{ "Event": { "published": true, "date": "2021-12-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-31", "timestamp": 1640995382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "dcfce48d-e5e1-464f-a383-a43808b28375", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e83f01f-6a6e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640978200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640978200, "uuid": "78c8bd78-f55a-498c-bdab-841b44e5571e", "comment": "Malware payload", "value": "4230e59d0bbb05fc3959fd59c7a77bab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640978200, "uuid": "73e8579d-5281-4edf-9f7f-1cd767feeca0", "comment": "Malware payload", "value": "03c9edcd023caff6903886d8c708cf83bd8e0ffc962523de0abcad76b9bc65c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640978200, "uuid": "a98ad688-af30-402e-a97f-007ccd5d6f32", "comment": "Malware payload", "value": "5d50f5f7b6e81f9a5af28e4d968941ea23e80199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640978200, "uuid": "3f2fc5a1-cd45-4875-86c1-0d9f121c0cc7", "comment": "Malware payload", "value": "7d759a8f94b5a0d2c7d8fbd9464cd2a2b76100f1c51ecf23de1df0fbf48a7f890eabc5584be98edc335496d40a84e246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640978200, "uuid": "4509e17c-8b35-4c6a-a067-997120206b9d", "value": "T17394DF4625DAD2E8E9FFABF41CA375830FB9E2E16590E08D7F5D408A74A2F70464C271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640978200, "uuid": "b9dc63c2-f93a-4fc6-aa00-f6fa768d1ef2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640978200, "uuid": "3e2659ee-dfdc-4bbb-b1c5-561b7140e77e", "value": "6144:X5A+/MqDDOZAjyu+Zuq9FLSHW31wR2fX4We+9EvvNke00EpHWOZ3:XSZTuuuIC72clXHxElP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640978200, "uuid": "9df12e2d-bd78-49bb-bce4-a6e4b5dae3c3", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640978200, "uuid": "f77fd9e5-7ebf-480a-90c9-3a94ba2577e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640978200, "uuid": "3540ca7d-c521-4b4c-a29c-e9afa4c1fdf8", "value": "BL-SHIPPING INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ceef023-6a66-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640974842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974842, "uuid": "5adb289a-84c8-41ef-b167-89a1c42510cc", "comment": "Malware payload (RedLineStealer)", "value": "c77665d2eab48414ab16191b800ddb6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974842, "uuid": "7b8f05f1-04f3-45c1-b9ea-d53e1f41ea18", "comment": "Malware payload (RedLineStealer)", "value": "0578fefbe296c7288e169996855fc341351d890fda777038b0f90d787c3bc798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974842, "uuid": "2189c546-0c50-4c8a-bab5-21d465e59421", "comment": "Malware payload (RedLineStealer)", "value": "ae7ded73651ebb73465a3edd125ca335738d241e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974842, "uuid": "90a934e2-5634-4fae-9605-57c6306499b8", "comment": "Malware payload (RedLineStealer)", "value": "9793e2b6434d4e1a6a330ce9999bae7c8f345cbafc58a1825387f60ec44f240ebbf1389668c8b98d4463263882e6dd0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974842, "uuid": "34a2708b-7741-432b-ba1e-0a18f15fe389", "value": "T17D5533CD7262F61CC5EE07F661317676379D38A8D9442A04F22D534AE86C8D2BB16CF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974842, "uuid": "49b41c3a-e09e-460f-8253-39e2660ab008", "value": "f6af73011d9ad7cbccf66eb190442910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974842, "uuid": "bf8beeb5-1277-4d64-b0aa-e922e372045e", "value": "24576:qEV3h96ikSlOsiTN+kGd7EqZVflv5hQx1eLI0MZH+RkEaHNYK3NwG:Th4ikSlrqIkGdEqZVfN5h01eLEZeRNat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640974842, "uuid": "3fa821c5-c46a-44c1-8531-7dd7f87b702d", "value": 1329152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640974842, "uuid": "ea96adc9-b4e0-423d-a1e3-b4e75e4aca5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974842, "uuid": "88e533f8-9166-4461-95b7-72a0b1c430f3", "value": "0578fefbe296c7288e169996855fc341351d890fda777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5547dcb-69cf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910216, "uuid": "57819e94-b187-4630-a5ae-665229018f03", "comment": "Malware payload", "value": "815fce9837f5a93373f3b753a8c72c94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910216, "uuid": "dcf5520a-3684-4b31-88f3-85c26111d729", "comment": "Malware payload", "value": "05807bf68a965ca33ca827454f94a6d5ad81bd58507d0687f7353c5b3b8db0a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910216, "uuid": "99472685-792e-46b5-9a1e-7736d09a3e26", "comment": "Malware payload", "value": "a6bf3f91a574b41841a89ebb2c3115edd54e7813", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910216, "uuid": "4232649d-73d8-4e37-981c-b1bf675c4d02", "comment": "Malware payload", "value": "7433289022e340c99cfe8ea9a3a9e694f9be7a72a99a7bb37389d24a813f4c84ef1bcdbe000e1c8ae8498bb4a13e2beb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910216, "uuid": "e13cb0ee-5cde-422c-a500-1fd6c7a0ba49", "value": "T1DC23E091DE088E73FB719CB4D3A15D435B585EFEF6A1601272259CFCC9E22810BAE9C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910216, "uuid": "59be85ef-fb06-4766-9a64-df7a96c0cd4b", "value": "768:U5yr+86QKATVvuPLoT0aIjgKMTbU2iQPq3eWw2DAq3U79ovDOnJ/u:RR3vaoSMKMTbPnPqOm4C6J/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910216, "uuid": "ee791c3f-b878-4d73-b1ab-2a87cd8ad77d", "value": 47052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910216, "uuid": "71882581-53d7-45b1-94a3-4616837e4825", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910216, "uuid": "fddccfc6-4c97-417d-a801-3045584f3e70", "value": "815fce9837f5a93373f3b753a8c72c94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae465e7d-6a7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640985286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985286, "uuid": "348ca472-3705-41a9-87e6-435ae42f8d93", "comment": "Malware