3a5837f1ae5ebdfa1e95cc8738c30aae9fbf1f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869bd2da-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686151, "uuid": "f6721aaa-fdb9-4082-a277-813485e9145c", "comment": "Malware payload (RedLineStealer)", "value": "d41f1c7e31301333d4566921fa2e746c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686151, "uuid": "007e726c-6715-49c6-b90a-02ca4b61bb35", "comment": "Malware payload (RedLineStealer)", "value": "8db6f544940545b4e7f0eef92bc68e65f5e9efd3707f33b7e5594777d56ed71f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686151, "uuid": "12e6d489-60e8-41c1-855b-5651ed449525", "comment": "Malware payload (RedLineStealer)", "value": "96f01a64517b81d61603d8d63d0a541c46989f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686151, "uuid": "e43c2320-93c0-4b99-b4d0-6fe24005d4a7", "comment": "Malware payload (RedLineStealer)", "value": "17cb559162435ece44270509cdfb82bb3d460eec442d1569626469268f0189893aa38a4ceb199039e0207d9bb3f63bd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686151, "uuid": "72fb28af-9885-4bc2-a726-060b978b0caf", "value": "T1AFB41213B2E68133D8B617B08CFB03C30B3ABDA25D74866B2794D95E1C72D90A472767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686151, "uuid": "3ad60b39-dac9-492e-af35-c25da6ce81cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686151, "uuid": "9920ace4-8ad8-4bfc-bdc8-fb1879cc14a6", "value": "12288:WMrPy90Mk+nx9EIMXo6ST4w8kur2PMHtpq01YsEc:Zy/vvDMXo34w812P6ash", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686151, "uuid": "8a0b9e4c-ec8c-44ed-9149-303f395d1178", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686151, "uuid": "8e2fb291-11d2-4373-ac3d-3db0c0ba0776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686151, "uuid": "2e961a5b-4bc6-4dd5-ac2f-bd43015a7d64", "value": "d41f1c7e31301333d4566921fa2e746c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1fa660-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686778, "uuid": "7ed5c37e-9c68-474c-acbc-ce3cae461f42", "comment": "Malware payload (RedLineStealer)", "value": "aa4b3907f8b47bb268b0bebd2c0e8a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686778, "uuid": "9eaf12fb-b126-4ba6-b423-38e796830ee2", "comment": "Malware payload (RedLineStealer)", "value": "8dd611ec5263e25db245b0262d769a783a8ab1d0b3220afcd8f6e9abc7923884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686778, "uuid": "082750e4-6083-447c-a265-fcdb845505a7", "comment": "Malware payload (RedLineStealer)", "value": "4946e334a3c893fdb7932f92643dd0eee00565b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686778, "uuid": "4dcae2d9-d04e-4146-bd3b-51d9ac51f11c", "comment": "Malware payload (RedLineStealer)", "value": "0417f90ef0b073f69d62fcd262a3c0948e4d718296c72525255f0a4a8674feb546c3a014e8e8a26da27ec83dbc21bef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686778, "uuid": "b5b00fcb-40bf-4da9-9b78-aa3956dd0e5b", "value": "T1E8B41212A7E88573D9B423F058F612C30E3ABCA15D74929B3395692B1DB36C4A93533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686778, "uuid": "044e6211-7f11-4734-b283-ba3a8a64c80e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686778, "uuid": "ba89401b-37c1-4448-8b55-9fe215edf3e8", "value": "12288:wMrLy90v1aexMkAdfwtOXoQta0/q+ib0IpcwY:ry+Xmkq/XoIdyLnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686778, "uuid": "41ccfa0c-a879-42f0-94b9-11bbe61033c0", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686778, "uuid": "c404aedf-a425-4435-ba9a-b61bbae269c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686778, "uuid": "308ac85d-3a65-4f44-ae4d-66e9db5a59a6", "value": "8dd611ec5263e25db245b0262d769a783a8ab1d0b3220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530079a9-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686494, "uuid": "6e6b8ab0-c6d0-4994-b48e-a29594be0e62", "comment": "Malware payload (RedLineStealer)", "value": "1ce3f5dc50db79e6de6740bcad1d360b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686494, "uuid": "f1321d83-d7d0-4185-a8d7-1cd9bcc8f46b", "comment": "Malware payload (RedLineStealer)", "value": "8df07dd0e87ead050dda2e82488c4c9fb14a7efe990e4bb5d10cde9b2742b3c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686494, "uuid": "9f419035-b890-4720-9a6e-b5945cd977f6", "comment": "Malware payload (RedLineStealer)", "value": "eaeddbe3888534af22b525c50df63d938fdc2164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686494, "uuid": "7d2e64d4-70b5-4772-9eba-20aedeacd127", "comment": "Malware payload (RedLineStealer)", "value": "5e2d81c9d5ca633702f3d22c853764c1512d6faf898cc371c12d2d9cd93210b973df51cd644e8fd4d5320703944dce50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686494, "uuid": "ad61a51b-c031-42f6-9338-aa61ff5f6f49", "value": "T104B41202EBE85172D6752BB458FA03C31F3A7D719AB4437B27859D4A0DB3184A83772B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686494, "uuid": "4e0b2f88-0b9b-494c-b08c-5917f60e0c83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686494, "uuid": "f0e651d8-7bc8-40ab-a868-89269b67abba", "value": "12288:MMrHy90TOv7xizt8O43mW6cWZuLI/fWE8P9kE:Ty+Ov7Izt8jNI2p9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686494, "uuid": "305b7eff-855a-45ed-bc3c-c6b639f4edbf", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686494, "uuid": "b45cc1cb-ee5b-4ada-857d-fad3f7e44b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686494, "uuid": "e59d9c0c-08e3-4e94-96a8-5c60579219d0", "value": "8df07dd0e87ead050dda2e82488c4c9fb14a7efe990e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e476e89-2f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690741891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741891, "uuid": "064ca241-26f9-487f-9804-29e0deb2bb9b", "comment": "Malware payload (Mirai)", "value": "2200173ba9e34feaae805777fb1c4f1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741891, "uuid": "55a54500-13ba-41df-b848-ca6f8bb417f4", "comment": "Malware payload (Mirai)", "value": "8ea1331dbdcf3e9cf7446fde049dad87d3848b3a8fb6a45b3f95787a83fb5a36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741891, "uuid": "c461cf7a-2c5e-42e7-883f-083bf831279d", "comment": "Malware payload (Mirai)", "value": "ac7889c1dbe9013f541cf7dc3eec769273cfd3e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741891, "uuid": "1b879700-672e-48f8-a7e4-9ae65cc614ff", "comment": "Malware payload (Mirai)", "value": "28c54184be2f32da994816dc66fc0866acfe20e9dcd7d32217832326791b01e1f635312021d1cf9def70574696d63585", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741891, "uuid": "3379baa7-d29f-43b3-a8b5-00d9554c576b", "value": "T16F430795B8819A13C5D423BBFB6E418D332563FCE2DE3207DD212F11768A81F0EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741891, "uuid": "99c5d311-9b87-49c1-92ab-e3aab61868b0", "value": "1536:EZdwF9GgUsriS3Yl3Gihdt5dp488fYFIS2t:EZdwcZtDbd2YFWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690741891, "uuid": "27ec109c-2710-4107-9622-ca1bad01617a", "value": 55248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690741891, "uuid": "248a2b9c-6874-4a0e-a1f6-f539ab07b015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741891, "uuid": "85a90254-bfee-47fe-adb7-08452f681b8b", "value": "2200173ba9e34feaae805777fb1c4f1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8e9d2f-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695206, "uuid": "4146960b-8b4f-46bd-b649-50c8972c0c17", "comment": "Malware payload (RedLineStealer)", "value": "75163827aaf19d30fec88dc7f0b031da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695206, "uuid": "bf953fa0-a6a9-4cce-bb79-c47f359df17f", "comment": "Malware payload (RedLineStealer)", "value": "90237c5abc5c787df74113c421126717ab424470f4e65b756e909ec7c27e47c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695206, "uuid": "67b9115b-eca7-4e80-9dda-83540aaa7099", "comment": "Malware payload (RedLineStealer)", "value": "abc1b443ea768fa0a24eef4312642ae83144fd57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695206, "uuid": "de9bb420-5157-4bd9-9252-e5ecc91f7737", "comment": "Malware payload (RedLineStealer)", "value": "988bb647912afb04db599f519fe6b8ef79f2f33d9eddabc827976b495300767f45b4ac18d61c08259d436202b0dbaf42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695206, "uuid": "67ab7029-d3f7-4522-88a1-34373aa35d44", "value": "T1CBB41213A3EC4032D9F92BB0A9F517C30B39FC915968432F6786E96A4DB2191B432777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695206, "uuid": "4e9225ba-80a0-4ecb-ab94-f005b256e622", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695206, "uuid": "9adb541c-2028-41a3-a449-30900cdc0b52", "value": "6144:KKy+bnr+Tp0yN90QErqyJ3Bjav1PIlKbwxgEQub+xZK2Cc36uwQgfau3DJh:WMrry905lBm9PIlaU+K2CU6uwlT3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695206, "uuid": "731d1201-fa1c-48f8-8a1e-5ac153c24191", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695206, "uuid": "587da4a7-3645-4219-b7e5-1a7dd6ea948e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695206, "uuid": "72f5e0fa-ae15-45b7-9f7a-a416aa84fb9b", "value": "75163827aaf19d30fec88dc7f0b031da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5893f03-2ea1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690698229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698229, "uuid": "12439ef0-6e42-4863-a3a1-de109f418777", "comment": "Malware payload (RedLineStealer)", "value": "6bb8a757f1d4ee9d20da4dbf748259cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698229, "uuid": "27d0c810-e94a-4aa9-8b3e-157c083a89ca", "comment": "Malware payload (RedLineStealer)", "value": "9024ff62a926fdff5dc4d832f8245978b37fba183a11fd1814336f538507ab4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698229, "uuid": "c9b42282-f3c5-4329-a388-51c36671c694", "comment": "Malware payload (RedLineStealer)", "value": "293061d46d1c344d42fcedb16ad213956367e312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698229, "uuid": "a4f71c71-d07b-4c6c-bfa8-3325432f9dff", "comment": "Malware payload (RedLineStealer)", "value": "b56b1af5a0644311190293d33d891681136edf202108fa1b963548ab1d210ca3298d9f4178d96f00657fb8a662180291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698229, "uuid": "c313a0c0-8661-45c9-8566-4c4ae22369be", "value": "T1ABB40213E3EC5433D8B9277028FB13931F3A7CA19DB4935A2655A80B1CB26C4A936777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698229, "uuid": "398aec70-2fd4-465e-a58f-e2124e17567e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698229, "uuid": "6190d7b6-3277-4c1f-9d2a-317f51a673a9", "value": "12288:RMrhy90FvDBlpm72LD6TPlNKWpZVnvi/3eo1:0ychY2Le7lnvi/uo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690698229, "uuid": "44e0535a-a3bb-4c25-8e6b-2ef74b607882", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690698229, "uuid": "b9ff220d-1021-406a-9d6f-744a3309f0aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698229, "uuid": "e52271bc-53b1-4c06-b89e-e844eca751cb", "value": "6bb8a757f1d4ee9d20da4dbf748259cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6684ad-2e7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690681301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681301, "uuid": "6894f148-40bf-4b2d-97b7-8f5b9c0a8dfc", "comment": "Malware payload (RedLineStealer)", "value": "38e56b7408766f0064324d650f8d0941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681301, "uuid": "0160aaa9-293a-424a-9ffd-b1dcbd805dfd", "comment": "Malware payload (RedLineStealer)", "value": "91354165acf41c6c5a94f7ddccd9314ae3f4742d43702f7db7c879103a532b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681301, "uuid": "53af98a8-a1b9-4b8d-a533-f90a8bdfe1a7", "comment": "Malware payload (RedLineStealer)", "value": "d241f83f3d165890964522999c860da676826bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681301, "uuid": "3a52dc3f-f67e-4f29-9867-879cb6578aa9", "comment": "Malware payload (RedLineStealer)", "value": "26f35be77dbbf24fb06533e08a55d8d41f817b081b8a8dacade8c956e5ea277b8cf49728510bbf84ff43269f075c8a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681301, "uuid": "0689c778-2c12-4f8e-a840-4a26252444b0", "value": "T1D574F247BBE49033D8F51B7068F603D70B35BDA18D38436B2795A88A0DB3688953677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681301, "uuid": "53fd7fa8-5c19-4c7f-859d-476b62ec0ebb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681301, "uuid": "8136044c-67d2-4465-8111-96df1f7886b7", "value": "6144:Kcy+bnr+up0yN90QERG069bCWoXbYpEzQSPDvRvmiQhBnm3GEFhrMD:gMrWy90Xg+Wz6LxSreGchrMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690681301, "uuid": "8b184b0e-ee3a-4acb-87e7-661fc6ac3103", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690681301, "uuid": "01f1386c-8a75-4fca-ab86-489adcb8c808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681301, "uuid": "1cbf70b9-79d4-4ded-a7d1-627e4f4f4270", "value": "38e56b7408766f0064324d650f8d0941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410414a8-2ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690709657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709657, "uuid": "1e433231-e955-4118-9302-7343d404f7b0", "comment": "Malware payload (RedLineStealer)", "value": "7e72749e19b9f157215addfe1da32173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709657, "uuid": "bfcaf09d-b610-4b83-abde-d2a42544d373", "comment": "Malware payload (RedLineStealer)", "value": "922d06e7f43eb2c6ac8e567786c75d7be2e932ce65a224330aaa7b3613a3b7b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709657, "uuid": "fbc8323e-4e68-489a-8639-b486b419f365", "comment": "Malware payload (RedLineStealer)", "value": "77e6eb06a8cad110ed299b36e4a29685ea035c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709657, "uuid": "71c1aa88-5374-4a31-86f9-cada56990c9c", "comment": "Malware payload (RedLineStealer)", "value": "d27ce206d1b59430fbe1595860d70b80115f46737495a8ec15a32647f02343f9803949e4b613816cae05bef68da2824f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709657, "uuid": "c77d3c76-c878-4f34-9e7c-b15ccad9a2be", "value": "T1F3B41222A6E88073DDB51BB018F707D30B3ABD619974836B3691586B1C727C8E53637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709657, "uuid": "7363d388-581c-4610-a664-34bad6f64396", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709657, "uuid": "26e07a6e-6a59-4f3d-ba7d-077f8d7990cf", "value": "12288:OMrNy90DgWOXxH1EutGI4i4yijXoizqv1vygSOwcYRgBYC0i52B6N:zysgWOBHe9Piij4iGtvZS/cY6zH1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709657, "uuid": "912e557e-a228-4a2a-a521-097ec667dbc4", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709657, "uuid": "f953b7bf-e735-4cfa-8bcc-ad525fb30bd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709657, "uuid": "27894a43-fd94-49c7-b04c-ee1a0c11a347", "value": "922d06e7f43eb2c6ac8e567786c75d7be2e932ce65a22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10295039-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686812, "uuid": "2e0540b0-ef56-4dd2-aced-0161233eb363", "comment": "Malware payload (RedLineStealer)", "value": "e365b34be8db5f7dd6929b79aced3b53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686812, "uuid": "388ca2d2-8b50-4fc1-b02f-22368d7166ce", "comment": "Malware payload (RedLineStealer)", "value": "9293b5e8d9afdd88412f839ce7c73a6ebac1695a54c1e4d9b484252e7366ca70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686812, "uuid": "22853db9-f8ff-443d-8752-b55a6e352680", "comment": "Malware payload (RedLineStealer)", "value": "633550a243352675f644b1e868b0c83250df6bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686812, "uuid": "cd878198-a108-4811-91c5-46281b3e5f2c", "comment": "Malware payload (RedLineStealer)", "value": "0832fd85ddb54619844282a6684611b7450a961e51d28bbe0107878671568cebddfb15ce4e7cdf7429c7d67a2f749ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686812, "uuid": "0601642c-6412-4779-8fdc-7844071746d5", "value": "T1B1B41213BBE89573DDB5137068F703931B32BDA11D78837B2216989A0CB36C4A57236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686812, "uuid": "4da7ca0e-1c3e-4962-a679-fac7b0157340", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686812, "uuid": "2c5f65e1-4ae4-41ea-829e-02bf5fdda6c4", "value": "12288:eMrLy90pREzvswBCiNKWKOIGeApdx/yWtCRCEEg:dyqEz0UHKW5I6Tx6Wttg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686812, "uuid": "65e48865-e11f-4d0b-9ada-a0812caabb7e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686812, "uuid": "961c9895-4efb-403b-bf6b-83a3f7f683d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686812, "uuid": "78fd8655-b839-474b-89fc-cdcec5ab2175", "value": "9293b5e8d9afdd88412f839ce7c73a6ebac1695a54c1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48576690-2e8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690689483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689483, "uuid": "2843e2bb-12dc-4e1d-a2c4-0b022305a16e", "comment": "Malware payload (RedLineStealer)", "value": "1c34dd856bc4296f80ff49d2c685d276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689483, "uuid": "86273a53-c874-41ab-8d39-91c1711cdfb7", "comment": "Malware payload (RedLineStealer)", "value": "93a0c5a905ddeae1a79149728ae22bba16364a94f045e584c8711cc4f11dc73b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689483, "uuid": "5200eae7-39a7-45d4-a1f6-eb0d9c11378d", "comment": "Malware payload (RedLineStealer)", "value": "62a1dafbdd8fe90040d38c3ceb1b5d35ac5ca87d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689483, "uuid": "e665a63e-9a70-4997-bf31-aab6c0587990", "comment": "Malware payload (RedLineStealer)", "value": "24d95a172d1864735f19469a70323b802419c2dd5c069927722ff237bbe30cc679d2684d93c49a8221e8013614424e8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689483, "uuid": "c6f73da3-d9bd-467a-8db8-d76f295201de", "value": "T135F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689483, "uuid": "5df1a1a3-72f9-45df-9b68-9b2b0b7ffc65", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690689483, "uuid": "53a7dada-055d-40da-98f6-00c58bd82484", "value": 37412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690689483, "uuid": "33fe3097-ee45-4b60-83e7-d20f321c257d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689483, "uuid": "2d0a14ee-ad48-4b55-a064-c64975373edc", "value": "1c34dd856bc4296f80ff49d2c685d276.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67a428c-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690687064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687064, "uuid": "a230ff62-d4fa-4c9a-bca5-5542182901a1", "comment": "Malware payload (RedLineStealer)", "value": "f7981751c8dbaa6ba49467b2878d5a65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687064, "uuid": "63d80837-abcf-4878-aa59-87f1df03ce51", "comment": "Malware payload (RedLineStealer)", "value": "947d24044cb646f0dcb36b726a5841608b5e8967b9102a3a2a48eb82b23b57d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687064, "uuid": "82ff08f8-d8fb-4452-8209-a147e8ebb7fe", "comment": "Malware payload (RedLineStealer)", "value": "a3e62a8e161c08a265d2dc9fdc277b43abfb8bcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687064, "uuid": "0b9a4019-6c27-4053-ac06-bb50ce0cba6b", "comment": "Malware payload (RedLineStealer)", "value": "3800ff40111cb1cf23bc6e1994e8cd95a22ad0087e6124d18ecfd55597f1f816be23ff318f82d410129898b1418d40d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687064, "uuid": "e5fb6330-db89-45f5-95ec-fc0975cf8e3b", "value": "T1EEB41213FAE89177EDB127702CF307931A35BD514D7893662789AC5B4872BC4663232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687064, "uuid": "cf164352-bb4c-4f69-b4fe-36a63ddac4b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687064, "uuid": "b62ac263-e132-4394-9adb-82f6f1429a00", "value": "12288:gMr/y908ZjSuzhWhwf/mjISuWApdZ/RgIxsSRNt6c:PyltcGfujvqTZpgIiSRNtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690687064, "uuid": "2ed9db07-d9a4-4424-9ec8-40b6fd732431", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690687064, "uuid": "30f22719-b321-43fc-8482-c6e544e2c576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687064, "uuid": "58b38e1c-04fc-4349-8078-4aaeff6093d3", "value": "947d24044cb646f0dcb36b726a5841608b5e8967b9102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac333bf-2ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690700036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700036, "uuid": "b1eb87df-e2e0-4ff2-8c96-97c452d23a1e", "comment": "Malware payload (Smoke Loader)", "value": "a39324cc51cb62024967cb57be39e96e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700036, "uuid": "eca0629b-bd2f-46fe-a106-e7b08e4422f7", "comment": "Malware payload (Smoke Loader)", "value": "948970eea0432cceae3189e7e1fd252d4f011912e87df95ab44a032f10941405", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700036, "uuid": "fe2787b5-82e6-48b3-ad7c-af86a42baf7f", "comment": "Malware payload (Smoke Loader)", "value": "33e49ef624247ec252d8ad40cbdd1ec3fb60bd31", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700036, "uuid": "305cc419-991e-4686-a82f-6d074f933824", "comment": "Malware payload (Smoke Loader)", "value": "e1f5f1d3d4b487bf00fbe7592527bc05e4e2d05a40ab4dc73d94bb3d3b2860adc289bb0115bbc45b514b6ddd9b0d147b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700036, "uuid": "a2c07ab1-2426-403f-a8ec-4c301021607f", "value": "T17F74D64382A13D45ED258B728F2FCBF87A0DF6608F5E3B7531199A5F01B20B6D16361A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700036, "uuid": "60403508-8822-46e1-af56-86ba45c69e15", "value": "edaf10ad64d79e0c6c6b14314dd614aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700036, "uuid": "65d752c3-de0f-4af5-9272-320f0966c0f4", "value": "3072:q2qHKk1LWZQc+P72tJptsxv795eGADy02509L0SctbV:3qqk1LWuc472T3KJ5tADy0794h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690700036, "uuid": "51331029-6722-43bd-8350-af4159c327a8", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690700036, "uuid": "9019ca7f-1374-442f-a628-028ad8fe8b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700036, "uuid": "54d16eda-5735-42af-a327-e37639c59c82", "value": "a39324cc51cb62024967cb57be39e96e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47eb205-2ea1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690698227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698227, "uuid": "1a289a7d-d9c9-4d00-a4d2-ee9b7b40dce5", "comment": "Malware payload (RedLineStealer)", "value": "ff169816b14910f372cf7d178f91b077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698227, "uuid": "556de655-dc03-4683-a0b9-3f691a2db061", "comment": "Malware payload (RedLineStealer)", "value": "94c38b66aca4af58a255fb5998aba4a640b03f10b5143db6194ff7d64bdfd524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698227, "uuid": "fd4dff8e-1c11-4694-a5d3-0048911e4a68", "comment": "Malware payload (RedLineStealer)", "value": "07c6789cdaefbff3dbb6b60dc21e999f414bb591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698227, "uuid": "d1548a2e-ae27-4d34-9dcd-64fb328321b8", "comment": "Malware payload (RedLineStealer)", "value": "45e66fce56d045d2e91ba43484e46b1de66012e0409dd88883899512f6ca32a691082e5ed1ab5e705fc63b888d8162bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698227, "uuid": "e9f16269-232f-4062-86a6-0942482790e2", "value": "T16AB41202B7E59137DABA1B7809F642830B36BCB54D3997A62745AD5B0DB32C0593133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698227, "uuid": "83adc9b7-08a7-4ddc-b21b-2d5cd95a0e53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698227, "uuid": "eb1181b0-e26e-4ebf-b2f4-8784b18badb3", "value": "12288:QMrPy90+kzUNRC4EbpKWEDK8t1SiTVAs22PsMv:PyLqUQ1KsuBhAj2P1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690698227, "uuid": "fd8737e2-d71c-489d-bdd2-198b05a95aff", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690698227, "uuid": "9c3e4dd2-1c41-404f-8aa2-c261a6d41ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698227, "uuid": "de9805c9-d486-4eae-b55f-a0442699fa6c", "value": "ff169816b14910f372cf7d178f91b077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14db3ac1-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686820, "uuid": "a4d20c4f-2d40-41a7-aebf-43cf9096d164", "comment": "Malware payload (RedLineStealer)", "value": "f56bc07e6f3c4025f34fcb245c27d094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686820, "uuid": "ae0a4c07-632f-404f-a8a2-c6f3795118e8", "comment": "Malware payload (RedLineStealer)", "value": "9501207a4ad5c1ef19f8f0cde9f583b46409b0c1828cf7f797e13deb44439844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686820, "uuid": "81cea900-881c-4adc-8c68-910dfb739407", "comment": "Malware payload (RedLineStealer)", "value": "4480adc108f0c24860013d18c6cae702a75f4b48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686820, "uuid": "4fe1935c-6755-4dcb-b76f-5fecbf166c79", "comment": "Malware payload (RedLineStealer)", "value": "d0ea95e877274a978ded75687504fb6da3d24357744fc91bfe6cd20db72fb063c19a3fcab3d6d986b42a7d37449f02b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686820, "uuid": "1eb1609c-215b-4acb-b7ce-4b7d3799f9c3", "value": "T1DDB41253B7D9D033D9B427B028FA12C30E36BCA18D79839B278AA84F4C7259455B177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686820, "uuid": "96bd9cfd-3d91-48cf-ab38-7cdd10d884a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686820, "uuid": "6a92fdc0-d6dc-4739-ab25-1d94c2cc6dcc", "value": "12288:7MrYy90uSM+gr9GliEP+ez8zrfQMrhqav71A:DyfAgBG/TzKr4uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686820, "uuid": "8659f861-06c5-46d6-a5ff-4c61f7537b6e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686820, "uuid": "b3b96816-136e-4b58-972d-ae15c1c60dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686820, "uuid": "b59f5372-1f23-40b1-9bb9-70927f3e2faf", "value": "9501207a4ad5c1ef19f8f0cde9f583b46409b0c1828cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9abeacd-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685834, "uuid": "9ec4734e-a0e4-4a77-95f5-2c8fb18b2cc9", "comment": "Malware payload (RedLineStealer)", "value": "419d14175c8905cfa737630b4deb96f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685834, "uuid": "eedda821-2e22-4fe9-9927-2078c4e1b770", "comment": "Malware payload (RedLineStealer)", "value": "95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685834, "uuid": "36337476-9e7b-4ee6-85a7-c1c0d2a7116a", "comment": "Malware payload (RedLineStealer)", "value": "83efd9b8305b7c9a246c2735ba22c1011b67a718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685834, "uuid": "2e72d250-b594-4a3a-a490-70226c7ee06d", "comment": "Malware payload (RedLineStealer)", "value": "f5537400940cfa017d99f33efcf5d550be3b4589f58b024d2756cf4060cb25855203471c7337232f1f6c72050afe5b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685834, "uuid": "03aadb63-4333-4abf-96fa-5d6ea62e8f4d", "value": "T100B40207A7D88463DDB22B705CFB03D30A36FC626D74936B1752546B09B3A94A4B273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685834, "uuid": "b766176e-439f-43d2-a49a-74e28935fbf2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685834, "uuid": "10c2d65e-1409-4241-9767-390f7d30fe3c", "value": "12288:hMray90Zbnj9cGAZfDL5q5He1HEOiddlTl7AIuaqYwmf:fyU5A1A5He1HEOihTl7PqYwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685834, "uuid": "5e6143ba-fa5c-4fc3-af43-228f522a3b67", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685834, "uuid": "91ca7a83-bb15-4ef4-ad85-0ff5b7395c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685834, "uuid": "bfbbe356-a78b-4e38-8b28-e9094f8e843a", "value": "419d14175c8905cfa737630b4deb96f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e422b7fb-2e99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690694898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694898, "uuid": "90fd24c6-06b5-4974-a8c2-27d5902785c6", "comment": "Malware payload (Amadey)", "value": "86818b54abcb9714887b580624b1af43", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694898, "uuid": "f9c60c62-97f3-44bb-9ffc-97c2a6ff677e", "comment": "Malware payload (Amadey)", "value": "96aa8a40689f2588a79dee841589dce9b9da79737fb445259afce033646a1dfb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694898, "uuid": "8e2c623c-0fea-488a-a2e8-e8d4aa10a7e7", "comment": "Malware payload (Amadey)", "value": "96aece978c389e1f9e791dc99c85bfcf04e434b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694898, "uuid": "2bff31e2-9d4b-4a5e-a1cc-6762231916c0", "comment": "Malware payload (Amadey)", "value": "d725616ebb36f95c894f2c92b02611e5aa56e48bce55e58246a7c8bfcc274eeeea12f740dbd0e1aa47df649436f4ac8a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694898, "uuid": "f98c0ad4-497f-4265-82b6-5d45a2ef03dc", "value": "T16AB41257A7D84023DCB517B418F717870B32BCA14E78836B278A999F4CB29C598B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694898, "uuid": "687d527f-7b8b-4ee0-95a7-667894568bec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694898, "uuid": "a0b365ae-7fdd-48a0-ac22-3d04fae33108", "value": "12288:qMray90oDKUQ79sC8K6DVZAQw2ifwKBz2oo2y3wu2tpTDyg:wyRTY9sPK6fl92e73wHvyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694898, "uuid": "6d4796b5-7054-4434-a089-c3b345c7d163", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694898, "uuid": "2d0c353f-8d49-457f-8ff7-3fd9cbcaba6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694898, "uuid": "a4ea287b-5229-420c-86f2-59550afc7b23", "value": "86818b54abcb9714887b580624b1af43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef10dcc9-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686756, "uuid": "a69fde44-9dcc-47b8-92e5-f3ced4ab1743", "comment": "Malware payload (RedLineStealer)", "value": "4eb3fcba974d95d1a2e356dbc53fa315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686756, "uuid": "b213b581-78e5-4275-9c6e-27b82361aa12", "comment": "Malware payload (RedLineStealer)", "value": "97015c7e4b18e9e77368fe771bef94f65c40afaf65ef4bb99e3926e623a7056d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686756, "uuid": "4d1c27d8-cdd7-4306-89f6-f5c3e66e0eea", "comment": "Malware payload (RedLineStealer)", "value": "af720f0ec046abdbd2358c86ae16a427a702226a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686756, "uuid": "d5133ac8-3f67-4c6a-ba6e-072d8f415853", "comment": "Malware payload (RedLineStealer)", "value": "ca84869ada7835316a960fa7cc9392038e3dcdd3727e28a51f18991395c49282ae5a45286a59afdcf3133ed4ca4511dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686756, "uuid": "6bc26f35-542e-432a-9bce-ee29a5c08721", "value": "T118B41213BBE88076D97A23B44CFA07E31F37BD615978425B3356591B1CB3980A932327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686756, "uuid": "e5a2675e-7bac-4a07-bc17-06e2b3ba8b8e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686756, "uuid": "245c2ae7-3bb8-4382-afd3-11631319052e", "value": "12288:DMrdy90iOOSyJ5Sm+ArAA5m7Y3eT4AsUAoj:OygOVJ51+gACq4rFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686756, "uuid": "5bc8e0d9-84ba-414d-a52b-1154cf2e375d", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686756, "uuid": "85dcfe76-81fb-40b8-98f1-c2e77ceee8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686756, "uuid": "bdf659d4-52f9-48d1-84a8-d96d4468b1b8", "value": "97015c7e4b18e9e77368fe771bef94f65c40afaf65ef4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8337d513-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686146, "uuid": "cf30c14d-c0c9-4cbb-914a-d3e3918083b1", "comment": "Malware payload (RedLineStealer)", "value": "8c5316b3c41d0f286bf728902b2e452a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686146, "uuid": "b229c53e-619c-4931-a242-683bd697f5d9", "comment": "Malware payload (RedLineStealer)", "value": "97acfc910a3b347ff4236e5a7f03989e4da2ec659d560186a0ac7115886fa47f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686146, "uuid": "ea11fcd4-9b75-4db8-9c7c-2307071da6ad", "comment": "Malware payload (RedLineStealer)", "value": "b2dbfb8c1a9030a94fbb819d707a14f03e2bfd59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686146, "uuid": "9177bb8d-fcea-41af-809e-cbf5de7174fa", "comment": "Malware payload (RedLineStealer)", "value": "9d79f84d6a092814eb0429a7f54edd2a2671871e12e3da2b07764d68f70ea206376735cba29330eabdf936631852f3b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686146, "uuid": "41f730c2-d40e-4717-93e7-3c144510b33d", "value": "T1B2E41252EBE85232DCBA2B716CF6069312397D924978932F3781799F1CB3584D43236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686146, "uuid": "231264d7-126e-490c-8af3-8f8d0c483f4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686146, "uuid": "ea78bfb8-e78c-4a78-acd5-6a012f0adc4b", "value": "12288:jMrby90PnCSOAeKphmrhrltx44+hJV5K:sy87mlanVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686146, "uuid": "ca9118fe-c0ab-4f52-a4ec-1a7837cbf7c9", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686146, "uuid": "6b0a4486-a616-4a63-bd64-04bf90bed879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686146, "uuid": "ffcac387-5a0c-4ea1-98f1-01fd6234f197", "value": "8c5316b3c41d0f286bf728902b2e452a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895c42b5-2ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690700329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700329, "uuid": "2ea7392d-d832-480a-bbb2-5596198d02c7", "comment": "Malware payload (RedLineStealer)", "value": "692db12bed17a65ac7abef31cae32365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700329, "uuid": "2607db9b-165d-4c8b-b435-ae8d20cdf087", "comment": "Malware payload (RedLineStealer)", "value": "97e00f3907dc425fe7b8b418fbe1908efd9174d9b3c50d299c8e899f95e4381f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700329, "uuid": "952d6bc3-2026-43e0-a297-4c913808494d", "comment": "Malware payload (RedLineStealer)", "value": "0aea777eff8960793f61688a39dd7a8cf1ac0536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700329, "uuid": "5d451fc0-0b1f-46dd-ac77-848ca6ced5d7", "comment": "Malware payload (RedLineStealer)", "value": "f66be574c68886ed525504416a46e54cef24376a13110a45d573915a42939f79e564da7ba4658626e7f360c81d766827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700329, "uuid": "bb79752c-0675-4c33-8867-0aec718f23ce", "value": "T189B41213FBEC4532E9B557B428F602830B36BCA59878035B3382A96F1DB36906571777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700329, "uuid": "f714f1af-321d-4b25-9bdb-29285827dfb6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700329, "uuid": "1a853fec-d936-422b-8c79-6825610344a1", "value": "12288:oMrLy90qVDm5X7FBtAbiwtu/l+8ge4DvC1CTsNb:Dy1KZrKtuADDKo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690700329, "uuid": "295af106-4523-4893-a1b7-9199264f6e23", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690700329, "uuid": "c1e28135-7c8d-48ab-9576-f58fabb39ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700329, "uuid": "87847d5b-3298-4cab-a627-e5f75d718ac8", "value": "692db12bed17a65ac7abef31cae32365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a415a5fc-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695220, "uuid": "68b3f936-d6a4-4746-8b59-816f6b29f0a0", "comment": "Malware payload (RedLineStealer)", "value": "b27f538ef10afb5eddaa219690e6627c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695220, "uuid": "1850707b-0519-43f3-adb0-d1aece610476", "comment": "Malware payload (RedLineStealer)", "value": "98c8ffd371bfaab9849b29243af58782e44f14a8844e8b890c1151ab08e072fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695220, "uuid": "64ae49f1-8f34-4b8c-bb94-01f08be69fc4", "comment": "Malware payload (RedLineStealer)", "value": "d094cab5df87be5ef65e9920b3dc0986e06b0024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695220, "uuid": "86d98b16-a14f-4175-af34-b824fca225d0", "comment": "Malware payload (RedLineStealer)", "value": "ca09f27dc616f696c6c3634107ab02a7cc5179953969f9fd49cfe4b54ff73420fe114ec631e3d0a09a7cb127c59b12ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695220, "uuid": "e0be4b70-835c-4d89-9af6-c65775e7c6e9", "value": "T134B40253ABE8C473D8B127705CFB06430E36BCA04E78936B2791A95E4CB3594697633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695220, "uuid": "a243c47d-48db-46e0-81ff-55ed336cfa9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695220, "uuid": "4ea031a9-2400-43a3-bc8f-1782d64defd8", "value": "12288:qMrjy90rrw/ecKr2bhAududxyQ2F7pK6:Zyww/R42bWKudr2F9K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695220, "uuid": "74914b2f-fc0d-42a6-9a93-6bd743b28dcd", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695220, "uuid": "773d61f3-190d-4362-bd3e-ee3b98899648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695220, "uuid": "74a25df4-e3ff-460e-83ef-44175b5126b8", "value": "b27f538ef10afb5eddaa219690e6627c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee46647c-2eb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690706941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706941, "uuid": "995df452-dc72-40db-91ea-795729e8910a", "comment": "Malware payload (RedLineStealer)", "value": "9b887e568e614142a7486398b27681c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706941, "uuid": "40055ebf-478c-4262-8e74-ed8501f28f86", "comment": "Malware payload (RedLineStealer)", "value": "9ab4def638a32fa3881f068f22c00686f59cd91d9a55d3cbc0511efc129d1f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706941, "uuid": "2ff5ba53-c08f-4c52-901b-2a591a2797d2", "comment": "Malware payload (RedLineStealer)", "value": "5d0f6eb116e3fe7702ff7df0d611ad6a7475dbf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706941, "uuid": "8e534d94-82e6-44c3-8c7a-7df6e482927c", "comment": "Malware payload (RedLineStealer)", "value": "07c3f2b1be8392ed82c87660e70546a00af03c927dcacf284948a1f9380996a0dd6c53604ce8c0618bc75dee73276af6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706941, "uuid": "67884243-c220-4ec2-abb4-d1d80ba1e8b7", "value": "T1C7B41207ABED8071DDB12BB01CF612831B367CB24AB5829B3761995E0CB3690653677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706941, "uuid": "2b956852-1e31-4960-b736-23a951473849", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706941, "uuid": "4da42b78-3993-4ecb-bbea-8ad6c9a92514", "value": "12288:0Mr5y90dh5JkHv8qW38s5CTUzrLtdV1zCXTFjObz:Fyyh5ylo83EV1zWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690706941, "uuid": "14fc15fd-2373-4943-88a5-319c091dfc11", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690706941, "uuid": "7485404a-ed1d-47bb-bda5-338b3390a50f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706941, "uuid": "9149d315-d91e-43ff-b4a3-43b56ef6b0c3", "value": "9b887e568e614142a7486398b27681c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8d8f1a-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686750, "uuid": "6dfb628b-2ffd-4d16-9557-0870c7142c80", "comment": "Malware payload (Amadey)", "value": "3e5c04a8c38f1bc73880068b3b4e1883", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686750, "uuid": "8e700817-07ec-4cde-b48c-bac658968724", "comment": "Malware