payload", "value": "4f91e6bbc4a3a7522327dd8f809ec2a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985286, "uuid": "68493c6e-9ff3-4b76-accf-6ac92d233594", "comment": "Malware payload", "value": "08c4335482f09a57351249707e9394382f53ada3ac2b5ba3ff268c7fa1eb1833", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985286, "uuid": "e826f2c6-65d1-4bf7-afd4-b091d99d1933", "comment": "Malware payload", "value": "96247415e6368aecd851addba817ad34ecb7ad81", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985286, "uuid": "c269b6cf-5379-42a1-9097-9fd52be8a8c1", "comment": "Malware payload", "value": "782bf36b3e257c052f0ddca6dff16b3a216a37a3e36cf2971e7c7b18aaa74565e4a411252d0dad1d2b40067081f77d8f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985286, "uuid": "f8e436dc-6687-427c-9b34-3c10795cd7b2", "value": "T13D32BFBFF3018608E6012FBA082D4B11F452A9DDD35500A8597CD9FBDAA5374910DCEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985286, "uuid": "e6f0192b-deff-4a9d-91d5-189ffd2548e9", "value": "192:ucXDDin4AztSOy+K52HcK0VKVp/cL5Ecph5sLzlcYndN5Hhy8v1k7KUCEYN3CBCa:uYi4AzZyh2H1Vp/inhoDP1OKZCK6Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640985286, "uuid": "0b9ac669-375b-4f11-bafd-8c6b768aa5d0", "value": 11960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640985286, "uuid": "d36fade8-fa0d-4721-85c8-da8a7d148a63", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985286, "uuid": "90cdd846-a9c7-4d2f-a0e7-a295cceec806", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b74193e-6a42-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640959350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640959350, "uuid": "3260f213-fb26-493c-aa4d-d1920640dfd9", "comment": "Malware payload", "value": "de84d90a07e7054325b1a9f58c903768", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640959350, "uuid": "127cbbdd-d8f5-4f21-bf14-4122d815d147", "comment": "Malware payload", "value": "0efabb454550dcced1310d1ec4039a8544417b46c6271b6fae2a113d7649cc09", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640959350, "uuid": "eaea6791-5d0d-43db-99a9-303db804cdb6", "comment": "Malware payload", "value": "ffa97d254082042376bf99d09224ccc28d760f78", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640959350, "uuid": "04bbce92-b2a0-4051-b39d-b7dbffb9d1ed", "comment": "Malware payload", "value": "cc4d3e012c779f7bf962dcca87cc8c997360e0275ca691333f024a2755e49a23627d4b6a75b14c5c7354fa5043c3e64a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640959350, "uuid": "84ca7129-23f3-44cc-9d75-6e458a25f639", "value": "T17E228696EE51BBF048701C56839B010EE6F90F628D8AD196119366DEFC08B33B7D58BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640959350, "uuid": "d4ba9894-cb04-4ab2-bbdc-0da0e9497354", "value": "96:ttIcI3iH6l8xgUIwm3YIiHiqppH96ZMRf4dbJMsnmEFeuA5yMedpebrnDOrxZdm:PIRSTxgUIwmItHiczRfO3mEE5yvpSrqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640959350, "uuid": "eda89cce-8f8c-49d8-828c-7cdccafa51f9", "value": 10501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640959350, "uuid": "e465e95c-9b14-4041-a80f-ecdb2bc89931", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640959350, "uuid": "fadeef62-1715-413f-b5dd-e5779eeacb22", "value": "Factura_310.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1080796-6a95-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640995196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640995196, "uuid": "d836c2f0-79c8-4d25-8c9e-ba531d6dce38", "comment": "Malware payload (Mirai)", "value": "44eaa65dff07f4751c471d39d9ee4560", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640995196, "uuid": "8e3ff402-f482-430d-a2c1-7eea2435f8f9", "comment": "Malware payload (Mirai)", "value": "1bbec34ebecfc3b33205294565427c7b6d4c4e07a4838464e05da43d03633775", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640995196, "uuid": "4f90e0d0-325e-41cb-b34e-317871105cf0", "comment": "Malware payload (Mirai)", "value": "f0bf0e35f4af79f242a86b5c6c59944a32d857a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640995196, "uuid": "6280db9b-cb61-4eec-9deb-b3268f8c7e26", "comment": "Malware payload (Mirai)", "value": "49f51998eb6b733f91dd9f015eff97182dad6d0e72d40127ee88d1e16ba94a72e61ccb9409fafae24d9692d9d5568e22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640995196, "uuid": "ca9db981-ff22-4137-9080-2fd7f9f24c00", "value": "T15063A64D3E319FACFBA8463457F39E10A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640995196, "uuid": "48668478-bc97-46b4-ad10-80727f3f1a42", "value": "768:RzZWyvL5MsRXxPx2pqV2Uuz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UQGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640995196, "uuid": "9b35e272-e3ed-4d2c-a6d4-95427c5b3faf", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640995196, "uuid": "021e07af-f000-4672-adfb-8864c00eece0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640995196, "uuid": "bd02d99b-89e5-424f-987d-d03d2ac265f7", "value": "44eaa65dff07f4751c471d39d9ee4560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e318a2e6-6a45-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640960893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640960893, "uuid": "9a6658bf-02e2-4333-b7a0-e5498cdd6357", "comment": "Malware payload (Mirai)", "value": "f6843bfa6d41e8bf3fe973b01e5f9793", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640960893, "uuid": "51f99dba-efa2-4185-9137-183bf0470f96", "comment": "Malware payload (Mirai)", "value": "1c8aaa44813ad2738d9f62335c2695de8d4eeb6a2aae0c28510fe1f0831ee8ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640960893, "uuid": "bdd348a9-6e6c-4683-b48d-1d25073eb0cc", "comment": "Malware payload (Mirai)", "value": "c8bd26b51353c74215be5687164cae24f14e0dc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640960893, "uuid": "49de56d3-eb6f-4cc3-8e53-e3dea543e786", "comment": "Malware payload (Mirai)", "value": "5153b063868128f36db6878dcddbf9724b15fe1f40556d75cfebd8cecba06b36f8b9eeb77e24bb741bea08755ff7bd8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640960893, "uuid": "c0b3e069-194b-4ed2-a7fd-dfef7a870eec", "value": "T1DEE2E1A1E25AA19BDDE15737FD280103136E1BBCE07B6091C6198886E6CF4CE60FDBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640960893, "uuid": "4383a55e-2cb7-40f7-ab29-c10ef55d2c6d", "value": "768:4d2SdUvc00DDCki8tIuqVTq5p+79DxC5hJecKvEB6KUw3UH:4oFvKDCkjtZqVTqDcFgOyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640960893, "uuid": "79bc6e99-6ef1-427a-a7fb-dd446bf9804e", "value": 34092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640960893, "uuid": "cd885ffd-c32f-4299-8222-8ff48509b8cb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640960893, "uuid": "01b28bcd-ade2-4162-832f-856c6b25ce9f", "value": "f6843bfa6d41e8bf3fe973b01e5f9793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecad571-6a23-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640946041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946041, "uuid": "245a4dd6-1723-4500-8eef-59e814eb23e7", "comment": "Malware payload (RedLineStealer)", "value": "ac381ed9d515babae30176a7daa1bb69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946041, "uuid": "5b80da92-1891-4c67-bdbe-252dac97d366", "comment": "Malware payload (RedLineStealer)", "value": "1ef493ded6ef9a2510a901032b9f2f0fd5e13143e2a57542c6fe656efd946332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946041, "uuid": "68aa73fd-35af-4423-bdd5-2b6f1797dc0c", "comment": "Malware payload (RedLineStealer)", "value": "ef26c60086ec2bd508f7e499d5abfb6637d753bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946041, "uuid": "d2763175-fe1d-43d2-ad5b-4e06030be83f", "comment": "Malware payload (RedLineStealer)", "value": "237b140b19e680b7f194dd92817c46d15c79c3a42c2b220580e58c4a965c1be2b246a75aca11ef9063fe67cafd304b50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946041, "uuid": "5505914f-70aa-4729-b553-3d88e646796e", "value": "T121749E10BB90C034F5B316F855B692B9B93E7DE1A76490CF62D43AEA5A346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946041, "uuid": "9bffbd4c-9a39-4290-a4ca-a5b8962b8d52", "value": "f9c2e6a1a2085a9fa6c1b7d773af20c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946041, "uuid": "a7cc0496-ab8a-417d-b278-821056a650de", "value": "6144:okbauVRdBonHY6MhaBF+9nElpdOFDnbHN69w:PiShaBsxElpejbH6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640946041, "uuid": "4eb8f1d9-6502-44c5-96e0-120ef4dedb54", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640946041, "uuid": "0bc1789d-7b06-4743-b296-1203469f6b7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946041, "uuid": "99741c62-8bc9-4a2b-a4e9-714699e611dd", "value": "ac381ed9d515babae30176a7daa1bb69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c7eae1-69dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640916007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916007, "uuid": "5fdef616-32b5-4a84-a206-43f48f849224", "comment": "Malware payload (Mirai)", "value": "93faec53fe8560715f5e1837af06b235", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916007, "uuid": "d6bc42dc-5c21-4a8e-9230-a5cdd2bedddf", "comment": "Malware payload (Mirai)", "value": "2114c1bacc86576c74b29539903dc5848fc1d94ab0688948888e60459d9fb440", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916007, "uuid": "6b81b852-c014-4463-9ce9-7ce43c863402", "comment": "Malware payload (Mirai)", "value": "0b146291655d4404099c19cc9d3500b6cd64821b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916007, "uuid": "e2fc35df-8644-465b-99a3-91dfc4f363db", "comment": "Malware payload (Mirai)", "value": "8886a1e88b59c7cce87646a9326ea44bdf243435ea822e3d2a1f80d2b69cccaf66093ccb652d01251ebe71162cbce564", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916007, "uuid": "bca67f59-480e-4ad4-943f-7a268213dd5a", "value": "T114F2F1A18C6AC81DD148D2BF2D9DB75638B4E86BC1CCD8192FDC65A708F57720824BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916007, "uuid": "94d96144-3b9d-4b81-a8db-cc66bae8417e", "value": "768:wkJ7XB1/OSfqWqqhBNfRsCNdX4gYtXFvCV7rhHRc3nbcuyD7UHQRjk:wkT1jqI0gN4gYtXlCNbc3nouy8HyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640916007, "uuid": "1b56bc3a-12c2-40ab-aabd-b798ecb83e62", "value": 36152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640916007, "uuid": "f54d3795-d439-44ab-82a5-33586c69936a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916007, "uuid": "d1c7e8af-0906-462a-9651-bf28050970bd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627e1a4d-6a14-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1640939632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939632, "uuid": "1a653c17-788f-4dce-b060-474e7c0c867d", "comment": "Malware payload (CoinMiner)", "value": "dc9f59eb5f4d531d8b1d8eb119ea9f03", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939632, "uuid": "dbe65d9f-b024-4382-a96c-2c55f2676afd", "comment": "Malware payload (CoinMiner)", "value": "2141044aa53f2f320af2c6a2c61c9b71de2a40076acf090ed854444e55b7e290", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939632, "uuid": "9f49c726-44e1-458c-86ab-04dc03e0c643", "comment": "Malware payload (CoinMiner)", "value": "c2a741a54b7e7507e69a2ff3302c7a9fd30b69b8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939632, "uuid": "4af6d5da-7a52-4669-b483-b423767fabc0", "comment": "Malware payload (CoinMiner)", "value": "73e8d504060fe4adefbbbf8ed6c22af2e5eb22c26ab479ae34ec8ee2cd0a9f14d91da3e83112790ecbcea9acf38b06a2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939632, "uuid": "0d3fce98-c1ce-4090-a49b-cc864aa73512", "value": "T12586AD052A66F0E1E5FEB07A896A4D47E272B9D0473087FB4AE4711A0E337D1DD3A2D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939632, "uuid": "2b5c071c-2c76-4ef8-9341-e6a393866c9c", "value": "a8eb81b09f2018eee064158a9f3242cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939632, "uuid": "7573c0d6-97d2-45d4-9a27-215e2b7890a2", "value": "98304:Y4oo1XVBKj0eLWDewwNML/lfXlr1/dOooHBxCjGKXCNw/A7rYcx:YkzQj0CWDewiydptdMkFSK/cZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640939632, "uuid": "ebbde28f-1b87-4c37-9b50-844924df6994", "value": 8418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640939632, "uuid": "b61dd5d5-c098-4dc9-8dea-78c8326a5c9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939632, "uuid": "eb084d80-0ceb-44c5-84e1-df8a5aef89a5", "value": "pm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af763a80-6a7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640985288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985288, "uuid": "27090629-ab62-4ca0-b6a6-87417e131091", "comment": "Malware payload", "value": "dd4ffde52ec7622861add16755d1363e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985288, "uuid": "a8be78ad-ad4e-4e43-91b8-75096b70bd30", "comment": "Malware payload", "value": "21b5cb504e0283c803012e6a7dcba34640364be41483134f88917bd2df566cae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985288, "uuid": "5b6196bf-640a-4ecd-99e4-be4e5323fab9", "comment": "Malware payload", "value": "00b84d07cff73be274c33234d706342dc624ecbf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985288, "uuid": "ff27056a-2710-4dc5-a727-82a71bd4a80e", "comment": "Malware payload", "value": "5ca683a5ac9e9ac4f040ac27a1b2c4933b9bc71dbfa4204a38aeb0b9af0f668c1ab8552995ce93bb109252ea00137c87", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985288, "uuid": "357a3f05-4249-4277-aa34-7185e3681c28", "value": "T13A22BFFAB6470508E378943314DCD5D59692395C208EDF17AA540F91B7064CAAA3FFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985288, "uuid": "ebed2f3d-99e2-4fa1-8d54-9ddd9b2e9068", "value": "192:/VB3WNKgqQ1WzhNItLzv4yB6vYVl8+IkBzwlhTpWOltZZEaBHKEx:/joKU1WFut3vUva89+shTp/ftB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640985288, "uuid": "4ea63560-1f80-4d7d-a933-16413ad421d5", "value": 10632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640985288, "uuid": "4f3a5316-e4ce-4d9b-a95c-dc4781b875a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985288, "uuid": "d2b5e0fb-8223-4092-a1c1-ddadae713dca", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd9a934-6a16-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1640940560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940560, "uuid": "f6b74295-0b76-4072-a040-a96b0628756d", "comment": "Malware payload (Socelars)", "value": "1bbd218e470d39b0109a979d1762904d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940560, "uuid": "abb7a694-a172-4498-8fdf-1f34680b0b81", "comment": "Malware payload (Socelars)", "value": "220e154fe520169c7f6a611ef5d59e897b3bdc4c55928219855cb9db1b62b81e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940560, "uuid": "4d21683f-282d-4108-b0de-e468d6545449", "comment": "Malware payload (Socelars)", "value": "081ad7822d77f4c97c18c59f17354530b1071057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940560, "uuid": "13d705ee-7fa7-41b4-b6fa-8ac5d62d0ee9", "comment": "Malware payload (Socelars)", "value": "0e2ce755948dacb234d45d354dfeaf88da8dbe4a838d7bda760410f22444dada4004742d128afef51bf2fcdb3af28ba3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940560, "uuid": "159c8bb5-07ce-4d20-881e-7234414ee054", "value": "T17165AF11F6825036EDF30077C2BF5AFE9D28A6210304A4D7D3C45E695E619E37A3BA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940560, "uuid": "c90c3504-7521-4b7d-8700-656dcad48525", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940560, "uuid": "17234d6b-596d-440f-b206-0f185a4dd269", "value": "24576:hr/phkCUyl+/LCBxJmnljksTnpbU2xbVh1pJCnBhqIzPG0tqtH7:9pny6WxdlnLCnBhqIzu0tqtH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640940560, "uuid": "a58fda4a-b5fd-4a91-9aaf-edf9e87ea8cb", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640940560, "uuid": "ac25f9fe-0a14-40fa-8514-0c232a4751bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940560, "uuid": "aeceffd2-ff92-4046-a570-a344def6de31", "value": "1bbd218e470d39b0109a979d1762904d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7850bfb3-6a32-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640952554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952554, "uuid": "3a50e591-e9f8-4618-a8e3-db2eb71d4705", "comment": "Malware payload (RedLineStealer)", "value": "7ccd2bd25fcd0ee6abb9a0b24573572f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952554, "uuid": "979ccbe9-601b-4491-b1b8-dc1ff6ac1cef", "comment": "Malware payload (RedLineStealer)", "value": "22b1bd5ff8d474bb70ad086e75dbba870aaeb52599d436b84ba35e9e612078b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952554, "uuid": "3b718917-74fe-4941-a537-96c95871cca1", "comment": "Malware payload (RedLineStealer)", "value": "398f69a4b5535e24a7e197e037c3672f47baf58e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952554, "uuid": "fd42a6ac-3f0c-46c6-8950-a45637819118", "comment": "Malware payload (RedLineStealer)", "value": "03caece6a8f8ec84bb8e7bb1d7d32898ae1d790c0516ac935c176b4cd9774328e27f5b0654b2cf103ad283eb1aad5d46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952554, "uuid": "2ed0c4d7-a26d-4bd4-82f3-d7d2b6ca8590", "value": "T155F53313A7C9A3EDEE8C81F532A65E221C6292C0E2DD8E16F65C1571FA250F1C5E2DF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952554, "uuid": "3193875d-dc6d-4af6-b074-5480160de8d6", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952554, "uuid": "1e2abed8-a5c5-4444-93c7-b1f2987fc3fc", "value": "98304:60g9ylqlVr9sh5r2dKmFUPKcQyXKygHrhWhCKB:N/lqzKh5GK0fHaKygFWhCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640952554, "uuid": "46eebb24-b26f-42af-8178-96e59fb726dc", "value": 