payload (Amadey)", "value": "9af42ac0976de96ef0d252f8842820a96cda613b90d3754b508b636576b3a7fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686750, "uuid": "4ed78e55-bf0a-40a1-84d6-5d36eb330adc", "comment": "Malware payload (Amadey)", "value": "845aa24af9602989085a1d0afea7da277a08473a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686750, "uuid": "6ebbb5c0-4ba8-44b7-a9e9-d489ac605219", "comment": "Malware payload (Amadey)", "value": "fae0cdae311d41b2e4ad78817045edfa5c7b6513c4728f51d42486db77a477c99305f932c92980bf4b1b68c58591b1db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686750, "uuid": "1b989ddb-a26f-4ffd-9684-a279e2e41402", "value": "T1ABB412567BEA8136D8B1577008FA12C30E3AFD919C39436B2B865C1F5D73290A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686750, "uuid": "e10a7de6-2428-4309-9514-bea1f836d12e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686750, "uuid": "d7a4a4a9-fbc7-4c16-b201-cec2d6e8cb3d", "value": "6144:KKy+bnr+hp0yN90QEUgXlZk+TOTXg1zRVzodMhpotxlu6KmDbwdmkrUNw0GeYv2:SMrBy90n1ZkcmXguvTluMwdm4UN7H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686750, "uuid": "02c0d1f7-e4cf-4948-b06a-6b6b6e9c2668", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686750, "uuid": "f8a78a6c-423a-4bbe-9a73-6b355b491c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686750, "uuid": "bb0c1a18-aa94-4916-b145-58977f1acd09", "value": "9af42ac0976de96ef0d252f8842820a96cda613b90d37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3125b32-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685823, "uuid": "0a66a988-b8c1-4fd8-ab72-74cfb24a8772", "comment": "Malware payload (RedLineStealer)", "value": "39da6d62eb04b947ef0c3b289cd76848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685823, "uuid": "ab8c16f0-1ecd-44e2-b67e-396783d19b18", "comment": "Malware payload (RedLineStealer)", "value": "9b8496e95efc2095012f46230bd3642a47e89c4a73886f41db8e991f7fa863b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685823, "uuid": "4fc085fb-7fd5-4ffc-8908-655c11281526", "comment": "Malware payload (RedLineStealer)", "value": "6fe12aecd3b54b2713c067bd1654977eca28c0b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685823, "uuid": "0803435c-cb3e-4def-8e73-652c70934859", "comment": "Malware payload (RedLineStealer)", "value": "b75f75c964db59205978c16e9e121cf6d3acda7f194dd9e94aff8c8aaa05ddcac5e07865ca232faeda11702f03922128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685823, "uuid": "17d5cc9d-e98b-4581-bebb-c3ad0edd5117", "value": "T199E41242E3E88873E9F117B098F707D31E763CA11AB9C39B2355564A1C73AE4D4B271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685823, "uuid": "74e9a957-e899-42ea-8022-4680296990ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685823, "uuid": "24cd8343-0b08-4f33-8110-32a043d7d0fd", "value": "12288:zMrjy902S1PSTBNhq3yjD2NS6Gf2Lt7qYEvae+0/PRUnioKyNh7P6:EyGPy0ijD2lG+9qYEvx/ZUjHNhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685823, "uuid": "09f21224-ffc1-4d9b-bea5-98c0394b0892", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685823, "uuid": "3ae0f7ca-8590-4873-8922-6c8ac17f6945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685823, "uuid": "6d3f09ed-230f-4855-b70f-a4b48cec3b9f", "value": "39da6d62eb04b947ef0c3b289cd76848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7854895e-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686127, "uuid": "e5676844-9b6c-4f72-8a27-4277163ce5e7", "comment": "Malware payload (RedLineStealer)", "value": "7f4aaa12c0588bd587db0ab81c6938b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686127, "uuid": "71714cdd-17a1-46fd-adcc-88f73a182d76", "comment": "Malware payload (RedLineStealer)", "value": "9cf3d2bf3c4df3cc22948e45de303aec0f5ffce78a74c453774be0f6f060f6cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686127, "uuid": "c4638d22-1345-4dab-ac19-52b032e21692", "comment": "Malware payload (RedLineStealer)", "value": "b29352033def4680163645af59e8b9902c338a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686127, "uuid": "d94c61a7-5c32-483d-82d7-b7b0731bfe55", "comment": "Malware payload (RedLineStealer)", "value": "a76f3fe24a380b09d9ad2f5659b3c4462f7e89eed4eb3b147181b89dbc204a4226cc6d977b21bb8fd35cab412ca9b8db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686127, "uuid": "33fb3aa4-f806-46ba-b2c4-83eab360bd7d", "value": "T108E41262B7EA8077D5B56B7059F302C30A3A3CB2AC78475B2795949F1DB2190B836337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686127, "uuid": "a4f6ada5-98c3-4be7-93a6-56a690c89b56", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686127, "uuid": "2351580a-847e-4f01-be2b-52c8c78f93bd", "value": "12288:xMryy90iumJvk82wBnhmuiUCch3p2PDP1qwWJKHHTnOPGAALMN:vyemJvN2wyfipoD1qaHTOSgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686127, "uuid": "057d367c-8a01-4a21-a9ad-13bde923dfc3", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686127, "uuid": "737e3b2c-fb1a-4e39-b42c-5acdc3c3c6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686127, "uuid": "6fd11cd4-cf5a-4b66-884a-0aca7210fd86", "value": "7f4aaa12c0588bd587db0ab81c6938b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf363906-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685844, "uuid": "5fb9d68c-5923-45c5-90b4-9cdee7125a7b", "comment": "Malware payload (Amadey)", "value": "48ac548ece29ebd2628888ee7e2f415b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685844, "uuid": "fa45197c-a779-4bd9-a01e-d0f7eb58f96f", "comment": "Malware payload (Amadey)", "value": "9d96c5e07deb15971b75afe5317e3964ba97e7133d0e2d318d106bd21554f47e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685844, "uuid": "290e619b-cff6-481e-be40-95a40e867674", "comment": "Malware payload (Amadey)", "value": "4c619c65bc7a7487544417d46bc6d2f94068f525", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685844, "uuid": "56083aff-5e1e-4add-a5d0-60ae4dfe31a3", "comment": "Malware payload (Amadey)", "value": "a716604ef32c210705c3b430dfa13f8b475c13914bf203792a8fe2cd47a0e244d2b07cec12587cd621de3b4753f70c17", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685844, "uuid": "22b30e50-0689-46fe-9f80-153923f7c50d", "value": "T18EB41201E7E84072CCB62B7064FA06831A36BDA19DB4931F3784AD5E1DB35D5A532B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685844, "uuid": "1e6a3bf3-fb97-4d1c-af45-1888da5fba8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685844, "uuid": "6f650073-1c18-417c-8fcb-4c5971cb28f5", "value": "12288:uMrny90DBJ3GrsPQhy1kaUoFYkVc7qgBYCuWjndqLW40psJ:xycssIhGka/FYnZz0rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685844, "uuid": "b3efa773-85be-472a-b986-2cb9b613be9f", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685844, "uuid": "26195cf6-1d34-49cd-9d23-cca15f5eebf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685844, "uuid": "d2781e3c-00bd-4b58-af2a-850ebc8efa17", "value": "48ac548ece29ebd2628888ee7e2f415b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a864ab-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686173, "uuid": "e3053930-79c3-4592-8f38-9995ff4f6aa7", "comment": "Malware payload (RedLineStealer)", "value": "b718329f3ae707d9a1f07f6f3f18e228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686173, "uuid": "705f9ab0-a4db-40d9-8d33-f7e5427e2ac6", "comment": "Malware payload (RedLineStealer)", "value": "9f18303c132017fa62f19216bd95d45b6d6c9da4fd006c04f80a527fa8780208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686173, "uuid": "842b4aeb-2ec5-413b-a232-322f6f37cc0c", "comment": "Malware payload (RedLineStealer)", "value": "e5c19b146d4051101d0f88ed1bf39ac00cb0d955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686173, "uuid": "2fca23ca-2c44-4a6c-9dc3-b314cf7df971", "comment": "Malware payload (RedLineStealer)", "value": "4b54a1582d54bfd8eb3c3a26d2e3947329405ad6f266c5f09b0ea61a937efa0536cf89637e54e847121357b4e5d20911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686173, "uuid": "b1c41033-c95a-40cb-b59f-17d422bc129d", "value": "T107D41226A7C890B2D6B5277068F913D31F36BCB69C3443673389AC5E4C72A91A172377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686173, "uuid": "b23a0a57-ba6a-4a52-b647-7a509a84652a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686173, "uuid": "efad293e-ce01-4a1a-b9bb-78a2ed3b9f47", "value": "12288:IMrvy90U0kge2sqvX5xVYjViw9b670kjycQ6C+mv+Xny7vjLEf/b084XdaWsjCn+:nyfWe2XvX5xVHUb6fFmv+3M3Efj05Xda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686173, "uuid": "ff3b6553-3158-4716-8162-3ab8d3d7a27b", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686173, "uuid": "7c6b2ff6-a4a5-4a55-bb6b-08d71894ed43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686173, "uuid": "1f99031d-3f9c-4a60-b47e-cc5942649aee", "value": "b718329f3ae707d9a1f07f6f3f18e228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6535d2fb-2ef7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690735058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690735058, "uuid": "9828770a-12cb-4a99-b960-96b2fa4af05a", "comment": "Malware payload", "value": "7b6b1be24621e0ad6167551ad017f0f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690735058, "uuid": "e4dd228d-92c1-41a5-a029-b32518e55122", "comment": "Malware payload", "value": "9f30c6210c55d93cd509061e350cb0e66fd5a409b4a9da8e3ee64e1495a6bda7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690735058, "uuid": "507af82d-a4fe-4e8f-948c-187168554e61", "comment": "Malware payload", "value": "1c2e1f825846805b820dd98b9fa1121a229b4fd1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690735058, "uuid": "044cb4ea-6a47-4861-bf3a-aa19012f24c1", "comment": "Malware payload", "value": "54f72ef71abdf3b0ab9692b826792ceadc22579663142fa7578918bf5df185a11b7b62c4f1ff5820100252dca864b9a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690735058, "uuid": "5ed533f9-95ca-4ce2-bd64-253d0c0d4da8", "value": "T13A363357A3F8344F24549530CDBEF169A4DFC5187C1168AA2BC6ADB33BC40FD0A59BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690735058, "uuid": "f6cd5d77-af47-4608-8b94-b87656c68c67", "value": "98304:Ouw+i1LHj9IHKrb4AgGqPlRNlzruGzd4X/ZBfnaLPKNwf2fOqZ5+DWap:OuwhXeKrb6GqNRNlzaGzaX//CPKNZjZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690735058, "uuid": "ad217376-2530-4953-b97a-1baa252dbedf", "value": 4871152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690735058, "uuid": "45202207-d25c-444a-ab3d-1456e7e679b0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690735058, "uuid": "5dda5ebe-25f5-41a4-bb34-f6b1a03110df", "value": "data2.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c98b4a-2f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1690750244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750244, "uuid": "2b9879d8-e5ad-4725-bc0a-e8e8c7e678e4", "comment": "Malware payload (NanoCore)", "value": "bf07f5162140d3db8b29400a3c8e4c58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750244, "uuid": "65d7c21c-94c0-4e43-8397-7eabc8fa4509", "comment": "Malware payload (NanoCore)", "value": "9f8a1a934f138cd657b8521f5a4d274f92fe418a7aa9e6095ea1e8678f0d3797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750244, "uuid": "17acffc5-106f-491f-98f4-2715d451e04a", "comment": "Malware payload (NanoCore)", "value": "65ac87ce669ebac1ab896bda342224e6dc554007", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750244, "uuid": "8752cc6e-d6b1-4c24-84a8-8be636c775b4", "comment": "Malware payload (NanoCore)", "value": "e7d3330cc1b22dc0b7a7ddadae6eb55c2966aa1baa347984846b63672f0568ebb2a8462907cadf4fda08fd5877f19d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750244, "uuid": "2f56ffc7-1fd2-4490-8201-6ed277407ea3", "value": "T13D14CF5537A88A2EE2DF86BC712206129778C2E3ADC3F3DA18D455B78F627E106071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750244, "uuid": "77d640cb-5022-4ce9-9a4c-935d1c2d31fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750244, "uuid": "c0b4b632-0cce-420c-8101-e87deae3c4b9", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIs3YxWJpgYWvuGNhgZXT4fZjM:sLV6Bta6dtJmakIM5qxlYONGZXMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690750244, "uuid": "42738e87-7100-48ca-bde4-742c4166ad05", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690750244, "uuid": "b6db9917-49d6-4b9d-8bb6-505ae8915184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750244, "uuid": "8b2799a1-23ea-40cb-8087-c6f0aee81e72", "value": "Nano7594nostart.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef56c8a9-2eb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690706943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706943, "uuid": "ed144d0b-6593-4e5c-be3d-f5602135db1e", "comment": "Malware payload (Amadey)", "value": "af68c4e442039d095973dc93c8a2a721", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706943, "uuid": "5056cdea-251b-427e-ac68-4cc18c5bb3c9", "comment": "Malware payload (Amadey)", "value": "9fe048c127a0c8e6d348ebd5d3bc713653749f32aba3f6b2ddaab4d5e7e4b57c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706943, "uuid": "73b1ef34-5112-44a4-9bdc-10c3ac97e3e6", "comment": "Malware payload (Amadey)", "value": "630aa97e53ee5c95fb088e22cdd3a895d3c6b55b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706943, "uuid": "bdbab367-4e50-498a-9473-8407a7281d55", "comment": "Malware payload (Amadey)", "value": "89bceb55afdd077424854b3cb27df29122537dc802def7db75cc1b2c59a4927fbaa01dc1bf1385dd53301bf06c89924b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706943, "uuid": "f222199e-46d3-48e2-82e1-319f8300b6da", "value": "T17FE41206BAD85076D9B1377049F253830E357CA66D3443AB3B46A86F1D72BC1AA7133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706943, "uuid": "fb4a4d33-a409-4b70-a654-e72d7cadd5db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706943, "uuid": "92fd7214-16b6-42e1-84f0-4d07497f9e64", "value": "12288:IMr1y90Pxg2t4uu7oRV+1ZcJT3maHphJ1xdD5Q5eJ67SKuxY1:dy4XYkREncJTdP5QBSKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690706943, "uuid": "bce3f110-d469-4f25-9c70-d8bc903429f6", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690706943, "uuid": "d0988e9c-e9a7-43c9-8a33-824bdd5f14c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706943, "uuid": "812b426f-eb6d-4eed-96e7-9776b7d73fd6", "value": "af68c4e442039d095973dc93c8a2a721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538146c6-2e7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690682200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690682200, "uuid": "7b122de0-f0c1-48ad-af63-29dc3455ccc2", "comment": "Malware payload (Amadey)", "value": "0ecfb979d9818418ec06158cfd7d1a6a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690682200, "uuid": "e16e4ed2-5907-4562-b556-f9a5896e9f49", "comment": "Malware payload (Amadey)", "value": "a0781b9035721fe07aa084c3c1b7f6c72fe19f433f6059d0d1540b58f34a6454", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690682200, "uuid": "869070b4-3165-4c47-a3cf-76fe1f1e14d4", "comment": "Malware payload (Amadey)", "value": "c500768aa2561db89df19d8a5e1fa226ee260669", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690682200, "uuid": "e94eac0b-98d6-4cef-8594-2bf96928a886", "comment": "Malware payload (Amadey)", "value": "2d25977839f24d07786c7cfe4ee8e32f98fcef61803eb69885824d6621767807ff9609085efbfaeaa969ccb1ece716db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690682200, "uuid": "8b32a087-31cb-426f-b1e7-a4c657aa16ac", "value": "T145F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690682200, "uuid": "be43a083-dc97-409f-b7aa-e4bfb0046fa9", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690682200, "uuid": "c3b3a1fa-c979-4442-91f6-5976f15ffdb5", "value": 37390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690682200, "uuid": "553b860a-aa42-4c49-a235-85b6c42de0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690682200, "uuid": "05cc235e-0c30-470f-8a4e-a8bdde722771", "value": "0ecfb979d9818418ec06158cfd7d1a6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e697add-2e99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690694593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694593, "uuid": "b6b97fa7-98a4-4b16-93a4-c0528fd84e89", "comment": "Malware payload (Amadey)", "value": "1ef1af449e88f98724a38e130b1d5996", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694593, "uuid": "4d1777ca-2f39-4cbc-bab4-79d5acce55eb", "comment": "Malware payload (Amadey)", "value": "a231caf647578c99e11e53ec477ff90ef22cb5d23913349e2fd5291a7edf80dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694593, "uuid": "a81e0a00-a278-41c6-a381-07686db606b9", "comment": "Malware payload (Amadey)", "value": "e55640bffe1ee43933b89137ae5325210486d6a3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694593, "uuid": "fee80121-0497-4a1d-8600-12022ca3bd5a", "comment": "Malware payload (Amadey)", "value": "f3b26df3fe9c7149e7dac2aee93d3c47882d102a4849c4f78e1ca89f035552de06097d058bcd611c089ddca9c278b06f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694593, "uuid": "b6b48923-45d4-4ce9-8638-804634f3666e", "value": "T15AB41202BBD95072E4F61BB028F707831B3ABDA19C78831B6744195E5DB36D8B53232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694593, "uuid": "80a8f129-0157-4368-b85a-efc49cf85a1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694593, "uuid": "d892ebf4-dba6-44c1-9be9-1778c700dbd4", "value": "12288:mMrny90gV/44URua6pEvE1hgBYCVyDi2jRl:5yu36p/1qzVwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694593, "uuid": "fab8c9b1-90bb-4ddf-9d8c-1c7b212da118", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694593, "uuid": "8d396aae-4ec2-4905-bff8-b80dc1509859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694593, "uuid": "9a4e7a0e-373e-4ebf-8b75-ca87d5743d9b", "value": "1ef1af449e88f98724a38e130b1d5996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa32c218-2e94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690692788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692788, "uuid": "320ca5f4-40cf-46fc-8f6c-96fcb92f3766", "comment": "Malware payload (RedLineStealer)", "value": "cca13d36c4b70eb7c3de1834e002bb14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692788, "uuid": "6f737fb6-b2f3-46ee-9a3a-95d9c71b4a56", "comment": "Malware payload (RedLineStealer)", "value": "a26a53d89c87e7e5651fc1b467412e37e3b89b3ea9fd7508a170b85a124d34ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692788, "uuid": "a401c2c5-ae0f-4704-87e5-71b014aeee4a", "comment": "Malware payload (RedLineStealer)", "value": "511fa98673e41d9a8548ee5f19981220750d9292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692788, "uuid": "4dc93ec6-7c75-4c7d-a7be-2a27b9b5d28b", "comment": "Malware payload (RedLineStealer)", "value": "c3cfa0e6f76caa9eea533348ab8fec59856e38ab4dbc3d7cd1e8a1b31f73be4817cbf510ec6fe637037ef125679cda12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692788, "uuid": "d54604c7-739f-4254-9cc2-7aedcdffb706", "value": "T1AFE41213BBD99033D8B6173015F602A30A35BCB2CEB983DB27116C9E1D72A51A6757B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692788, "uuid": "7cad5f9e-5007-49e7-a7a5-defea66d0fa7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692788, "uuid": "a41afdf9-0cee-43de-958f-0593e00c59ea", "value": "12288:0MrXy90buHbQWq3340wRaBQ2aYpE+DP0z3l+9m34VwXN0woTKcFI:bylcrNMqHTpEyP07am34Vc7loI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690692788, "uuid": "1d359a87-7d16-40bc-a2c6-5a9afe1bf9db", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690692788, "uuid": "6adad51a-4923-40cf-82d4-66bf03504865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692788, "uuid": "05f3784e-1055-430b-a094-a4ce772fd081", "value": "cca13d36c4b70eb7c3de1834e002bb14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1573de-2e72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690678000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690678000, "uuid": "170a9854-40e4-4a3b-b4bb-2ba6a9dfea98", "comment": "Malware payload (RedLineStealer)", "value": "16bc95b1891c4e1a6adf43df09b2a08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690678000, "uuid": "6f227244-2208-4ea4-bbde-0a72f27270ca", "comment": "Malware payload (RedLineStealer)", "value": "a2b2a6099da545dc38dfd357bd8039bf133cf60e55f989a1e3e6131d7296b8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690678000, "uuid": "c08dcab1-a33a-47ba-9c85-c76a4a70e161", "comment": "Malware payload (RedLineStealer)", "value": "fde242fb885ab37cf26fbf66aa9c7d9600985839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690678000, "uuid": "7d472e8d-ebea-4cf0-bf98-6910c8c8163d", "comment": "Malware payload (RedLineStealer)", "value": "b9ba93886100db913b4c5f517c18df5cfaa2a680149550986cb1c120ef3248883f9a29878b63faca30984294d6c8a35f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690678000, "uuid": "763cc0f7-0f83-4bf0-81b3-5bbad197aaf5", "value": "T1BF74F103B7E88472D9B11BB458FB03831B35BCB14D3846AB3B95A95E4D73684A93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690678000, "uuid": "e4154f3a-2400-4ed3-95a4-e4e87bbe89d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690678000, "uuid": "369f2c09-0614-49aa-85d2-7ed6785c5050", "value": "6144:K8y+bnr+Ep0yN90QEo/e3Ig1CzXfS4o4j0erjyMOXmH0u0Vq:IMrIy90G/o1CzXK4oMX7OX40A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690678000, "uuid": "b592c169-de61-434f-82ec-177c2070dab7", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690678000, "uuid": "4e5db84d-2f07-4193-baf6-c3f794827fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690678000, "uuid": "0042242b-d2d6-4905-82f1-a27ccf2c113f", "value": "16bc95b1891c4e1a6adf43df09b2a08d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b96d7b-2e93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690692190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692190, "uuid": "52de0480-54e4-483b-b5e6-a86fe828501a", "comment": "Malware payload (RedLineStealer)", "value": "6b15b47125dd2c995813bbfa529f23c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692190, "uuid": "0a4e69f5-9551-4e33-ac35-d72ffd295c4e", "comment": "Malware payload (RedLineStealer)", "value": "a308c472811bb9d8864aadee217cc98110ee118090c7ba40c776d43e766dffa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692190, "uuid": "7d3e7d34-0c3d-4862-9a8f-c150949176f3", "comment": "Malware payload (RedLineStealer)", "value": "7b292360463d77f1e9b4b6a6df36001852f0cfe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692190, "uuid": "9c493bb8-eeb1-492b-a525-800931f4be39", "comment": "Malware payload (RedLineStealer)", "value": "1dec9ba74061f90d50491fabb1fb25fbd31283d98999f92dc28ca63d1402ebe2a238f7357a221c59bd48ef956cac91ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692190, "uuid": "685f0c20-6732-4caf-8915-a956b1ccaf1a", "value": "T1B3B41253A6EC5031E9B667B014F603D30E37BDA69C38836A2395A54F0DB3690A97173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692190, "uuid": "5a368e2b-c6a7-486b-8029-9c2e40d270f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692190, "uuid": "2a7b4400-cf60-4043-b5cc-ba5aed890b6c", "value": "6144:Kry+bnr+4p0yN90QEJyLvAw+dFsApn4/NNovZfwkWGjZNxjp7zcF/VRSWeMggA93:ZMrwy90fZw+dHZfBFMPSWWksicz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690692190, "uuid": "acf73c9d-8d41-4609-a194-6fcb8e0d2f74", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690692190, "uuid": "de2625b1-0613-46cf-8687-ebefdd88d375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692190, "uuid": "13bdc387-00ac-419c-b431-19a73ca1591f", "value": "6b15b47125dd2c995813bbfa529f23c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5394608d-2ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690710547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710547, "uuid": "557f42b6-929d-48e7-8182-5f7c7f5fbba3", "comment": "Malware payload (Amadey)", "value": "90e622e5bc164c1745829ad8036ca858", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710547, "uuid": "1cfd5545-f9c6-4247-b188-42ee8f195cd7", "comment": "Malware payload (Amadey)", "value": "a32c900fa52e4ea344ebecb79238fa01831d507657c2052c9165c08aea825997", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710547, "uuid": "f9b6acee-92a3-41c0-a6ee-dd97425a0786", "comment": "Malware payload (Amadey)", "value": "128c4162ec717429c92b0aafed845805d19e81b0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710547, "uuid": "8d151bf5-0bad-44b6-ad35-285c695a5aa3", "comment": "Malware payload (Amadey)", "value": "e843f7c73cd76d761dab4f5d5c85e407e8b7cdd7a2bbfad8810eb612a506d2da0bf24feef1b1e48c42d896c8bad7eacb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710547, "uuid": "7506a15b-b4d5-4495-8191-4124e3f2f369", "value": "T1FCB41202A7E81032ECB527B469F713830B37BDA15D75833B235A4E5A1DB3294A57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710547, "uuid": "7c3c96ce-983c-4d66-a6a2-807c9438c830", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710547, "uuid": "6bdfbc68-c267-42f1-8c77-89d03c32e286", "value": "12288:MMr3y90UtJXKagDGN6Sl6oF/3u4/SKEwBjQKe:TyfJqM6S/N5lZxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690710547, "uuid": "01d1e23e-1ddc-4217-801d-2b345e8e2852", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690710547, "uuid": "95d769fa-4bb2-4e05-99ef-28fece43e2ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710547, "uuid": "1f30dae0-da14-4a02-97c1-b9c3dda84487", "value": "90e622e5bc164c1745829ad8036ca858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa11230-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690701199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701199, "uuid": "6ce23b1f-4c36-4a25-85be-f927ebf37890", "comment": "Malware payload (AgentTesla)", "value": "f95279ef897975d217858b839f486f8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701199, "uuid": "dcf4e670-9e3c-4919-bc60-2720e06e2f46", "comment": "Malware payload (AgentTesla)", "value": "a37c009a14513400e1703af1bd68355a4f9174898eb1af7e1e51bd9acdc0f55d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701199, "uuid": "c00c3c5e-79df-4513-ba4e-b096d1ca640a", "comment": "Malware payload (AgentTesla)", "value": "e621f3b6a872e42fe72a6cd3a5790515a3ce055a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701199, "uuid": "cb3d1192-c7cd-4598-a1e2-1a9b0230fe02", "comment": "Malware payload (AgentTesla)", "value": "9e58d31bf66a18291a414887fa5baf4e3edb564b329453b5f04dc67e79b90fe52d523da6ba56f5fded60563c64bf82c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701199, "uuid": "eb7093f4-d2a4-4b26-a59e-e363d3b47e43", "value": "T146256E91F190889AECAB06F26C3BA57020A77E6D5464810C559DFB1F6AB3347209FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701199, "uuid": "95eb58d8-02e2-4407-a367-8df024078a79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701199, "uuid": "088b45b4-0a2c-4ee1-b3cc-09fe7f8834f3", "value": "24576:B7R7ypKWh9ycnoyiymMJdjfSeCoPW2Pn5C:B79ypnh9yabiymMJdjfSe/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701199, "uuid": "1ef97f63-5edd-4182-8f11-45ca7f1bc092", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701199, "uuid": "bae201ff-1747-481a-b947-dadd15a38127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701199, "uuid": "9bc5a53e-9a18-45bc-a467-f7bdcd48d0d5", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccafc8c-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690701114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701114, "uuid": "16b1bcc6-25a2-4378-b2af-0b1df3f5d01a", "comment": "Malware payload (Formbook)", "value": "5f40418b8c0921f451732797cb5198d3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701114, "uuid": "720ccae5-75f5-4e92-a229-c3b4eb09200c", "comment": "Malware payload (Formbook)", "value": "a556fa583b2ea5e350b73970bf5c6c0e251d9d76c4681e3afd19e35fe65409b0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701114, "uuid": "8928382d-908b-40aa-a3ca-3bafd2df2acf", "comment": "Malware payload (Formbook)", "value": "6eda8c2cb04cfe586ea39ecfe8c3e1f484f3aef9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701114, "uuid": "75a62a03-ade5-4871-8d03-6787fa9007d9", "comment": "Malware payload (Formbook)", "value": "a66c3fafc08ca9c0fbb1b6b53f6ca0f0e3ec6b5c86939c0145c864a841665af9fad753a2467bbd31bf06f21fb7c78dfb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701114, "uuid": "fa9543ed-7025-414a-a311-0653d3823f82", "value": "T10D65F103DC008B83C40D83F47E531DE94F1A7F0AE89A7DDB11527F9B3A72A62896A55D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701114, "uuid": "b01b6cb3-9592-4cf7-9114-edc603b3da64", "value": "24576:Juu9VNZylw6VHEnDZyPw6VWViNhuuvvtnDbohhhXQwngZZigpcWyqRw3g:JuuPR6VHEFT6VuiNhv3tDsXXnRgWW5RU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701114, "uuid": "90f8f052-28ef-4b3f-9b6d-6f4fdf173fed", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701114, "uuid": "aa0d89e5-60e7-4955-aafb-7ea0892bbaac", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701114, "uuid": "ff7a2cd6-ec82-4de9-8d59-1e7d53fe1f6c", "value": "PO_390909353.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5109b24c-2e9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695510, "uuid": "92c132fc-62ee-445d-87da-203bb25b107a", "comment": "Malware payload (Amadey)", "value": "9fbd3e275365fcd8be55261e35883fe8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695510, "uuid": "c42e9a34-1904-40ad-a764-21047c7e0534", "comment": "Malware payload (Amadey)", "value": "a66c5d63e48fa5c5a238ccf84900bb7dc88fb79ad577ed344d4433b7feb50836", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695510, "uuid": "8283f68e-a3d7-4a87-a277-c4e4f28aac8e", "comment": "Malware payload (Amadey)", "value": "39940ddbc06ff903cc2fa9bf45dd31b9fef0b7de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695510, "uuid": "de4cf993-d2ca-4064-bd81-af1cc6c789c2", "comment": "Malware payload (Amadey)", "value": "f6818779eadac0ddc81f3751e9ba6e83b6428a95f11f37a3cd8095c2f2178013c98114a56ef433bbccfd4c94e7419749", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695510, "uuid": "96b8d143-9c78-4094-a0ff-de35771708e6", "value": "T1B9B41207AADC9472DAB527B05CF606D70A3A7CA29C38532B2389981F4CB36C5D572737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695510, "uuid": "40219d0c-4ae6-47ab-aefa-b94f29139135", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695510, "uuid": "ef440c02-4af5-4a6e-bebd-b55a17c970b7", "value": "12288:qMr9y90U/gdqBM+tjdll33NyP7Iz7CycGpdzt1gBYC58o/dFGtx8:/yAEGyxX33NyPsz+nsdztuz66/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695510, "uuid": "264207e9-e96c-4b9a-9ed8-07909601a55f", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695510, "uuid": "93d3f19d-b384-46b0-8ed6-6ca0f27e5a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695510, "uuid": "3fe66c28-3738-4257-9c50-44dd934fb1c1", "value": "a66c5d63e48fa5c5a238ccf84900bb7dc88fb79ad577e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33b5470-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695246, "uuid": "46efe4fe-c745-4222-9949-789cdefd1eaf", "comment": "Malware payload (Amadey)", "value": "ea8f8dc05b478f21af13e15c1de0adc7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695246, "uuid": "52078930-44ad-4f74-879e-ef3dfd8d84ed", "comment": "Malware payload (Amadey)", "value": "a6b47aa8090e791e62a87c64ddb0b2044579916f8487102e1f76348e318dc318", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695246, "uuid": "28521192-d41d-4545-9fe1-34edfd525793", "comment": "Malware payload (Amadey)", "value": "4244b53a87100841a9338a30763c5bddcfadc973", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695246, "uuid": "b66f1a39-2a7f-4483-9d7e-10bd0ce5c5d3", "comment": "Malware payload (Amadey)", "value": "38b6c9b4c416fb41a20f1f7de9a3b30dc4d42c1afdd735c2da7bbbfb785770193b517c6dfdc60962beb029ed008a460c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695246, "uuid": "2dfff6ca-b7e6-4fc4-9969-f62548630d3d", "value": "T1E4B41203AAE59077D87667B01CF617830F33BC52297853AB23996D0B1CB36D4A972727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695246, "uuid": "78c1da31-1fd3-4374-b25b-ab3fe8605ccc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695246, "uuid": "f78e1ed7-b249-48fb-893f-f176bed2623d", "value": "12288:KMr9y90UbnDvPiK12/rhZfbrgmS590ZI+U:vypbnjKnjIr+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695246, "uuid": "83c134d4-7bcb-4048-a904-89d7d7fafd5a", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695246, "uuid": "dbfda2c6-f835-4073-aa1d-c1494e094cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695246, "uuid": "1a13e38a-f60d-4975-8284-fde7543c144c", "value": "ea8f8dc05b478f21af13e15c1de0adc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a25246-2e94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690692488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692488, "uuid": "00668f4c-43b7-4a36-b137-a3aff80afb10", "comment": "Malware payload (RedLineStealer)", "value": "1e9955416d17dbd1054f5ef1e5b58ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692488, "uuid": "c56dc6a5-b13c-4ada-9497-57518ba0bcc4", "comment": "Malware payload (RedLineStealer)", "value": "a755ed6325e9b76161da6717a97e908251f731591b6903a4a2fffc8322f38073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692488, "uuid": "1918ee4f-6cf5-42ad-b7d5-5dec3ea13451", "comment": "Malware payload (RedLineStealer)", "value": "62fde6057d9c009f9b56da7bdde1440fc19bae1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692488, "uuid": "50230fcc-ddea-46cb-a1a6-a0c2d79e9420", "comment": "Malware payload (RedLineStealer)", "value": "5b1ba53f21e7ab7b0d01c1544b4884fb3df3374296a821404cba48fc9a98e2ea57ad1b60d5d2de482a95dfe88fb10283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692488, "uuid": "469bec79-8cc0-4d59-8664-23e8d5ddbf41", "value": "T1EDF2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692488, "uuid": "4a8cba4d-d7bb-44da-9af0-fc28c568ff3b", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690692488, "uuid": "0d1660aa-fd61-4410-8d0e-8d1baa2f7682", "value": 34840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690692488, "uuid": "b889f1ff-4abb-43b7-bd0e-89c64bae4d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692488, "uuid": "d36b3a97-2a31-48ee-ba69-9fd69fb9af57", "value": "1e9955416d17dbd1054f5ef1e5b58ad7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02181ba0-2e8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690689795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689795, "uuid": "b3455ba2-3681-4ab8-92b3-dc55e2ecf0ef", "comment": "Malware payload (RedLineStealer)", "value": "beeea60273e079c3d8b7749b0744dc61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689795, "uuid": "7ea2186d-8fe5-4771-8097-70c85f40c2e3", "comment": "Malware payload (RedLineStealer)", "value": "a77a8642ea7dc545650b75e35dec27b92e5c85038ae1a5f50f9f4471837b6efd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689795, "uuid": "ee82361c-8a2b-4dfb-99a6-3e5103f9bcda", "comment": "Malware payload (RedLineStealer)", "value": "fa505b42eb7a6b0d3c35fe0049b355788bcbe1f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689795, "uuid": "51956297-7803-4f6f-961c-ebbfeca6e9bc", "comment": "Malware payload (RedLineStealer)", "value": "34de34f8e58183d372f8511f1ac95ee80059dc1765d8af05cc7e0898b229afe6493c6ca73a860954b41d6b01682d7001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689795, "uuid": "d09bf55a-60bd-4cfc-ba0e-4d5d4d9859bd", "value": "T1C2B40212FAD85073ECB0277198F712871B3A7E908D74876F2749A91A1C32BD0A57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689795, "uuid": "4427c601-2818-423b-85fe-d8a2bd6c3284", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689795, "uuid": "c3e1fc93-f180-4e95-bf48-35eb68506a6d", "value": "12288:qMrWwy9074PCtycRRfal/MqCSx1HSPK4W6jaD3sCLIUjGW7dqr:5yMRnCl/Dx1HSPhocCLIUSgqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690689795, "uuid": "9c3bd1bd-8005-4f13-8dcc-628919160404", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690689795, "uuid": "f7385aa3-82a0-4dc9-924c-51ba1de9a7e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689795, "uuid": "7b72ffe7-ca86-48c6-8272-f210ab0ffdf1", "value": "a77a8642ea7dc545650b75e35dec27b92e5c85038ae1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da26895d-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685862, "uuid": "6150d7e3-60fb-453d-93ad-7e9708c39e08", "comment": "Malware payload (RedLineStealer)", "value": "7a4c7e87293811a73f42e7f92c0b8316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685862, "uuid": "3403b90a-b8f9-4f21-9dea-db9d60627df5", "comment": "Malware payload (RedLineStealer)", "value": "a93cdbaf566fade31e87e311858df0856f0517939130df5db6c904a54d61ffdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685862, "uuid": "56ce63d2-5131-4bf9-b3f9-e86dd0fdefac", "comment": "Malware payload (RedLineStealer)", "value": "a6f9a80112901db5a316a8c5cbda717651b02141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685862, "uuid": "0e3a2164-be95-44ab-937e-d82bf9537662", "comment": "Malware payload (RedLineStealer)", "value": "de590215306f77d3ac800fb452ecd88c1a15a3bb3559c3672ebc456a92a1482502f72794f0f694cd86529bf2c358576e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685862, "uuid": "8b904f57-74a3-4323-8cd9-560b70a043c0", "value": "T11BB41223A7D89033DDB52B705CF753871A39BDA15C78531B2B85A88E1CB29C4A93533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685862, "uuid": "ae8ce455-9ac5-4eac-8297-423f52d3e0ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685862, "uuid": "eba6852a-41ca-4021-a92f-dbf53b393d30", "value": "6144:K9y+bnr+zp0yN90QEhf1lsLhCm6G2QkI/lcqmMitHw6xCnijn0IQVJHZVzI2fzBG:vMrny90b1ikw2QPqwtij0bVJ5Vrr/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685862, "uuid": "3aff4c8a-1794-4154-badc-7b79f54d73b0", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685862, "uuid": "2b30d62b-dc5f-416f-9cd7-7fc99e787945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685862, "uuid": "2c06583a-acd1-46a5-8970-c94a089f944f", "value": "7a4c7e87293811a73f42e7f92c0b8316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8660e635-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690701183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701183, "uuid": "954a57f3-2ad0-4a52-bcb6-86d889259e42", "comment": "Malware payload (AgentTesla)", "value": "260b384f26d61d95e330f0837f5afe40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701183, "uuid": "e312e6a9-9ff1-4494-a95f-804e3783683b", "comment": "Malware payload (AgentTesla)", "value": "a9b35ab8cf9148b07865c2c0c092ee8302d237bcd70b6a4f95e8f58d0682635e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701183, "uuid": "de13a4b7-31fd-4077-a091-764582a79dc6", "comment": "Malware payload (AgentTesla)", "value": "147a776d207ffbc68a95b56366bdd0e1526e2515", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701183, "uuid": "8303ec06-9177-456f-a986-2a41c0c2c32f", "comment": "Malware payload (AgentTesla)", "value": "a2e4052f8847a97d911439441a1c05f9d4a81559dc39e2fd407073eb47514dceddc73119ebdb42e1e83fddfacd989bfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701183, "uuid": "16031611-974a-4e4f-822d-f51798b0b604", "value": "T168059C51A154BBA6C0A17AB7F4D2E035076B6F775229C1C1DAB67FC222B1F904E03E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701183, "uuid": "ed0e353a-2e13-46a1-a76c-aed29c449d7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701183, "uuid": "58d87f90-6cc5-481a-9057-2821837cbfe3", "value": "24576:3kgjj4Ag7DcvXOgTZvMtmPxA8wtyio0+b:dD6IhMMPctgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701183, "uuid": "76844ee2-2c24-4b1a-9d5b-111832914469", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701183, "uuid": "63b07ae0-7ab7-4a7f-baff-40717eb73ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701183, "uuid": "a7ce2728-6d09-455d-b6e8-f20d113f7988", "value": "dhl 6833295033_AWB_23199_2026-07-25 .Xlsx 6833295033_NPG_0235200266 doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f2a0c7-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695257, "uuid": "99cab65f-8292-46fe-84fa-9c143f47d98d", "comment": "Malware payload (RedLineStealer)", "value": "ab322007acb2c32aa2c1430d82b3af05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695257, "uuid": "eb11611f-912c-42a7-aab8-8db65657bbc9", "comment": "Malware payload (RedLineStealer)", "value": "ab38b430061a7f916900fba51b34a46f128eb45102c0d53cef1037bf60912a38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695257, "uuid": "3ba9153d-c2fd-4b2e-9649-b3defbdc7b6f", "comment": "Malware payload (RedLineStealer)", "value": "1c5f88e56b34e90d20c13993ced1a308c4cd5048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695257, "uuid": "dd92ad2b-d13f-4341-a975-feee5d86096e", "comment": "Malware payload (RedLineStealer)", "value": "998eb45a6b19a670f5285732bf633436007cd057474850fe81d305372208c06cf95515eed1babf0eec3fbcbfb2c13f0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695257, "uuid": "23768e45-d110-45c3-83c7-1dc524abd530", "value": "T1A9B41206A7E89032E9752B7058FB02C31F3ABC612D75433B27475D5A0D73A94A972B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695257, "uuid": "8a52f648-5b32-43a0-86c1-c63f65c38bc7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695257, "uuid": "09e5c978-4d08-4d8f-b2e1-af56fa97c32f", "value": "12288:MMr3y90QsR9JDoxfum81fcovhySC2QGA:jyiR9JD8fuTko5/Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695257, "uuid": "d1bfce73-31e0-49fe-a7c6-e4c15717251a", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695257, "uuid": "bdf3b0a2-0783-4b82-bf00-da257653d2c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695257, "uuid": "1a0d741f-d5e0-441c-b468-ee4909e19a8d", "value": "ab38b430061a7f916900fba51b34a46f128eb45102c0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec132d5a-2eb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690706937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706937, "uuid": "fba2147c-4ed7-4cfb-967c-c564f3476533", "comment": "Malware payload (RedLineStealer)", "value": "f9e5ceae1e4fa2bf7505d63dc2fa311f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706937, "uuid": "83826dd7-164a-40c9-8486-296f5deaf548", "comment": "Malware payload (RedLineStealer)", "value": "ab703048e3cb5b50e7081ce58e19c94f35d09513179abc56523c3b04a86243df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706937, "uuid": "a6dabb2e-bf5b-4b4b-8d91-f1cfc6e0a238", "comment": "Malware payload (RedLineStealer)", "value": "9595f716108c365c02954060427abf062f059d6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690706937, "uuid": "240c759c-693a-4aca-982b-8a52dc12c528", "comment": "Malware payload (RedLineStealer)", "value": "31f989f607cc5a3809bd05c1082980569bb5aad2321a44816a14fc61e24282260d8719bf7272a325fc5d7d8ac55f9056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706937, "uuid": "64a7ad42-f70c-48aa-8da3-cf97c6372076", "value": "T19AB41263A7D94032D9F12BB05CFA12E31F36BCA14D38831A7746692A1CB39D45A7532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706937, "uuid": "0ad9ba37-a1ae-4147-ba8a-7877e9170700", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706937, "uuid": "a61dd086-dc42-48d8-9d96-dd2dcd289f43", "value": "12288:HMrxy90IEuynZkLcxbRn9ZqBk9AZc8c+P0ia:Oy7FwucxbRn90+8Jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690706937, "uuid": "b9c75cd9-21d5-464f-b7e2-b5c0e31289f1", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690706937, "uuid": "cd013f26-01a2-4b53-818c-faa34e564dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690706937, "uuid": "2168a263-7614-446c-a48e-25e119048de8", "value": "f9e5ceae1e4fa2bf7505d63dc2fa311f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76debb2-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690701239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701239, "uuid": "d56078f8-8970-42de-a182-a6a8d8e862d4", "comment": "Malware payload (RedLineStealer)", "value": "08a9afcb2c1e963ab7b81b75ff25b82a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701239, "uuid": "976f2d8b-eaa8-4251-86d1-6224c47f00a4", "comment": "Malware payload (RedLineStealer)", "value": "abca0964c749e88bf8d4799126b4b75d52b1623e377fd294f9ed268518a2da6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701239, "uuid": "c78ca700-91b1-4506-a049-c8a60c14d5de", "comment": "Malware payload (RedLineStealer)", "value": "518aaa911f7b7569932d8117b1a10b9389fecbb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701239, "uuid": "68b650cc-65f4-4206-8356-0bed99de6800", "comment": "Malware payload (RedLineStealer)", "value": "2e35bbbd9aa7b1f5daab7ca2d777c0fbe109697d2cb8bc197e4ad1f0638a520a0545e946f3e84a13449b278bad7bd178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701239, "uuid": "ab5afb3c-5ae1-4f9a-803c-1137cac88a89", "value": "T103B41213FAE08472D9F407B158F707D31B327CA15E78D32B2756AC5A19B1AC0A97272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701239, "uuid": "81f05698-3009-4a99-b839-9353333d976e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701239, "uuid": "8b2894bd-9d53-4ae1-bce1-1438a8af0187", "value": "12288:RMrJy903jkD1hobb/Jf9PaZsta0ejUf/CORZ5Fu/yL:syGjkWhVPayahjcCugi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701239, "uuid": "380a3b34-b5cb-486f-b7ef-f4fe4483ed69", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701239, "uuid": "02a9f3f8-6880-4612-94c8-632662ebcbb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701239, "uuid": "9d1bc5fd-73db-4fbe-98eb-88c5fc31a4cd", "value": "08a9afcb2c1e963ab7b81b75ff25b82a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b621853-2eb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690707849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690707849, "uuid": "659ff0cc-20c0-41b3-a1fc-168914e566f0", "comment": "Malware payload (Amadey)", "value": "15fc9361eb35dd28f0d2861a7af3a9a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690707849, "uuid": "4ac0f9e2-a424-451b-ad01-02698786a522", "comment": "Malware payload (Amadey)", "value": "ac2597cd91e7e082e175371b824fde7dc67bfb65368c95acdc58897346d4d638", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690707849, "uuid": "d0ece51b-165c-4b3a-9495-d94aa95af0e5", "comment": "Malware payload (Amadey)", "value": "bd7f63513411c64a170c1b2bed68dc5d6d7229aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690707849, "uuid": "7290261e-1e6b-487e-a926-2ad362bbceaf", "comment": "Malware payload (Amadey)", "value": "51614f260723e4a23046ee62ff414cf1603a408b64c2c1e72ef5dc3c99954608e55b4405f339546792bd63c7036e7492", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690707849, "uuid": "3794ba25-2c2d-424c-9900-4c1a19302fdf", "value": "T1E3B41247B3F552B5D8752B7088F707830A36BCA19D78932F2695994A0C73B90BA3077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690707849, "uuid": "00e9325d-b500-417e-a058-7413de2691a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690707849, "uuid": "d9753309-4fbb-46bc-b3fa-98bb9dc33694", "value": "12288:wMrPy9043UmINXDf1WasxaCFSdxLgBYCC32Faz/jJ:vyRUN1FASAz1i/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690707849, "uuid": "0d1b7dc1-29ca-472a-9d13-785dffa121bd", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690707849, "uuid": "3d4287cb-85f6-4d0f-82a6-e2957acc70bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690707849, "uuid": "918fc3ad-244c-4bc8-b2aa-9f87c8981d2c", "value": "15fc9361eb35dd28f0d2861a7af3a9a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fd7ecc-2e79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690681001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681001, "uuid": "0319f598-3410-48c0-9030-ade8ff8b6f6f", "comment": "Malware payload (RedLineStealer)", "value": "4425af0ff361314cb805ab285509b382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681001, "uuid": "e4179eae-d4f9-4ef2-a495-c356c1e9e6e7", "comment": "Malware payload (RedLineStealer)", "value": "ac3260199e6d7a8f4da9cb5324aced787d1bd19b3adb7c545a9cf25fd570e2da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681001, "uuid": "7317a325-90cd-42af-a291-38841ad86c07", "comment": "Malware payload (RedLineStealer)", "value": "baa85079867ffa307a4ded29f49a2e3e0a6219f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690681001, "uuid": "1effa725-e464-4d35-8b49-9d51ebb3e9eb", "comment": "Malware payload (RedLineStealer)", "value": "9a1b05a3f776bca8edebc835f83e0539247cac7ac3ff924f459718c8fc3c079e360ad5da129bfda96d329e7b22a06d03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681001, "uuid": "c990a30c-b784-4070-a997-ef5def62c5d9", "value": "T172F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681001, "uuid": "157e227b-8de2-47e0-9b2e-3d04f1f1d6e7", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690681001, "uuid": "a2a2ee8b-2cc7-4b11-835d-7d3d3d2c56a5", "value": 37053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690681001, "uuid": "91dea448-f106-44c5-96d8-a2e0c3548ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690681001, "uuid": "704ffacd-daa2-47c1-8a6c-f31a4c7f61e2", "value": "4425af0ff361314cb805ab285509b382.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568e8f34-2eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690704539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704539, "uuid": "43eaa728-7e3a-4b13-9840-74f62f994a16", "comment": "Malware payload (Amadey)", "value": "fabe4129e4de16642a47171d6ef3c055", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704539, "uuid": "54aabf0d-89ae-4dc2-80ac-05b0d5d2c2eb", "comment": "Malware payload (Amadey)", "value": "ac8a1256f5d06a786a71650d13765debd904feaa2387ad9375cbe61cd363df85", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704539, "uuid": "542de3d4-e6f1-4e59-8b94-56f5a0f3b271", "comment": "Malware payload (Amadey)", "value": "b5aec1360e4834f7fe4e74c532c01d8271a69fc8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704539, "uuid": "6e4131ea-53a0-4329-ab07-37fd76bd8bf6", "comment": "Malware payload (Amadey)", "value": "a452f56ede31fd23d64c462d552e9e47e650e0d3ff1ff818f1142f349b112a274a57715d66f8f101f9142b05b06874fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704539, "uuid": "6dcadfa6-d28f-4db6-a14c-aa19ff1e9471", "value": "T11BB40213AAE86473E8B953706CFB03931B357DA09D78C36B23469D5A1CB3690693173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704539, "uuid": "618a4ce1-706b-45ec-a04a-7761b18e26c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704539, "uuid": "104f146e-2a05-4248-923f-c44bd48ee481", "value": "12288:rMrBy90ZTfOyNgxujKquq+UdBt5vvv1mP7awLyl:eykTVOujof0BtNuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690704539, "uuid": "9fe8fa17-b5d9-4365-8d62-5ab022a7e421", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690704539, "uuid": "7f7ecc9f-e186-4ad6-acbd-57a615a24706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704539, "uuid": "46d38854-f816-46e3-af6e-35f314417853", "value": "fabe4129e4de16642a47171d6ef3c055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b951be8c-2eb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690705134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705134, "uuid": "d7b46911-8adb-416e-8360-df06f8953e44", "comment": "Malware payload (RedLineStealer)", "value": "97d84b0a7ceb33581f34228e41528cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705134, "uuid": "d6b62d37-0bda-4804-b4c9-9f323c8e6018", "comment": "Malware payload (RedLineStealer)", "value": "ad4c33564453b11af6a7009f5669f7ecb4685d16f3e7c956ee842428dc65e075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705134, "uuid": "d681f976-92e4-435c-a7c1-6d6fd173f3a9", "comment": "Malware payload (RedLineStealer)", "value": "b0049c8d4dc4e90c080e71e570e55eeb11488ffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705134, "uuid": "40603538-33a7-47e5-bc26-8d86abf9cd2f", "comment": "Malware payload (RedLineStealer)", "value": "1527bda03e86248207bf2c3c568a05681512b705d9cf5ba93cbcc4cbc261032ad4f48b97a217ff66db1c2559d0389fa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705134, "uuid": "37cad812-235b-4785-8049-224db9005d87", "value": "T155B41213EBD88032E9B62BB06CF106C30A377C618878836B2795955F1E73685E57673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705134, "uuid": "fae6a4bb-ee3f-4790-9391-c1bbcb230a91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705134, "uuid": "2f3aca1e-bfd4-4406-aa65-936072d657d0", "value": "12288:lMriy90BD9sFlkHU4R853vt6bcSFSK/kMyykrNmJKAMR0M1:7yk5sU8BvtwUXykrIMPR0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690705134, "uuid": "46d21e21-ea95-4f84-8ce8-a4613e01cb7c", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690705134, "uuid": "97352dab-66cb-4006-be6a-25804edf3d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705134, "uuid": "738802e4-a541-4b25-b507-3bd6290b8fd2", "value": "ad4c33564453b11af6a7009f5669f7ecb4685d16f3e7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11feccfd-2e97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690693687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693687, "uuid": "b8187634-8b6e-43f6-8129-beba97eeac69", "comment": "Malware payload (RedLineStealer)", "value": "6a44ec05bfb69f69928d87135b302a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693687, "uuid": "a3afed46-9858-4c7d-ac8c-1b8bd3d06359", "comment": "Malware payload (RedLineStealer)", "value": "ad8f4681ab13ac3b02553d63c4103a48c474c64a418c081eda74e4833a9c50d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693687, "uuid": "3255835a-9075-4761-8a2f-e518cf8eb0af", "comment": "Malware payload (RedLineStealer)", "value": "c668e9e8cb80922212433fc29562ac63da379413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693687, "uuid": "53a9d59b-0882-43e2-afe7-24f4fd1bd5c1", "comment": "Malware payload (RedLineStealer)", "value": "9fb45f28357792194fdadeb2bcc2c53039db9da98563ec7e54818389fefaa76a89f7c7e2b958f2ba5f0ede150cced5d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693687, "uuid": "4a00e705-3c42-4cb4-a08a-43fc4539bb8a", "value": "T13CD41202E6E59072DCB63B701CFA43C71E777C61CD38936A2656886A0C736C4A87677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693687, "uuid": "97f7fc87-8282-4faa-b573-976a06f332b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693687, "uuid": "595e2a18-3bc7-4668-989b-f708533795d0", "value": "12288:MMrpy90/jJmF/aDphNuZ5GpabEpD1XSxtdlfBWa2gm2Ej:9yijJM/azNuzGpabEpubuazEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690693687, "uuid": "d0ac8990-d7c9-4301-a47e-92470dcb48ef", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690693687, "uuid": "7d8a9ad4-b61d-49f3-bf9b-aabd15a7b15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693687, "uuid": "c7570cf3-e68b-4fe0-9f5d-0ca1eff45280", "value": "6a44ec05bfb69f69928d87135b302a2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237e733b-2eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690708748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708748, "uuid": "f9f912fe-3d1e-4a96-be2f-53df507d7d5e", "comment": "Malware payload (RedLineStealer)", "value": "e26869d3339637e9d8f1cfc50fc15ac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708748, "uuid": "a64fe12f-2b54-4925-9c10-f75df45db59a", "comment": "Malware payload (RedLineStealer)", "value": "aed8f4563e5a4bb4ad61e3ebaf02697b493eae639eafc407d3ff6abaa01ad8d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708748, "uuid": "f70aef13-599b-4830-a7d9-947801ac5485", "comment": "Malware payload (RedLineStealer)", "value": "d6d7b7bdd499c03c0b011226792f42282d543fca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708748, "uuid": "e08f9e6e-69b9-4628-a3b1-a81c7aa7b24a", "comment": "Malware payload (RedLineStealer)", "value": "4310db6da15cdda5892ad86102455ac007ce1f360a5bddc62980968be7e473faae61de23587e1408e1c67aa10ca8975e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708748, "uuid": "b865bae1-17ec-4602-a23e-a1ecc83a20f7", "value": "T197B41213B6E094A2E8B127701CF902D31A317C91AD34937F67D9A81B4CB2699783677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708748, "uuid": "e3f63c68-1c92-4f3c-8494-cacb598dc431", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708748, "uuid": "0aa756a7-7a35-47e1-a129-837928f57e3a", "value": "12288:ZMrTy90bBBPUXHQiUnRfuYIB48zLkOFQ/p2BWqD:2ye7S8Rfux/LkgQrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690708748, "uuid": "98f86f1d-7cad-4ad5-999f-1b398525e9f6", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690708748, "uuid": "275b1858-bd46-40fd-8596-1497adc04e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708748, "uuid": "20e50e7c-dfc1-424a-b99b-05bc54e75898", "value": "e26869d3339637e9d8f1cfc50fc15ac9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0949b3-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690701191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701191, "uuid": "30b2c5c4-f8be-4dfd-a547-7c7cafc8daa9", "comment": "Malware payload (ModiLoader)", "value": "ed0c35ac961dc8238fb1089232025f8c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701191, "uuid": "d52de70c-3ec8-47f5-9736-a3f7afd2dae6", "comment": "Malware payload (ModiLoader)", "value": "b01b3004a614e2cb35a6e68cc92354956f82c6e02511deb101f897875c0ec838", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701191, "uuid": "ca134abd-4551-4bfa-88ea-f44eaf89335f", "comment": "Malware payload (ModiLoader)", "value": "d298df78ad42d8bb7c4553d089128147a471694d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701191, "uuid": "b687469d-d26e-4031-83ef-95e89bbe76e7", "comment": "Malware payload (ModiLoader)", "value": "f11d04794a793b780c1912db68caa6837f66533a4f63044dc7555427084c3120801c1f27aec538e053cda733b4e44d06", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701191, "uuid": "01ea0c34-77e2-4441-87fe-e291af285ef4", "value": "T11B55D03677424072C156253999AB8F24E8397F203F0425AE77FD3D8C7EB6583B81A1B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701191, "uuid": "6c49866f-e0b8-48c0-8fb7-00ffd005fc94", "value": "05f4f91aa1809de9cc9e340317e84db3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701191, "uuid": "4bc2f311-9287-40c8-9e2d-426174982eff", "value": "12288:vmqWab9vmCM3PYAQ/goAL2k0jluBjXj+hGHxWgyFaB3ZwveR8VOBUGTZL1z559ts:vtWkmdfWvxSw9aBB8sN52OJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701191, "uuid": "86840525-2324-4b64-98bf-83fd9166258a", "value": 1320448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701191, "uuid": "fcac9adf-f8a6-419c-9e60-df2cea770cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701191, "uuid": "39abb633-a585-45c1-add5-fc7f97e2ec74", "value": "dhl delivery document and receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13aebda0-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686818, "uuid": "35d3c07a-6ac2-41d7-9274-f4a406e79e67", "comment": "Malware payload (RedLineStealer)", "value": "b8b93bbe6c35076ab96349d5c6fea27d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686818, "uuid": "59ab3bb2-55d9-4724-ba60-1e91ba4a152a", "comment": "Malware payload (RedLineStealer)", "value": "b04ccdab56c4473799aa129e25b88840def5ead5e712e0ddf474d07abb295a9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686818, "uuid": "6e7cb7a4-650f-4165-b063-52847bed87de", "comment": "Malware payload (RedLineStealer)", "value": "e10fb95a8a2c50cd6234abb8ffdd1f57d3a1c027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686818, "uuid": "35222188-6993-4923-bc2d-d682cafcb825", "comment": "Malware payload (RedLineStealer)", "value": "8a0ef1ff73a6baedb3f52bf60e153d46c2cd411a9c9682ccbf5c78fb05bb9d9ebddd8062614a400ef23827437b539d1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686818, "uuid": "e054676f-e47c-4277-a571-56a3d74a0474", "value": "T142B40253B7E48422D8B217B068F601D30E367CA35DB4875F2695A92E6CB36C4AC72737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686818, "uuid": "486cf6d0-fca1-416e-bcae-8dfa2995d8e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686818, "uuid": "89bc13c9-ecdc-4ca4-921f-511662f65bd1", "value": "12288:qMrZy90+e7kF9lSuCTEvn9f6XosnpoDcqgBYChB9ztE8c0pggm:jyfQknlTPJGBZzBztE6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686818, "uuid": "c4e5e49c-52e5-48a2-b3b1-c24ea29d598c", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686818, "uuid": "568ac8be-e053-4d42-97ea-c929d4b9bc42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686818, "uuid": "cad822e2-7065-4f3e-a6f8-05b2a5e4ce5e", "value": "b04ccdab56c4473799aa129e25b88840def5ead5e712e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4faebdc4-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686489, "uuid": "0cc02bed-677e-4339-a034-b05ac9491057", "comment": "Malware payload (Amadey)", "value": "44dca141239252027c673dd6aabb9d4b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686489, "uuid": "533fcfa0-c90b-474d-a9ef-7cc9ef1fac71", "comment": "Malware payload (Amadey)", "value": "b0dd29e12afdb9f81cdad4fc0f2e373048b61c6506bb5e6ff41eb938be1a485e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686489, "uuid": "3be63989-aa1d-4039-ad9d-f2187fc8b10f", "comment": "Malware payload (Amadey)", "value": "88b3e9698878eb8e3bffcb60d943393fd1df7c88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686489, "uuid": "5400f7f6-e820-4329-8ac2-06cf52fcba81", "comment": "Malware payload (Amadey)", "value": "2c699adbcfe7b0feb0d9a272461171d089c066246bb048dec454fb3b4d2894cf8808652e629be875171976c87f34f4c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686489, "uuid": "419fad7f-407f-4109-a299-951010dbddfb", "value": "T1B5B41242A7EC4132EEBA17B41CFA12D30F357C71997583A7635AA94A0CF25D4E47232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686489, "uuid": "d2d489aa-1a88-4c42-9af6-51e8c3937595", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686489, "uuid": "6f6ff0f7-1444-41e6-8f39-69ef636f4e95", "value": "12288:nMrYy90rO0XVTKLGD7M3XGYSkSY/CM5nvVgQ2:zyu9FW6YDsM9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686489, "uuid": "e1ce4640-6b9c-497c-ad45-38ee71632c5e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686489, "uuid": "c5a9ca22-805a-473d-9c09-a5d038676dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686489, "uuid": "8be5eca6-55f0-4ea8-83b1-bf892c15b303", "value": "b0dd29e12afdb9f81cdad4fc0f2e373048b61c6506bb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055b4314-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685505, "uuid": "cbd0aa70-4be8-4e23-8c4d-20ddd3296f90", "comment": "Malware payload (RedLineStealer)", "value": "1d0fbd5c41a0aef56f28e1c20d10e394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685505, "uuid": "6d2d3a77-c81b-466e-a1f9-970d8d366a5c", "comment": "Malware payload (RedLineStealer)", "value": "b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685505, "uuid": "aa4cb83b-1a8c-4aa0-a953-58f97d0ab141", "comment": "Malware payload (RedLineStealer)", "value": "aabbe503a0cd0511597bcfdd4df77993b1af0f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685505, "uuid": "c2af3f98-d4ea-42cf-9a41-6e8746fd54e0", "comment": "Malware payload (RedLineStealer)", "value": "7b1b2d785046dd08231d837777fc19d3be01f5f83dbf59942901864f9a698ab0d421e117ccbf032a72734170a9b06b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685505, "uuid": "1fba5bbf-b735-419a-aa94-bae7031383d8", "value": "T12AD41212BBE98173C9F897B458F707C30F367C629E74826E33856A5A1CB2580E671727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685505, "uuid": "8dac8478-a39b-4a3d-a24d-d1dac7a3fbf6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685505, "uuid": "58f83168-5d5c-4c9f-af0d-aad5668e62a2", "value": "12288:QMrey90Wa5yBOAdL1yBrSFbUhlBXxs8SHlaCYYMrk6SpoBeaKVl:eyFaEgAEhvJSHECYApIWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685505, "uuid": "4f668726-dee0-4dee-815f-d48c695640a8", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685505, "uuid": "dde3f010-7ece-4f55-a45c-934d297e1cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685505, "uuid": "c42876d4-120a-4f4b-b1b1-4ecc28b98670", "value": "1d0fbd5c41a0aef56f28e1c20d10e394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe58779-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695267, "uuid": "61c15c77-dfcf-4073-866f-ef7235a5378c", "comment": "Malware payload (RedLineStealer)", "value": "17d587738c478d4a626b1b1988412244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695267, "uuid": "5f39aa8e-7c99-46b5-8d07-2ef1ce414dcf", "comment": "Malware payload (RedLineStealer)", "value": "b227525eb2c7178abcbc40f1f5fdfe41869b928c3d3e449db71b1f9be5d41418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695267, "uuid": "949a44d3-b0ee-4b34-b160-382111bf05f1", "comment": "Malware payload (RedLineStealer)", "value": "9c5f33acbf9bde6c441965a5d68d2b26c1cf2aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695267, "uuid": "4a69fd6c-84f3-4cf0-b98f-ea7fe6ccb5c3", "comment": "Malware payload (RedLineStealer)", "value": "3c665d836cb312b1d0b34b87f5a7c7a5599f3d46531fb0b4c884c0b4a057890b240bfa7bb899939e3119a2fa136252f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695267, "uuid": "d019fced-7023-4f3d-b78b-948aa43b3b3d", "value": "T166B41227A7F49033E9B01BB028F702C70B393DA19E74836B2759655A4CB3AD0A572777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695267, "uuid": "c1ef7fb8-f54e-4b0b-903f-fe2aeee1b4fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695267, "uuid": "bc845bfc-0311-451d-8dbc-3570ac396449", "value": "12288:XMr3y900YJHLuoM3jba7G5COmXcHSudQicPN3B:cy3QST5pmsyKQicPN3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695267, "uuid": "66dff9d2-27bb-4346-a340-b63dcaf8b018", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695267, "uuid": "6c2a0362-9af6-49b5-9ca5-37683b56a356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695267, "uuid": "80b213df-5265-42b5-bbee-aa85db211467", "value": "b227525eb2c7178abcbc40f1f5fdfe41869b928c3d3e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6ed140-2eb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690705136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705136, "uuid": "76c69f0e-60b0-4933-bd63-da3207521e1e", "comment": "Malware payload (RedLineStealer)", "value": "2c56695b0c3cd32b5efc7ea0481a8a68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705136, "uuid": "6cb1083d-66b2-4e4f-8eef-6e5b76458989", "comment": "Malware payload (RedLineStealer)", "value": "b26af4e1c612f734b04ff47eecc5e62c557d477bb490d568d089bdb9be56f24a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705136, "uuid": "5d91baac-bd34-48b0-96c6-51e6571b494c", "comment": "Malware payload (RedLineStealer)", "value": "e64067f9b730eefe2dc74cc725e2232a4e920565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705136, "uuid": "ec815ddd-60b8-4022-a131-8780484fb5aa", "comment": "Malware payload (RedLineStealer)", "value": "30c1207acc104137aba805e77ed7859cd71a09bfe417813e35059c978b6ed316eaa3d2bad1d2c84ef0976b8a3dc9eefd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705136, "uuid": "8e8bb3ba-08a1-4bc4-a067-f9a482cbea5b", "value": "T1C0B41257BBEC8036D8B917B068F613931E367D6199B9D32A2744946E0C726C4E27233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705136, "uuid": "9dc05db6-2dbe-4846-82b2-82fb86f20b06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705136, "uuid": "474cbb3b-3384-4ff5-b763-9e5576b54576", "value": "12288:zMr8y90s1tVMNmbzo1vflsUT8BpSgBYCS41wsTQ+W8:7yymbzoUG8pzhtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690705136, "uuid": "d9d4c6a0-1edc-4d8a-90a9-415a5660a909", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690705136, "uuid": "b823e677-8932-4937-819f-3d182eb60dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705136, "uuid": "ba730f6a-99d4-45dd-b739-4a26732fee54", "value": "2c56695b0c3cd32b5efc7ea0481a8a68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cd7bb6-2ea9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690701533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701533, "uuid": "87c32791-7a25-4e9e-b012-71694de6b5d9", "comment": "Malware payload (Amadey)", "value": "be2fe1b8ac744751a57baf81af167425", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701533, "uuid": "05a9b583-3bb4-4434-9155-5424dbf2822e", "comment": "Malware payload (Amadey)", "value": "b39939a4c2e4297c1d1732aba7135a8ef70f2822d8d96e2b05ad593e64fd78bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701533, "uuid": "aa889b89-9ee7-404d-a83b-7e107ea188b5", "comment": "Malware payload (Amadey)", "value": "1c394fc7f0621feabc28fa5a2e578afea6b511ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701533, "uuid": "07e3f5e9-3816-4982-bc5b-9eef2e8d10b2", "comment": "Malware payload (Amadey)", "value": "c0bdf4aa57a7f1bdc47610b97ab53a7823f41606e1ca69561cc63fe50c5d9263ccb7aa37fc753d4057cf2a03b8945b16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701533, "uuid": "0a14f3b9-06e7-4772-a9e5-0c0cdde2ecf9", "value": "T16ED41207A6EA5033D975377464F747831F35FCE2993893A32B92684A1CB36C0A479B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701533, "uuid": "46718ce8-8574-4d57-81d4-b9d20a3a2439", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701533, "uuid": "5faea4d7-f3c5-45dd-b107-a760b3c42956", "value": "12288:RMrBy90oDtcHb1dmHaZCiygHdGlU0MJ6rj5XemyMJ4:wyrtUAaZCzgHdUsJ6f5o+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701533, "uuid": "867a3f10-84c7-48fa-847f-bcf423c1df8e", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701533, "uuid": "8f2022d9-952c-41c2-9f2e-0a1df57712ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701533, "uuid": "a80b3dd5-d373-4493-a8b0-f9d629c2b147", "value": "be2fe1b8ac744751a57baf81af167425.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5494700-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685827, "uuid": "e6d0c26d-ca30-40cd-bb87-4ae86ce180d0", "comment": "Malware payload (RedLineStealer)", "value": "3de18bad8d6b2693194daa6da0e0f584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685827, "uuid": "f1e187a7-5fb4-4516-b532-86ac0e3205af", "comment": "Malware payload (RedLineStealer)", "value": "b3aa0f4ab057fcc47661406b009a83644e4e45e8814b8f6b953269b165601e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685827, "uuid": "76619de8-7cb6-4d41-a4b8-1e5f1f1ec1b6", "comment": "Malware payload (RedLineStealer)", "value": "7365b30e0ded51c0167d5833b5427a168805c8c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685827, "uuid": "ff94112c-c678-4b79-8c9e-990737a528ac", "comment": "Malware payload (RedLineStealer)", "value": "e2b04c31eb877eb144d85596c9fbe814e38877d4a6ad678b8bcbe4ed67defcbebd9564f5190f939f79eb6a3bcc89d49a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685827, "uuid": "ea7cc431-69b6-4bda-9849-7d346831d6d6", "value": "T10DB4022367E95532E8F117B018F703A30E367CA15E78C36B2746695E4CB2AD9647233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685827, "uuid": "f790fcf7-ecbf-49d2-9ea3-21dc95699126", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685827, "uuid": "27fa4bbb-b9c6-4d74-9840-80c5c3b4b663", "value": "12288:KMrdy903tHeg9hS1mLSmaRlsGHV+xO0wpddNrAYILq/Vgp:fyINeg9hS1mLVavsAeYTdNrccA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685827, "uuid": "6df8f730-689a-43f1-aee7-784306ef775d", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685827, "uuid": "8bc4cfdd-653a-4ad4-9019-f3a0ee5739e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685827, "uuid": "1c7fbf55-c738-4d47-ab90-c517d315381c", "value": "3de18bad8d6b2693194daa6da0e0f584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce136b08-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685842, "uuid": "ca4fc509-5334-4fa3-aba4-9e002819b298", "comment": "Malware payload (RedLineStealer)", "value": "7542551d341048a668a58cb10c2152f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685842, "uuid": "076413cc-e260-4d2d-90cf-b46d5b55a5dd", "comment": "Malware payload (RedLineStealer)", "value": "b3b8299ade63b725b6569739ea884e01ba7a3d3566652f1a52ca1d2d8e93676d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685842, "uuid": "e57d269d-7360-4989-99cb-aa220b1d77c4", "comment": "Malware payload (RedLineStealer)", "value": "773a48a30bcbcf72d8a4f170ca5f8e49b6e89f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685842, "uuid": "85829458-3599-41be-b16a-0001525e79c0", "comment": "Malware payload (RedLineStealer)", "value": "e9c4ebe3bd08bc2ea2c39fd9b89b9091d524e4b702abb27c73b2584c0f2d8ba6ed27a8d6f313a0369172dcb39ffe85fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685842, "uuid": "8c2cbb25-7471-480a-91ad-3b87b97715e3", "value": "T1DEB41213E6E84133DDB527B069FB42830E36BCB1693487673B51A99F4DB22D4A871336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685842, "uuid": "c092e00d-3fa7-463d-9497-7a7ba2c72ebc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685842, "uuid": "42a18750-356c-4427-8d16-8e941b2c75b7", "value": "12288:6Mr0y90w05KaB4cSGkCB6HYxyIjTaYqlRRgUff+GgIX:Wyt05O/3CB6oyIjToRgS+6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685842, "uuid": "ebe2ecfd-9244-4549-8d5b-1ab7f2bd7749", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685842, "uuid": "94a89800-fc0e-4097-8b76-1b3b437b2fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685842, "uuid": "99aa2c74-71e5-4a4f-b94f-5e29dab556f1", "value": "7542551d341048a668a58cb10c2152f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a8ecda-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690687066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687066, "uuid": "d23c028c-405b-4160-b6fd-ca800e8b313d", "comment": "Malware payload (RedLineStealer)", "value": "b1ad58423a36391dd51fe40615797d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687066, "uuid": "4abf248f-a609-43d9-8a2b-1496653b5404", "comment": "Malware payload (RedLineStealer)", "value": "b4470e39efefc1f10de134bd9f9c0bc1c05293597f25b6c993d1512076963d6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687066, "uuid": "aa5b0e4e-9594-4277-813b-6aea885ef8f8", "comment": "Malware payload (RedLineStealer)", "value": "61f41c830197619df9bf26e4bbb9db0931c2b529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690687066, "uuid": "22464029-b6b7-412f-aca3-5b3f5496f5c9", "comment": "Malware payload (RedLineStealer)", "value": "83fb8a9e0454c9fe58dd5f6b6e16ca56eefb4bdb5307f63d6f4729499be17cfefe7c4d2df293f0a176e4282ed9b3f10f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687066, "uuid": "edfa45d3-7728-4fcc-ac0c-05a934237052", "value": "T172B41207B7E88472D87527B058FB17931B39BD916C78D32B2705A95B1C722D8B83272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687066, "uuid": "3f28b589-76b7-4bef-ae89-cf1991b634fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687066, "uuid": "1156137c-9850-4fdc-b100-ca3c2c9dabcd", "value": "12288:uMrBy90S4dTlBVoAzfwdGiCJj+gBYCjoADQLf:HyWriAzf5iszcq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690687066, "uuid": "da1addd4-bb9b-443f-822e-2ce897336467", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690687066, "uuid": "cbb12171-9980-4da3-99c7-512af38cd86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690687066, "uuid": "9fb15693-c0d4-410d-97f9-2c357833887d", "value": "b4470e39efefc1f10de134bd9f9c0bc1c05293597f25b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c506aa-2ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690713260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690713260, "uuid": "0d6d6a18-facf-440f-8255-0ea55f1f6e5f", "comment": "Malware payload (RedLineStealer)", "value": "80bc2043c15a7a108ace0200df332b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690713260, "uuid": "4a1f3b86-b90e-41a1-87e7-fcd21552b6cd", "comment": "Malware payload (RedLineStealer)", "value": "b57a5a2244f0eb3cbaedba5ff449cb4b762afc176b865f6e367ae6fa1b12a6ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690713260, "uuid": "41eaf0f2-b1e9-45fa-8b52-6ee4ada8dbd5", "comment": "Malware payload (RedLineStealer)", "value": "fc15823123832cf4ca6f19e68db949c4c0faddc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690713260, "uuid": "bf255eef-55f7-462e-918a-1dd2d0de6d50", "comment": "Malware payload (RedLineStealer)", "value": "75680cd6754ad9e051ad349b4fbdfc79b18b84799eb8810bf6b2728be76d4b22813708e578d3761bf924a8fe3b510694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690713260, "uuid": "9f0f47b8-3077-4417-b27a-44ca31ce37d7", "value": "T1B1D41203F6E41432E47107B18CFA07D31B31BD95AD78976B3B86955E0CB26E4A87273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690713260, "uuid": "1e7c3acb-5206-4d27-8da9-32bcc91c6d0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690713260, "uuid": "04cdbb9b-de7c-41f1-8ca9-9ecdac374a92", "value": "12288:xMrgy906AKW7RoqcKt4p78XwG2sn49d4D+id3w1aZvwKB1R6IRWFXAi:xyfAKcRzSpKwG7tKCwKB8Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690713260, "uuid": "a64f500c-ce8d-4357-944f-38e110089420", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690713260, "uuid": "8a1b8e37-9d62-45bb-b2e0-6c1c063c8f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690713260, "uuid": "5be25e3c-baff-4295-b8ec-8f12979e7332", "value": "80bc2043c15a7a108ace0200df332b10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfab636-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685840, "uuid": "244dbb35-c226-405d-b3bf-1e372f34e0b6", "comment": "Malware payload (RedLineStealer)", "value": "0f273763b0c25474aa30049ad0267125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685840, "uuid": "28f3541c-ee8c-45a0-82a1-d75dccb07bd6", "comment": "Malware payload (RedLineStealer)", "value": "b5cf853b21edc44f0712ffb827b1b4352245377b0fd92f0a51d6dc83b5edc99f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685840, "uuid": "86da932f-3104-490d-83d5-80d29b7234a2", "comment": "Malware payload (RedLineStealer)", "value": "fd897981ee568b7987a3d2802885e334f41d036f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685840, "uuid": "45b88ded-21b4-4eca-ae18-a602bb830b68", "comment": "Malware payload (RedLineStealer)", "value": "37cef5518cf684b38ce8a21ccdb0e6882c6edadb90b4b1e5f3be9e42e866e0d773028dcbc7bc7e9617bc7c012c83c8f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685840, "uuid": "60339d7b-34dc-49de-bcdf-51d7656673be", "value": "T159D41263EAE494A3D9F927745CF713831A723DA18D3403A73244B98E0D727C0A5B676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685840, "uuid": "43f5c19b-8bc6-410a-9284-7fad4d979461", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685840, "uuid": "d075202f-c009-4d61-81ff-7918885d85a5", "value": "12288:fMr0y905ioDTl/GBOb+tQwSxpURU/4XFlqI8H0huqnMk6PJuKj+:jy2TOGCQtx7wXFlqI8H0oqMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685840, "uuid": "3ccd8088-c6b2-4a97-930b-0da1bcc413e4", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685840, "uuid": "29efc12f-65d1-48c0-9650-e696152ade01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685840, "uuid": "c2f4ca53-d150-4afe-b53b-243322d75396", "value": "0f273763b0c25474aa30049ad0267125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216fb6ed-2eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690708745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708745, "uuid": "fb566815-aeb6-4454-931f-9207a51b423c", "comment": "Malware payload (RedLineStealer)", "value": "7c1c029584e1ac7a44aeb9de7cb8e7ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708745, "uuid": "7ebde7b9-fa6a-469f-b52c-8393a6666e45", "comment": "Malware payload (RedLineStealer)", "value": "b67eac365a0ec306628909ec8c1fda737fdf32f2331255f585656f57de436131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708745, "uuid": "4e2d0c0f-ea16-4e5f-8e88-10788b8afa64", "comment": "Malware payload (RedLineStealer)", "value": "9d293f961d3ebf32d786609081c526e10674c693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708745, "uuid": "6a694043-264e-4aae-9245-05f6f9f6a2dd", "comment": "Malware payload (RedLineStealer)", "value": "79e97ca99037a9c9b67277959b966cc3679302f395902220582350ac7b13e165c1960570a24d1ff22fc105f45cc81cee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708745, "uuid": "253deeb8-345d-46a4-8f4b-2c005d683bff", "value": "T1B4B41202E7D8C432EDB517B095FA43C306367CA25DB887672681996F4D72BD0A97233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708745, "uuid": "32bac0b8-c669-4b0c-8c90-71101229373d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708745, "uuid": "6ada5769-ecdd-41e8-8c49-fb0bea88bf44", "value": "12288:ZMrKy90xnPK09Yn3whHWBAY4/xejeyfmTRgBYCiNUfyt/BhqEg:byePNWgIAYgxGegJz0RPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690708745, "uuid": "271c00bc-c734-4df3-9b3f-9c0c7cffde44", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690708745, "uuid": "530488b7-7e85-4128-9702-b8fd9b5f46e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708745, "uuid": "fdbe5a57-ca32-4986-ad3f-3ad5081f91ab", "value": "7c1c029584e1ac7a44aeb9de7cb8e7ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d74f382-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686136, "uuid": "ef9250e0-8fec-4650-a4bc-46bcd0e55d7b", "comment": "Malware payload (Amadey)", "value": "9599d149ba9979955404587c90df2921", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686136, "uuid": "b58be7f8-ab7b-4c98-8658-1a0a1671ad01", "comment": "Malware payload (Amadey)", "value": "b695010b0b7c652b5ffd2d66582334b099d1fbbc87a7d58ac54bb02d63f60bad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686136, "uuid": "aebaf8ae-7605-4d40-9544-90b1d539b1b8", "comment": "Malware payload (Amadey)", "value": "50a26465d88eee164a8a012eaaef3fa76bb59f0c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686136, "uuid": "fb495005-9f3a-499e-a7f0-c85589493d56", "comment": "Malware payload (Amadey)", "value": "80c9ff20f50e3259886ef935049cf898d3c40473203a75905d271d765ba5a8ed9553847ae9d17d2cc629b249da2e3469", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686136, "uuid": "fe294efe-059f-422c-8b4d-b7d04a652fb4", "value": "T11AB41253AAE98023D9F61BB048F701C30B367CB1ECB5926B2799894B1DF2181F875367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686136, "uuid": "e09b4262-c0fb-4339-85e4-ad4f264cffbc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686136, "uuid": "8e648304-c771-4096-be13-56aea393fb21", "value": "12288:7MrVy90DEy0FgWD9+SJXjNSMoyi5uA4fm:ayHypWgMXnoJ5Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686136, "uuid": "1617a126-b138-47dd-ad26-6055fb08ddd9", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686136, "uuid": "88b37213-606f-42ef-a6e9-4c088a0f3f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686136, "uuid": "891b363c-0464-49c6-8a39-a52e2405af51", "value": "9599d149ba9979955404587c90df2921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5b8707-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685810, "uuid": "85052a94-fbd1-4738-a226-5b0fa7d8274a", "comment": "Malware payload (RedLineStealer)", "value": "1c109c9b1a3b11edd79b332c48a5c094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685810, "uuid": "ca396f7e-3d4b-4e6a-8e4d-447586a963de", "comment": "Malware payload (RedLineStealer)", "value": "b75aa5e97e8c605527f0a043b675e6523edb7be5f4ccfe77c601da83d78703be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685810, "uuid": "736114ba-cfdc-4e09-ad89-13928ce79e88", "comment": "Malware payload (RedLineStealer)", "value": "1aa6e60d4d725a9faa4cbe6814c48c319d53bbc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685810, "uuid": "54e34d84-9434-4f5c-8048-28dd38738838", "comment": "Malware payload (RedLineStealer)", "value": "585c9ad71cf1b7ce92801745e25237562fc556995d4421041e7d31367cfe7de11b90131027339798dbe97f0177b52afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685810, "uuid": "c12ed460-80a0-413f-9874-a905e2ef5c1b", "value": "T18FE41243FAE84463ECF22770A8FA13830B36BDA1587886A77755649E4CB36D87434727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685810, "uuid": "48b7094d-202d-4fbc-822a-b717bc58d363", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685810, "uuid": "31a3b3a3-7ee1-4538-8b40-45f1fad19321", "value": "12288:gMrZy90pqhz7aVwiAjwJR8yW0SKgtWCGo9hJ6X3S+twbQ:Jyb3q38p0SKIvGshJs3lt2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685810, "uuid": "af979546-fb6a-4dd4-bb29-78e0eeef9fc1", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685810, "uuid": "99bec2f8-041d-4c44-b1c4-02b76c5ec8f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685810, "uuid": "7b4d818d-13ef-420d-bb48-21077e65e92a", "value": "1c109c9b1a3b11edd79b332c48a5c094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c1778d-2e6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1690676329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690676329, "uuid": "cf4143dd-5847-4ba9-9a38-42654bc6ea73", "comment": "Malware payload (RaccoonStealer)", "value": "cd466f12ddbe80dc64f34868f9ae4126", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690676329, "uuid": "277cd8a6-5cc5-4004-974b-c75c99acc916", "comment": "Malware payload (RaccoonStealer)", "value": "b773ca84f8a93ac8477e377178499e5f4bf65cf3fdf228c3c4a594fc19edd647", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690676329, "uuid": "41d4d0fb-635d-4790-92aa-e7f595706abf", "comment": "Malware payload (RaccoonStealer)", "value": "2dba5307f91e010acc61f157ed2fbe9cfec9ec0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690676329, "uuid": "ae02104f-5f05-4475-9930-9c9e5c86bc3b", "comment": "Malware payload (RaccoonStealer)", "value": "9347607eb7da0e7550abba93d9d8905c9d674589c522aee4fbb4dbab854440f420d4382ca147ee97eace0ba58587c6f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690676329, "uuid": "b4533664-344e-4ef0-a7d3-ab34a42a1112", "value": "T1A956236713600019E5E6CD38943B7DBAB1F5426BCBC1ECB4E8EA6BC11E225E6D713943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690676329, "uuid": "7976531e-ffd0-4ded-848d-0ee625ec8430", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690676329, "uuid": "2a7c75d1-fff5-49ce-801d-ff2ffde9b107", "value": "196608:c0+9DEUDYUhqeucv2OQB+3gu5vJtF5JYfc:P+9wOqQiMLvJ92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690676329, "uuid": "71c0db3d-d0e3-4998-a1c3-1e0ab0381230", "value": 6325760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690676329, "uuid": "895f73ee-d55b-4bfe-9308-ca980ea8e428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690676329, "uuid": "6d834638-3808-4c74-98e5-11e0f905f22a", "value": "cd466f12ddbe80dc64f34868f9ae4126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a55f57f-2e92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690691580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691580, "uuid": "f203d350-f791-416c-b17a-4fb24d993fb9", "comment": "Malware payload (RedLineStealer)", "value": "aa44f01835f3ec0026e065494ef8ea06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691580, "uuid": "c8a00e62-fd57-418d-9317-5e380b22947e", "comment": "Malware payload (RedLineStealer)", "value": "b84d0d196ac3a5bc6a2985b4c25e3d696b47d2b8ec83c55019d6c7a681b1d944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691580, "uuid": "f1669823-c837-4396-86cb-4e4623b9aba9", "comment": "Malware payload (RedLineStealer)", "value": "efd134db5c51c0cae008999b99a54c30ae40e562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691580, "uuid": "409b3f9b-58b0-44e8-b737-0952df4789fb", "comment": "Malware payload (RedLineStealer)", "value": "0cd637d96095199a40e124407cc7a1fdd835b62d73b6ba0e8b6291515f8c5ebd61b16b4fa7065eae929bd73cbd136263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691580, "uuid": "e11d99d8-892b-4599-93d8-cef8c7f7a745", "value": "T109B40207B7E89032DDB16770ACFB03870A36BD62AD78437B2255D91B1CB2684B57173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691580, "uuid": "ba8fe722-51fa-42d1-ab3b-e9048f556986", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691580, "uuid": "8ce8c0c2-d396-4811-815a-d6fc54b5bf11", "value": "12288:6MrUy90XZSA90kGHiwcrpveehiOgBYCQrtZoVU:ey4ZD9/GHOpvPcNzoZoVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690691580, "uuid": "e0841b28-09c4-4922-955a-2212595f18ea", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690691580, "uuid": "f6477a8e-8f05-4ad7-b905-582f262a00d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691580, "uuid": "07d131fc-ef02-4f93-b7d7-0ec699f42cf5", "value": "b84d0d196ac3a5bc6a2985b4c25e3d696b47d2b8ec83c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5459c670-2eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690704535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704535, "uuid": "0ea9dcd9-aad9-41d3-ab48-fd7f949553a4", "comment": "Malware payload (RedLineStealer)", "value": "16d385b1becdbc8e36f5d1d0fd57615f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704535, "uuid": "b8be03ff-0894-4a4e-893b-5b684516fbcb", "comment": "Malware payload (RedLineStealer)", "value": "ba5c9d840c93ebc6710e647c2536f2c811d7af83c76d5eda892fe21495932d7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704535, "uuid": "188a9d46-06e1-4af4-8d9d-f5c6ed6f0df9", "comment": "Malware payload (RedLineStealer)", "value": "fd744f498fdb587a65b48947c62f7e6e1cd6e2aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690704535, "uuid": "2d0acd01-a311-4598-b2a9-1a26dbd4966e", "comment": "Malware payload (RedLineStealer)", "value": "f04fa18d38793bbc23b34c19e90fe274bdc66edee9198bb5953ea2b349e2c3d9659f60596d74a3e6f92a2524761ef80e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704535, "uuid": "d31a39ea-0923-406f-b8dd-d6f71047729e", "value": "T1CFB41281EBED8471D8BA03B41CF217D31B36BD91A9A4536B3741589B0D736E4A93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704535, "uuid": "d78d0584-accf-454d-8506-48603b3bf9cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704535, "uuid": "cd55d0fa-e418-48aa-bd19-d27eaaba4a02", "value": "12288:uMrHy90dtJ2zSNyj+Tmq3mC9wH5/bCoeANWG:JyPZj+T9x9E5GY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690704535, "uuid": "d3477571-7922-4bff-94ce-9d0394913649", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690704535, "uuid": "25df1a2e-8c1d-41a6-a205-eff57ae90f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690704535, "uuid": "0d49ad3a-6a8e-4007-b343-8594ca16d68b", "value": "16d385b1becdbc8e36f5d1d0fd57615f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc72597b-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685812, "uuid": "9ddb0cdb-6d79-45f4-ad45-e4fb18c69b5a", "comment": "Malware payload (Amadey)", "value": "17201f27b9a737cc72d075b56827c6c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685812, "uuid": "183b783d-5110-4b7d-94e1-1c2708faaa15", "comment": "Malware payload (Amadey)", "value": "ba63b79154d52efadc695233ef2e71398a110deb3ae48a43566b5cb3d306ba12", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685812, "uuid": "fa825186-1b94-4e20-a17b-8602e3b9bc48", "comment": "Malware payload (Amadey)", "value": "74ae83b7f1da61329d8aa76dd29f24527f678b24", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685812, "uuid": "464f5e43-eeaa-4035-97da-0a29a96d397e", "comment": "Malware payload (Amadey)", "value": "a866d0c93679214a611cef8575f0d32414479986b36a055656d0eb0b93500ef3c3dedd6d448327469933d7c13584d861", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685812, "uuid": "5189fff0-e936-4c4c-8934-fd238bf1b771", "value": "T196E41202BAD8C076F8B6673059F31383073ABC614DB483AF2646ACA61DB3795A535737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685812, "uuid": "e1772d4c-5004-4287-9a2d-79713b437f51", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685812, "uuid": "1edaa496-b9ec-412c-b513-0cd6c3d43838", "value": "12288:xMrNy902d7dgDnxMc35dYe8plrP18g4y3RSUco14BQO:wyhSn2c3Ye8plrOFy3HF1MQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685812, "uuid": "5057a6fd-8291-479e-86f3-0142865ef7c4", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685812, "uuid": "01a99f30-da2a-424e-813b-1ebf1034cd95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685812, "uuid": "8bda7a9e-144d-4dfd-863e-762754037f93", "value": "17201f27b9a737cc72d075b56827c6c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9151e6db-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686169, "uuid": "a327b5ec-87c1-4677-bba8-efd8ba8cac3e", "comment": "Malware payload (Amadey)", "value": "be89e6d6095f86a6446279aa60968569", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686169, "uuid": "763ec0b2-59d4-4dad-b30f-ee91cd8cd7de", "comment": "Malware payload (Amadey)", "value": "ba75445c1f88f33294432dee6fe36bc76fe3db1f5eb77ea1a7746391ce7729e7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686169, "uuid": "c8ccad31-4ce7-42cd-bfa9-efa7e6830def", "comment": "Malware payload (Amadey)", "value": "75dbfa09c5afb88efa9bcb4faf4e0e41e43d46e9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686169, "uuid": "62d0af9b-950a-4b26-9571-7729446be171", "comment": "Malware payload (Amadey)", "value": "6352742fb8ef55e5fdc28a8fea52072f4ec0d2add8263e768cf238055a41545a1ba4953803a8e59ba86f97b517941381", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686169, "uuid": "eb777344-b88b-4620-b648-c9b79ee66792", "value": "T14EB40202A7E904A6DDF617B0A9F707931F35BD905A74936F2386985F0CB32D1A432367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686169, "uuid": "0fb4b296-d7c4-46ad-b704-86b971656cf4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686169, "uuid": "18f0b98c-98da-4084-82eb-d8fcc8952475", "value": "6144:Kiy+bnr+rp0yN90QEDgmkSq4ME0Op6lHc64SFzI29WwmVCYC10OthM5wRSsmfcHV:aMrvy90jkSk/96oW/VRQi+MAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686169, "uuid": "51aca839-e564-478e-88f6-b28c5b93952e", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686169, "uuid": "ad3837fc-c5ba-4518-b561-9d7930a36a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686169, "uuid": "dbd061bd-61aa-4cce-8a30-e1530bc35228", "value": "be89e6d6095f86a6446279aa60968569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927a56ee-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686171, "uuid": "978e3e76-9d71-4eb3-b4b4-d274aa7b9dd3", "comment": "Malware payload (RedLineStealer)", "value": "c298669f707e56598ce48a7aa006f1d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686171, "uuid": "9176eeb3-4a67-4de4-aa5b-33e7acb995a2", "comment": "Malware payload (RedLineStealer)", "value": "babc623f00a97e487f2ea540bd52e3d3dc44f748f8e82b431df48a071e96b834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686171, "uuid": "5a081ba9-da8e-42c6-b473-01fccaf183c7", "comment": "Malware payload (RedLineStealer)", "value": "c4d81bd0631f3e89fce8cad4127910800f50d587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686171, "uuid": "e156c461-c40e-4581-bc60-870a3658a289", "comment": "Malware payload (RedLineStealer)", "value": "ff7e4db29a08cbad8ddbcb96e45d4fc5dfa7af693408e1e85bcb0509bb5b8c8ba9d17f53e9e1273ed18a691f2d63911c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686171, "uuid": "f2d09005-86c3-4588-bd6d-7ccd942b03a8", "value": "T140B41263A7C88563C9F56BB01DF716870B31BD616D38C31A2792A94A19B36C0A53337F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686171, "uuid": "a22072d3-7e6a-43e5-9bbd-6079d62543ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686171, "uuid": "b19ee58d-bfc4-4dd1-a318-b6777c38b314", "value": "12288:jMr7y90fPbL00q7T9cuC6dWlcT8p7D1rwSD60OJJSPFBe:cy+Pv09rC6dRsX1rlD60OJJSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686171, "uuid": "b9eaed4a-9446-48bd-aced-25344a11648e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686171, "uuid": "8f1dc2e2-79db-422b-856c-d78fbff25348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686171, "uuid": "f56ddc50-1965-4575-809d-dbce30ae61a2", "value": "c298669f707e56598ce48a7aa006f1d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc85e23d-2ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690711153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711153, "uuid": "a8d5c35d-c498-4092-9bfc-4e02cafcb96a", "comment": "Malware payload (Amadey)", "value": "cea342a1376b4a54cd73d443ac13e4dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711153, "uuid": "a8db3811-a61f-464e-ab7e-c1303b440263", "comment": "Malware payload (Amadey)", "value": "bc2ca4183bfb1ea1fe5be4e570282d97dc3e6cab30a81b65f720f54a417ba735", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711153, "uuid": "e6831dab-876a-427f-8b15-bb01a20d1f08", "comment": "Malware payload (Amadey)", "value": "5b6c97b7d29f6caac4af78534d1056426e0a6bcc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711153, "uuid": "70ee9386-f58d-47cf-8454-81868d33fa99", "comment": "Malware payload (Amadey)", "value": "b41b9824202253b1017a3fee8a930ce721d20a71c6826fc4c6866dbfb4f521bc0bfd9286cc2171543d3e8e867539c78f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711153, "uuid": "24bc8aef-0e8c-498d-93b8-bc39c3e415b5", "value": "T1EFB40212A6D88136DCF4677029F213D30B367DD29C7C835A2786AE6E1D73184A9B172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711153, "uuid": "85659835-cd80-46e1-aa4f-cc487c857dc2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711153, "uuid": "1a5674a6-fd20-4e39-aebe-c3a9385eaadb", "value": "12288:tMrVy90d1J2GtaKALStJnFAbjwsZH2Dj:UyQKGUKA61FAb/ZW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690711153, "uuid": "37f9255a-f42f-4679-aef6-07d8b90962c5", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690711153, "uuid": "a1477ce1-c5c9-411b-83df-44047a65cc49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711153, "uuid": "c855ecd0-57c0-4167-9756-b1467aef4cd4", "value": "cea342a1376b4a54cd73d443ac13e4dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a894cde-2e70-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690676924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690676924, "uuid": "c0f00582-3e4a-4f9e-84c7-2a058cd4d8e6", "comment": "Malware payload", "value": "ef8abe29ea0b5df003f1f883290e08de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690676924, "uuid": "928d10c5-cb7f-4714-bd33-38f41a49fa7f", "comment": "Malware payload", "value": "bcc7c41209afcf67858b3ef80f0afa1eabf2e4faadcaa23bacc9aa5d57b9d836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690676924, "uuid": "2702e13c-2775-43b1-8b78-d156b4b6839c", "comment": "Malware payload", "value": "3afcfdab42519467c62dcb8ad4157880a6e0983c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690676924, "uuid": "e4c69ca4-1c82-4ae9-b583-0aedaedd489e", "comment": "Malware payload", "value": "928766cab375979fbc8fb6164d28bf0c9cd95c9e1f26b06c33a965d44861c15a0fd04986100bba006da2b1485a95df2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690676924, "uuid": "099aff97-a6ff-40a6-86dd-ed297f8d9b30", "value": "T14B52298BFA8644FDE65801B588732E1593B5B31C03F156CFA3A06A4D5E776C93438F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690676924, "uuid": "560b9b2e-2901-448e-aed0-6ffa7fd6d299", "value": "3958b5fbc8acc612838d7c869ca4156c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690676924, "uuid": "a682d620-9e83-4a22-a89f-a39b79bd77eb", "value": "384:VXtvjo3oWZMrnUmAcokBVbPFxEIOiHTCa:TrwqnUmAcokBVbPFxEIOiHTCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690676924, "uuid": "ee362e38-7e08-4887-a843-311a8da1fe66", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690676924, "uuid": "1d25fa56-0f0b-4f24-b806-127c6d355dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690676924, "uuid": "7c2dca70-3943-4e5e-9a4a-d59dda16f8e5", "value": "SecuriteInfo.com.Variant.Ulise.424202.7581.7847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a52ad28-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686802, "uuid": "53d3da1b-02e1-4295-aa62-6ede98f8b491", "comment": "Malware payload (RedLineStealer)", "value": "f39abb0c33bb5208869d2a011f57be67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686802, "uuid": "46a0c0d3-2201-4222-8cbe-d45a4bd47ffa", "comment": "Malware payload (RedLineStealer)", "value": "bd4db20a91bd64c0ca6817c8ca3a7325dc40f5c571b604b9df1f66667c88471f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686802, "uuid": "95e3253f-96ed-42fd-a2de-a83bc8a20985", "comment": "Malware payload (RedLineStealer)", "value": "3556528fd097529cb0c8df02cd719b1ffd821088", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686802, "uuid": "cb4f18df-8a96-47a1-84c7-dd4a8ed2d08c", "comment": "Malware payload (RedLineStealer)", "value": "ef3a85238d71753f976b8c3db4e8c9a5d66bed669de70055926b1a6d87fd934a2ea240dd741a861ce84ea2c0d17da616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686802, "uuid": "f50f74fb-5820-4618-8b85-01e2c571660e", "value": "T15BB41242B7E89536E9F41BB04DF613930E36BDB18878835A23C5695E0DF32A4A17173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686802, "uuid": "122f856c-294a-4ff9-8dd8-512912bd8cc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686802, "uuid": "4140f37a-f0b9-4707-a00d-343c759d0c6b", "value": "12288:NMrjy90iR/rBFDu28HMP/ABph4L0trSP3Y1S2wiqTR:iyxDBJoMP/FpVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686802, "uuid": "ca8e6e60-e430-4766-95fe-babb51ef4270", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686802, "uuid": "4f0b5237-2591-4d15-8fa2-553fbd0d3dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686802, "uuid": "e9d68f00-1262-4905-b378-56ed9984510f", "value": "bd4db20a91bd64c0ca6817c8ca3a7325dc40f5c571b60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1439c1-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690701171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701171, "uuid": "f7b35e32-1e27-453b-a893-8b3d58a91166", "comment": "Malware payload (AgentTesla)", "value": "4ed2f05d7145240494afd3f82099db00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701171, "uuid": "b9318f0e-17d1-42c9-8f1e-3902d9452210", "comment": "Malware payload (AgentTesla)", "value": "bd76dfd66888cb5adebf9737c7f7a9860cd8de96cf809208026401c95f425100", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701171, "uuid": "9b7d71f1-5fa3-4b61-b74f-f657c861394b", "comment": "Malware payload (AgentTesla)", "value": "b952477dd43b0817d2f47748ffd5a12320a603f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701171, "uuid": "9bdfc6af-c581-496f-84ed-591515071cd4", "comment": "Malware payload (AgentTesla)", "value": "7c66d97299c7aec5ff4d41d954a0ec800294e3c6d5ae258a74fac1ba2bc6e0da8aae2d4e6e358117afcc70bc088a10e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701171, "uuid": "341b6ba7-386a-445a-83e7-afd2fee2f1db", "value": "T132749B0162EE4148F1F33F561BBA69A58F2BBE91563AC59D214C1A0E4FE3E40CC65B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701171, "uuid": "bd481eff-8b72-452d-9825-a7c716940029", "value": "6144:E6AV2nLdMxzakn55555ZNFCPo9bM5KfrTHXTXiDX/Xl9bXaXWTeXApxpppTKp+5W:E6AVgMxzakn55555UPo9bM5KfrTHXTXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701171, "uuid": "3bc9f994-c3fb-47bb-b366-f3ab30d0f9d6", "value": 360748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701171, "uuid": "3e1feeac-42af-4a65-96ea-84aecb22efde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701171, "uuid": "134daa5c-cffd-4967-a162-7039d239a855", "value": "DHL867888_factura_commerciale.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9ec47d-2ea0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690697627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697627, "uuid": "86537369-6f30-417b-843d-cc8de452cdad", "comment": "Malware payload (Amadey)", "value": "ad9295a29188202676165fbbf89eeabd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697627, "uuid": "d064eb88-371d-4a57-b391-f5ac3a20d67d", "comment": "Malware payload (Amadey)", "value": "be0a7266a13e3cdc50c27a32c86b62acdca955d2cb206d1e71b3ffe13fff922f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697627, "uuid": "ce53acf6-d82d-4ef9-adc2-693c4e4a79d4", "comment": "Malware payload (Amadey)", "value": "5ae0d658347b4c6162f5c581acbb25fc236a7dab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697627, "uuid": "2861d888-1347-44de-88ba-2b09e3aea22b", "comment": "Malware payload (Amadey)", "value": "21a16ceb6201a28610af3882859f4a5e1d5426883daa1fda0964d7673a370774b5494b51e75e301a0434e9bda06571d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697627, "uuid": "7cccf9a1-fa21-4672-9f95-bc61f40327e9", "value": "T167B41212AFD89133D9B5177048F717830A31BCA18D79837B2B96994B0DB2AE5613237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697627, "uuid": "5eab92da-b7a7-4301-aee8-61dc1b5bec89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697627, "uuid": "0a57c556-fd43-4c50-a4f1-2456b48fa4d3", "value": "6144:Kyy+bnr+Lp0yN90QEStepZq5XAz1I6rphH5w3HYA8g0UlqfhajYB90EhlmBwt2xX:SMrXy90gj5wyMfO3HYtlUe0EhQeU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690697627, "uuid": "4327225a-68dd-41e5-957f-545534baaf0b", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690697627, "uuid": "a81b1712-5d92-4056-8368-c626c5b906f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697627, "uuid": "40864e56-8166-4371-a6fb-13c46ed70567", "value": "be0a7266a13e3cdc50c27a32c86b62acdca955d2cb206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7e68df-2eaa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690702130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702130, "uuid": "f9a3ea2a-4211-4749-b3f3-ee3691d4f9f9", "comment": "Malware payload (RedLineStealer)", "value": "fe89dd6d525d0decf31b15a694af9d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702130, "uuid": "95582141-d295-4e02-9510-7fe32a0ca002", "comment": "Malware payload (RedLineStealer)", "value": "be4b0c29ee1bb7fad4d720342abe11b8a6cf257a2a23e956a3a39838a945744f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702130, "uuid": "16eb0780-bd5f-4824-8997-6badd54cfe39", "comment": "Malware payload (RedLineStealer)", "value": "ffbf420cee21eb068b0053049939362b0dee59b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702130, "uuid": "e672e643-35ab-439f-a02e-18ff3bab8c72", "comment": "Malware payload (RedLineStealer)", "value": "81048d1c503ec2026bb97a9faca11aba36ecc60a4e8906fa70212429c47545b12ff122efc236005033fbc4c251ee406a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702130, "uuid": "9eb46931-540a-44aa-9425-91a56563b49d", "value": "T1D3B402026BE44072DDBA277458F602930E31BCA3AC7893672646A95E4D732C8E57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702130, "uuid": "92b57fa9-cbf1-43e7-8e3e-16b03c0f5a8e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702130, "uuid": "da0cd79d-714a-41cf-bb71-1f690674e5df", "value": "12288:PMriy90lFZz1CEaYViMZar1gBYCtIYIno:ByenoEaYBZaruzvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690702130, "uuid": "bfdec581-2414-407b-a2d7-466b225beb7e", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690702130, "uuid": "779d960b-cea5-46cb-91fa-0a67a15c4a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702130, "uuid": "6155530f-cee5-44c7-b520-3d347c5b56b9", "value": "be4b0c29ee1bb7fad4d720342abe11b8a6cf257a2a23e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fde39a-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685822, "uuid": "09a09779-5a86-456d-8140-7244b54d88a5", "comment": "Malware payload (RedLineStealer)", "value": "291ca5ba855e14f00b9795f6423b5caa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685822, "uuid": "23fe3a3e-f28d-4a36-83ee-83bc26592235", "comment": "Malware payload (RedLineStealer)", "value": "bed18af065d17feeb31976eab625b7860a0d98231034c39f282b043c983205a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685822, "uuid": "5fb5da62-0af2-46e4-8dca-2a1ca9b27b88", "comment": "Malware payload (RedLineStealer)", "value": "e725c30f27152aeaa7c0ab608ab53ff62a1671b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685822, "uuid": "23c3d4b5-28be-4937-a7fa-4c27a30bc388", "comment": "Malware payload (RedLineStealer)", "value": "3a013a26eeca6e2d7b41952bd4a5f05f9e61c6fb36b67ff4b9953718830de2bfc9853da2b748804a6368a3dcb8641763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685822, "uuid": "228d34ec-c784-4911-a7f5-2d7fd6f9bd5a", "value": "T127D41213BBE8C473EDF2273068F9129B0F367C925934874B2749DA4A5D325A0B8317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685822, "uuid": "148aa0ef-e0a2-4efd-b328-840ecaf253cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685822, "uuid": "a202c8d9-3c7f-411b-88f5-fbfac142df90", "value": "12288:cMrly90G9J7i9FP7jPKpqQzsnyFjpccMcAM1f/+2ki:hylAF/PwsnyFjpfL5+2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685822, "uuid": "a2b7581b-2321-4268-b2b2-2b4b04f20732", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685822, "uuid": "68270988-c4ac-42c7-8cfe-01a8e61d2ef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685822, "uuid": "0f05185a-a9e8-4b57-b018-2d5112fd97ea", "value": "291ca5ba855e14f00b9795f6423b5caa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9df058-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686487, "uuid": "fbd9fb48-cf12-48a8-b591-24319d49c5ab", "comment": "Malware payload (Amadey)", "value": "925b6e7ee7dd429ace73bc4848334ae4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686487, "uuid": "3773e072-c267-451b-8cd6-3ce6c1f0178c", "comment": "Malware payload (Amadey)", "value": "bf71475ce459de4e4b9b9b6f053406da76d01eefe7f1ac259a078de0b5f5cf2f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686487, "uuid": "bdf3cfdc-1ee3-451d-a6a3-9df5feb1c6e7", "comment": "Malware payload (Amadey)", "value": "30bcf3d74707b03d4b55dd4e23ed57607cf070b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686487, "uuid": "a229b01a-0849-48cf-a6bd-5623f40450ee", "comment": "Malware payload (Amadey)", "value": "9b32da90394bdf649c094fa1c8d5c255270250f1b9816b2b11a8da469c46dd840a122b393cde54a9ff3692d829b59af8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686487, "uuid": "9d15a42a-273a-4877-b47b-dfed4e898682", "value": "T143B41203E3D8407BECB117B01CF712931936BCA29DB0875A27966D8E5CB36C1A57672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686487, "uuid": "7fb9ef1e-f06f-4e54-9a37-f495480b4ce9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686487, "uuid": "a493dfe1-43aa-4740-b9d9-aef31d2f6abf", "value": "12288:4Mrly90AmzqpHvGyPVK1W80sj7FlRv1/DXM:dyzmYHvJVK19j7FlRt/jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686487, "uuid": "731ce7f5-7ba2-4908-accd-8c679e8e4f97", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686487, "uuid": "1df5e1d8-56cb-4806-a87a-ac497966afc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686487, "uuid": "4ec4234e-c58d-455e-bdaa-4d3eaac140e6", "value": "925b6e7ee7dd429ace73bc4848334ae4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a935f36f-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690701242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701242, "uuid": "412ff3c8-0dfd-4436-a2b0-8245102cf42f", "comment": "Malware payload (Formbook)", "value": "59f195d834f5a358744ee32684e112ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701242, "uuid": "d8876525-f908-484f-9381-072b5a63c147", "comment": "Malware payload (Formbook)", "value": "bfb1e4ae02e8f53a6d2023eeda4399be5502b9ab99770c9c3e4bfde0548a459b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701242, "uuid": "de70cd38-fca1-4071-85ba-f8e55770db2d", "comment": "Malware payload (Formbook)", "value": "a5fa7839e7fb2634efe7aa61e28cd7889594cc09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701242, "uuid": "1b685a2d-9a06-4067-bd2c-5c193698e5e4", "comment": "Malware payload (Formbook)", "value": "bb28ebd68bb3788a05d7e6e2e041d9e5d5b913e227f035375916a8eabcc53a319cb7e07d5afdb3994d168b1d952f0d13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701242, "uuid": "17046edf-f6d8-479c-a8f4-52436f0d885f", "value": "T12CE4E041F26C1F6BD876A7F90C22E10493F6BB6A503DE60A4DF674C712B2BE10946E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701242, "uuid": "60cd181c-cd88-4d61-be97-6c750638e03c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701242, "uuid": "70ee9a06-5bc5-4939-bd68-ada94fd4675e", "value": "12288:p0gjj8cSwkbHh4j8FAVVbxtYtRiHPsJJhQFfvvEe+OnwwMN:p0gjj+wT8FAbiiHPsJcFfXEeqwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701242, "uuid": "d98cf8ae-eceb-422f-8e86-1eb95bc85131", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701242, "uuid": "acc21e91-b001-4b12-a0e5-779f1786d99a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701242, "uuid": "19870a30-2d6c-4a95-96c6-d60a9f621e26", "value": "FEDEX_AWB_INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857da8c6-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686150, "uuid": "acbec8e5-5268-4153-9d87-1354a6421ce5", "comment": "Malware payload (RedLineStealer)", "value": "ab9dde52927426f84e257336961c6b4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686150, "uuid": "be79ec9b-f66f-4593-9d15-2113c862e3d5", "comment": "Malware payload (RedLineStealer)", "value": "c2dde09d415c9a9cee697b38102054fcf775c3e2880ba4593929311da994dd11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686150, "uuid": "2866478a-a571-4924-894e-684f2937707c", "comment": "Malware payload (RedLineStealer)", "value": "f7c563c8b65b07c075a5511a3e1ee8cef52da9ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686150, "uuid": "a3ff38ef-3535-44eb-b20a-b75dbf088f54", "comment": "Malware payload (RedLineStealer)", "value": "d26330a1eca943d50ad470ffe76bd792a68e1f66deaec59414d2e405cbe221d54a8eb391584a16837e67748dc68dc0cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686150, "uuid": "0671deb1-c1ff-4351-abd6-3b7c32f30e38", "value": "T1C0B41203F7E8A472E9B12BB058FA038316357DA1AD78976E26C5951E1CB27D0E07173E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686150, "uuid": "d7badbd9-4124-4283-afdd-330815658b92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686150, "uuid": "d65a73b5-40ec-4f65-8cdd-d3ce6b9f26e0", "value": "12288:/Mrby90jRYgkwIWo+YS/ZBGLagBYCiVR4P4JyGj8zC:oycrkTWo+YSSNz6RZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686150, "uuid": "44cd9953-d9a6-49d0-a3a4-3785720f3eed", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686150, "uuid": "285308c5-64be-407e-9d68-b4b1e48618e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686150, "uuid": "f5c4d851-0e40-40c0-8814-6b4561d08021", "value": "ab9dde52927426f84e257336961c6b4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d82387-2e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690697022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697022, "uuid": "6f9fa939-53e5-4fee-8eb8-2d9fffdff6bd", "comment": "Malware payload (RedLineStealer)", "value": "cd1bd95b7236ce0ed66ac9f3bae5aa5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697022, "uuid": "94e227ce-8ec4-46c4-bd14-6a813304622f", "comment": "Malware payload (RedLineStealer)", "value": "c32d36f5e946e2b2e2b3a04bd9d223beda5d728514ffb04e841c71856061dedc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697022, "uuid": "7acd9d39-505b-4631-9257-f341621e162c", "comment": "Malware payload (RedLineStealer)", "value": "48362bbe6e2d1d20942f683ef1dba4cb4ee1381e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697022, "uuid": "c32bf8ac-df3d-47b4-8f94-cb85030b5b35", "comment": "Malware payload (RedLineStealer)", "value": "bd1707e4c042c1e77d738b4db387f97120a69929103f3f029413ec7ece6039360edd4782104626742fe6e4b0b02f85e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697022, "uuid": "ff265ad9-0983-4149-8313-15260e73c437", "value": "T119B4020BEBE85532E8B523704DF613870A3A7CA09C78476B2746694A1C736D5F93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697022, "uuid": "db38a045-d0c7-4b35-9df5-035052753a8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697022, "uuid": "2a80edd4-a5da-4683-b383-6c12a124675e", "value": "12288:SMr7y9054e0md9jVORdL5i1eYw2naFbANoY5Eyu:hyk4OkdL51Yw244Ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690697022, "uuid": "a38ddd49-ad30-4fdf-8c8e-52549b1c2510", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690697022, "uuid": "7225c69c-96e8-445f-a361-1ae682bdc884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697022, "uuid": "3c86c92c-6343-4bda-b569-ca35e0696663", "value": "cd1bd95b7236ce0ed66ac9f3bae5aa5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94908552-2e93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690692188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692188, "uuid": "cfc669f6-9c47-4353-90f0-5d1975c2a07a", "comment": "Malware payload (Amadey)", "value": "d8ed2c588d448c8a591b4acbfb35b758", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692188, "uuid": "62249dda-4554-4d75-be26-e4cfe3e8207d", "comment": "Malware payload (Amadey)", "value": "c362113d00b82bfc8c5fef2054fdf9eb63d12a307f49f031285cc68c5bc58101", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692188, "uuid": "cc371c62-256d-47fd-b782-c0b350eff01a", "comment": "Malware payload (Amadey)", "value": "a34c9d80de0759c2ca43c8428fabdf26dbaf0b6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692188, "uuid": "027e18d2-9694-4463-974e-5c7673e78b1f", "comment": "Malware payload (Amadey)", "value": "df33a37b3fe830a933dba07ee9a73dcb82aaea574f44be08413156f6ea7f8287b8e4be6dd293aad414303e1a97b6c303", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692188, "uuid": "53847842-6809-4638-b4ac-d8381825be9a", "value": "T198B41213ABE8007AE8B5277028F203871E36BCA19D74875B375B994F0DB3590A67173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692188, "uuid": "ae65ddd6-9593-4634-988c-f18e4d605b2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692188, "uuid": "47d84766-69e1-4f42-94ce-4263468d6865", "value": "12288:6MrJy90cQJq2nWfKdAOxdITEZq0zpgd7w6W6cIvrHOR:zyWM2n92/2pgdE6nOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690692188, "uuid": "7f91b618-18bb-48b5-9034-9625b765e840", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690692188, "uuid": "9252a7c9-8a1c-479a-8649-f111cee46e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692188, "uuid": "eebe5214-be23-4d85-857c-5de346e9dc34", "value": "c362113d00b82bfc8c5fef2054fdf9eb63d12a307f49f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b4d842-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686774, "uuid": "9c97b1ce-980f-4d1c-8bd5-789d3570c3ab", "comment": "Malware payload (Amadey)", "value": "768bcb3df2c366dc12285543560d1534", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686774, "uuid": "bfbc3798-991b-4868-bc11-a54816e29812", "comment": "Malware payload (Amadey)", "value": "c390ed25f3b6bef115c8a94b75287e2096b5748ec06fcaff4366342a4bc65282", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686774, "uuid": "b178f725-f1bb-42bf-92b3-ac263266836a", "comment": "Malware payload (Amadey)", "value": "0f06abadf68d9aa65e223c974fa5954b1ce86ed2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686774, "uuid": "02897316-652e-4efa-ac59-093dbd41b106", "comment": "Malware payload (Amadey)", "value": "314148ef0cfbcaa42edcc41eece69e43ecfce4cce90efab1f757ac9cf7fe8f6261a4e9f7519ea14adc6f1208a5437689", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686774, "uuid": "0ecd3fdf-cd54-4376-a2c7-8d59b3bba523", "value": "T1EAB41222A7F98072E9B51BB088F516C30F337DB1A974C26733959D161873690FA7273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686774, "uuid": "43440cee-7dde-4ce9-bc3f-29b8c881b4fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686774, "uuid": "f2732e57-7add-4a38-b593-ec5a3724cbd1", "value": "6144:K9y+bnr+Dp0yN90QE5dzdaQLxWrQgW8y4zoJYsEsGNlKh7OmqwpLVm6Z/ou6gmgc:XMrPy90hzd1LxW/z1f8pLPomUKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686774, "uuid": "c2351181-cb80-40fd-9f44-9599b3dd165c", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686774, "uuid": "125499a9-eabd-4dd3-bd41-75b94f7ed572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686774, "uuid": "2c901ab3-34f3-4011-b0dd-a7a6d4582c75", "value": "c390ed25f3b6bef115c8a94b75287e2096b5748ec06fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0c629f-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690709541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709541, "uuid": "a79d83b8-ff6e-468b-b3f5-e230d3923858", "comment": "Malware payload", "value": "edf94df1fd7e27b0a5dfcdf299662fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709541, "uuid": "ca98dd50-67f6-4096-9340-42a49a71a9c5", "comment": "Malware payload", "value": "c472f4044bf8a2db478e153b4fbdb8abfca6d81b774cae67e05c8167d5c06310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709541, "uuid": "c165766c-e3a2-4b30-b6c7-d9dc36555625", "comment": "Malware payload", "value": "236b3a1ef9c94db4d7b34a0b12d2c5bb69230b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709541, "uuid": "f3311fff-810d-47dc-b87a-a7afaf8988c4", "comment": "Malware payload", "value": "37de5fe53ee87e2ae35ff65c8d12139877b4837f6e3cf73258cf15c034edaede5b5e2d57f54e4bd19ba1e942fc9ed0d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709541, "uuid": "0d675ae1-fe06-4da8-ad20-5d445dd6ab4f", "value": "T1EE948C20B686D031DA6202715E69FB3A55BDFA704F365AC7F3D80E5E2EB01C16B35B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709541, "uuid": "d8381581-e450-4516-b787-557ae5d382bd", "value": "23daa7cf94123d67cc036c041658d343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709541, "uuid": "0a681c47-03bd-401d-a470-a04bba7bcb5a", "value": "12288:El4Q9zhp6r4wszElA6lc4dZVjqU8tGYOfhWyZ1e5z:El4QBhpOFsGlV1/P5nZkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709541, "uuid": "5402c448-3abd-45e9-9574-1ad4c4800dc2", "value": 441448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709541, "uuid": "d1f8c848-e603-470a-882c-cbb2f113e72e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709541, "uuid": "79d84895-f8e4-45ee-a932-8518d99b851f", "value": "SecuriteInfo.com.FileRepMalware.787.21695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9692a2e-2eaa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690702128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702128, "uuid": "dba401b4-099a-415c-834e-fe73d1b9786b", "comment": "Malware payload (Amadey)", "value": "29aa8f9dfc03a937e36869c7d450cbdf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702128, "uuid": "1daf1114-6caa-4dd6-a557-2d56285f0ebd", "comment": "Malware payload (Amadey)", "value": "c539c4a7f72482bbfbe123018fd5b772f2960cf13ba90b951d9d6f2faab0085e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702128, "uuid": "ddaff497-39de-46ae-bfa1-4a02f1906914", "comment": "Malware payload (Amadey)", "value": "e424c815af4984242bdcc2bc85a4951a5f9e8c96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690702128, "uuid": "e34a830e-5d1d-4c52-9ea0-e0345f49aa12", "comment": "Malware payload (Amadey)", "value": "46ed222759b9a6103c78e04b9b303874eaa0248e85fa98a10d85440d36e838772275dece9698f53a233e5bc016ed628a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702128, "uuid": "5362d685-d9e3-47ca-8bb0-fc35c4f3a236", "value": "T199B41253A7E44173D8B92BB05CF203C30F323D62897497672386A99E1D739D4A97272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702128, "uuid": "0cdb3e1a-d69a-4f6e-9742-0097836f4f57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702128, "uuid": "b074f37c-2759-450f-a3e5-595c4f2ab8b6", "value": "6144:Kpy+bnr+up0yN90QE6B8UW3EWKsxPRmp/dNeRUzNIjq85UzWFNEImwX2KuGQ:zMryy90I9UEWDPR6jGwNIe85UyNEQuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690702128, "uuid": "690096a0-8f15-4fa1-b597-dbaddc4a2c8a", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690702128, "uuid": "a6c17f2a-0a71-4444-936b-993d88cdf498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690702128, "uuid": "1d772f86-c3bd-459e-b0b6-0573bd1d1a13", "value": "c539c4a7f72482bbfbe123018fd5b772f2960cf13ba90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4336a582-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686468, "uuid": "a2d6c927-e6f6-4ca8-8540-820bff878904", "comment": "Malware payload (RedLineStealer)", "value": "0f23b93fce8f48859a307ef498fad036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686468, "uuid": "52ed301d-c45d-4c81-a31e-a07bc291a304", "comment": "Malware payload (RedLineStealer)", "value": "c82d2fce74ea779ecf9d29ba5e371111917a7724b72a321406755a97434b6b9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686468, "uuid": "18765d11-7e72-4e26-a96c-665bc32bbe55", "comment": "Malware payload (RedLineStealer)", "value": "e5caf73defacf25492e4ba5745095bfc5f8280fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686468, "uuid": "ad1432e9-81a0-4fef-acb3-9f1436976aa6", "comment": "Malware payload (RedLineStealer)", "value": "decaf6f6effdc0fdd206f383c7b154b2fcc50368becfce48a5ba2b01b72bb02e85ed0c10bdf696b8ff83b2107b4ebecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686468, "uuid": "184358cd-92c8-4ac0-8686-f3e9ff394341", "value": "T181B41202ABE89133EC7527B058F712D70739BC724C35D76B2689E55E0CA22E0E43676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686468, "uuid": "952f13a6-9918-4049-82b7-f1325635b6af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686468, "uuid": "e21c52ac-4eb5-4675-9149-52dc3208bda3", "value": "12288:TMrny90+FUygbfKU/tSHBuX4aMcgBYCOwkDMa:MyXtgbKUtM3DzVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686468, "uuid": "20f3b814-f040-4f5e-a213-debae650b7eb", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686468, "uuid": "9bfc31ed-f4d3-425b-bf03-426f8cb69d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686468, "uuid": "6f9e21e2-954c-4714-abcf-0306e2536825", "value": "c82d2fce74ea779ecf9d29ba5e371111917a7724b72a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e61d30f-2e8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690689493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689493, "uuid": "87eac91b-0874-460b-b4fe-8a0d908ed649", "comment": "Malware payload (RedLineStealer)", "value": "1c77593985ebf8a2ef9df90c3e125009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689493, "uuid": "057306dd-3c42-460b-8219-f21308e2bb24", "comment": "Malware payload (RedLineStealer)", "value": "cae238246aa73a5477a573ba31734b8d8d33436480c4d5c107d08d883f1b643b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689493, "uuid": "71aaebab-0c4c-4980-8e7d-a1f820616e6c", "comment": "Malware payload (RedLineStealer)", "value": "074b5ce6a0568e160f556b1c809c2131a8ffcc91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689493, "uuid": "18be5cdc-b6eb-4fe7-a6fb-13865bbcbd1c", "comment": "Malware payload (RedLineStealer)", "value": "f63d4e034fce870a22dbdb1d8f9bf33563336a9330e5423f5cd47c8d7baa2ff2e8a79451605e5254737cb3924c3da6a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689493, "uuid": "6d56d798-c92a-4b6d-9db3-d72950ccbbd7", "value": "T16594CF40BBA0D03DF0B312F47976C3A8A52EBDA19B2454CB22D57AEE56346D4ECB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689493, "uuid": "dae13d2e-d5ec-4c71-9bca-d5466add048a", "value": "341ace376080222d26a7767debb6055b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689493, "uuid": "3c8b1211-e122-43b0-9be9-cb015980b1a1", "value": "6144:A12WCyld8sWWBv/hpihkavOb6K7GlP1WLz+FQ7mxkz59kf/ud:AU4v/hpiPGOQLieNN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690689493, "uuid": "370d4f2e-66da-4be9-9815-aab0c82b9a53", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690689493, "uuid": "5a1b75ab-5fc7-4a12-a586-08cbe010377e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689493, "uuid": "5e6d0921-2cd5-4c50-ba2b-00232a95d691", "value": "1c77593985ebf8a2ef9df90c3e125009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a4d6df-2f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690745818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690745818, "uuid": "58773cbc-279c-4be1-86e7-fde59c3afc31", "comment": "Malware payload", "value": "35076aaab03b16a8d443f5d3f257cf07", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690745818, "uuid": "9dfa9cb7-3ed9-4bb6-b41a-9570dca5f5c0", "comment": "Malware payload", "value": "caf0756b22180943412bf57fb7e5848701e620ecfc219422fc74ae4e98ddcb68", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690745818, "uuid": "f0cfc0e7-172f-448e-9f76-9e62f5093350", "comment": "Malware payload", "value": "60ee5637f297f9ebb94d2f513290caaaaf04a0c5", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690745818, "uuid": "39ac2d67-1e42-45c3-815a-33fd1b987106", "comment": "Malware payload", "value": "dba3874176215f6759461cd750c23cda57ac2cabc33ee30f98d3b1a22d439f5b5ecc033e4bb1683d191cb68b5ded3702", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690745818, "uuid": "6c8f6062-0af9-4a6c-8f5c-278ed89ab31e", "value": "T1CC763356F09D048EE739CA6D1718AE29D64A4132AB3F78DC84FFFD83185BE416B254B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690745818, "uuid": "3b32f828-b206-4184-80ea-d277393d363d", "value": "98304:d3TqzAzVgA5V6pxCYSUTYf7UW2Eq7BwTOx1H7kmq/aP5p8bNRApCZGVOxgcjq:d3pRT5V6poPjVewTY1HDIhNAVOxtjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690745818, "uuid": "44adcbc1-7f7f-4a9c-a947-1b295139d093", "value": 7499310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690745818, "uuid": "e43ae447-f88f-4853-92ce-8012302f8f5e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690745818, "uuid": "2c1ac638-f514-46d5-a36b-26866a3ff6a9", "value": "EMPRESS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f58f89-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686130, "uuid": "13fbe631-cf7e-46e5-8367-375881f4aec1", "comment": "Malware payload (RedLineStealer)", "value": "723347617bd6ec79a9d31236924d6370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686130, "uuid": "e039a54c-151a-4987-bf76-38406a3291f2", "comment": "Malware payload (RedLineStealer)", "value": "cb8a6de270d282604ba95e058ff8d9c0939b036c35e1e2394016fb1f97926cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686130, "uuid": "40cc35b0-c59c-4b1d-9038-3d7511e9eccb", "comment": "Malware payload (RedLineStealer)", "value": "c07719c6458331709a9d74e447c00d2a84227c38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686130, "uuid": "09c0d5c2-c52a-4686-b9f9-4023d21f6873", "comment": "Malware payload (RedLineStealer)", "value": "7639ec89640a49d490df6ff6235a717b5aba880eaf8366b5e043e9c68467dd1abb8f0623094ac66a8237325ffc9071ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686130, "uuid": "850dd4b4-ef9d-4c3d-bfa9-bd53355645e8", "value": "T129B41253EBDA9135D8B517B029F702830A357CA24979CB6B3740A95E1CB36D8E43273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686130, "uuid": "11ce0abb-4bed-4acd-a717-28666075739d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686130, "uuid": "cc676829-eb92-4831-acc9-dcf5a6cf80a1", "value": "12288:jMroy90O80MhzHe866YnlbKmeJrZQJdgBYCTJ2THEnRRAfu:zyDUhz+h6Y1eTLz6ffu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686130, "uuid": "97be15b8-274c-417b-8f64-60601b4e3eb8", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686130, "uuid": "45972cc7-219d-42e3-8a9b-85564897f045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686130, "uuid": "e652dd0c-0912-4f84-91f4-51562da562de", "value": "723347617bd6ec79a9d31236924d6370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d38707-2ea0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690697926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697926, "uuid": "52585943-fea7-430c-a708-223f5df12ce2", "comment": "Malware payload (RedLineStealer)", "value": "454b7e2b29a2608e80ddeedd438fac3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697926, "uuid": "8c01f22a-5297-4220-86f6-6c5b0795d6bc", "comment": "Malware payload (RedLineStealer)", "value": "cbd727cd5c6137800af2401de4ceef8c93cbb70e2670418ad6c1db22f91e591f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697926, "uuid": "ba92b92a-cec4-49c9-8213-e6edf25317c8", "comment": "Malware payload (RedLineStealer)", "value": "7825514e42496b116dd1c41aa464f7c087cdb0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690697926, "uuid": "b56092bf-9101-4be6-aa0a-40096995d66e", "comment": "Malware payload (RedLineStealer)", "value": "ef3255c1a3d7c2064cf0dfa85aa5721fcc5c149609ed1e33dc40c6ac028bc1b03d53306189b0e7db045402ff1e19da07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697926, "uuid": "43b08610-1633-49b1-8e1e-aa4b72943838", "value": "T185B41202E6E88032DCB167B069F703D306767CA29A38576B37899C4F0CB26D5A875737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697926, "uuid": "960cc4bb-f654-4076-94d5-cc425a816e7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697926, "uuid": "5d85a44f-eb98-43d6-918e-8e9066494de9", "value": "12288:UMrjy904PnDd8ygntRfiYbUim3xgBYCgUACTT3k:nyJPD3gviYgJKz9TT3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690697926, "uuid": "60d50088-225c-4ca6-9cc9-c45c462c2281", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690697926, "uuid": "7c17ec0f-484b-42ac-9de5-d72f61d31036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690697926, "uuid": "0500260e-a9ee-4e46-8e63-53329a0f3574", "value": "454b7e2b29a2608e80ddeedd438fac3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c296ee9b-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695271, "uuid": "114df9d2-ae29-434e-9c38-b807474bd6fe", "comment": "Malware payload (RedLineStealer)", "value": "9db332a72b281165ef2ff49e6b003971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695271, "uuid": "15dec940-18bb-4b8b-bcd8-1967f173c258", "comment": "Malware payload (RedLineStealer)", "value": "cbda6f921654d314c18b7a4137340289a0e5e68a12643f18a3fd760fcd0e2f80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695271, "uuid": "d4fa3a7a-fe8b-457c-bfb6-3256d6eca04f", "comment": "Malware payload (RedLineStealer)", "value": "bd28c2749e6f81e887dbe45c6e326b0dba4bdd22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695271, "uuid": "c4b2f116-2320-48d7-ab0a-3e73f67e3726", "comment": "Malware payload (RedLineStealer)", "value": "eb43947df4fc48195779267099b1b68ea542ae95e67d72857b668b4fab99cab9a34ddfa0d1092b0644e16833ed48fb41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695271, "uuid": "ced1d55f-554f-445c-834e-1ead3ade0f68", "value": "T1CFB412437BD8A072D8B52370A8F706830A31BCE35E74976B2745D94B0CB26C5A536B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695271, "uuid": "cce76baf-2b70-4a6a-9cc0-9f1d76bc6ce2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695271, "uuid": "2a4617e9-49a2-40a5-ae78-d6ae9ed6200d", "value": "12288:DMr7y90ADeTaFQIyVPSOaP4olFCM7xkpBjLxgBYCaoWObv7:4yTyauSOo4oxINazp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695271, "uuid": "6e93ca27-e2a7-47c3-b830-d5ba387c9702", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695271, "uuid": "93a263d7-28bf-46aa-a628-4468b7d9c3aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695271, "uuid": "6c57f5fc-080c-4896-a7cb-77e7f3d4548a", "value": "cbda6f921654d314c18b7a4137340289a0e5e68a12643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0918af52-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686800, "uuid": "1dd7e011-13e1-4f88-bcd4-b8a90dffaafb", "comment": "Malware payload (Amadey)", "value": "df79ec5758a1ae66299604372d82c572", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686800, "uuid": "f721abec-7258-46db-aaa8-07bde80c17fa", "comment": "Malware payload (Amadey)", "value": "cd6f5edfb359f1c84cac94ba2bf40b97eb22f43951a09557a47e215283d0ee8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686800, "uuid": "bf84b34b-2d08-4e6d-bfeb-b5b9125ededc", "comment": "Malware payload (Amadey)", "value": "8668db2bc77bfa7edee70c781cec70eadbc497d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686800, "uuid": "733dcb3f-ee01-47b4-8cda-367681f33f2a", "comment": "Malware payload (Amadey)", "value": "6449f360d9f66d114e5c7fe72275cc848aaf047c9df715b46c0de570df1fe884372f591f740875163df2f168f1dfc9e4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686800, "uuid": "fb606e82-b2db-4666-a6f5-289c729febab", "value": "T1FCB40213BAD88062C9BA5BB058F703C31B36BC619D74836F2B54AD6B0C73594A53672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686800, "uuid": "e2455fbd-b9c6-43d0-b29a-3728067e3800", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686800, "uuid": "c68ba02d-42fc-4481-99e3-e250f6db3278", "value": "12288:TMrPy90EuOEsGFPJ9o94+8x4PlILOiIXgBYCxs7Rigz:syqzsGFPb+8x4PlIKiIwzq1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686800, "uuid": "fbcbea5c-9336-4f57-91f8-b6ec0feeab4e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686800, "uuid": "da6d7154-e8a7-470c-9a5f-aec4c06d7308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686800, "uuid": "f48363ed-25da-4f73-b919-ae69147ba223", "value": "cd6f5edfb359f1c84cac94ba2bf40b97eb22f43951a09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ab4905-2e8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690689183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689183, "uuid": "201e9360-462f-4a93-bad9-712ea00cc58c", "comment": "Malware payload (RedLineStealer)", "value": "a0bfbd2aa04108e5106a355550ca3f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689183, "uuid": "1a7c985a-fbfa-4eae-b2f5-aff42af42485", "comment": "Malware payload (RedLineStealer)", "value": "cde71d5301f83fff82a7bb4a63820bc340e072fc939d72a5f6756f1b1520a24a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689183, "uuid": "8eee4385-bfb5-472e-8d46-9c9de0b54779", "comment": "Malware payload (RedLineStealer)", "value": "7e02f127fe794d86cb9dc308711aeb36015ae168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690689183, "uuid": "10820daf-7e36-4936-a276-ad7c0ba45ee5", "comment": "Malware payload (RedLineStealer)", "value": "7aa2568079d9ddbfe26a5cd45f1df1416b5645eb979cdd5515f1fb0670124afc02db41a5daf44abed07deb8594f5d8d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689183, "uuid": "b35b0e4b-3afd-4a9c-b346-d4dd1cef5391", "value": "T101B41253FAE84432D8B617707CF602931B3A7C226D74832E27469D5B0CB1AC5B97672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689183, "uuid": "3d609a56-e8f9-4fec-9d77-ebba8b142b71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689183, "uuid": "760bda95-b0a4-458f-b65e-9aec032ab3cf", "value": "12288:GMrYy90Q/+gyD+d+Q44k6f6Ju1dhmfgBYCn7xUU7ty8:WyMRywGCuXsYzdUl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690689183, "uuid": "d92f6445-6d73-4c32-be61-14bae08dae13", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690689183, "uuid": "a2da72a4-9ec3-4701-b7c8-e68020b014ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690689183, "uuid": "628d3248-7976-453a-b232-afbee69459d6", "value": "a0bfbd2aa04108e5106a355550ca3f95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960f6a73-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686177, "uuid": "1f189bf7-c69b-44be-888e-89c9676becfd", "comment": "Malware payload (RedLineStealer)", "value": "d41f3ee8275160080046bc0a0921e991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686177, "uuid": "e201ceb0-7618-48a4-9f27-6ffdab993736", "comment": "Malware payload (RedLineStealer)", "value": "d05167d2dd9ff7a1c3fd9cc8783bb02e98c4ac373da943c7c219521875dfaa9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686177, "uuid": "45fda439-a776-44d8-95cc-367be202f818", "comment": "Malware payload (RedLineStealer)", "value": "2cbe0605fcf060cdb8e735db8d671331d3d687d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686177, "uuid": "f0bf397f-58fb-4e87-b166-b077dd9196f7", "comment": "Malware payload (RedLineStealer)", "value": "fe21431682bb7ddaae46c7076a7052151e5b4258a11c353826f84c9a65552034451727f15104a941df81cad03ae31573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686177, "uuid": "2118b3a3-8d10-444b-b151-c6460858126e", "value": "T1C3D41243FAE84472D8F91B7008F743C30E35BCA19DB9532B279A645A2C736D4A47276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686177, "uuid": "7a2c398f-a4de-4e55-9a26-782840b2ffcd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686177, "uuid": "a164f78e-6233-443f-881e-5573036a4552", "value": "12288:pMrIy90OJBgFl3UzOHI/d8HK6601MpqdsXUZ3tvQoPk/:hyDGXxH+L62pqkUZdNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686177, "uuid": "2251eec9-a273-40b2-a9c5-8947d4bbf0bb", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686177, "uuid": "46458cc2-2f18-41c4-b5ab-d3ab7c5cf457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686177, "uuid": "963bbd63-a305-4ce2-8309-0e6b414afd7a", "value": "d41f3ee8275160080046bc0a0921e991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebf3d24-2ee6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690727719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690727719, "uuid": "18b316c5-16f9-4722-a226-916c43198a81", "comment": "Malware payload (njrat)", "value": "6fdb7f6d727cd77782ebb2837c6ff76b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690727719, "uuid": "8000cf2b-ad49-49f7-8ed4-83a1314964c3", "comment": "Malware payload (njrat)", "value": "d09f2570366936a4146033b66853e4af8d284d732f7cfcbc53a1820a454f70ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690727719, "uuid": "43d2dc50-c637-4b35-9cf8-1b8411f87e42", "comment": "Malware payload (njrat)", "value": "f4b1c8ff9da2880f6283d5f9a2064bda295eac79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690727719, "uuid": "b500bcf8-6396-46f2-ad16-8b520b5d24fc", "comment": "Malware payload (njrat)", "value": "1e68f03011a46b8550be4bfde6368e22af3db113e832a87746be4383ff75ce613d7a291a610942dcb4c0b7b032d0504a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690727719, "uuid": "71885b7d-6db4-434b-9c72-02c56374171e", "value": "T1B3A229097BB88B15C5BD027854B36305837AD2478222DBCF2CCE10CC5A66BD96257FEC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690727719, "uuid": "71e71ac0-9696-4955-bd07-dbc0080ceb75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690727719, "uuid": "8ae5e7ed-f312-4cac-ac8e-6753f4281a68", "value": "384:TnaskV4E3vyLONkdnMi0XB0tDFYCbbhSj/xh3MRA0uuToEGenbOH:usCVaONYIabMbUUEGe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690727719, "uuid": "0a6a828f-dcea-42f2-b50f-55daf5362fd1", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690727719, "uuid": "97fcd925-f678-4dc1-9425-c2f8c9cf6cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690727719, "uuid": "e1060115-34b4-4eaa-9c4e-45895255ecbf", "value": "6FDB7F6D727CD77782EBB2837C6FF76B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb08f3f-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686806, "uuid": "dbf33153-8dc5-4fca-a1c5-1816f92364cf", "comment": "Malware payload (Amadey)", "value": "f09e43466edbd65502e64e17570d1971", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686806, "uuid": "51e2203e-6d43-4cdd-a67c-046f2ae1784e", "comment": "Malware payload (Amadey)", "value": "d0a990c32a67c911cdc29dedbe9719e6d30e37a81677ad50e272b8a71cc6cc8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686806, "uuid": "9187c033-1ca1-40ad-ae12-46f802b843a8", "comment": "Malware payload (Amadey)", "value": "1008e50187818f5d09b9f14eb077f5ccfeb0b2aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686806, "uuid": "823f9fb6-4cf2-45f5-9dba-77119c4ed19c", "comment": "Malware payload (Amadey)", "value": "5f4a9ed6442c68f5d90c978189a955625b2eb6893f74cb81a8bcca032c9bbd659827fb191a950d0f58aa09da94d7f301", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686806, "uuid": "8ce79c1e-d133-44e4-b9f5-fa5c02e86a27", "value": "T110B4024296E8C0B2D9B617B04DF906930B3E7CA2AD78571B3785985B1C732D0B97632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686806, "uuid": "82026336-dfeb-4e98-a6d1-08acf0dfba3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686806, "uuid": "2259a3dd-3340-4d32-9de3-59aff0612e47", "value": "12288:1Mrhy90NBRI7MV0uPefplRVdr5N36hgBYCYXDGmMnlEvY:EyslVrelRVdFNjz6VklEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686806, "uuid": "fbeade37-5ba6-4186-a274-88d71586e6b5", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686806, "uuid": "9b479b4e-4ee4-496f-842e-a00de227f2ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686806, "uuid": "c3c58087-1f22-46af-88c8-4465729b6415", "value": "d0a990c32a67c911cdc29dedbe9719e6d30e37a81677a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51eb2ac8-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686492, "uuid": "309900c2-0a65-4621-9269-6a508fcda32a", "comment": "Malware payload (Amadey)", "value": "fda6cc37dd163b76e873b8c4f43369fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686492, "uuid": "6cce7e9c-cb96-49c3-be5b-d7f74770bf87", "comment": "Malware payload (Amadey)", "value": "d0e5407b51fb8902a840d0022cedd28e8e7a72f4e9a21aacb9d28d97585222ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686492, "uuid": "216673f3-c911-4a08-a35c-a667104f0dca", "comment": "Malware payload (Amadey)", "value": "fb46876df44921fe788fe7f6c76b8bceb72238be", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686492, "uuid": "4f2f0f96-745b-4199-aec9-fd0475188f8e", "comment": "Malware payload (Amadey)", "value": "4fc82fbd25f90c84af41a6e346e1fb2ee71ec1facaf23ebaf707662cc9d80ade7bfb7d7eeafcf0acedd7d7acd957df52", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686492, "uuid": "bb97c76a-a0ee-4bc0-85ba-b1028a6c41e3", "value": "T1D6D41242A7D84673EDB523B004F613970736BCA15C39476B2B9ABDAE0C726D1B43136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686492, "uuid": "8f02e7b7-20f1-4af7-a899-9cb8cb235588", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686492, "uuid": "c9fa3453-610f-402f-8c05-d098d38a6d96", "value": "12288:eMrdy90edpwSCcB0yMamjKralT/d87qUWV3+Pe:DytpwSXZMagFT1cS+Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686492, "uuid": "742d1b74-0973-4ec1-9080-94233f7888fc", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686492, "uuid": "92f72f82-2617-43ce-a2d9-f09070ab7072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686492, "uuid": "e610bc1f-1118-4830-8d8b-923b2f150cf1", "value": "fda6cc37dd163b76e873b8c4f43369fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0f45bf-2eb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690708442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708442, "uuid": "dc71192a-ae60-48cc-825e-6093ff914fc0", "comment": "Malware payload (RedLineStealer)", "value": "4de84534e40e282b00225cb20c15572c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708442, "uuid": "ef6253e5-8485-4c4e-be8a-62e4719ba026", "comment": "Malware payload (RedLineStealer)", "value": "d154b3b05dc2aa7aef66b06a8e7d41f6804719243741938fe148d03a76bcd598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708442, "uuid": "722c274c-4863-4d95-8f09-5b567aa3ad5d", "comment": "Malware payload (RedLineStealer)", "value": "2c906b9c05b35a4ddd0e4b86b3c9d87e2d730620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690708442, "uuid": "bbda54c9-decc-4702-861a-22d36de3447d", "comment": "Malware payload (RedLineStealer)", "value": "817091689c42ee1da75c74d61f612d6f5c524c9ca25953e31a04d4e56d36493338e8bb89ae08ebca176577163bfd06a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708442, "uuid": "1a25389b-e198-4ae8-92d9-43fcc8c733b3", "value": "T169E41253B6D84473E8B1273058FA57831F32BC912D64822B339A5E1E1CB2792D97277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708442, "uuid": "95071ee2-853a-43b1-8731-ad077ec28f87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708442, "uuid": "c4b7a73c-4c38-41a5-85c1-34ae96b1cc34", "value": "12288:wMr/y90lakXR+gX1jm2H3IZY/dVUNChCqZjQ2Qntu0wWacXygU:fysXR+Sm2H3rV1hCGencnWahF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690708442, "uuid": "f921a9cc-fee3-4186-8248-5e9d1fe337ce", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690708442, "uuid": "b2b60522-4ad5-40f0-87bc-6af8236210f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690708442, "uuid": "e38f05f4-1d66-47d4-9ab6-7e724e133861", "value": "4de84534e40e282b00225cb20c15572c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1606d461-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686822, "uuid": "d6af20cd-e9e3-4ddc-b49e-71e7c0504220", "comment": "Malware payload (Amadey)", "value": "bd749027924a9a506afcd61dd6876f4d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686822, "uuid": "3d877e44-1cc3-4a70-9a2d-eb8a23fda069", "comment": "Malware payload (Amadey)", "value": "d3242656dfb776031c27ff75a48c2088e53c2e5b61f204ea6e945a1bd9c689d2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686822, "uuid": "89ff7221-6474-4a56-8355-a49cf286e03a", "comment": "Malware payload (Amadey)", "value": "1ba82881754538be71a07557b1316ba51cec6629", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686822, "uuid": "9f877b21-e81e-46d7-865d-a189c5ea3f79", "comment": "Malware payload (Amadey)", "value": "a3189580c75c0419c81077dcb4c43e7fd4316bc5ef6115059d82992d20f90d71597125aab7e8eeb4177471c825ed087e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686822, "uuid": "afcd32b5-91d4-4929-b3d1-9681e92ae87f", "value": "T156B40203A7EC9072D8F927705CF613930F7AFCA50DB8476E1799989A1CB3690A47132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686822, "uuid": "3109e6b2-0ccf-4437-9fe9-33aa3435e117", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686822, "uuid": "90cb1df7-eb29-422d-9c21-1e4995b64c5e", "value": "12288:eMr+y90HQSzkXcKPaS00iqOyHudJzwyWCdfNhSpPuaFpYqyL:IyGkXdscKJ0yWmqFFeqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686822, "uuid": "934bd4fe-4235-4d23-9247-4562f57d3955", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686822, "uuid": "0518b9ca-5e6c-4b0b-8540-3f41b044b585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686822, "uuid": "481a4d97-b128-425d-88ab-333d702f3fb6", "value": "d3242656dfb776031c27ff75a48c2088e53c2e5b61f20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46863819-2e94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690692486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692486, "uuid": "f7d906b5-3dc5-45c2-9d88-f1ac3aa1eb24", "comment": "Malware payload (RedLineStealer)", "value": "b5c0db40d5cc43c8200673bfc15b405b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692486, "uuid": "b91e9e15-131c-485d-8b52-b0e070a44066", "comment": "Malware payload (RedLineStealer)", "value": "d383299ea8651170bfa147a96ea9287a7d6ebe430325daf0845dd7505f14cdd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692486, "uuid": "65e48300-7199-47c3-be6c-ef38d5184e46", "comment": "Malware payload (RedLineStealer)", "value": "68b3a7cef1539aab4701eb4f00f87a02fa3bd79f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690692486, "uuid": "2884e510-b0bf-4f7b-a2ad-5ce05eda6ec9", "comment": "Malware payload (RedLineStealer)", "value": "c172dc5eca5e42d3406ba17f8d3c7a7ef6b72b21c87147210cf0f9511ed60de26ab3b31539aa5dd6f10414d22be0c4d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692486, "uuid": "e0bd6075-7398-466d-b55f-4aa6fc12a05d", "value": "T143B41247B6D88072D8B11BB058F712870F3ABDE28D7487AF2716A8590CF26C5A57077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692486, "uuid": "767fccd2-94de-4f99-beb3-4ba4808de21a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692486, "uuid": "9b4b222c-d04a-4076-ac06-c31f7e5d3380", "value": "12288:uMrPy90CQKer0ByotoffKx5rV81v8bHx/3Q74sLuh:RyAKIitK+5rYv89fsah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690692486, "uuid": "37b1fb22-12c0-4d85-bdf1-491fddff74fa", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690692486, "uuid": "a23cd609-8388-4ce7-9e61-0bab09720264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690692486, "uuid": "f5ff2ec7-5ef4-44df-9874-d8fa519f96bf", "value": "b5c0db40d5cc43c8200673bfc15b405b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05a5415-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690685846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685846, "uuid": "bb109ee7-6e39-4de2-8dab-ff97da52bca0", "comment": "Malware payload (Amadey)", "value": "5cd78870e509a8aadff546ed6a7b68cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685846, "uuid": "8e864787-2b72-4f53-8ed1-b9ca0bda1804", "comment": "Malware payload (Amadey)", "value": "d3c3b2bafe9d9f843cb198c377c65c2a48005ceb90dd4185999f5b89fdd5fbc5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685846, "uuid": "59f10c13-1b9b-44e5-a9e1-523fc3a164dd", "comment": "Malware payload (Amadey)", "value": "28a0c79307698292dd3b7a5600cc89ecaa57b510", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685846, "uuid": "e19920a2-2458-48ea-b1cc-7ac10ae6235c", "comment": "Malware payload (Amadey)", "value": "d3a3ca372a496f7484ee89885cb492a415e91201da00ae1cbdbc1375f75e930ec21feda2ccfeb2d286acf4d549be86e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685846, "uuid": "0296e1db-6ee3-42e9-bfc6-5e4611b844b3", "value": "T1AAB41252B3D84573DCF52BB058FA12870A3ABDA14D38836B3B49AC4E1C726D4917277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685846, "uuid": "6ffbec36-ecae-4538-ba5c-1185af275407", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685846, "uuid": "3d6c5f71-9cdb-41b4-aa49-35b754fbd769", "value": "12288:QMrby90/l067+WcFqYn3O3iRuhNZEmtS:byET9cUzyshjEms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685846, "uuid": "43205ef7-4940-4b91-af07-6eef1eabe789", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685846, "uuid": "23ae8e13-8378-45a5-bb2d-c91279f50ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685846, "uuid": "cde13a54-ee00-4ce0-8400-6138a6844b90", "value": "5cd78870e509a8aadff546ed6a7b68cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0df875-2ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690698831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698831, "uuid": "c812af96-fce2-4c63-879b-d6cfa3256b7f", "comment": "Malware payload (RedLineStealer)", "value": "f0e42f1c12f17f3500eebe97c5a801eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698831, "uuid": "3e9097df-8167-46b6-b40f-2475fcb4259e", "comment": "Malware payload (RedLineStealer)", "value": "d4d792bc2fbe0bb6a579f9df189d9c4239d5d0cf6cdfdd901619b7078c8d35ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698831, "uuid": "4a054a4e-a1cc-407d-8189-fb8c58e6e37c", "comment": "Malware payload (RedLineStealer)", "value": "07030b8d147234e14e63b149c8fce42d59207670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698831, "uuid": "844fd0d8-2ed8-4614-a208-f6fe5152a79e", "comment": "Malware payload (RedLineStealer)", "value": "c25921fd1b6f939e2b16c5ed62abbaf980175680e3cf419a113d109a04e423b113c6e9530733a6c5f2eee5dcba29711a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698831, "uuid": "22cfd1a3-ca80-4b16-b33d-02a1c2d940a2", "value": "T1A8B41202A7D88472D9B62B745CFA02830E3ABCE25CB8836627479C5F5CB36D4953177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698831, "uuid": "f7382b3e-9fcf-4ea9-9f98-b336c09b05df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698831, "uuid": "a20b77c7-634b-4162-80a8-4bdfa239c92f", "value": "12288:qMr6y906oKC9L28vmgBzE9JM9y1Rtm9Tea2O:YyyZ9LJN+Y+mlepO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690698831, "uuid": "c1354e4d-8ce7-489f-a312-d89cdecfdb64", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690698831, "uuid": "a0f3b99e-ee6d-4860-98f1-b9093e169001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698831, "uuid": "a51b8de8-20a0-4751-93cd-ff5554f9f63f", "value": "d4d792bc2fbe0bb6a579f9df189d9c4239d5d0cf6cdfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36102eec-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686446, "uuid": "127c7174-3be5-4e47-8ce2-d4be31aa5685", "comment": "Malware payload (RedLineStealer)", "value": "e70ff490a44b2172afd9e374575dc7d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686446, "uuid": "4476b68a-4462-4b9f-8c75-69cb0808b057", "comment": "Malware payload (RedLineStealer)", "value": "d52e2ae687eecccd120f4803e17ab2fc7792fee4034e8775ae10c182c1d43a25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686446, "uuid": "459271e6-f4ff-45e1-a3a5-fef4303bfba0", "comment": "Malware payload (RedLineStealer)", "value": "bec494104653b86d93ba5188ca71dc925ba75edf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686446, "uuid": "05c95b18-679b-45da-b267-1540776a94f3", "comment": "Malware payload (RedLineStealer)", "value": "d25c6d131799322cbbff8697b29dfd70eba3f5b373242093af624d8411379ab1cfa810e3e7072110c61768e4ef9f6e5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686446, "uuid": "f6c6ab4b-939a-4f45-ba38-f22facf73490", "value": "T1FBB41203ABE88073D8B567B058F706C30E33BD625C65832E37859E5B4DB2694A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686446, "uuid": "16a6e919-fdaf-4255-a0f3-272f6afe4406", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686446, "uuid": "160f9bec-5fcb-4c27-9d60-5d8d66a6766c", "value": "12288:QMr8y90uTUi7a5c61xhNMgBYCPyG8veUsw:8ylN7aW6/bTzKXvgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686446, "uuid": "9a6f14a8-c91a-4a8a-af05-b5651917d8f7", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686446, "uuid": "7b8d08ba-274f-49f5-9ee5-8b2c51c640f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686446, "uuid": "18ba6e89-e895-492e-b29c-959fa5e44910", "value": "e70ff490a44b2172afd9e374575dc7d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65359e0-2ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690700029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700029, "uuid": "66e53384-cb1f-4063-8f65-5dac4ac83536", "comment": "Malware payload (Amadey)", "value": "1a66e02ddd976341437c9584fd7cb624", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700029, "uuid": "839931a0-e0eb-4b5b-a717-c58317bc3b97", "comment": "Malware payload (Amadey)", "value": "d672640301b03db56ded1891b5e145f9d9a2cb62bb612d83ad1914954a3ca9dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700029, "uuid": "c7b23d6b-20f9-49b7-9cca-04efa2054327", "comment": "Malware payload (Amadey)", "value": "46c7a4641c97a1e1ab58f36353634610e52c4b4c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690700029, "uuid": "74f6cfb6-6d67-4e30-b503-ceb30234e785", "comment": "Malware payload (Amadey)", "value": "b7f5e8c2c5f7494fc4611780442497aeada2e7a910b8c037b5da1bbbae7d2525eaa0935d44bf523be8e8a0e22ec3f029", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700029, "uuid": "99a0c6dc-69a6-415c-ab80-9785e9622b02", "value": "T1A6B412826BED0132F8B417B56CF602D30E3ABD925C74836B2355ED5E0CB22D4A87176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700029, "uuid": "565b760e-bc86-4d59-af82-2ff6c61c8bf9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700029, "uuid": "f9d5f033-7fa1-4066-b57e-f7338a49b8a5", "value": "12288:+Mrywy901Zd29tW6yI/H/6qs4rG5tpCC9l1ctqeoZxD:Zy82EI/H/zqpBTCExD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690700029, "uuid": "4f94776a-77b9-4559-88cd-253c1f659606", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690700029, "uuid": "8b523425-9deb-41cf-aae8-815243357d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690700029, "uuid": "2c2aad20-3e31-40cb-8ef3-22115ae07c9d", "value": "d672640301b03db56ded1891b5e145f9d9a2cb62bb612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ece0c8-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695228, "uuid": "3ae0b12d-930e-4ca2-bc25-90f2471e0cfc", "comment": "Malware payload (RedLineStealer)", "value": "3db4ef36f77e5d1d1eb3743d1beaef7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695228, "uuid": "8564b17e-8496-4ee1-9e9b-f791544d0301", "comment": "Malware payload (RedLineStealer)", "value": "d8148b53e99c1191b672cce9e844ca984a7447c6e991c47b9d0a49b52ec652a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695228, "uuid": "c5b80b23-71b4-4692-812f-4134f3fa1bb9", "comment": "Malware payload (RedLineStealer)", "value": "348f2607b40ed7cac279c50f25676cafd8aa9be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695228, "uuid": "5f50af4d-123b-466d-8993-932c2b821157", "comment": "Malware payload (RedLineStealer)", "value": "4543899f0021aa4bf24ead76b558f5ddf5704c5b228038f47751d168c15c78fe11800531160e644cb2a8bb5ee80943dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695228, "uuid": "ad660cd3-4317-4c4f-9c7e-6d7b4ecd9487", "value": "T16FB41243F6E89432D9B527B0A8F6034306363C655D78826B2749E95B0E736E0F97237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695228, "uuid": "449cd4a4-7255-43f5-a921-5778833b3206", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695228, "uuid": "13419a44-f94a-4280-8f18-2bac3cc6d457", "value": "12288:1MrKy90R9PRXP/WGNzwWFW4y6sg6wcgBYCUqtK+bPTi:Ty4ZNP/tw+WnO3DzWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695228, "uuid": "5f894b22-efb8-4c8d-a1c1-5c25be2a597e", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695228, "uuid": "7d2629e3-808f-4ec2-b0c8-1dd9c7bb5c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695228, "uuid": "4b8323f0-58f6-4697-b271-6a2f7072400b", "value": "d8148b53e99c1191b672cce9e844ca984a7447c6e991c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3105dfb-2e99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690694896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694896, "uuid": "a6d372a5-9ace-42e3-9abd-bae0abc71e93", "comment": "Malware payload (Amadey)", "value": "4667c821c1dcaa815216828cc2dc51e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694896, "uuid": "d63a8831-8937-4eb6-92aa-b9937b226555", "comment": "Malware payload (Amadey)", "value": "d81b8f9d4673d7e2e95ddb159d3243071697f61b6b16c265a2559f37309600d6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694896, "uuid": "5c817e9f-5d58-4d62-bc17-809c2490fd56", "comment": "Malware payload (Amadey)", "value": "5a1365b570977aaac1928666e846ede2aaefb583", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694896, "uuid": "3063a37f-d2ca-4f84-b3f5-4ad2744fa7a8", "comment": "Malware payload (Amadey)", "value": "4d0907e0f69494fbb03e0b9a678d9148e3c1235c4fe92b4f3b35eec3ca87b44d957da7656e4cf4aa40fb4802a083b1c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694896, "uuid": "13e6f715-c162-4880-8ab6-eba97c10a148", "value": "T18BE41206A6E88576D8B517B05CFB06C31B367C518978C3AF3782D94E2CB26D4A170B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694896, "uuid": "67cc1886-3102-4ac5-b35a-61cdd69ba678", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694896, "uuid": "853c0d8b-ad8d-40b9-8de3-956e852cbcdf", "value": "12288:tMrAy90Bm5Am0CSuayBQaPRJIytomXlo65ARMiwXJfBIjzyXIUttSna:By2oAkSmQwJ5tqRPwXBBI67t4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694896, "uuid": "26db1497-9451-4aed-9ef3-94c2417440d9", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694896, "uuid": "4c137d2b-e4d7-4a39-8eeb-fb63d73d443d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694896, "uuid": "d9eb5f3f-d7eb-4a01-98dd-1acea0fd3ab4", "value": "4667c821c1dcaa815216828cc2dc51e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1830f40-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695216, "uuid": "196e45e1-1391-4a0d-9088-cea675cd696c", "comment": "Malware payload (RedLineStealer)", "value": "a5ce322ee3b18effb19db35ab6b1224f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695216, "uuid": "489e6e3d-f6e2-4c79-9137-2b0c314f1ff9", "comment": "Malware payload (RedLineStealer)", "value": "d8263ca5b091fa827bddb83cf5e2d36d387be0fd07fd52272f755c0f5b312322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695216, "uuid": "ee65a015-b851-4d04-b872-d20a14f83454", "comment": "Malware payload (RedLineStealer)", "value": "7e5b6cbad3efe9bfeba6b4b1629e6c3fe8f19ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695216, "uuid": "52138efb-dff2-4c15-80a7-ec4eee0025af", "comment": "Malware payload (RedLineStealer)", "value": "c2735dda62f5ada98fb80e27b111950317d5305aab946f4bf61adbd564dfa3e4cf5421b4349a142b1fc17cecfb03db75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695216, "uuid": "df0d58b4-0e01-4fd5-be7e-b30043d38644", "value": "T1C0B41252ABE88532E9B5277114F613830F3DBD718E79936B3781A91B1CB15C4A93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695216, "uuid": "b048990e-50d0-4c04-9821-1623ca628b98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695216, "uuid": "8725a465-0269-4391-9ddf-672a7da4fd8e", "value": "12288:yMrAy90GcDyNYh1zEfEgv6+QeZW3mM16cgPcv7mFTWx:ay96/5UE6W3kcgU7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695216, "uuid": "899fdd1f-fc2a-4820-ab75-05216db6b020", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695216, "uuid": "b7e8e088-04d0-4d90-9c51-bfa7fdb5fc59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695216, "uuid": "ccbb2c1a-29c2-4055-82e1-eea7da824300", "value": "a5ce322ee3b18effb19db35ab6b1224f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ccb28e-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686464, "uuid": "9ced8a57-667b-4f23-b69f-b9773c6a769a", "comment": "Malware payload (RedLineStealer)", "value": "0a0496a64597ed2a279826f1f99e8b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686464, "uuid": "d85e3eea-55e5-4c1b-8cd7-6f80e713410b", "comment": "Malware payload (RedLineStealer)", "value": "da09729d570cd93ed61c515d8407a5f4b201aca65e870a52b3082a39645d32e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686464, "uuid": "be3a9924-6227-483c-a8fb-58906a91328f", "comment": "Malware payload (RedLineStealer)", "value": "a56286aca00d98cc6dd17e0a0ca0776d270f6934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686464, "uuid": "91177f1d-1cfb-4fef-846f-815558abaea1", "comment": "Malware payload (RedLineStealer)", "value": "2ce0db43ec89c3598d4179c3729fb3c1a9fb4ed34d4c446ae6670195350d0f26320be0f8d531da996aa076015b4d2578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686464, "uuid": "d84aaabb-0a8a-4e96-bbe5-8f39dde1c26b", "value": "T1C3B41253A7D88033E8B41BB46CFB12C30A37BDB09D34966B37456A5A0DB3980597973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686464, "uuid": "7981170e-2fa3-4bdc-8efd-bd99847090be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686464, "uuid": "f4313d53-07b4-43c4-a2f0-f8dd3dc8814a", "value": "12288:XMrny90SGsys5qsuyfEBsRv9isNkG+Oce:Yy99XuysQjuFOce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686464, "uuid": "71ff4afa-1f7e-4a3d-91b1-09262049f47b", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686464, "uuid": "aedf5b55-e095-4e45-ad4d-27ef61d0ed72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686464, "uuid": "4dbf5287-42b6-4133-8e91-7508c91457ac", "value": "da09729d570cd93ed61c515d8407a5f4b201aca65e870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b485c150-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695248, "uuid": "5f4397e8-0845-46ff-a5ab-9cb90c1f8d30", "comment": "Malware payload (RedLineStealer)", "value": "e2e3480455c1c5712c530a35c2d3a6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695248, "uuid": "54b1adaa-c59a-47e3-9e6b-8673238fc8bc", "comment": "Malware payload (RedLineStealer)", "value": "da540961142be78109a7355113885501c7dfa87c0bd674027f2ab26cacbbbf4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695248, "uuid": "7d1f48a6-c12e-4542-b6e4-dc7c615fe34d", "comment": "Malware payload (RedLineStealer)", "value": "9d9b141da22873065b987ff3f1d5e22e03ad6cb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695248, "uuid": "4cf142b2-6844-47c3-adb1-e5733f81f44c", "comment": "Malware payload (RedLineStealer)", "value": "6d506fa5f8cc1209e7dc52f9462a9721438f3d553c61eb961d6082f32f3dbcb08cb8f8da499f9ebcacf3b9cd68e04c74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695248, "uuid": "eba3feb1-dd5c-44b1-9688-71d50af51549", "value": "T129B41243ABE98173D97917B058FB02830E397CA2DD79836B3355694B4DB338066317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695248, "uuid": "7f6ac4d5-7591-47d3-b439-f82176a1a3ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695248, "uuid": "0aaf29cc-8ff1-4051-9795-e3134b74a38f", "value": "12288:MMrXy90fw9vx3hwn0KFD/BBAix3g02TJzJxK9iq+/Ydu:jy2olKBvVxAzJxKYfEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695248, "uuid": "396359c1-3ce6-462f-8b11-30bf38100929", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695248, "uuid": "ba368f4d-f1e0-4bba-9963-bfaaa2e5b563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695248, "uuid": "02a3a7e8-340f-4def-b6ee-85b4bfbcd1ee", "value": "e2e3480455c1c5712c530a35c2d3a6ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a13f66-2ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690710249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710249, "uuid": "b83d9898-1acb-4e1e-8cc0-883b299266c8", "comment": "Malware payload (RedLineStealer)", "value": "bb96a7f854ff3707c8739d23f8ed0740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710249, "uuid": "30b21c88-d7cd-4d7d-917d-783dd33e3534", "comment": "Malware payload (RedLineStealer)", "value": "daecc8476d890bd4b410b076a1a51e51c82b0e54786f8630f01ff1b82069d394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710249, "uuid": "54f623f5-a125-4b4f-8d18-6bccc6c8f415", "comment": "Malware payload (RedLineStealer)", "value": "4b75ebdc4e56b1a41994ac5ce560ad605b065839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690710249, "uuid": "1b548cf0-8d7a-4268-a2c4-8c601aea2136", "comment": "Malware payload (RedLineStealer)", "value": "0cbbfece428dda7824ca0790523ef293d0e3554f515071a4408702ecd4414223faa8e85c615854ce7ba1ffdf82824550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710249, "uuid": "ebf54098-aa75-483b-ae4b-2d5f2289a973", "value": "T1F1E41256BBD48033D8751B7029FA02931B35BD656CFC432F2746686A1CB36C9B171B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710249, "uuid": "4a8adc2c-e9a1-445e-8255-c472afe2e20e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710249, "uuid": "34ad70ad-528f-4f87-9ccf-f4d94e17878a", "value": "12288:HMrEy90z478+eFYKnZ0ByP3/Wyahvmxo1FPi6wW1HVxr:byN4LGKtnAhvRFK6f13r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690710249, "uuid": "3c7d8347-544b-41cc-8c4f-12bf78e6a9e8", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690710249, "uuid": "157db0f2-4851-4d43-9772-635217866ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690710249, "uuid": "effc4820-24c3-4b29-9c69-edb8866d5047", "value": "bb96a7f854ff3707c8739d23f8ed0740.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbe3f68-2f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690741914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741914, "uuid": "870fce35-c304-4dee-af57-29a685e59de5", "comment": "Malware payload", "value": "5fd0b738288f3c648c35db1e8f40fa8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741914, "uuid": "d0f316c7-4d15-4385-a3f8-39debf034eb6", "comment": "Malware payload", "value": "dbe30704086dc0a5c2ad22a0692788cd99b98ead5e21dc31608c450673b3a884", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741914, "uuid": "392e7212-00d2-47f6-baf3-915293bfef64", "comment": "Malware payload", "value": "3c00350d77442990002e16f30d7e5c3eb3573912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741914, "uuid": "b6956f0b-8296-405f-a2aa-464d901f20df", "comment": "Malware payload", "value": "b39f53429a634ed84eda9f542ba68bd00c9654d87282a8925d35971fa5dd6191ef71f5c67e1ab011adac2963b67ad6f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741914, "uuid": "02c302ae-43e8-45f8-88d6-5e1ae84280af", "value": "T13263950D2E258FADFBAC87358BB78F219348339626E1C685D15CEA015E7034D741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741914, "uuid": "d69c751e-c7a5-49c0-830e-e1a79e47854e", "value": "1536:20OHju/Nutovp8JydKdxvbn0LQcwfGpy10P5k3Il:uHjmN/phcdxvbn1c7P5sIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690741914, "uuid": "11ff6eea-9fdd-42ee-beac-2617080c2b4e", "value": 71816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690741914, "uuid": "6f319308-8a7b-486d-ace1-b4af2a646d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741914, "uuid": "1588604a-dab0-4e6a-b6ba-43b151ba995b", "value": "5fd0b738288f3c648c35db1e8f40fa8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2050cc89-2ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690699724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699724, "uuid": "dda4d176-7efd-425c-a079-a2205892a688", "comment": "Malware payload (RedLineStealer)", "value": "853cbb8e570bcd9bf2512329c31a949e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699724, "uuid": "33b0488f-10de-4680-b3b4-3cf5c2f19093", "comment": "Malware payload (RedLineStealer)", "value": "dcacd7a2d65c294f27350cade8ca01fb2a135f69ce34ee5f260362e8d4c44952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699724, "uuid": "c335502f-fb78-43a8-8f16-ac0a529a22d0", "comment": "Malware payload (RedLineStealer)", "value": "584bb94f9a72b153eb37c1cb4be8cf96d4d37d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699724, "uuid": "4db77670-9527-4f1b-aa26-a6676215ce84", "comment": "Malware payload (RedLineStealer)", "value": "fa78f1f0ec5e2ff093e810ac083b2584255bc0686d8c2a85b0596f99134d4219b0553ae146b871aea4ee04f4ca81bef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699724, "uuid": "01fa81f2-fc23-45bd-8597-d99304b4439d", "value": "T13CD41202EAEC8531D8F62B704CF712C71A357CE19A74436B22995DAE1CB36D0A17176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699724, "uuid": "ac9c83a5-c8b0-4209-b20e-80a7f0b1e5d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699724, "uuid": "bde91de5-7217-459c-9f05-7f7b3490d85d", "value": "12288:RMrzy90US6Q3LLrWLz1BrSJ5RpJLAG+3cCuXsLFyPDJn8lsf3g17:uyPw8rSrRTwcCEsEPDF8Ofg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690699724, "uuid": "ffbf2305-ac46-4d78-b2c6-1df04fb6519d", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690699724, "uuid": "2f34c6bd-112b-4b35-85e2-5700536d406c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699724, "uuid": "c859d66c-dd2c-4553-a8d1-dbf6888a01df", "value": "853cbb8e570bcd9bf2512329c31a949e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac93349e-2ef5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690734319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690734319, "uuid": "bd0d2c2e-d297-4149-a812-6c3bb365a19a", "comment": "Malware payload (njrat)", "value": "0c4e25d699b1c4dc205c8e15489fbe48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690734319, "uuid": "eb9387fc-430d-4bc6-a839-1d6fa84cabd5", "comment": "Malware payload (njrat)", "value": "dd771e630f93891e7613505d3f524f76dd2f3218a71c18c24519126f9253a747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690734319, "uuid": "b3f0f388-a5f1-40d6-bc47-7bbc7479ecd8", "comment": "Malware payload (njrat)", "value": "3bc435ba8fc103b1667be529ec8c5cecc9586bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690734319, "uuid": "aaec004d-5f99-4b99-bd03-d6b61eea0889", "comment": "Malware payload (njrat)", "value": "b0c889260dfb5bab128ce0ef9c172afd87a4353e34b68de2bb2b5e97c283f2e648a1aff1a4ecd658f6ae54f178973bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690734319, "uuid": "920a6885-05a7-4de5-b158-f8833ec709a3", "value": "T1D493F84977E56524E4BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690734319, "uuid": "01b89238-ee56-4cd3-80bf-569d25b570b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690734319, "uuid": "e90c7b7c-b568-4399-aa6a-b4f1e7a69a99", "value": "768:bY3j6pD9O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk31sGA:m6LOx6baIa9RPj00ljEwzGi1dDFDSgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690734319, "uuid": "98e108a6-9ee4-422b-a421-a5afed8e78bb", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690734319, "uuid": "346ac31d-6b79-4c58-bd5c-4f31c9e5787d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690734319, "uuid": "aa25e8be-a373-4087-9b55-a28288e2ef69", "value": "0c4e25d699b1c4dc205c8e15489fbe48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1231f98-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695269, "uuid": "1980f95a-bb18-4fce-a0fa-b2e37f33f985", "comment": "Malware payload (Amadey)", "value": "6b9d24b2d6d3241fd01e1e0791c31e3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695269, "uuid": "ede6df75-4eb5-4d30-b4a1-22e41fbe8971", "comment": "Malware payload (Amadey)", "value": "dec4f81cafb016d353d14d9d6a01b8c5f6be4260da706f10057e0ced653d22e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695269, "uuid": "a06d3442-a65e-4405-83ef-aee5fcf40ac0", "comment": "Malware payload (Amadey)", "value": "a4d88a2ccadc83896b28298bc60dd5787c9d5090", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695269, "uuid": "b2ca396d-89cd-48c8-80ce-ecb384adf612", "comment": "Malware payload (Amadey)", "value": "b94e85951f7faa0b47efab4cd83b68dbd69cb77e81da212f2b645395a50b1f43ec1eed20e37f2820cceea0b7fb13a709", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695269, "uuid": "c115a2a2-ddd5-497d-b486-932cd55f2a5a", "value": "T100B4128366DC5072DDB527B05CFA02830A34BDA16939836B3345A98F1C727D4E9727BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695269, "uuid": "dd021c02-c539-47ca-8b38-be3b332cd6ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695269, "uuid": "d893260b-d53b-41cf-ad83-85ba4902f67b", "value": "12288:lMrCy90wQuP+CH8ybRES3S1rNNiKgBYCGh6HSvY:byhjNctS3S16zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695269, "uuid": "aaaa5922-8aaf-4432-a2ce-a2eba0924d34", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695269, "uuid": "ef8547ec-023e-4081-a1a8-df64f7683966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695269, "uuid": "2440e39f-3817-43b2-b454-c1c8ad42d851", "value": "dec4f81cafb016d353d14d9d6a01b8c5f6be4260da706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0332eba0-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686790, "uuid": "8f632a68-f2b8-4541-9e56-aa78cb3ab2c1", "comment": "Malware payload (RedLineStealer)", "value": "bf76372392cea1672b60f9dcecb269ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686790, "uuid": "d62b9fd0-c582-440c-882c-580d749f555f", "comment": "Malware payload (RedLineStealer)", "value": "df71ff1fd081c725ff2ea5cc90b2d1e0cbe564452e1e5a40c81347aaf92d7bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686790, "uuid": "05015c89-7677-47c7-9fcc-fc67ce949feb", "comment": "Malware payload (RedLineStealer)", "value": "9aeffc8e431b9a0bd948f9c0ae50b532f4307455", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686790, "uuid": "33b7340e-2464-4f1e-a253-b5c30ff7e6fc", "comment": "Malware payload (RedLineStealer)", "value": "331f458292b7dabd1ccf2a3efe238552f70daca97eebe6c58daebf18a49cf830f1c964888e514bd2f04c84df8ce46c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686790, "uuid": "c8e5770a-66b5-4cf8-bcbe-29cf2122d7df", "value": "T1A7B40252BBE88033D9B0277024FA03931B35BC918A38C76F27855D5E5DB36C8A57376A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686790, "uuid": "1fff7422-acfb-4fb6-aec5-3d6038911297", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686790, "uuid": "c2921903-f724-46db-a667-9b3470ff9a40", "value": "12288:pMr2y908lBCTMNcyETWsAZqKd61VpARwiqX5BKSsTyj:jyzlBkMetW6T0nqpBK12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686790, "uuid": "d8205f49-c76d-49b5-b770-772b2d220688", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686790, "uuid": "dfb18129-53b7-4520-92ee-53aaac8a1780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686790, "uuid": "550541c8-df59-48a7-acb8-68f5d6767b99", "value": "df71ff1fd081c725ff2ea5cc90b2d1e0cbe564452e1e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329e591c-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686440, "uuid": "0833e178-a4b1-478b-a77e-f35d1adc3469", "comment": "Malware payload (RedLineStealer)", "value": "e41603102b06dad1f4b6a1a7ed1dac55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686440, "uuid": "33e89eaa-ae08-491a-a60f-922f53fee49e", "comment": "Malware payload (RedLineStealer)", "value": "df7a972057b2c89e955e4ae6d48630a19df286b974cb15dcaacffb2b0dc6fe23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686440, "uuid": "31b2ebc0-14b7-4aff-ae70-630d0f854ca2", "comment": "Malware payload (RedLineStealer)", "value": "265fb1f71ada86e1563803a92e5778c44fb6c7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686440, "uuid": "91001017-259d-4f05-9a9c-5c78837263f9", "comment": "Malware payload (RedLineStealer)", "value": "51536df37df04e09c1be736dedbd8b05df3f310daf4c2c9d1092380e2c5f04814bbfee7fdbb5090904210802e2ce2ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686440, "uuid": "8456b330-2a20-4901-8813-d0d6a13c627e", "value": "T15DB40202A7E99433D9B93B7058F702C30F37BDA24CB4436B2386695A1D72B90657277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686440, "uuid": "3d18a842-9d00-4362-898d-97cdeb1f9c71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686440, "uuid": "1731659a-efa7-4ba2-a48c-74ca55b651ff", "value": "6144:KKy+bnr+/p0yN90QE0QLi/dBZGh9ThgDvePZZKpEEwM/GznmCv1QZyAdyf6wSlD8:6MrPy90VMBMh9eD2ToEEDGtQ9yiwSl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686440, "uuid": "aca9bcf9-2dfc-4d42-b5f6-2cd4562f412a", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686440, "uuid": "8101bd16-e043-4589-ad57-6c9871401edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686440, "uuid": "c0d2d372-2d12-4ed1-b76b-d98fe168c3a2", "value": "e41603102b06dad1f4b6a1a7ed1dac55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f85d0d-2e99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690694895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694895, "uuid": "db99f65f-883d-4cf0-a731-ccf80b6ae21b", "comment": "Malware payload (RedLineStealer)", "value": "1859687b2f495c643ea272e605afc125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694895, "uuid": "009c0e37-072e-493d-bd78-a333a26eed17", "comment": "Malware payload (RedLineStealer)", "value": "df8552dc2f90d49eba14911fbf87381e2591b9ed7873513c72d2a83b34130e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694895, "uuid": "d64fc731-adc5-4d68-9cd3-b26dda4199b0", "comment": "Malware payload (RedLineStealer)", "value": "b89125077854071e93dafe8e8e98badc4a7b1d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694895, "uuid": "f088ffad-abde-4a7e-9269-28a30c932f55", "comment": "Malware payload (RedLineStealer)", "value": "aa98d2c585ae74e30af7a2fd33cc6f7aeada074663a6f330c5a7214888b3d9c8691b74abbe5402f7a33dbcac29959ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694895, "uuid": "5dfb7cf9-7d58-4cf9-a516-a6fb33b73f46", "value": "T106B41243B7E88036D4B617B05CF707C30B3A7CA1A979876F23865A4E5C726C4A87176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694895, "uuid": "f25e27f9-8585-4c2a-bc02-ce284044c2c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694895, "uuid": "0d52aaa3-bb4b-4219-b661-9b1b77758ace", "value": "12288:jMrny90JG2SIFU2Otis7+oZGoRCrB1Raff0rj:Iyqm2OtisSRoR00g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694895, "uuid": "38644e0b-cecb-4a4c-8c0f-a5a4e8555ff2", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694895, "uuid": "970f0894-c172-4e89-bf4c-9d2a6829baa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694895, "uuid": "60d99900-09f4-4c50-b680-3e88eafab860", "value": "1859687b2f495c643ea272e605afc125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6d4c7f-2e95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690693083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693083, "uuid": "d917f77d-dd11-40fd-a5db-a3ba44fcc3f2", "comment": "Malware payload (Amadey)", "value": "05fb865f16cb9f7d200ebd23bbf25ef1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693083, "uuid": "d56d9048-2522-47f8-8326-c123e54c9187", "comment": "Malware payload (Amadey)", "value": "e00aaee8fb6faf8736b36b24a378439e9f071d790470f1724fb24df6ee1be303", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693083, "uuid": "27bb6f36-c1f6-4eb7-8cfa-fb8050a797d4", "comment": "Malware payload (Amadey)", "value": "0004b8dcc79ab1d5507a1aeb4d68ad7c5dc03748", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693083, "uuid": "2d280ef9-ee4e-4948-8a12-a952a362832e", "comment": "Malware payload (Amadey)", "value": "8138ad6a8f448b7beeb9e711b57d4e644afb8eccd64154c095b4fb7a294202317b7313f320442147210c0b3294ce56dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693083, "uuid": "064ecf2d-bd7f-43d9-9a55-3a241cc8c4d0", "value": "T1DEB41252A6E88032D9B52B705CF713C30F32BD624D7A523B2789599A08736D4B87673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693083, "uuid": "1ee29697-2cdb-476b-84cf-5f0e946276b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693083, "uuid": "027e6b1e-27d1-4c53-bafe-8b0a5ddb6ead", "value": "12288:pMr/y90hWZjNRKre+pVhugBYC2movgMZqM1h6xk:uyvpHKre+pV7zeohk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690693083, "uuid": "8e3bcecf-7d1c-4eb3-ada6-7d2bd94f26fb", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690693083, "uuid": "f01dae11-90fb-41f3-9915-8b08fbb7d988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693083, "uuid": "bdfe2419-1d30-4efd-a9fb-e17b79e89970", "value": "05fb865f16cb9f7d200ebd23bbf25ef1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9d8f19-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686138, "uuid": "e3451faa-0cbd-4d60-ae15-6661877cd041", "comment": "Malware payload (RedLineStealer)", "value": "40b35adcb911b7d0042f6dc5dd9773ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686138, "uuid": "9b219a4a-58ba-45e1-8514-039aa02c87b9", "comment": "Malware payload (RedLineStealer)", "value": "e0d15765f8aab66390d58035036a5f6fd7bdd541d41a71b0244ff23493008ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686138, "uuid": "f1eadc69-657d-4e52-8fa8-ce4a883783bb", "comment": "Malware payload (RedLineStealer)", "value": "c4ae6a52aaa284758fae73de9fc4f8eb9cf19308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686138, "uuid": "ab5f9ce3-ebc8-4088-bb14-1fa331f17419", "comment": "Malware payload (RedLineStealer)", "value": "100bed3504276aab3546ddbb891ad7bbfc9638cd5bb7b7f8e267ddca386be4fad13713794b1ca4cfe6614af89938f335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686138, "uuid": "54c3b6d5-587a-4ddb-8f3e-48043702f400", "value": "T1E3B41253F7E9A032CCB81B7418FB07931A36BDA09D68436B3F6568591DB26C4E07136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686138, "uuid": "20b2914c-2632-4428-9521-8b70d987d85e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686138, "uuid": "e6280c17-d345-4113-950b-a14d9102bb47", "value": "12288:IMr9y90NxDIW+hFqdJsXyMiPzeL+3mtFG5Gt053dzU+hPh:FyLhFqdZze6mFEp3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686138, "uuid": "c1de5b4f-e2b3-4b83-8ea5-6f843bad2ec7", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686138, "uuid": "fc5bab50-a30d-40c7-9271-d93a88a5c91b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686138, "uuid": "e47cba37-2ff3-4130-a3db-c8936e55af75", "value": "40b35adcb911b7d0042f6dc5dd9773ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb31aea-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686752, "uuid": "c26c2461-aea1-4c3b-acca-b755f130de23", "comment": "Malware payload (Amadey)", "value": "8189c2dedce840c1968e0ca0c4b8b851", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686752, "uuid": "e617818c-c572-4388-af5b-c93851160c27", "comment": "Malware payload (Amadey)", "value": "e108ff127816c7473b4288f40bd13567a985e223950fa93d9ab0d43aeb8ec658", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686752, "uuid": "ce943347-ef42-4e8a-9801-e36555011c32", "comment": "Malware payload (Amadey)", "value": "e317a1efee92d259c681c85ee604db8e9143db5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686752, "uuid": "5d49f40c-0a7b-4abe-bbd8-b18f22466578", "comment": "Malware payload (Amadey)", "value": "ce6649484469c45ecabde5fdb49933b9cf34446a2aa35e783c5d4c84b4d6a10271c21d657a14c62561db44f5cd103973", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686752, "uuid": "cd8a8091-1513-4ae6-9c4d-5f502e997f58", "value": "T18BB41202E6E86172D9F41BB118FB02931A3B7DA18D7453772B8A9D195C727C4B83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686752, "uuid": "9736e9f1-89ea-41d9-ab92-e21072486698", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686752, "uuid": "cc2a030f-d3bb-4490-94d8-60abce79d140", "value": "12288:GMr7y90iRAY0o2mFIxFvgBBiTuzgBYCriq3WMYgta:tyEZqIxFciKMzmojxta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686752, "uuid": "8896c596-238d-450e-b5aa-bc6faa6a77e5", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686752, "uuid": "b9729e55-b22a-4d04-8635-1b45dfc11458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686752, "uuid": "f5611cd0-d690-44e1-9ca8-9b2af707558b", "value": "e108ff127816c7473b4288f40bd13567a985e223950fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd06ac15-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695262, "uuid": "d93d51db-77e5-48d6-a435-7685e89b6547", "comment": "Malware payload (Amadey)", "value": "15a6ce87d6a2742dd23b9d264424ef9b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695262, "uuid": "05890872-c444-40cc-91f2-f54da9acf6b6", "comment": "Malware payload (Amadey)", "value": "e19fdfbeb82fc1884b2c7d5da6ae4a60c301b4d50d319299130dc50d3d5b3657", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695262, "uuid": "3b11539a-b5b1-45a5-839d-e025f2c7f88a", "comment": "Malware payload (Amadey)", "value": "252f5eaf63b571b76a73b3ee1e9356970feea17b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695262, "uuid": "0535b773-2a14-4022-a9ab-ab2071a19943", "comment": "Malware payload (Amadey)", "value": "55880f4ecb6bc110c472de6d48b6be4dea9ca7a1884fb90ffea65b74eef68971d6f554b517769b34c3e3b83c2c1f1e0f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695262, "uuid": "26786310-d3c6-4607-ba47-c32f66b0bc81", "value": "T1F0B41202EBD89072C9B56B7048FB0A930B3ABC519C35976B3785885B1C736D8997533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695262, "uuid": "8dd275df-c5db-44a5-b430-38889491cdb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695262, "uuid": "aba27ea8-7ae6-4867-99a3-6e8d0a075854", "value": "12288:sMrhy90ecVnTDQxRzpy+70yyxA5gBYCoyU/N8r+:1y1xRV90yuAiz7vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695262, "uuid": "34d79862-6658-4e05-b961-f577dd500a85", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695262, "uuid": "ee510f00-071d-4cae-ae8a-72afaf322673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695262, "uuid": "9973492d-b986-4b24-9922-250d13c7981d", "value": "e19fdfbeb82fc1884b2c7d5da6ae4a60c301b4d50d319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06f00a7-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695241, "uuid": "cc128df7-86bb-48cd-90fd-0dfefb93668c", "comment": "Malware payload (RedLineStealer)", "value": "b11150cb6f8d8f6a9a4210cf4ea470a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695241, "uuid": "4dd7c6b1-88b4-43e4-8c5a-998cd82e2c0a", "comment": "Malware payload (RedLineStealer)", "value": "e3d15488671063f6fc8407b10f1d3764cd6eaed70b927b340cda017957bbb41e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695241, "uuid": "d0bb4819-3936-4132-958b-50c04d248887", "comment": "Malware payload (RedLineStealer)", "value": "8e6d5e11d4750aaeedf40f5ad8b9f6bf6a7f5593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695241, "uuid": "841e00e8-c6ca-446b-98e7-4f4ded42b88a", "comment": "Malware payload (RedLineStealer)", "value": "2a84fa7fb306f17d9122bd84815ef49a342fd2d3755759458e30211cd6be40cf2ee716434ec118118c30932763c42f58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695241, "uuid": "1cde6692-13f2-4ff7-9f3c-f325db43c77b", "value": "T154B41202ABD49133D8B42BB058F607930636FC616CB8972F23C5999E9C727C4A476B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695241, "uuid": "eff4e15b-870a-4158-8ddd-cb7875108c01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695241, "uuid": "39d168a5-7315-4765-adc6-da16751d6a8b", "value": "12288:UMrXy90Gb/tCZg2/Ciez8GLvZgBYCn4K3mmyfmlr:LyXwf/hqfaz4K2myfmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695241, "uuid": "a3cb707d-f067-4663-9405-5ca8e42833e9", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695241, "uuid": "d38ee6f3-1dd6-4a50-866a-68665c43c5e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695241, "uuid": "64a1dd07-e92e-40e7-882d-57c1477a71d7", "value": "e3d15488671063f6fc8407b10f1d3764cd6eaed70b927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90303574-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686167, "uuid": "76a651fc-5748-4c17-bfe6-7ad03e5b6ef6", "comment": "Malware payload (Amadey)", "value": "c84c8b4c07c0af390e0cd2dc423adf02", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686167, "uuid": "37533745-e513-4d3d-96a1-60d501347b91", "comment": "Malware payload (Amadey)", "value": "e439677543164cdbb131515adc793b6d69de000dc3326c44940434dcce84acd5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686167, "uuid": "5c507a7d-66b7-4af4-a39c-8aabf0f4f806", "comment": "Malware payload (Amadey)", "value": "82bc4022582661d1216354853dbb2d9f282a80d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686167, "uuid": "f1a37813-f995-40fa-82e9-19394c36d9c4", "comment": "Malware payload (Amadey)", "value": "faf7b0b26dbd9b892cd86cc767681b68ae21bf213ed03ddd69286a3f1071155235a85ace7a0e9d3f384eefda5f295d41", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686167, "uuid": "44909db6-b2d8-41f2-b8a4-b4fbbf38f77a", "value": "T1F7B41252EFE88076D8B11B7048FB02C70F357DA4997097AA23966D5E4C736D0B53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686167, "uuid": "b8946a60-b788-4d71-a118-c2ec69c57b71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686167, "uuid": "866c9387-72dc-46e0-bfee-6d60b681b4d4", "value": "12288:/Mrey90CID1LOLIh5MysYt89HwXkgDF0jWJJHe:VyBIhO65DYAkgDzHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686167, "uuid": "47eb58c2-7191-44b2-bf78-c5d2891fe9a9", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686167, "uuid": "da507436-dfd5-46ce-8797-ec4a7d794f25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686167, "uuid": "5ddf846f-6a81-42a1-a9fe-6294ff4e8f90", "value": "c84c8b4c07c0af390e0cd2dc423adf02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5345fa77-2e9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695514, "uuid": "30ebedf9-e4bc-45d3-b657-ce9a0488a301", "comment": "Malware payload (RedLineStealer)", "value": "1979476b385ce5a78fdb469b61916ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695514, "uuid": "f422ae61-cf61-41f5-8f25-4d89726a5216", "comment": "Malware payload (RedLineStealer)", "value": "e45180138d1e807a75821b1fe68e39c2efd17f0567588c3f6841794b321d1568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695514, "uuid": "a130a180-3c94-4cb6-8a66-ff48e5f63fa5", "comment": "Malware payload (RedLineStealer)", "value": "da61da7e342f605aa46fd327ace95a11c2e5d261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695514, "uuid": "7480a719-b8d9-466b-ba8e-b7e3e9a75c60", "comment": "Malware payload (RedLineStealer)", "value": "659f691685b6d31ce9363e3ad79edffdcd7aeac528b05ac84e6a1138ccfe5253d2e4afc9692baa863c145b57f95995e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695514, "uuid": "b4880c7b-3c5b-4386-a2de-059bdbd92aae", "value": "T11DB41212A7D852B6EDB527B018FB17831A37BC618974435B2746AC4F6CB39C4A53233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695514, "uuid": "76d82a5d-b64e-4f87-8fca-214c21137a83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695514, "uuid": "9a6c7f5a-dd2f-4f25-8405-444f57c5064b", "value": "12288:EMr9y90hU8bkPGOrPILejQ8hHrgcycrZKvPv:pyx8by7Vd7yCZsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695514, "uuid": "429b0f11-f8f9-4b6c-bcfb-5c85e133b64e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695514, "uuid": "7a20d7fe-c28b-469e-88b1-3d22f24d1160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695514, "uuid": "3bc53506-0a7b-4c28-b8ad-cc4bf1e45f7d", "value": "e45180138d1e807a75821b1fe68e39c2efd17f0567588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648c1059-2f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690741929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741929, "uuid": "cf4834d8-aacf-4acc-944e-e04e39ed537c", "comment": "Malware