3645440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640952554, "uuid": "72a47b70-360a-4894-afe2-f31c2db856a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952554, "uuid": "30731b9b-c879-43df-8ef7-3d7bbe4a7bb2", "value": "7ccd2bd25fcd0ee6abb9a0b24573572f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548b9e39-6a0e-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1640937032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640937032, "uuid": "08501288-920c-421f-84dc-42149bca2ed8", "comment": "Malware payload (njrat)", "value": "a66f658cec33d5ed7ffbe6794283de68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640937032, "uuid": "72ae3899-eff8-486f-afe2-c92ef6c5f28f", "comment": "Malware payload (njrat)", "value": "23c50f61db3d334ed33b41c50623635bc5dd4eaac79faa695127cea2bbf00611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640937032, "uuid": "71398480-0aeb-40a5-a512-b0e85654c0f8", "comment": "Malware payload (njrat)", "value": "56f726667dc46aca4ef13740a5dbad23cf44e532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640937032, "uuid": "87b457e7-b49b-46df-9283-a0f4b7de3eb3", "comment": "Malware payload (njrat)", "value": "d8c61388de2f864ae483115ecee638d9bd8d95ea44f1f347eef5773a5cb0523740d51578b0a3e2f1320619a150257729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640937032, "uuid": "74edf02c-affe-48a0-8e95-39acc0fbe393", "value": "T123E208067BE98215D6BC5AFC8CB313214772E3438532EB6F5CDC98CA4B676D00646EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640937032, "uuid": "37f963dd-cee5-4de0-8a0c-b55ce0842360", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640937032, "uuid": "60aa9e25-d35e-4fc0-a921-f8364f23ff0e", "value": "384:U0bUe5XB4e0XyOpjw0Q0mS03AWTxtTUFQqzFdObbl:xT9BuxC55dPbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640937032, "uuid": "e0ed2de3-8760-4ab3-b509-ec500733a15f", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640937032, "uuid": "6ee1418c-c334-4956-886f-f41088f68cc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640937032, "uuid": "febeaeef-12fe-44f7-9e99-278147f7649a", "value": "a66f658cec33d5ed7ffbe6794283de68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9584995-69cf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910196, "uuid": "15b0f064-c9eb-4d4e-bf18-33b93576c415", "comment": "Malware payload", "value": "ebccb8b6c84d4f4cc340b7b5dfd2993c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910196, "uuid": "b9821d04-7560-444e-b92d-0e3b0fc2a7ad", "comment": "Malware payload", "value": "2413e1b73c382aa7a6b22e9927eb3d3820fcf37d608cf83322b6d706ff588ec7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910196, "uuid": "649a7db4-9dd9-4fd7-8693-881ecffef817", "comment": "Malware payload", "value": "1c057deea659687f04bf0ccfa9de3f3aea15f863", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910196, "uuid": "743dadfe-9071-45e5-891d-ed760873f8e6", "comment": "Malware payload", "value": "4f2ac6cd2ef8331590cd7d5b5b62ba38fdbd20ed40231601747239415c98036f9b2482af72992f19b59ad13a2937b8ab", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910196, "uuid": "52fefeda-c1ca-4012-bd64-47064e453acc", "value": "T19013D1360B3BB8F8CB772E7170BF9980F5653E9D6065171B0E8C729A4D97E25AD30052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910196, "uuid": "684e154f-1989-4acd-bb8e-8b2f1fa448a9", "value": "768:vSXHm1e/Uj581NgPQEexiFbH1QySXsGpMyyibcg8A8Zl0Fsv9sPtPnta1R02BLf:vSXTDgPQEs+BQLXPWi4g855FudnAtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910196, "uuid": "0a76b788-0d44-4171-a266-1d9232c83ecf", "value": 41532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910196, "uuid": "9a0a0a37-9450-4675-a37c-71f73b116d54", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910196, "uuid": "a9dc1084-5cf4-4a80-84b3-8df2b445a59a", "value": "ebccb8b6c84d4f4cc340b7b5dfd2993c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f64330-6a11-11ec-9275-42010a9c0029", "comment": "Malware payload (Conti)", "timestamp": 1640938190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640938190, "uuid": "0989c6ad-ae3a-4718-bdfc-108cf6406e80", "comment": "Malware payload (Conti)", "value": "42800d065e5855e261cc617fa688850f", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640938190, "uuid": "e11e8010-a9bb-43c3-b665-b809bf8b342e", "comment": "Malware payload (Conti)", "value": "24ac73821de77cc9644d2ac40e97067ff63f625b5f20e085ad10535e47d7db59", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640938190, "uuid": "e599b02c-78fd-41b9-a50d-9aa1ddc0412f", "comment": "Malware payload (Conti)", "value": "6c7b35e36830c1cc613fb08280ee25e5fbba9937", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640938190, "uuid": "6037c464-8666-44ca-b3e3-c5ed55f29a78", "comment": "Malware payload (Conti)", "value": "928abfdc4910da9095a67722bf5ddac46d8a55eff618ae2c16c9fc492600658395b40d3a79f0bedd77198f8940821bd4", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640938190, "uuid": "a089499e-ad29-4018-bcf3-35571e92d7e2", "value": "T11A256B00E640B127E9E300F685FB96B9997C6770236149CB12C86BF9EB256D47E31F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640938190, "uuid": "b46ebd71-6f02-4483-af6b-12bc59d12478", "value": "0f2a24737eacb6592b8213ef18f5ebef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640938190, "uuid": "df5c745a-445e-4a58-8e5d-d327a8917380", "value": "24576:IBktd5tCfUsfLKX0Jb74GbOXHbqK3sCSTQW:I6tFC8oKjmssCSTQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640938190, "uuid": "afb93de1-f7b8-4fab-964d-683621fca820", "value": 1051648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640938190, "uuid": "73a77a4e-7a6c-4e92-9762-0555d08ceb72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640938190, "uuid": "0d9aa1a3-ded6-4be9-9a91-97ea3b0f6111", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16db26c3-6a1e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640943800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943800, "uuid": "dd07f27f-0df2-4737-a951-8005c624d2e6", "comment": "Malware payload (AgentTesla)", "value": "cb21df60260d148f99385e0cf4dbc241", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943800, "uuid": "0bdfb505-9a53-4a9b-9cb5-ebf2be5f0257", "comment": "Malware payload (AgentTesla)", "value": "264145e78124451b894e54a101de51436145f947bb11ae26a4f12784545b3384", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943800, "uuid": "5f0a8ef7-2331-44b3-952b-59bc2330d679", "comment": "Malware payload (AgentTesla)", "value": "b3f25a3c6a976f6fdc2ab361ac65b4081329b882", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943800, "uuid": "5302c860-1ebb-436d-b464-2963bbdecd86", "comment": "Malware payload (AgentTesla)", "value": "1ca68f83e18f7ec1e0c935d20b8b644ccef24928a4a9691e501e32469631120fb89d0b7c7148e584d2810dd97d55197c", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943800, "uuid": "91038de7-6394-436c-b847-376d5d4e6361", "value": "T16B54231BDDCF538A077862F39CDA7E7546E0C5C13A1BA03A61446F27448A5801ADDFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943800, "uuid": "79e9592d-2ea0-429f-87a3-0a4135306f56", "value": "6144:OAh1z37kcWRiuhgf85SgeRSS7H1o1LTOqHKvHJNWGjS:OG177krfmU5Sge4UNWGjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640943800, "uuid": "edc48fec-5af4-4f42-bd49-89f36a6dbb3d", "value": 281202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640943800, "uuid": "b2a3979e-083c-4cae-bc3a-840c3af82af5", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943800, "uuid": "82fbdcc6-4786-4bb1-ae56-1626fe1c9772", "value": "DHL Delivery Documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886bdd80-6a39-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640955587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955587, "uuid": "b98dfcaa-1a87-47bc-843a-7b3ddf3eac05", "comment": "Malware payload (RedLineStealer)", "value": "eb39b445da5d5ce4129120db14f1c4dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955587, "uuid": "2c5a6951-9d09-4db7-8a67-cbe1622a4065", "comment": "Malware payload (RedLineStealer)", "value": "26b68718e74708840c2dcb6a54ff5b32a0cbd532e38a646cfb722ff6b2a4daf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955587, "uuid": "53d82b17-3451-4e94-92d1-2d86454eb2ad", "comment": "Malware payload (RedLineStealer)", "value": "563b08ea1b33f8cf5bc7a4912ddd488f38c86183", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955587, "uuid": "9da29589-78d4-4847-986b-882712567d6f", "comment": "Malware payload (RedLineStealer)", "value": "76fc71a91c2786d58bd49831cd89e783e4eac8d5ae3c88f42b766d2766f092b123e61ddf54ae4c62cf53ca84744e4cc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955587, "uuid": "8e933b08-cbc5-4bda-b7cc-c16977e29296", "value": "T1D0F5334295C4D635E70679FC7AB93D1F9DBC1F44E871A133C234D16F6806AB2D9888E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955587, "uuid": "a2c56dfe-c4f2-414d-812e-86dd5c2bc6db", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955587, "uuid": "bb0ad152-ee27-425d-9068-f1719847dd29", "value": "98304:fEbUnnnPLxvYTww07pP1QKYCTGahLMIVCoH8ykJ:fW+nnPLyit17Yi7LMv08xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640955587, "uuid": "10c0a8f5-b2b3-4fd4-bcf2-c2257c3cfe6d", "value": 3602944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640955587, "uuid": "d86424ec-39b4-4c8b-9297-8a75ebc61a9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955587, "uuid": "25fa405c-227d-4d49-b057-249fd1acb5ff", "value": "eb39b445da5d5ce4129120db14f1c4dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d332b83-6a38-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640955005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955005, "uuid": "3e31e7d4-7170-4509-9fd2-d1c19f4857b3", "comment": "Malware payload (Mirai)", "value": "59b291677b8b5648d62e59b057ec4e4e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955005, "uuid": "8dd8dbde-d694-4e63-8d60-a219a4ee43db", "comment": "Malware payload (Mirai)", "value": "26dc17275e6e6c6f7379879849e94c291fd83b3999f67e86ee0770ce90f23270", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955005, "uuid": "59ad1904-c838-499e-baaa-2c99e8c4725a", "comment": "Malware payload (Mirai)", "value": "30ed7ae0e1c2481717f8b502def7c6d106bdebf2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955005, "uuid": "bc5d6c0b-2e2e-4f2e-9075-5c4046bff433", "comment": "Malware payload (Mirai)", "value": "c9c11911ef3b3febdcf31b5c2c55318e386ab47f6d6cf567d59f035b0be8d27054d9f8386beb722fe6a8f8d59d9c1c40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955005, "uuid": "4b63f2f9-24a9-405a-9c47-8b3505387978", "value": "T122E2E1219852A858D4A049326C4BC619B3CA43B9D1FE7131929BF5D4FCE5813ABFE8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955005, "uuid": "a4d69481-7c6d-4297-87b9-cc99e0f1e26f", "value": "768:Kxb/ZT4XpHbXYXcWwyug6DSFk05uuiCLV5tufB3Ux:KzT4XNoXcWt/L5pA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640955005, "uuid": "585749c2-21f3-4643-ba00-3c22d82b74f9", "value": 34052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640955005, "uuid": "b6657662-b23a-4e6b-a156-407ef245c67d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955005, "uuid": "c13ef844-aa3b-4e61-8210-c4badc26c4ec", "value": "garm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8984d184-6a52-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640966326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966326, "uuid": "cd779bd8-ada0-4ad8-a087-451084be10e1", "comment": "Malware payload", "value": "a004013371075add8b8f30259e48b9bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966326, "uuid": "39223218-71fb-4f23-87a9-fd2558b1b7ae", "comment": "Malware payload", "value": "273ad5a2b3f62bd80b72a345fc153d30f3852301ed8d60ad40584086d7ee7735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966326, "uuid": "cb0af3bd-668f-4005-abae-13c4957af69f", "comment": "Malware payload", "value": "dfb28cd1750b0a8998cb7ca5b3dcab1ee31d2dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966326, "uuid": "464615fc-81ad-42cb-80bf-71e170abae20", "comment": "Malware payload", "value": "f64797c09fbfd012e114a069f0ae4af6919088e084a5e57d8c1bdb2fc5b6ff610cf5546c3c3f7d1e8955edc75a9fec54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966326, "uuid": "45c84792-6fbf-406d-b3e6-e6c987915d00", "value": "T18194C5E623D0A854D0324139DAA28E32A77EFF6C876D95E712C11545DA0BAD17C32F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966326, "uuid": "832748b9-4ae0-4f2b-b61b-aa4605c41c33", "value": "a6b3cf5795afe59db3114ae7499f37a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966326, "uuid": "a32c2ef7-2a2f-44a5-bfd3-3b784dc49ef5", "value": "3072:rcynG+VL2wL/re7AXaEoXN77J2a/IlEVAw97KYzlzu4hgYhN73ONqVXZLXrAepL5:JG69yEoXf2/Er7KCl3rnd+nBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640966326, "uuid": "29c3d894-bf6d-4efd-9a4d-d57cff99cb92", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640966326, "uuid": "76a7c6d4-8990-4cef-9245-2a552d17ceb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966326, "uuid": "62f76f8b-7672-4734-be51-f4e45c94eb26", "value": "a004013371075add8b8f30259e48b9bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483f86f1-6a5d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640970941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640970941, "uuid": "4ff5889d-000c-4107-9fd3-a4374abb4e1e", "comment": "Malware payload (RedLineStealer)", "value": "2da8ab89fff4bfc1be98d577169e3cf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640970941, "uuid": "408609c8-6665-41cb-9afc-75e6571cbceb", "comment": "Malware payload (RedLineStealer)", "value": "28043b9d96a6d54044950bca23633ab601dcfdbe4305bd18f624209e974d4e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640970941, "uuid": "d67313fc-af17-4e80-9555-37e7755d238a", "comment": "Malware payload (RedLineStealer)", "value": "5379737ccaf546c86fe92ee92e49afaa2eef1bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640970941, "uuid": "9eaf8d2b-f9a2-4e72-914d-ab5f920a93bd", "comment": "Malware payload (RedLineStealer)", "value": "24de6fc3a6154f9e2568bd6b4dbbfead9c415b46e2c63ea08cc920d8d976ed258d0c5e1b65c9ed86af07b7b63c696063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640970941, "uuid": "525877c1-6d33-455f-86ca-6eac57a747c7", "value": "T1396633D83D738DBBCE6318316394A623B1DACF1D46218DE36B9486849D38677903FCA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640970941, "uuid": "9c13e80a-5da2-422c-bf33-01d48b50443c", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640970941, "uuid": "fa46acac-a24b-4d03-bd6f-75ec16f96bcf", "value": "196608:xB4jtHqQeVSoBkpzqsOAyKPkC+EP0dSIyl83C3iKGBls/gevdWqi:xBDQcSoBVBAyKPN0dw3i5orhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640970941, "uuid": "c3e1ddcd-de2c-4a6f-b5f4-ae00bb389fea", "value": 6629238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640970941, "uuid": "37144ea2-5617-4055-8332-34ff92441858", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640970941, "uuid": "0febb97d-7742-4d8a-a37e-94a6ad87306f", "value": "28043B9D96A6D54044950BCA23633AB601DCFDBE4305B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b8ef5d-6a64-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640973945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640973945, "uuid": "41659ba4-4b07-4f78-8864-de4c8f1bf174", "comment": "Malware payload (RedLineStealer)", "value": "56e18023455303cd24f828173da31e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640973945, "uuid": "06573c27-d150-43b8-b256-c36b6f306710", "comment": "Malware payload (RedLineStealer)", "value": "29a5461cca77683d6a47c83eb774235bd0ae092adc58c987e571eeecb3e1cd03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640973945, "uuid": "8ecd3ec3-56af-4326-8132-42e9b8337acf", "comment": "Malware payload (RedLineStealer)", "value": "7877f8a39399b18af1e7c4fad422254b82e9a44c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640973945, "uuid": "6ece5dcb-6c6c-4bb5-9ef0-7cea6a61a835", "comment": "Malware payload (RedLineStealer)", "value": "c5dccf4de78756ca55729af219f0f764be9781ae4d9b181547ba0f5fb544b1b6fd476645e1afc6fc69c4a2a1fe02fc2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640973945, "uuid": "184474e9-bd0c-4383-ac32-bd8d2ecf315c", "value": "T127746C10BBA0C039F5B752F849B952B5A52E7EE1673491CB53D42BED9634AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640973945, "uuid": "145cf6a6-f2e6-4e5d-9e02-5566a25871d1", "value": "6350208d7bb708f91d85a9d922cb915d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640973945, "uuid": "3f6f62a5-c82d-4d0e-b62b-7d2c39a306ca", "value": "6144:xsvMuKYjxL9UcBh9hO+s3MrN/Yb3Wz4psPlFkgi7ip:xsvMuLVL9xBh9hO+s3MB/Yb3WzdlSgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640973945, "uuid": "7bc2fc8d-c5c8-4c40-9a01-8345fcf17541", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640973945, "uuid": "44637bd0-1754-4a93-beb8-fccfbd8fbdf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640973945, "uuid": "bdd03b84-af28-4bb2-93b5-1649ad9fceb6", "value": "56e18023455303cd24f828173da31e2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1507033b-6a3b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640956253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956253, "uuid": "18d82a21-477d-4331-b3a9-d5d264e9cf16", "comment": "Malware payload (RedLineStealer)", "value": "bddc88de480d3be44b7627fcb3912392", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956253, "uuid": "078463f3-42bd-4bd9-8d8b-6be2b5ee7e84", "comment": "Malware payload (RedLineStealer)", "value": "29c21dfbd286de4e1ef151053a40b5de880607c0edf38f5b77a5721b1342bb61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956253, "uuid": "23ee5077-3e8a-43a6-9d1c-51fe763b9820", "comment": "Malware payload (RedLineStealer)", "value": "a69097d41804088b6a0bd1fe3d1ecc1f2a39497c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956253, "uuid": "83822667-7ef3-4f49-94f0-8e8838fe9139", "comment": "Malware payload (RedLineStealer)", "value": "c3bb23b0a99163280aba38e4dd1ea5fa1853650aaf74186c48105298307762d8bd698c038d126549ddab0e1dd6305df6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956253, "uuid": "ae3c10d4-ba7b-45f8-982e-04677fd12bd3", "value": "T1F3F5338B8F28AEADCED91BB6D08BE4C8C14FD4C118AA5D84519A5F033D94564F23F53D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956253, "uuid": "a2b7c121-b7e0-4327-9667-d2a0110c60ef", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956253, "uuid": "bc774136-e118-4750-85b0-63b1552d878e", "value": "98304:hDS0e237QZl5Lexzme+geMYOYD7h7IJo5xCBTEPQH7:fe2LQZNrMYRWOLYT0Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640956253, "uuid": "47ab0caf-5243-4242-b484-4cd7a711f9af", "value": 3620864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640956253, "uuid": "cf26b6f8-5420-4646-810b-dccb3a33d2f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956253, "uuid": "a0c3c42b-28d2-489a-8dba-dbf9358e2de1", "value": "bddc88de480d3be44b7627fcb3912392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ac75a1-6a16-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1640940652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940652, "uuid": "9c3f3c76-bbf4-424e-b885-70c0ebb57f62", "comment": "Malware payload (AveMariaRAT)", "value": "3ea862d96d55ec1b0e208fa30649634b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940652, "uuid": "307d6ebb-df4c-4cdf-a668-25775c368259", "comment": "Malware payload (AveMariaRAT)", "value": "29d31c597a130a0cdc857768c6b04c551085ed822982d40bbff3fe02cfaba61a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940652, "uuid": "c04eaadd-195a-483d-95c7-fc3fae964cdd", "comment": "Malware payload (AveMariaRAT)", "value": "6461c6de0895e159dc9f572b1ea3b9d159665888", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940652, "uuid": "cf2e9e7c-4451-45db-9c93-48573e9ca3e7", "comment": "Malware payload (AveMariaRAT)", "value": "d66d975d1c7cb0c01a1ed35a2bf61234f6e54c8a31b3b79fbbdffa4c9b067a94dd0b13aa960b425fb49331a855bd926b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940652, "uuid": "e6dece91-3a65-409b-98a9-5560d7fd575e", "value": "T1D6A44BDB6E96E051E61D19FAFDE60FA12231DB342613B12E498529F401BB33C5F4B6B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940652, "uuid": "cf150494-6a29-4aa6-914a-cf6effb9e21f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940652, "uuid": "fcd6dee2-b366-4460-9542-6ab9037d6b7d", "value": "12288:X7JtOyqAs8Iu+BiM9gfgep3zXKMSmdoSt1yvDpr3vEdjbMVV0ScOHIuNNqzd6ncW:XdEOsNBiM9gfgep3zXKMSmdoSD6Dpr33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640940652, "uuid": "1374eac3-d64c-45ee-9dac-d6b1af245052", "value": 474176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640940652, "uuid": "1c8fa109-147a-4717-971c-832e22ff7ad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940652, "uuid": "353137dc-4442-4c03-b022-cb2b94a364cf", "value": "3ea862d96d55ec1b0e208fa30649634b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608f0385-6a94-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640994604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994604, "uuid": "c21d5190-e160-4953-a303-42f1d6f49fba", "comment": "Malware payload (Mirai)", "value": "6fc030e84bf933ce362236187626f0fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994604, "uuid": "7a8491c2-c000-4352-b97a-b271ea42457b", "comment": "Malware payload (Mirai)", "value": "2c7ef7de2d4af05f116134d3509e1cb84be57d1d17a8a7ff97eb5d86b8521513", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994604, "uuid": "f0e5510d-d858-4f3d-8eff-039bf9f3b2b8", "comment": "Malware payload (Mirai)", "value": "27e0310ba00b9d97f17bed382d05316d1cd76133", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994604, "uuid": "cf4adcf8-dd60-48a7-9eb2-70f08d6b8001", "comment": "Malware payload (Mirai)", "value": "7960f1dd09344a41f0fe29410a2efefd7cde159ade63c6b05552f31e1aa6a695cf850556ec3031a5c662405c7a63378a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640994604, "uuid": "8ea63ad3-226f-46f9-8ac1-7fb72eb194f5", "value": "T18AE35C46EA808E03C4D61776BAAF424933239754D3DB73068D28AFB43F87B9E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640994604, "uuid": "03a845ab-6755-4b6d-840d-d544f55e7051", "value": "3072:zv77jbmI47aSDV2u4AUDjNLPMvEn3ExYM/9QzjTf:73uj7aSDV2uJUDpQEn3EmM/9QvTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640994604, "uuid": "36ed2ee3-6603-4b1e-b25a-6a3aa6eaab65", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640994604, "uuid": "68ea265d-a138-4e13-9ff5-ee5fabd93704", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640994604, "uuid": "9702533b-6d46-495b-8c40-591768000b0d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98474524-6a2b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640949601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949601, "uuid": "4a326c75-e3ab-409e-ba6a-ed37db0c2ae4", "comment": "Malware payload (Mirai)", "value": "f844fc424553022e60065b537cabac5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949601, "uuid": "c447242f-0599-47f4-9b09-04edff0ed9f3", "comment": "Malware payload (Mirai)", "value": "2cb675a5683068ac1080e68606ed5b05380f45a18c3d89286ecd4e8e70538a3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949601, "uuid": "5ef2d4af-e152-4f1c-847d-51294d2e3d92", "comment": "Malware payload (Mirai)", "value": "62b5c46bc363b73b60a5cd70be66a94f3d613949", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949601, "uuid": "fe890a5f-1e6a-4d09-bce7-34ea8998a76b", "comment": "Malware payload (Mirai)", "value": "6ea1a91ff544fb6d6929431da4f194f29d1ead0918e770e98dab368346427132b84d62e61290f37e897696bf6d962ba8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640949601, "uuid": "f5e9ea97-405a-40dc-80bd-7b412