payload (Mirai)", "value": "251f13708b13d6df4dc85b55544e34c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741929, "uuid": "baa190d4-1fd8-4613-82ae-39d21d7a36e0", "comment": "Malware payload (Mirai)", "value": "e45e5ab1c267c1aa55c8d03e6aeda26d8fef9576631c38f1b02580fdbaed1374", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741929, "uuid": "8419e786-9985-4578-8340-b839809224f0", "comment": "Malware payload (Mirai)", "value": "5784cf5c869dbfdc9d6f499734cd893dbc360a9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690741929, "uuid": "a1b93dad-3b3d-4b69-a980-6ed777e644d0", "comment": "Malware payload (Mirai)", "value": "20fc2ccde85339bbba3fe11df72f79a25fb354bc363131375fb7b223171988806d67b3d880397e80d0cd7e905eb2a0f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741929, "uuid": "2b6c3649-9322-4f31-a6f0-426a094bc27f", "value": "T1EB63A519BF610FB7DCABDC374AE91B4528CC651A21A83B757934D818F24B24F19E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741929, "uuid": "2d53811e-c9fa-4d4f-8cde-1ef3911380e3", "value": "768:RW+CQja6UDSRk7DRVFMq2qdqsS1pvr5NgePjegkeyFtDWBgXi3M7yKA/pX:RW+9e6UDL7qaE1NrMmj9k1FtyBIyBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690741929, "uuid": "a8f6ef91-63b0-443d-8fae-f89c0fa5bec1", "value": 73320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690741929, "uuid": "ff2acd83-fc61-4ee7-8c5b-d41724a63e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690741929, "uuid": "86fb21f0-fb1b-41fd-97aa-7f5f0d812bb9", "value": "251f13708b13d6df4dc85b55544e34c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78aef42f-2e98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690694288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694288, "uuid": "b33f5910-51f5-42d6-beee-ed157bf1a5ac", "comment": "Malware payload (Amadey)", "value": "93dd17b7f0fd380c2fd56fec60aa7317", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694288, "uuid": "6f9de78f-7f1f-452f-9e88-bc3a060e6830", "comment": "Malware payload (Amadey)", "value": "e49c4b2313b6777965a74c5c209701006224b3c9f9d198aa19ee5326dfb6b702", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694288, "uuid": "5d7a2021-0066-45b3-adf2-c482d89fdb77", "comment": "Malware payload (Amadey)", "value": "3e7bb3c0df5f3cc0ed1f7d73d6898618a2b26094", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694288, "uuid": "d6cb27ed-9af4-4c66-83a8-72463788f709", "comment": "Malware payload (Amadey)", "value": "572fb0b8c32942e69d12fba7c50f03bf7e4ab210ba6d93d61b3aeeb75f354f742388b19f0c18e8a45c45c4f57acc7749", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694288, "uuid": "99196d61-b3bb-4a7d-8b56-52de33802c44", "value": "T1EBB40253A6E8D472C8B92BB058F713831E35BD918E30872B3391AD590CB16C5A93677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694288, "uuid": "cdf089de-be36-4a50-8352-9fe23b55e26c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694288, "uuid": "1a3af015-71fc-46d9-8558-6fd11058df78", "value": "12288:WMrbzy90LSVQZuTxnwztbiYzj/7yrn2wM1a:5ylWZuNnUtbiYzjOrOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694288, "uuid": "fe69a9d1-30cb-4f4b-a4e3-f1dfd0e91132", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694288, "uuid": "1e99b9c1-efb4-4d76-a92e-fb421270c0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694288, "uuid": "77e679a4-f15c-4fc4-92d6-ceae67f2d37c", "value": "93dd17b7f0fd380c2fd56fec60aa7317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78731cf8-2e91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690691282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691282, "uuid": "9e29f496-16c4-44f7-9c4f-cfb5b831f084", "comment": "Malware payload (RedLineStealer)", "value": "01011c5ec5c4acf036fa06ed812f1401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691282, "uuid": "d8257efc-3026-4708-8006-f96708676961", "comment": "Malware payload (RedLineStealer)", "value": "e5324b42b89c067618156dd86eee92cc4bb49367db5ade661ae800cde8878e39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691282, "uuid": "5f92ccdf-a672-454c-b49d-74b360101c61", "comment": "Malware payload (RedLineStealer)", "value": "5816bd6d4ca9e07975054a20b45275bfa3551e56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690691282, "uuid": "2f1f76f0-1f0e-4b15-8976-751cc1656e45", "comment": "Malware payload (RedLineStealer)", "value": "3705ed75ca2dc53a7f3e1ecfe5d17e002f80ffd47d5faaff7927df5e3c702181b9a4b4d7639527fceb54a8fee089d53c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691282, "uuid": "1a0b0d38-e14f-451d-8a0e-e7088a71ff71", "value": "T15FB41212FAE48073E87727B059F702C30B39BCA29C758367275A5D9A0CB29D46932777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691282, "uuid": "d4474373-4f4c-4d62-af26-38f824eb6b39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691282, "uuid": "c4aff7a4-47cd-4898-8269-2e813aaac7ee", "value": "12288:MMr5y90syVFPyglv625Y10jsW6Kc8TyN:9yATPy6/Y0jN/c8eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690691282, "uuid": "d881c02e-88a1-40e6-bed8-b5d77fa660fc", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690691282, "uuid": "dbcb1baa-d885-4812-9dea-19ef248ad8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690691282, "uuid": "7b481d1a-9833-4e00-8a19-ce874139f279", "value": "01011c5ec5c4acf036fa06ed812f1401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bcd57f-2eb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1690707861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690707861, "uuid": "316009cd-0943-4505-86c2-bb5e324512f8", "comment": "Malware payload (CobaltStrike)", "value": "5dffcb334266d95a30c451c6d1aec727", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690707861, "uuid": "f60d49f7-6a55-479e-abdb-b468745a9957", "comment": "Malware payload (CobaltStrike)", "value": "e5897829835f3e9fbab71674ca06f48ff127ec014d1629817f0566203c93b732", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690707861, "uuid": "724e3c72-12ed-458b-8acc-06395de95d3a", "comment": "Malware payload (CobaltStrike)", "value": "94bb4388ea7f4bc11785dff9a1855dff8c9a24ef", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690707861, "uuid": "ff27dda0-34af-4367-b080-0bf4b07f6431", "comment": "Malware payload (CobaltStrike)", "value": "c6b14cfee2fe87532ed927b821cdfc2d22a5ebd84d8ce622543aa6181f8face7a3f9c275f43a2d4ed42f66970b0ba11f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690707861, "uuid": "ef2f8dc9-7ee3-41f3-be6a-e62faf5854b2", "value": "T1FC92DA3FE71368E9C106D57845FF3733DCB13DB285A6A72E1724D2B42E105A46EBAA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690707861, "uuid": "a97ea391-1c27-4860-8519-3e6a4d81fcf9", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690707861, "uuid": "d013ff35-48e0-4b72-a8b8-70faaee260d1", "value": "192:eV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2v0NXvU/WF8qa1Dojjgi:oqaCF31cix+Dc4zj7hvU+FF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690707861, "uuid": "1353ef39-0499-46bc-b4f7-7154c7ff8316", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690707861, "uuid": "48af9bc7-e58d-47dc-ada1-3170d509da42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690707861, "uuid": "86a4d2d8-4661-4645-aafd-a75a64069d6b", "value": "5dffcb334266d95a30c451c6d1aec727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f49933d-2e8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690688582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688582, "uuid": "dcbb3569-06fd-41f8-92af-9f28de7c8f9c", "comment": "Malware payload (RedLineStealer)", "value": "9b2599db02d7a60364984ee04b8fb11b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688582, "uuid": "9296bee0-7726-4d23-9d0f-43fbc54010cd", "comment": "Malware payload (RedLineStealer)", "value": "e7b6437912e7aaa04ddf45d3975edf474378ca553b4b3b47c82850ccfdd67790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688582, "uuid": "f9bd5a25-c321-4ca3-9a8d-4e9730c89357", "comment": "Malware payload (RedLineStealer)", "value": "1d4b43609574a9a5c51256498eeb6dadcd919cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690688582, "uuid": "4043aed0-4f78-4652-a274-271b3e8058c8", "comment": "Malware payload (RedLineStealer)", "value": "87d1677e8c26acb26c641ee8e934c5ba03dfbd2bdafb788eeaeb3d5ee7d2b50dcc65d1f154958401dcc91cabfc4491b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688582, "uuid": "04532103-904e-403e-ba3d-9c38231ecff5", "value": "T1A2B41243AAE94233DCF4277068F706830A757CA5597853AB379AA94D1DB36C0E4B133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688582, "uuid": "03492214-4645-4ca1-a544-29bc0b72e848", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688582, "uuid": "409e796c-cf86-4422-a1c2-c8b1a41d5fa3", "value": "12288:9Mr5y90gWcBAvszD1o3l8Yh23eo3sJXKqKdL1GT4mgkyksm:YyMOAUnC3lhkJOWLoVgM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690688582, "uuid": "00e2510d-3421-483f-bde7-4f6488f5caf5", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690688582, "uuid": "89b585d1-4f6f-4195-b1a7-d4639426dcfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690688582, "uuid": "c0e41a9d-6245-4fd9-bd0c-770e50add4e5", "value": "9b2599db02d7a60364984ee04b8fb11b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6163eb3-2e6c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690675601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690675601, "uuid": "20c6a1ca-e97d-49eb-931c-3436772c844a", "comment": "Malware payload (Amadey)", "value": "34d688665c13d7af8688934b0b5608f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690675601, "uuid": "fc4dc3d8-2b7c-4aaf-9e90-ec9c6a71d4cf", "comment": "Malware payload (Amadey)", "value": "ea11703c1f5f2051ea306bf38f41e9c52d71ab3a65b14467912721a5458746b2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690675601, "uuid": "2b1e9603-8468-432f-b2fc-121012c3d049", "comment": "Malware payload (Amadey)", "value": "5fb4f3dab0825fdb7d48c6a76c4978f51128f16d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690675601, "uuid": "46c3b697-3a4f-4dc0-a43a-9440c197d386", "comment": "Malware payload (Amadey)", "value": "a77851007ac5c6fe322c75140ebcb5435d849699e0c34cf9133ffdfb1ce661af960c9c7ddcbc34473467226c17eb9e1f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690675601, "uuid": "ff5da511-0cf1-4465-8a37-2853d7df19fc", "value": "T104F2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690675601, "uuid": "bd404fe7-e428-4777-825f-209df600f36d", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690675601, "uuid": "926e4441-4ae6-40b6-8b82-9cf70f185d1b", "value": 37029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690675601, "uuid": "2f6d29b4-5ba0-41c3-a92a-20e3e9068aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690675601, "uuid": "b0d4f300-4ac8-4d9a-a26e-e469db192d0a", "value": "34d688665c13d7af8688934b0b5608f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec66380-2e99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690694889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694889, "uuid": "5cd66e12-f06c-403d-b4bf-12c79cbc8375", "comment": "Malware payload (RedLineStealer)", "value": "589dbcf81fb2a9b24545491490c20faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694889, "uuid": "197a9b07-2bb9-4781-b89a-5076dd00fd6d", "comment": "Malware payload (RedLineStealer)", "value": "eb04c9a6de40cd0edd97be4e422437ff8de19f43be2d22ccf1a18a8c88cdd54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694889, "uuid": "bc5327c0-a584-4a58-b366-5d75f35e61c9", "comment": "Malware payload (RedLineStealer)", "value": "3dd91b18565576bd02d6ef9c6a1a29f195f20f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690694889, "uuid": "88a46dad-36e0-4645-ac6d-4c5422d901ab", "comment": "Malware payload (RedLineStealer)", "value": "770780a3ed24454abac41deb3e502b3dab6002430bce38687de3ac4be123160adc61bfcabbf44fa224d208a014c81a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694889, "uuid": "4c00ec15-7bfb-40fc-993e-06edc1f5f4c5", "value": "T1E6B40253ABE84132DDF117B029FA13D30E397CA55D7C832A2752A96A8CB36D16473336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694889, "uuid": "46c998cc-8775-4147-b5da-4b8891b73bef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694889, "uuid": "c24b8492-b2fe-4131-bf15-2b9e22d164e7", "value": "12288:VMrgy90kGmhFEAO1i+/Tsnj9Dm4341VcUdX5AQwQeMaG6Gouf:Fy7Op/Ta4ZI0X5Aava3GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690694889, "uuid": "827836f2-7d2a-41ba-a467-b5fd914259b2", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690694889, "uuid": "1ed1ca2e-2a9b-4e49-a92a-d095c015931b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690694889, "uuid": "63a92a73-bb9e-4ffa-80c7-770cd633ad11", "value": "589dbcf81fb2a9b24545491490c20faa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7b23ae-2f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690750262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750262, "uuid": "526b0097-6498-4d47-aa55-9336ce96d62c", "comment": "Malware payload", "value": "1728acc244115cbafd3b810277d2e321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750262, "uuid": "badb6f41-c27a-431d-9b47-1398fd34c00e", "comment": "Malware payload", "value": "ec359f50ca15395f273899c0ff7c0cd87ab5c2e23fdcfc6c72fedc0097161d4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750262, "uuid": "a7bb3640-2a57-4b12-abac-8dd2ce89d317", "comment": "Malware payload", "value": "be64732f46c8a26a5bbf9d7f69c7f031b2c5180b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690750262, "uuid": "f1034df9-ab90-4a6e-8adc-46ac3479754a", "comment": "Malware payload", "value": "1d00cceb26b3a28d6e18293142b7959c281cbfd500ff0475884d72dcef42f75f307f14fb8e2ba2377877f390b924b7b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750262, "uuid": "c3af7ca1-c546-43f5-ad4f-e76a2d111420", "value": "T1C765BE01A6B2CF2AD3D86A3981ABC22C4B51D973F323B75B1F2E74642C5223B4D417D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750262, "uuid": "af2c4dc8-ae03-4d69-8fa3-325eddb0c76b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750262, "uuid": "21d2a42e-7623-4afc-a94e-762f6bca19e9", "value": "24576:d7dOT1b7eAJzjSTUd+21nm3kEvpqZ0vSxmfexX6shz07DTl/uz:d7dqVw2+2KkS4PmGX6og7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690750262, "uuid": "51e36ff6-e70b-4a0c-ae75-45a242869824", "value": 1442816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690750262, "uuid": "5a034f65-7a19-40c0-a460-122f9889e5f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690750262, "uuid": "3b5da5aa-47c9-4f2f-9846-3694c7afe09f", "value": "NanoCore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35782a83-2ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690732401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690732401, "uuid": "4e3b3a3a-f15b-461f-9c4f-de96606c18ab", "comment": "Malware payload", "value": "d31f4c2592ba6124ac052e8830a368ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690732401, "uuid": "94472f51-0f03-474b-8ac3-e53711682835", "comment": "Malware payload", "value": "ec623451dfa86be6a68e1d66d8076fe0fbd87161e3264cdb772805754e898ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690732401, "uuid": "022bd4e4-cfdf-4271-80f6-b96384b5105d", "comment": "Malware payload", "value": "06f5d3d7c1edacc9f3d3da112f50ef25c6fbd920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690732401, "uuid": "b9bb2258-e194-4068-adbb-b449f9be6e07", "comment": "Malware payload", "value": "dcf89667b4c0baa9f2fcd782d2835a36fff1e288e3adb46171d35e526a9d29768a6da1f2120510447ecf224db8f90428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690732401, "uuid": "49da8505-63d1-443d-96df-11bcdc8f28f6", "value": "T1F0B4120766D8D477D9B927B06CF207971F367C615878C39B2B269C1E8CB26D0A431B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690732401, "uuid": "e5180c0f-54de-4d26-95f1-b14b1000ba09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690732401, "uuid": "8d841c87-866d-4a94-a115-99457895d3f1", "value": "12288:kMrQy90MZP7zvXJItYNhCgqyEvJBkUdN3lxsSnuzA0q6:8y5PHWtitNEvJC0N3l1uzpq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690732401, "uuid": "8d73c0da-ec74-4306-9150-29384451aa57", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690732401, "uuid": "52e7f3be-80f6-4c19-9fce-4801c584c4cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690732401, "uuid": "8335c9ff-897f-4271-a670-6b80126fadf4", "value": "foto5566.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe77869d-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686782, "uuid": "d9eff951-5c48-46fc-85e7-ab76c0cc6a57", "comment": "Malware payload (Amadey)", "value": "e42cb9a9d0631f19d3e5ca9412a667d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686782, "uuid": "8ff9ba74-7cac-42d3-8a35-8b38274cbe78", "comment": "Malware payload (Amadey)", "value": "ed2a50b5432575988c029a6d9c0daddc781e4bd1d2da9cde390c963e573ee271", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686782, "uuid": "5f605ff0-2cf0-42ff-a8f0-e0241489a87f", "comment": "Malware payload (Amadey)", "value": "2c92c9b22a5c41a865e0ca9ed52aa31f88fb0e59", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686782, "uuid": "34ac6fa0-a806-4e58-b1b2-d13f835a8171", "comment": "Malware payload (Amadey)", "value": "c3730f5011a27264e3d52721b5157eea0e71fec58a3e33c7db4ad705d2f7af70a3ef22064190e2857aad3d16f258a54c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686782, "uuid": "c220db7e-9b15-4a5c-a390-b1212496baaa", "value": "T1C2B40212BBDD8123EDB5177019FA13870F367C60697992AB675A5A1B8C737C0A83073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686782, "uuid": "d398560f-b195-4b98-ad70-0ac6b849aed0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686782, "uuid": "806bc5de-616e-4867-867e-71eecfd64bcf", "value": "12288:OMrLy90Ba2sEdmxBMuEkRnvbJwuyhLX0EieJqp:1ygRs4G2u1JvGpkEZJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686782, "uuid": "b8dad476-47d7-4625-a47e-43c29c512f90", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686782, "uuid": "a7a79c0d-a6b7-4ef2-9ea4-3e8386724490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686782, "uuid": "c6fa596a-02d4-4c20-b8cb-afd63280d9d5", "value": "ed2a50b5432575988c029a6d9c0daddc781e4bd1d2da9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69ac815-2ea1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690698231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698231, "uuid": "bd05f36d-1747-4231-b408-f37d78589d5c", "comment": "Malware payload (RedLineStealer)", "value": "f4bd5ddc6e00c1e058986213c4fd6e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698231, "uuid": "99787ca6-a53e-4134-9a44-292ae3d1a79e", "comment": "Malware payload (RedLineStealer)", "value": "ee4c5daa2e1992d339be9e9a69726641952127dfc0c4a74b695e720fd8f2c548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698231, "uuid": "276c07be-29a1-497c-8a07-1121e9cfc62e", "comment": "Malware payload (RedLineStealer)", "value": "7c9de8f89c9fb0dcbc03a90bc4cc10c94919b813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690698231, "uuid": "80f3f2e0-4604-4638-b138-47f2c8cea478", "comment": "Malware payload (RedLineStealer)", "value": "ba0bdbc9d8ae3a438a922ecd8a2c54aa5b08b5abb7f246d9421685f8645a6c0eb8dd3d6cb29011db5c047e97f6bbb1c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698231, "uuid": "8602046c-c6ee-4ce7-959c-bf84c3321087", "value": "T16BB41213FBE95432E9B213B048F606D30B397C769D78836A3305985E4EB27D4A53672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698231, "uuid": "93e1c8fe-2fba-403b-8c5f-ea8bf1684fec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698231, "uuid": "6e3b01d8-89d5-45ca-949a-e5076d181677", "value": "12288:NMr5y90Ml54C6YmdDtP4TgBYCQJJtlaA94:8yx54RjP7zcRBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690698231, "uuid": "cf6e5915-b37b-40e8-a391-b04dec4b786e", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690698231, "uuid": "49437b0c-ba5a-4c03-89d1-5fae0f8ec577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690698231, "uuid": "5911f5f7-6200-4280-8c31-9bdc9c48f2af", "value": "f4bd5ddc6e00c1e058986213c4fd6e33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68624592-2ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neshta)", "timestamp": 1690701133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701133, "uuid": "9d38fc6c-2cf3-4568-b903-26f8a612a0ca", "comment": "Malware payload (Neshta)", "value": "5c5f8f7ea8786c941ae32beb7c1de226", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701133, "uuid": "ddff78cc-c034-4cfb-a102-f6ccca6cc673", "comment": "Malware payload (Neshta)", "value": "ee7d0c2b6f12bfd376b2daca92a1e8cf17a39e3ca497e1133465c607d1334fa2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701133, "uuid": "ba5bd835-7727-453d-bc65-6b6cf84e4cef", "comment": "Malware payload (Neshta)", "value": "a2b2aeaca35c2cfb16bfe2359e825d7be8a3a022", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690701133, "uuid": "4703b9a3-c080-4d8d-a861-1186762510ba", "comment": "Malware payload (Neshta)", "value": "d0b94dc3a145945bf1b81f479c2eaa507b13958d46181bbe0df0a0adfd730fa52605ba0616ec295ac630aca133f63625", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701133, "uuid": "65c26e7e-1b78-419f-90d6-dafe351c4bcf", "value": "T14F641217F8C14573DA123FBCCC7AD22CA67B7763387566AB919419C4ECAC3D10A2C25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701133, "uuid": "72f9cca5-e041-4add-a672-b0ec8f184577", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701133, "uuid": "6102e9e5-fb27-4b26-93f8-6d878fe30f2a", "value": "6144:k9UYQ+6slhheMiKBtwMzCr5kOslNKuySQVzgq9r09jKuZDzV:HZ+xfXiMUGBySQVsq9rvuZPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690701133, "uuid": "c3085972-e0d7-4b71-8286-5a53419db0eb", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690701133, "uuid": "918fa939-8f60-4626-afcd-7a02300f1812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690701133, "uuid": "77507165-711f-4e57-a76e-d7a0325a968c", "value": "5c5f8f7ea8786c941ae32beb7c1de226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db426686-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685864, "uuid": "3933057c-f63b-4755-865e-69ba0ff80705", "comment": "Malware payload (RedLineStealer)", "value": "4785d1ebe3de35313ab8fbab6f56e6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685864, "uuid": "ef7c59d8-c6bf-4229-9b84-79fedf9826bb", "comment": "Malware payload (RedLineStealer)", "value": "f019d7429effd09d8d60f978ac7ac5844b683f209148d7370b82a570f2c533cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685864, "uuid": "461ad022-c161-4cbc-b7c8-98214659bc14", "comment": "Malware payload (RedLineStealer)", "value": "01bf7bfe82b0a2190e36712e3652931089aa30ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685864, "uuid": "a7596684-d1e4-47fd-861f-84b9a76ed3cd", "comment": "Malware payload (RedLineStealer)", "value": "4ee5fe06d99f4e6fe73e58c8420a9fa74e9bb1fb7bf81dea192699688d0a2f47a6cce83543e9b8a310b49376f592b31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685864, "uuid": "ff8b8945-84e9-46ea-b254-b50133f95ff4", "value": "T1D0B40206A7E84076D979277408F613931F37BCA29D74826B3785A90F09B27D4A5323BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685864, "uuid": "1cf7eff3-ec29-4411-810b-0241be7b9a12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685864, "uuid": "a5a8ce78-d13b-42fc-a324-4cbfe6984f4a", "value": "12288:8MrJy90Z+HwZRFEhvErl6sbop5lzeIi8EB:ty+2hvmEnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685864, "uuid": "ec99ccc2-78b1-4605-a453-2078e2ea0d3b", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685864, "uuid": "181180c8-3b98-453b-8997-0cc763dbaad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685864, "uuid": "f5e76639-a535-4415-bbce-539fcf40cb9c", "value": "4785d1ebe3de35313ab8fbab6f56e6a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db9f880-2ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690709651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709651, "uuid": "ee3a5ece-ced2-4db9-b3d1-a126b9884585", "comment": "Malware payload (RedLineStealer)", "value": "9402b6e8c5ce8d7109b64249539a8d02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709651, "uuid": "33624b42-6b5c-45f4-8f88-9e6eccefe816", "comment": "Malware payload (RedLineStealer)", "value": "f023157c63f81e776f1150b761c63e2176f0b5cef87c0337eb7fe48003e7aa16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709651, "uuid": "ba96ca1f-6f30-42a4-a7e4-b144cc324777", "comment": "Malware payload (RedLineStealer)", "value": "a01d006091c0cff91904e711e8faafd3e01dd45e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709651, "uuid": "086d5a13-8577-49a9-9d8f-688eb34113b8", "comment": "Malware payload (RedLineStealer)", "value": "40e7eb90efd9f3fd7324944afdf5170843c0734b4572fa5cd988212388547f9bff5603abf4579bac487ed2ad7a6a68b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709651, "uuid": "1ffe8eb7-5e10-4483-a135-f29b43600874", "value": "T17CB41202FBE88473D9F927B05CF606930A397C725D78822F2B96A55D4DB21D0A53273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709651, "uuid": "98ca264f-bf75-430f-a205-04b034180dce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709651, "uuid": "be3de998-cc8a-4902-aac1-53954fbe6f4b", "value": "12288:EMrry90/dfjGfYyOmL0QvO2xgBYCZNzGG8TpdT:/yw0A8L0QvOLz3Gfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709651, "uuid": "cadb7fdd-853e-45b5-a6f0-644d851cea56", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709651, "uuid": "f86d4c86-237e-45d8-b11f-962ad2c69d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709651, "uuid": "c73f441d-8e62-427d-944f-670d0f0da579", "value": "f023157c63f81e776f1150b761c63e2176f0b5cef87c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025f31e9-2f11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690746059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690746059, "uuid": "0928dbdf-b677-4d34-9d71-e972b4b6cdc8", "comment": "Malware payload (AgentTesla)", "value": "486f68aa68bab6c04ff34e41af0be96c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690746059, "uuid": "e957fff7-7e55-497b-a03c-86f8cb1adfb0", "comment": "Malware payload (AgentTesla)", "value": "f081790ad8b00bc389bb9c087f8281ddbff8541b4325312e9882efb594a35033", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690746059, "uuid": "3a4ec80a-5719-4723-b545-abc9d94571d1", "comment": "Malware payload (AgentTesla)", "value": "faff07a3c88d0ae1fc0f4ca3f0775c3b3581af5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690746059, "uuid": "53a39293-397a-4509-97c3-6352f79b0d2a", "comment": "Malware payload (AgentTesla)", "value": "863f6e4b166a68ba3aee6ba82390fb875589a0b14f5bec5511f385415904126bd3c5ea779400169826541e213726681b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690746059, "uuid": "f3c8a0b9-4569-4dce-8dd9-27f2622817e0", "value": "T1AFD4237F058BB58976F409893B3AF15E4A400E5503028A3DC3AD742F7BF96D66C7E828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690746059, "uuid": "f4ebf38e-7da8-414b-bcab-571d539aac77", "value": "12288:tkfKB2nz+o2jfS6xJ69RSqbBW7P4H37ETm/K+HEc1EimMXJk24bsihV7Q:6KAzt2jNJosq1lH34Tm/K+DJJ4br4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690746059, "uuid": "9b60ea88-fecd-44c5-b03a-278528272ab1", "value": 609358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690746059, "uuid": "e890e439-d88e-4b88-a00a-3fe0ca73d2d4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690746059, "uuid": "71fd343a-dfca-4c59-82cd-6108841cae5d", "value": "ndhl 6833295033_AWB_23199_2026-07-25 .Xlsx 6833295033_NPG_0235200266 doc.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cc8524-2ee0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690725310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690725310, "uuid": "e1f8dbad-4784-4251-a21e-fbf8e341d975", "comment": "Malware payload", "value": "27599c22e0eba42f3e91e27fe1d04598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690725310, "uuid": "1528be0c-1d3c-4133-8bcb-4d7cb534b4e9", "comment": "Malware payload", "value": "f09ffe74770a7229ddef667bc95fa73e0886adf8739cdfff36101443975e5b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690725310, "uuid": "f1807cb8-544d-474c-8aff-d3cd3ad6ced1", "comment": "Malware payload", "value": "62f64646050a7052767881f73fdf57825ed501ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690725310, "uuid": "dc566106-f85b-43e7-b10d-ff24100a732e", "comment": "Malware payload", "value": "549fcb8135425fccb4f60fb859cb6df7d2084655d8715f4723f29a862dbe51b469342ab32e3f26805a6468eb486b98d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690725310, "uuid": "bef02323-2e44-4abd-9884-770f44e12743", "value": "T15B139A46B384A9DEF4513F3194E23F6B237A1D60205C6E439E3276C67A791C274AF8E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690725310, "uuid": "26086dd5-509d-4f3a-b512-681f713833af", "value": "4a5ebec485beb64f91edf76f986f8113", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690725310, "uuid": "9ab75a7c-7458-4cc7-b62d-b6da828de065", "value": "384:b6sus8sjumVO2DdGfa8BeQVaZbsjmisNp8UhGWqkLNRaPX1:2seCumVO2DdGf/evVsjLs8UvAPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690725310, "uuid": "5fb1f174-5190-4fe7-b22b-12ee77f4a0ec", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690725310, "uuid": "137e0978-bd14-43b2-beb4-f8189e9d64f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690725310, "uuid": "0470311c-e350-4030-8759-14e2411569e8", "value": "invoice.xlsx.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac0abf8-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690709539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709539, "uuid": "000bd554-54dd-4945-aad2-ee9458f76e00", "comment": "Malware payload", "value": "6d9b3ad15b869553c2a5c4262ce2fdba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709539, "uuid": "e1e19d78-d6fd-45bf-a532-7f26a69121f9", "comment": "Malware payload", "value": "f0c5ea5ba7b2a84e08022ae3157fb917003f68335956a5788a5ff12600b7a8cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709539, "uuid": "66f724c4-44f5-467a-94d8-4a2d0b4dbf81", "comment": "Malware payload", "value": "91be9caef3e2ed584c17a95142a603d208f2389e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709539, "uuid": "dbaa0d45-c7f9-4cf6-a8a7-e6aad6ef9776", "comment": "Malware payload", "value": "5847a6b342ddd309a871d219e713adbfa2a7a0a92e797389c6272439f53b3d6270e52abb4f55adcb8b90a060c83236ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709539, "uuid": "8851732f-8edf-4eb8-ad8d-6e2fbd70fc6a", "value": "T1EC044C86B2D2172BD0B33B76C43A89A5680FFD517C1EB45F5CE90E089B3C5507948EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709539, "uuid": "83751f4a-286b-44e5-b464-0cf76bb6ba8e", "value": "3072:raWyEJqts+Y94tgp28Hw4u/iYizcvRiyCsnWnIAfg60eQo/q6ls273H0bxm:Jy4C44ipbRu/Z0n7N73H0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709539, "uuid": "a10ba592-78cb-4796-9c01-1a7d08df6a2b", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709539, "uuid": "7bd5d639-a641-4732-8416-1593906481d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709539, "uuid": "8655ca51-5af9-469e-8f93-7b42b2ef42a9", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.6248.9834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7510921-2e97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690693991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693991, "uuid": "6725810b-fd3a-4387-ad14-dc7f79433643", "comment": "Malware payload (Amadey)", "value": "8152c1d7936e7fe08a44a8a6f50b9c3b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693991, "uuid": "ea7ef430-4bd3-483b-85e2-7b74876dbb33", "comment": "Malware payload (Amadey)", "value": "f2314040bf2ff9e68cbf1458cfdec5fb832d55735e22544bf6c760f9903cd175", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693991, "uuid": "9be22368-68b2-4017-b1a6-9ad99aae1429", "comment": "Malware payload (Amadey)", "value": "6748fe497ae0e9d35b16bc70136bc2167e75a7d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690693991, "uuid": "e9b91191-3169-4faa-85d1-ad444be735a7", "comment": "Malware payload (Amadey)", "value": "a54a4cd106723b6834e72a1cf6fedbe8c27f0772d8c73b3d32f23eb10f07ba96ba9933e639414cd8c0c97019363ec2ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693991, "uuid": "3bf76940-f6f3-41cb-816e-6ca4397bcb22", "value": "T163B41207EBDD5132E8B517B00DF711C31A3ABCA2AD74976E2395984A0CF26D4A83573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693991, "uuid": "1ecbde73-ef14-434e-991b-2082f6b06bc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693991, "uuid": "1255608c-c932-48ef-84d3-1f67ef225ed1", "value": "12288:uMrZy90ccb8WomtWC9WWf/vHugc6lzR6sF+7FDe8O:PyybDeWX/ugEsFYFDe8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690693991, "uuid": "27fbe085-1e2f-46db-8585-e6426a8766f4", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690693991, "uuid": "8bd71f03-ecfd-44d4-b9fa-0090bf34a5bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690693991, "uuid": "040d7177-0fdf-418f-999a-a9bc87498151", "value": "f2314040bf2ff9e68cbf1458cfdec5fb832d55735e225.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e6a5db-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685820, "uuid": "97b5c59c-78af-4685-ba6e-fda05d997eb7", "comment": "Malware payload (RedLineStealer)", "value": "2fc77a286d2fe916959e10fcc29f2d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685820, "uuid": "f1ed00a7-2101-4a9e-97f9-c838a13c201c", "comment": "Malware payload (RedLineStealer)", "value": "f2cbffc882be579c7185c0385b50d53d8d32809f94acd6c47782c67f55c37ced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685820, "uuid": "14ccca9b-1b72-4969-a6e8-a1a322fdb473", "comment": "Malware payload (RedLineStealer)", "value": "c9315714e930ff19916069e57a8a212c703f83b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685820, "uuid": "32a371dd-9cef-4804-b8fc-988a5ef42df4", "comment": "Malware payload (RedLineStealer)", "value": "d08bf02d65a0a558394c95b4a9d73795378df3b35f757e592478c686b1e2de69dc897f9f1e7e9737beb3ce3b2fcdfd3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685820, "uuid": "a23152ea-b226-4f2f-849a-f671412c1b40", "value": "T1F1B4124767D89432D8F527B008F603D31A7A7EE68D78973B2349681E0DB25E5A93133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685820, "uuid": "f547e3eb-c28c-4bb3-80f1-d0a53e91a1d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685820, "uuid": "b9be6730-d4ed-4412-9d0d-b57d60c57697", "value": "12288:0Mrhy90p0E+49WOhLXrP+Wi2gBYC9CL8kGJohN:dy2xl9WtVzUQohN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685820, "uuid": "e21fbd34-2622-4cf2-a77e-86f4c2151133", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685820, "uuid": "c8787342-abfb-4c43-a44c-8cc97f7b1b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685820, "uuid": "dea318dc-a536-4557-9144-2e678ef62fc5", "value": "2fc77a286d2fe916959e10fcc29f2d6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93e15f1-2ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690709537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709537, "uuid": "5a451213-20f4-4c37-a641-27f3ad30d236", "comment": "Malware payload", "value": "f2b633592c8de5181ce532000d94c9e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709537, "uuid": "40bcb86b-538f-4b32-957d-2c7c6dd43146", "comment": "Malware payload", "value": "f38bfef6c6755aca8e0d2c50ca60bc9d32c00937542e1a259f2d5f756c811a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709537, "uuid": "712ccbcd-63e6-40e4-b873-cb08132960f3", "comment": "Malware payload", "value": "5a3c8fb9c92cdacb9e19712562750ae521cf5299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709537, "uuid": "e8c0a692-884d-4e40-8b66-c4ac8b2aa324", "comment": "Malware payload", "value": "266ed2b56b8f9b8562f4d4c5acf27ba7694d59fccc0a3d7e783ddbe87fe2867c71a9b651ee318bda1d55b9c120aeac9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709537, "uuid": "96dfa0d5-710e-4a0a-863a-c9ebdb734c62", "value": "T1C4646C8379C12073DFDA533440E76B744A7565A2123BA8E9FD70DAF2A5532336B3A243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709537, "uuid": "9e2cad86-e3c8-4042-b6b4-ea243e0bef0c", "value": "3072:96+3N9/taLbhYFVlLkHRf0Koq2+EPrf4QAjtb53Zi0Yl8u:9xbtGbhYPOHSKhVQf4FjTZVYlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709537, "uuid": "500c88f9-0070-4969-a976-1b4652f7c137", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709537, "uuid": "804d6d48-10bf-44f2-b5e6-d2586804a489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709537, "uuid": "a4b00afc-e11b-4524-9766-35e25e835d5d", "value": "SecuriteInfo.com.Trojan.TR.Patched.Gen2.31429.1543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f891ba38-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686772, "uuid": "639f0f91-a11c-4d86-8a07-f563563db334", "comment": "Malware payload (RedLineStealer)", "value": "a20cdff3023cc92433a9b75899f60c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686772, "uuid": "5a54896f-f66e-4109-a93d-6389ef3e18dc", "comment": "Malware payload (RedLineStealer)", "value": "f455f3f2aed55d2ef81d1b1b3cf491bb0a28d07218188a06e29563bf49284b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686772, "uuid": "63df648c-e559-43bc-a319-49e7e45e5871", "comment": "Malware payload (RedLineStealer)", "value": "15f17fda48689b9951a7f202db2922b5325c5b24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686772, "uuid": "9ab1ea89-3beb-491e-9694-6df9e4760867", "comment": "Malware payload (RedLineStealer)", "value": "044944e1b374ba00c07e0fcadbceacf4d7b996e959a3680953cf1cd516a5ab305fdda9307c61e2723f5e88d25353ab1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686772, "uuid": "440b5242-7817-4fe8-8343-f7dacac9dc74", "value": "T158B41213BBE84033D9B523B06CFA42931B32BD625CB5932B27469D4F0D72A44A57276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686772, "uuid": "89f3b658-cc12-492f-ba01-99a7773d746e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686772, "uuid": "5720bdde-182f-4b2d-a938-c149ca6da8d8", "value": "12288:VMrHy901pZZS0rCJfGJ1sDdaxU8gBYCicSrIdG:SyEHCJ+asmjzxab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686772, "uuid": "b3986284-6668-4ab0-9ee9-2361ff3116d9", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686772, "uuid": "3ef63f52-f9ae-489f-8297-122f1503dad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686772, "uuid": "24b4c690-cb13-4a66-9299-183281d8d545", "value": "f455f3f2aed55d2ef81d1b1b3cf491bb0a28d07218188.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f15a8fd-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695212, "uuid": "38fa0f54-1b25-4862-acd4-a563b72b3335", "comment": "Malware payload (Amadey)", "value": "8c06b7a0606c6d3eda8290c982984143", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695212, "uuid": "83c5736d-dc20-4697-aaa8-47f9653bf1c2", "comment": "Malware payload (Amadey)", "value": "f5f8c241fc0272f1d9da4c81277308e066b341f6dade31247069ff9559e5bc82", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695212, "uuid": "63a5f217-93e6-4cb9-9f3c-03bf40ce6f19", "comment": "Malware payload (Amadey)", "value": "9fbdcb9e3190919283648a03f41cb445e59d8fe1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695212, "uuid": "dd376565-fd51-4f68-b848-1a9af3f7ec71", "comment": "Malware payload (Amadey)", "value": "1818abe4edb649c96821bc0fc93ea319d564daa6dc72194455ec259646d3073b2e07ab16e0cf99414e0ffb497fa39d6c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695212, "uuid": "a0011ee8-6e7c-4aab-9463-265a25f4407d", "value": "T104B40202EBD94172ECB627F048F606D30B73BC666E79836A26406C4B5C73694B83577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695212, "uuid": "6a1b03a3-539d-474f-88a0-002606d81c48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695212, "uuid": "b28c24bf-2672-495c-be77-0fa9eedf5ff4", "value": "12288:lMr5y90Yejg5jVx03ipOIgb9t75Qzw/gBYCZIsi:YyreAVm3ipOIgb1Qzw4zqsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695212, "uuid": "e0e33154-7e5d-408c-9417-cb2df7f1763d", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695212, "uuid": "be374950-743f-419c-9477-af6c7693f2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695212, "uuid": "8183060c-f586-4e7a-bcd0-d75f910d0e0a", "value": "8c06b7a0606c6d3eda8290c982984143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3968d38-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685851, "uuid": "a8d70b4e-a7ee-43f3-9f72-12e1e19f0e10", "comment": "Malware payload (RedLineStealer)", "value": "6c1dc7e741cca5fcabea1e7a969811d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685851, "uuid": "54678b1d-58b9-414a-b807-8cb258f0fde9", "comment": "Malware payload (RedLineStealer)", "value": "f6cdbf1abc577833512280ed115c3de7e03087cc8b20bf6b4e3570d8abf33825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685851, "uuid": "6e5242a6-abf6-4762-9579-2aaebe0153b1", "comment": "Malware payload (RedLineStealer)", "value": "f0bfea8d77b2022bd15bac5bc0f8165753c5023d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685851, "uuid": "1b1e6b0c-7bd2-4458-b882-93de3c20cca3", "comment": "Malware payload (RedLineStealer)", "value": "bc14718bbe88a00de739bfa8ce83ac63a752f07881f2dd42903ac27f7eda1fb3038e0d8a21d719dd05b96a3dddc88c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685851, "uuid": "787bce23-29d7-4102-aa6e-2558b1c0c1b9", "value": "T177D41212F7F98033E9B417B418FB05830B3B7D929A39522B3608E94A1D73A65A536737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685851, "uuid": "8da1317d-f4fa-4970-8203-dd2d5965007f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685851, "uuid": "afe5adce-d161-419e-bb9b-8ba2ff1bde9d", "value": "12288:wMrhy90U2vvR86zvsKiPCA9V3vnUA9rxHBfjxJ0gCK:By2e6Y1PCGZHBD0gCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685851, "uuid": "b93b3ef8-7ad2-424a-ba90-43ebc56ce3f0", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685851, "uuid": "17bef1aa-1ad9-48c8-9c3b-eae3a214f364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685851, "uuid": "cd2704cb-6337-4928-89ad-6f10a91b57a3", "value": "6c1dc7e741cca5fcabea1e7a969811d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9786abab-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690695199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695199, "uuid": "f86c5259-68bd-4155-a6f4-8679453d6a68", "comment": "Malware payload (RedLineStealer)", "value": "639742540ddac65fe5dc956fc9288040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695199, "uuid": "1ed516ce-5a73-4a75-bcb1-525ffbaa38cd", "comment": "Malware payload (RedLineStealer)", "value": "f787874491d3f676bff7b46c73da225e157728a3e8176537871e36847d46b007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695199, "uuid": "64430e36-5691-4aea-988b-08d0caffa2a5", "comment": "Malware payload (RedLineStealer)", "value": "c8702c18d574eb45182ee6f6e3d95103467a37b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695199, "uuid": "408ae0bc-c2a7-4ddc-bdab-79ed274e697d", "comment": "Malware payload (RedLineStealer)", "value": "38575f2307d80eb033a2466a3c50f8913d37e5a151b52583d9ede6aa88ab9b9ba5901e60e5653d364c07ef0e3a2e8187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695199, "uuid": "d57e81c8-3d59-4ba3-a54c-6f6a203d1df9", "value": "T1E3B40252ABD88073E8F48B7468F706830F357CA25C38972B27859A6B5D72580F97137E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695199, "uuid": "43f03ac9-96ad-4a95-bba9-a7b5f830bc60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695199, "uuid": "7a0654ba-a689-4402-bc80-d883b091a55c", "value": "6144:Kny+bnr+Zp0yN90QEqGd1NMNhP3B1WWcU1RZ93b32gErIAkbumj9HngjP4+WPGOF:FMrNy9011yx1NGrInb/ncAufgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695199, "uuid": "b6a734de-8c27-4147-a21d-ca4f668cd879", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695199, "uuid": "e62771c7-3bb0-41c0-8d27-5ff3c430204a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695199, "uuid": "4fe47049-b715-4951-a680-0fbdae0e778b", "value": "639742540ddac65fe5dc956fc9288040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38853591-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686450, "uuid": "e6b2ac95-37e7-4df2-a003-70c47e88a2e5", "comment": "Malware payload (RedLineStealer)", "value": "f33dadf4b5c96340903685b6f5bebb22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686450, "uuid": "bcce1e6d-103d-4658-b1b2-b5d451e1ae5d", "comment": "Malware payload (RedLineStealer)", "value": "f94dbf2a0e70d9cb1b0438d4801355633798312568cf894ba69c7a2235f78cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686450, "uuid": "5745b7d3-fc2d-424d-8a1d-4fc56ac474d1", "comment": "Malware payload (RedLineStealer)", "value": "06b387672c8602c705b2368b211d6588592ffd55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686450, "uuid": "fa36d5b7-15ac-449f-b96e-3a62c501d659", "comment": "Malware payload (RedLineStealer)", "value": "a334d8ab7ab6189546f69c128942f9e636072b5ac139feab2d80e59154d189320bdfef099b8e3fd445ba81d500b2564c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686450, "uuid": "0effd948-5c29-4672-83f2-1c5785349c43", "value": "T1A3B41252F7D44173D9B1273068FA01830F3AFCA19D3846A72345A92F1D73A94AA7177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686450, "uuid": "30480b55-6361-45f5-b5e2-d010a971a2b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686450, "uuid": "d0cc68a0-dfd8-41a5-9485-b449f9a831a4", "value": "12288:9MrTy90mAUu/t+UgdaccWU7/g4cMoa5PM7db0MKMNe:Sy4sbdncWJDMoa5PM7F0MJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686450, "uuid": "0bfc14ae-e71b-4c86-9632-f1436ce58832", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686450, "uuid": "d20e7a25-5941-4758-a227-193a410053c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686450, "uuid": "9b35b913-9992-44c3-a22d-396fed8934d2", "value": "f33dadf4b5c96340903685b6f5bebb22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89af5111-2ec2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690712356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690712356, "uuid": "b9d448c5-b214-4ef6-9064-786601b0ec2d", "comment": "Malware payload (RedLineStealer)", "value": "60291dbed4769953f2f1d0c2fec99b7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690712356, "uuid": "e1303cbc-7f1f-432d-afbc-a2145053b8e2", "comment": "Malware payload (RedLineStealer)", "value": "f960c1dec354ff1ad4f7cf51167ed8f892551a3a2eceaf8ba4845d4dcaa8a73b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690712356, "uuid": "5440053d-c9ca-4163-b91a-6c7bca0e6772", "comment": "Malware payload (RedLineStealer)", "value": "fd71b80d7880d00e0bfbd3ea38beb00b1a32a511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690712356, "uuid": "35907d00-25f2-4fb9-8e63-0164f4baecce", "comment": "Malware payload (RedLineStealer)", "value": "6dff97ad172a19376123df514b229860871273022cab18ba9b7a527d0d527cbd2dc91ba1de0a66fe4e87e3c3845dbdcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690712356, "uuid": "3c703c29-4c26-4d78-acd0-e62ad3b4c5c7", "value": "T1C6B41206A7D88073E9F527B15CF616D31A36BCE29835937B374A8D5A1CB22C094317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690712356, "uuid": "23c50b36-b5f4-401d-a84a-7fa955970aba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690712356, "uuid": "7362cddd-b775-46df-bb37-5aeafa9da85f", "value": "12288:7Mrfy907dr1v87NwnCv1OhLpgBYC+DugW+3tpf0lW:cyTwCvYtyzsug3QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690712356, "uuid": "36f509c1-7926-40e3-bd68-def4c3e398a4", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690712356, "uuid": "11dbee39-8046-417a-8290-c5b662be0fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690712356, "uuid": "0e4ed4ea-5a9f-4ba3-b145-b597f1ae7247", "value": "60291dbed4769953f2f1d0c2fec99b7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46997680-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686474, "uuid": "f37709f1-ffa1-429d-9588-307cf117e6c4", "comment": "Malware payload (RedLineStealer)", "value": "0816b83c3c7fd81b6a3b24b886bb0f0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686474, "uuid": "85c45c91-2ff3-4c22-b652-fa2f4ecf9001", "comment": "Malware payload (RedLineStealer)", "value": "f97ab34b05afa8e419c750bfe14d2be4904a1d51408234219ed037384d7ab71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686474, "uuid": "4700deec-b0de-4e0f-bcb5-07d410c78370", "comment": "Malware payload (RedLineStealer)", "value": "733e9fc8a4448e65ca2446d52217950bf3958c2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686474, "uuid": "074d279b-f262-4012-b4b5-144e35bffdac", "comment": "Malware payload (RedLineStealer)", "value": "e5ba337d740f0414b06ad9c7421b5f16f3bac9e5700134051a06224813fa27fe55f94d0fb9a012fa69b37eba90a46519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686474, "uuid": "b9845d14-1fbf-4d1f-a5ca-da8e093ba41e", "value": "T1AAB41212EBE4A033C9B927746CF612D31E36BCF4893893A72B51594E0CB36D1A572367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686474, "uuid": "5c96862d-ab2e-4f3e-942c-ef333c8958dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686474, "uuid": "597609f5-fe21-4c33-9bf9-0d7f07340aa5", "value": "12288:9MrHy90ZovjmIVvDShEHl1ROhFIoqobBRXUoOG2zF/gZsSti:Wy4i7LSqHl1RO26nFOGgyC+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686474, "uuid": "e225d165-ac13-4c8a-b2cf-8a5cdbdfb36a", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686474, "uuid": "f1407095-a490-4367-a732-80ec526e53bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686474, "uuid": "a2420a27-fdda-49de-8a2f-509f40bc4a59", "value": "f97ab34b05afa8e419c750bfe14d2be4904a1d5140823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7b9ba2-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686485, "uuid": "a9882af3-2fdf-4528-bba9-732f78210d27", "comment": "Malware payload (RedLineStealer)", "value": "3fa765e6b69366cc3610dbab40f691e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686485, "uuid": "6684d668-bd47-42ab-b3f9-23b3590ee22c", "comment": "Malware payload (RedLineStealer)", "value": "f9ffe2d40d1955c1087f4ccfca8ef35e249405c5f90e655f8ae97b9accf46725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686485, "uuid": "0399e700-aa13-43dc-8d6f-eb5790943333", "comment": "Malware payload (RedLineStealer)", "value": "c905b02e5d9cf788022e3f853ad435e950e732cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686485, "uuid": "63a6998a-5f75-41ea-91cf-022d86c98df1", "comment": "Malware payload (RedLineStealer)", "value": "c60c1ab64dc41d8293554ca314acab95717bb23286a33128177fe29ceb82987bd8da1566a429cc40f2072acdde4ed803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686485, "uuid": "2c82d50b-b478-4cb3-a2fb-9998d927342a", "value": "T16AB41253E6E95473E8F12BB44CF513430F36BCA08D34839B2359A95B4CB7290A97672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686485, "uuid": "5bf02b51-c055-4232-b5fb-e723d289a9ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686485, "uuid": "3c473e2c-6050-493d-b7b9-a22f266d62f7", "value": "12288:iMrHy90mpkHExT83Zl9yQSzSd/jVWOQLemtP:9y5SHEe3q8VHMemtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686485, "uuid": "956ad8fb-7545-470f-ad0d-07c943f820e5", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686485, "uuid": "d18f90b0-850b-43a2-9cee-d0add1560842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686485, "uuid": "3c0b3fa5-2525-4c75-a321-938b9f971f2a", "value": "f9ffe2d40d1955c1087f4ccfca8ef35e249405c5f90e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3a8b31-2ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690709654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709654, "uuid": "b4acdfaa-ab70-405f-b765-70fedd6570dd", "comment": "Malware payload (RedLineStealer)", "value": "79f36f954a3d61275d10ffaaf7a37c2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709654, "uuid": "73c5ecdd-f562-48fa-bf62-47652837e1bc", "comment": "Malware payload (RedLineStealer)", "value": "faca2e5aafd70d76ed12ce1694aa38669333eaf57fd888995dbba7caf4efea80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709654, "uuid": "e3b49f60-7acc-4233-a108-2f7c22c19019", "comment": "Malware payload (RedLineStealer)", "value": "484485507e4e6c5d552dc156c100462ee12fd935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690709654, "uuid": "5847d0d7-df4d-492d-921d-fd6ad2710c9f", "comment": "Malware payload (RedLineStealer)", "value": "82cce7841dde57ec83ac1f2575c4234c6bacb245c9f8fc5b17d2c12f70b7d61490d7418e9fd7f040b3462e9de631eebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709654, "uuid": "8cfbbc51-0ff9-4193-ac44-98d57a5edfc7", "value": "T148B41242A3DC8173DCB527B459FA07D30F32BCA25E7082AF2399595A4D732D0A97172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709654, "uuid": "a2692d00-abde-400c-8603-780bb0ef86d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709654, "uuid": "d2f14924-1f48-4235-8a95-63c805448bf6", "value": "6144:KAy+bnr+3Vp0yN90QEPfp//uzGG5uIa9rq/0zEUyjFJXdRISWm3Fch/3gZoEaOMo:oMroAy90ZfV/mGguZr+1RJ5dRI/Kk5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690709654, "uuid": "0f14b841-b42f-4d87-bcf0-33f13583b629", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690709654, "uuid": "699e2293-0690-4b45-8c93-8c7141519ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690709654, "uuid": "aee96f9c-a51c-4c6d-b003-d0e1a8b76050", "value": "faca2e5aafd70d76ed12ce1694aa38669333eaf57fd88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb73ba13-2ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690711151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711151, "uuid": "0f2bf9b4-0c98-49a0-984d-2d5972bab525", "comment": "Malware payload (RedLineStealer)", "value": "883a06d918ebbdd490526b96c946a074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711151, "uuid": "578e4802-2cea-4703-86e1-7547b93507b5", "comment": "Malware payload (RedLineStealer)", "value": "faf002feacb8e022750d7076213cbb7a45a25c4a69725cbf3fed71e5d218e3f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711151, "uuid": "cb6c96c6-59a8-4a80-93d3-0a50dfab09a5", "comment": "Malware payload (RedLineStealer)", "value": "d6ba8b18cb7f0bc86ab278a171593b764e994176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690711151, "uuid": "291fa49d-b22a-49ea-9f26-66fe90be6b31", "comment": "Malware payload (RedLineStealer)", "value": "f9131b0fd355877c8904505a809c66ede8518313563d5e4fba33574b76f4b706b114ccfe38527190750ee1bd764ac02d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711151, "uuid": "c97c9cc5-658a-4fe0-a9a2-98c6ce243ac2", "value": "T192B41213BAE84173EDB1277058F6068307317C92AE74476B2786DC0F5C72AD9A53476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711151, "uuid": "54ff785b-8de8-4d2a-9c0b-23f8a0436bf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711151, "uuid": "538ec210-3b9a-4118-9e30-7bc102430921", "value": "12288:ZMr/y90I88+ALDWru67tdfaTm9Imvyvq+:ey86aPTfQm9gS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690711151, "uuid": "db2f2cc4-fae0-43d6-ade0-5489757f310c", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690711151, "uuid": "cad3b210-94f6-4a7a-afed-30b7b6f7f4ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690711151, "uuid": "7483c025-b99b-4744-b867-16a8de6c9cbd", "value": "883a06d918ebbdd490526b96c946a074.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9314442d-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695192, "uuid": "70014158-9485-4a0c-96f0-7297fa5f0658", "comment": "Malware payload (Amadey)", "value": "56271eb5ea4f28786d4243a871cf62a2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695192, "uuid": "f08a7364-140f-4628-92a2-d7006443f61c", "comment": "Malware payload (Amadey)", "value": "fb1cb9bf8219c0823ff0fc1dbd5016c03f88f3d263e1c582df7e31852c7034c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695192, "uuid": "556e5b0e-5bd5-4e65-8f4a-3d486c8cae8c", "comment": "Malware payload (Amadey)", "value": "0249673c05783f8493a22089689bb4586131ea1b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695192, "uuid": "3b8a05e1-d3fe-455a-928f-c1ac51aba19e", "comment": "Malware payload (Amadey)", "value": "15aa58fc9219284254e622ef7225e33fb68f859dd098b221f5eeed9c00f1be366ca686f056df731047a1c9638e7ebf66", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695192, "uuid": "4b823bc0-7648-4f81-8856-7a45aa519de5", "value": "T101B41202F7E88036ECB56BB01CF603C30B367C918D69837727869D8A5D72A91A57477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695192, "uuid": "84c94a53-f791-4459-ac5e-611cb163ec99", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695192, "uuid": "ba657292-7366-4044-b378-f561ff670c58", "value": "12288:LMrJy90BpppHiGJfdJh9IX5engqHfpFsg5jadtX:aySpp9VIpXqHfpFsZtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695192, "uuid": "3bb88d54-5bfa-47ff-b7fc-b164f794f09f", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695192, "uuid": "05f4bba3-5d8b-457a-9af4-ea428040dab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695192, "uuid": "660437e5-6459-4b51-9eab-0c5b004d57dd", "value": "56271eb5ea4f28786d4243a871cf62a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ad22fb-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686452, "uuid": "787559b1-325e-4fac-9687-20a870772e75", "comment": "Malware payload (Amadey)", "value": "bc80809c5f4832fdba8c5bac39430f59", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686452, "uuid": "4986c610-4cb5-42b4-96b9-b302df94ede4", "comment": "Malware payload (Amadey)", "value": "fba4feb75905a0420c848ea841010b04010e8600a864f466017eb5c0c231339c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686452, "uuid": "1cd900c9-6a43-4254-8424-25c63dd8767b", "comment": "Malware payload (Amadey)", "value": "d6c8a7865d50f093a388f187f0ef597560d15470", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686452, "uuid": "2dd40d90-86de-4683-93ee-97ecd40929e4", "comment": "Malware payload (Amadey)", "value": "55c132a703995df8db1b5285b87d7422f3cf918edc4c74c3f9e1a14276b6603f3a035216bec581d88f6e04b08cfe66ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686452, "uuid": "0491afed-7c8e-4f8e-b052-5ef1cd240e41", "value": "T108B41282ABD84033E8B5273058FB06D30B3E7CD16F7886272785685E5CB3691993776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686452, "uuid": "059fcb98-a8b7-47bd-af3d-134242c9b91f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686452, "uuid": "93938ee9-a921-4027-90f6-6dcc9852fb15", "value": "12288:zMrMSy90uGAJJItamycbL+YAiLrShn2I:cyTLJMycbrSp2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686452, "uuid": "f3029a76-cf41-4533-b33b-4d7834a9d59c", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686452, "uuid": "2e055dae-d011-4e27-ae70-90beca871524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686452, "uuid": "6c3129a6-0b47-4aa9-a946-3fef05c86c1e", "value": "bc80809c5f4832fdba8c5bac39430f59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f8ed1f-2eb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690705739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705739, "uuid": "a13a1404-0499-4842-8ba8-c9337b3df46a", "comment": "Malware payload (RedLineStealer)", "value": "71cddcaa3f1997534678fd6a527fe154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705739, "uuid": "1d37088a-a88d-46e7-8fbe-7a10a10ea299", "comment": "Malware payload (RedLineStealer)", "value": "fcd07ccdb5f3344192ffa4f39b6d522bda8cc5535ec8c097404e7f46ed25bda9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705739, "uuid": "b20ada18-4da1-4777-89f9-68b4b5d9c0a3", "comment": "Malware payload (RedLineStealer)", "value": "780f81c24bbf1a3b1641b792d7cfdd12acc7e353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705739, "uuid": "8fbb2a44-61f1-4695-b4aa-953762c6f1c9", "comment": "Malware payload (RedLineStealer)", "value": "60ff4b84ae9749630bea8df0b456615739d10f5fc6ff3e3d366b708da1e0044ed1b7f986ab04450d37234f0b683a9af0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705739, "uuid": "8c5c6a40-6d34-4daf-900e-8023dad0aa37", "value": "T100B40212ABD89076E8F527B458F612D30E37BCA19C74876A2385A81E1DB36C4F871737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705739, "uuid": "e7a67228-feed-4ebe-ad02-c1caf4e90038", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705739, "uuid": "04be30ee-d539-4434-8271-bfeaa5436217", "value": "12288:5MrHy90tQrQC61DDgJZ2oQKqWS7SJ/DIa7rHCBsAwrp:6ya0QBMLIdZ2ZTQ4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690705739, "uuid": "9f2bb0fe-204b-4a0d-a0e3-0442572a4a91", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690705739, "uuid": "d7d79c94-e12e-4f42-b78a-e1a3e8d16a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705739, "uuid": "923dfc94-8aff-407b-8c36-270e49a44bbf", "value": "71cddcaa3f1997534678fd6a527fe154.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eb1263-2eb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690705738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705738, "uuid": "25768a26-e36e-4411-a2bf-dafc2c3b5a3a", "comment": "Malware payload (RedLineStealer)", "value": "7ed99998bff5d873e006f09ac75a2588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705738, "uuid": "c0a33215-43f1-4984-b65e-2a4d7c6db617", "comment": "Malware payload (RedLineStealer)", "value": "fcf464b05016d4f9a43f2dbc627218ef63840077f00b1c63abc5e102ac972d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705738, "uuid": "49cf45d9-bedd-416b-ac09-77950485d566", "comment": "Malware payload (RedLineStealer)", "value": "8cff5adb3ce31a0796ca3de013ecd94124b0f418", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690705738, "uuid": "2ad6a222-d101-4d26-b8e6-bacfd123f778", "comment": "Malware payload (RedLineStealer)", "value": "f26f83ca528ee04ab30c0a7f1e71be301fb26dfba4ca29d91d94a12fb6ef7f110b85b788d9fe12ee0063cb175d8c23b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705738, "uuid": "18624b3e-e0cd-4390-abc5-7f7c0b79d460", "value": "T199B41203FAD88873C9B1277019F706931E357CB158B8976B279599490EB36D0B9B233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705738, "uuid": "2f7c0568-9155-4176-b86b-4e9c060dfffd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705738, "uuid": "260bfa7c-951c-4561-9362-b86b93972a14", "value": "12288:0Mrwy90Gv2ZXCwh5H3jpMjr3RoNPdMwycBAIEsQ1l:8yZv3whFNc3kFM4nEZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690705738, "uuid": "93221bc5-e081-431d-ad79-41f1df3479cc", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690705738, "uuid": "ac8fa46d-8026-4065-8bd3-9b5dfcec0856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690705738, "uuid": "1d0cb456-7659-4b5a-b667-ec4e60cdf316", "value": "7ed99998bff5d873e006f09ac75a2588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29722b5-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695218, "uuid": "7216d4bc-19f9-44b1-82a6-511ee397070c", "comment": "Malware payload (Amadey)", "value": "4a4d0aa5e802cf1e1fdbdae21fda1d5b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695218, "uuid": "54778bd5-f133-4dd0-a93f-84a38c8acdd1", "comment": "Malware payload (Amadey)", "value": "fd6b31784077f2249b619f596496e7a997dcb32ec1ac36f233af605a0d00b316", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695218, "uuid": "8c0bb5b6-cf54-4754-a515-7fc899c70233", "comment": "Malware payload (Amadey)", "value": "e8ae5d6dd241cbc6c44a67337e44a5233be809ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695218, "uuid": "a3f46cbc-d75b-4067-b3a2-de5dc415d6ea", "comment": "Malware payload (Amadey)", "value": "a06b464200e18937fadb89703502a0b9496c4042706e01f0b18e500acc18076fbf141ecc94d1f32bdb52c04c16591f6c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695218, "uuid": "1c798e9f-3029-4466-8a14-13b8a41df418", "value": "T19AB40213ABE85532DDB0177048F713830F3A7DB2A8B4536B2396994E0DB3681A97177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695218, "uuid": "6bda2731-dac7-494b-be76-19f9964e1eb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695218, "uuid": "3e6cba1a-a6c1-4dad-82e4-6047a5535aa1", "value": "12288:PMrvy90u7ZM/TvhWCEwW6sJE5hq0FOXzQSM35ik:cypm/TbET0EXhUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695218, "uuid": "9077bb3d-459b-457d-8c19-4540bd3fadef", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695218, "uuid": "62c7ab3d-3ad7-43a3-a41f-ead18964c00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695218, "uuid": "564ada8c-929c-499f-beb0-9c81ecf0511b", "value": "fd6b31784077f2249b619f596496e7a997dcb32ec1ac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49feca9c-2e86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686479, "uuid": "34497b5e-abc9-445a-9c8c-8cbb0aeee18b", "comment": "Malware payload (Amadey)", "value": "00ccf74efb2d4a2452cf4e6323864a1d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686479, "uuid": "b3825099-f182-4315-8333-3005ac2753c0", "comment": "Malware payload (Amadey)", "value": "fe521375fab071726a294565914e766c666a4114c44a5e4dac5d0909ba20eed9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686479, "uuid": "a48de509-83d3-4bc1-ac4b-73910fcd7414", "comment": "Malware payload (Amadey)", "value": "8918656cde37d8b9f8187bb6c40f9906f133a0bc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686479, "uuid": "ae3c6f09-3bfc-4f78-99cc-7566a5458645", "comment": "Malware payload (Amadey)", "value": "ce1a629178b2a1e20ddbdd6c7b111cca4f525010d8ec1252201e3bda2e4d2e38b1560325a571024efe7c426b071f9cc0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686479, "uuid": "ad4230b3-a29c-4173-962b-8701f0732d47", "value": "T1FCB41203F7D48062D8F217B05DFA06830A377CA25D78476B3785AA5E0DB27A0A575B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686479, "uuid": "8cfb4795-66c1-4199-8e62-58404eca5ea6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686479, "uuid": "471d97f8-9d2d-4c47-b9ca-d42f5ce9a8ab", "value": "12288:lMrfy90o0aMf6T5d2iTV3p1Rf9C00gBYCiNQfytWszK:yyL0AH2mX1rzgFhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686479, "uuid": "159346c1-b045-4ab2-80d8-01dd5da4da0d", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686479, "uuid": "b8edb7b3-5a63-49b9-abba-f18015e1c7de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686479, "uuid": "1edad0f2-c1fa-430b-b310-aeb9d81053af", "value": "fe521375fab071726a294565914e766c666a4114c44a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df1ba73-2e85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690686164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686164, "uuid": "51168b55-b598-4572-830f-014a988a55a4", "comment": "Malware payload (Amadey)", "value": "bf8244faca19363544fb939e924eaa5d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686164, "uuid": "5a5d5025-c607-4c6c-a0ae-843a316841a5", "comment": "Malware payload (Amadey)", "value": "fe61e058d398a4c2217c492fd06856c9ad3662d59081fafe95c0f00d7439f900", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686164, "uuid": "dfb0e223-c3fc-42c5-af86-db504ea76207", "comment": "Malware payload (Amadey)", "value": "2e1298b24a98262a6789db15ff449dfe9ca43d4e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686164, "uuid": "23d27f5b-bca6-4271-aa14-4091819a7642", "comment": "Malware payload (Amadey)", "value": "29e25610be47b3d18b87d8f17a1d72b211c66e410c792a894a0d22d85c7b08f041da95e38b9aca13e7a0026113ce74bf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686164, "uuid": "8e7c9e5b-fc49-413d-9c3e-9168e968879a", "value": "T170B41206A6D49037EDB92BB048F607D30B32BCE55CB8576B325AED4E0C726A4A574337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686164, "uuid": "4e891841-5cd9-43af-9ec0-d4ae65e3079d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686164, "uuid": "fca56614-3acb-48fa-b137-aa8821264247", "value": "12288:uMrny90RqlALR6IJs1UYIBScz6SdO0jRQa6j85xq0mhu5:pyDSRJQUY2z3QQQvj85xzmhu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686164, "uuid": "5aa69dc6-521f-45f9-b71c-481aea136a88", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686164, "uuid": "12db0c06-c79c-4fb0-bf52-e7fb393cd01b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686164, "uuid": "8859ee2b-d995-46b4-bae2-d24153a3f3db", "value": "bf8244faca19363544fb939e924eaa5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95f4869-2f2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690758795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690758795, "uuid": "1b2559b8-ea07-4d54-8ac0-03ecaa586f31", "comment": "Malware payload", "value": "ea5e8f01656c8d5cb7f7cb3e2aff6a66", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690758795, "uuid": "ab9e0b2f-5255-4b87-a234-05b93002d09a", "comment": "Malware payload", "value": "fe87e9ca6a7a6da4fedc9b2dd7a0cf75b0658fb68776b7a853ed3e6f568d49ac", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690758795, "uuid": "8e6e10e8-7ffc-4894-9905-5a3f96b5fa16", "comment": "Malware payload", "value": "a257f47cbee9fc7efc3e5b97df972471d83519ed", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690758795, "uuid": "78695058-eb7b-4b85-9325-36efee1342bd", "comment": "Malware payload", "value": "3566e77cd1d583bd4f11e45773ff17e5e6cf0973f5be6a81c6072d9812700c9a38faa15336517673755a0530b36ec721", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690758795, "uuid": "d936d693-5b7a-40a7-9aa3-284373110e61", "value": "T18A2712ABF72D942FD8BA26B68D7A627227674D0049537B6B3540332D6C336984F5CBC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690758795, "uuid": "70f6b822-6dac-454e-ba6a-c286ea13a4a2", "value": "393216:gWA7I/1v1t16Gh5bnIoVXu8JVxpb9pzmbQzpCznhaAe11fwoau3:nAc9JnhRzVXffb+M9GhaAe19Bao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690758795, "uuid": "a4042552-44ea-4789-89c2-c55d739861d9", "value": 21127106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690758795, "uuid": "90d24366-22b5-43e3-9d8e-510624d7b052", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690758795, "uuid": "9e22f908-41a1-4f33-b604-59e18085816d", "value": "com.android.vending (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af26871f-2e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690695239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695239, "uuid": "766df155-d776-4124-b29f-36940594a3f9", "comment": "Malware payload (Amadey)", "value": "50e008608e1d48fde991d1a2f1e6d605", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695239, "uuid": "9dae3f84-b0c0-4927-a1f0-67938144c24b", "comment": "Malware payload (Amadey)", "value": "fe967015f6f05085285265fcc070b4d47a58135a94f8dbd1c561e53779cd0d1e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695239, "uuid": "04a506a2-56ea-4e7d-91ad-1f118e6f0bf0", "comment": "Malware payload (Amadey)", "value": "15bd72d93c5ddb2bc7a1c729af01abc9d1cff885", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690695239, "uuid": "3bb7f70b-328c-4e32-a7ca-fc6164e21657", "comment": "Malware payload (Amadey)", "value": "e1431f7e388d5914292cf83153ddb080aa8c0a7ff09c92c4ccc3ab9a43725befc33cfbf70b20d2b6ed418cd230e8c3a5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695239, "uuid": "d2bcb2f7-4067-4202-8a63-ddaf7c431119", "value": "T19DB40216B6DCC532D9A5177018F212D30B37BCA2497587FB63896E4E18B32C4A9B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695239, "uuid": "e7f5d3db-47d1-4e3b-a980-94e78fe39960", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695239, "uuid": "969de3da-4cbf-4e07-9188-9549f05964b6", "value": "12288:GMrVy90AjNX68GFCjqOgiDSuS2FHtgDxrqv:zyPHGhOgvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690695239, "uuid": "d5b9dcc3-18c0-402b-97ba-688df70a2ded", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690695239, "uuid": "1e4ba60e-0a76-46d6-be95-ec3633be95ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690695239, "uuid": "54980b3f-fa81-4cb7-91eb-3bc7d63409f0", "value": "fe967015f6f05085285265fcc070b4d47a58135a94f8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05851543-2e87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690686794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686794, "uuid": "dbabcc75-7403-47b0-a682-6fabc6829c78", "comment": "Malware payload (RedLineStealer)", "value": "c7fb6a047e24b4c3ab49ae270cad368b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686794, "uuid": "5bab559a-a72f-4d4e-a3f6-9227efd7ed3f", "comment": "Malware payload (RedLineStealer)", "value": "ff1b7f1df2c574acefc6da423b927a985af1261748618e51fe0e70f6b9f9cab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686794, "uuid": "2b4d4a2d-ee17-4f54-b799-cabc30bced5b", "comment": "Malware payload (RedLineStealer)", "value": "ba275b99688d50d9cc5cc2c01cf9e17524969e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690686794, "uuid": "477d7334-f674-4541-9b47-b684b7a8113a", "comment": "Malware payload (RedLineStealer)", "value": "421520b39d509060f54989939e19bef8e545ea9e0957377eca56b8aa772e817820dfce33439c6b3499a6ef51cae7242d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686794, "uuid": "7624c544-dd6c-470b-b85c-2b437fbb863b", "value": "T101B41207EBDD4072D9B02BB018FB12930A39BCE29C75975B6745A95F08727D0B432B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686794, "uuid": "a5023294-7fee-4755-ade0-298ad6059630", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686794, "uuid": "43b7137e-f75f-4fa5-9c46-b9ea9723f26d", "value": "12288:wMr/y90DdI8jQtBIf7UQ1RdjK1gBYCmzoy+ND:fy1t+AQ1RR7z5y+ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690686794, "uuid": "70498c28-8c36-4096-a9e0-661587106872", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690686794, "uuid": "b9906cea-55a9-4941-9ee6-560e2dbce8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690686794, "uuid": "4a57e4a0-23d6-4e50-89f5-3ceb6eeb2a5e", "value": "ff1b7f1df2c574acefc6da423b927a985af1261748618.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763403ac-2ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690699438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699438, "uuid": "ddb3d6c7-2922-4500-9324-e2453c7f5f5c", "comment": "Malware payload (RedLineStealer)", "value": "3e6c4929a82b142d398d5b1a60a93857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699438, "uuid": "44e50d92-3e5e-4362-86d8-a2a4ee36d42d", "comment": "Malware payload (RedLineStealer)", "value": "ffa14d4c0be8bc789970a81ab0d1c4ceb689e261224f173a8dbd9609a9b45102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699438, "uuid": "6ee1ddda-2fc8-4700-9231-5191df24f0bc", "comment": "Malware payload (RedLineStealer)", "value": "478ba0a29fcab3a9674f20c5b28f66a0fcc53795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690699438, "uuid": "471528d5-2fa9-4714-8628-57d673f7dbbe", "comment": "Malware payload (RedLineStealer)", "value": "cb8ed30a96a45f57b7c16328d1d0ab180f72c657e1bb538310c53a17381cfe5528ad1b5863cfe6cb91e1de1a841f077b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699438, "uuid": "543d6ec6-fd97-468b-a452-a2693e2e235e", "value": "T130740113B7E98032E8F967B028F602D31F36BCA25838875B2751955E0CB32D5A57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699438, "uuid": "dd81a3ed-07c6-4ad3-8e6c-2e4c41353b1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699438, "uuid": "e3715c6c-809f-41c7-8800-fd7fcfa7e523", "value": "6144:K1y+bnr+op0yN90QEdx1i6EoKZ8J+gY4OUsKOK/Apfn6l+ZMFIPXewY:XMrIy90nMUzOUsKOK4p9PpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690699438, "uuid": "c864e32f-0ac5-42ed-b998-c5a5ac7812ab", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690699438, "uuid": "910589eb-364e-4674-9329-48fa873d9140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690699438, "uuid": "2360a71b-ad02-4ea8-bb98-53d875e74565", "value": "3e6c4929a82b142d398d5b1a60a93857.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90bce2a-2e84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690685860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685860, "uuid": "dcc61e2a-e06e-4d89-84ae-2c842bd0e38c", "comment": "Malware payload (RedLineStealer)", "value": "78ddef7d6c9b01634bb868d81a499824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685860, "uuid": "d138ea20-4fb3-47f8-a9e0-c1e452950e63", "comment": "Malware payload (RedLineStealer)", "value": "fff73994420fd611a2f6b266adfe86c3e0b082fa65d7078654d0e9c8462b22ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685860, "uuid": "6b263698-28de-4d9d-aae0-898d651515c9", "comment": "Malware payload (RedLineStealer)", "value": "c1e20a0c5f0bc7140fec50a798c71a59a1d49647", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690685860, "uuid": "d0a85e93-3573-47bc-8a1f-8b4d1a2b9c11", "comment": "Malware payload (RedLineStealer)", "value": "c9ded9298dcb578ca2d32b21d17ba40640a5f49b8b60591e434f07356688a3c8622ce19c71ee37f0ab7d518ae527a204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685860, "uuid": "4572d1a1-3699-45f3-9e7b-cb712ccf739a", "value": "T1BFE41202ABDC5473CCB51B3029FB16C31B3ABDA1596DC69B27962DAA0C326D9D431337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685860, "uuid": "08831711-7791-40e7-a298-251b852bb34e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685860, "uuid": "cd6da255-b550-474b-b4a3-0dfe8987523a", "value": "12288:+Mr1y90QMfRbSxQ5egvHko2Vx4iHwc+jF8Isem3MfGkQZglq/Qiz1v:TyHMfRJ5JHkHx3Hwcxdjc0glqDz1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690685860, "uuid": "8ba20a18-c373-460d-ac52-09e73f7fbb3e", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690685860, "uuid": "61dcded6-0128-4242-bfd1-23cb70070ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690685860, "uuid": "b4867666-cfa8-45b4-a43f-34d557567a05", "value": "78ddef7d6c9b01634bb868d81a499824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }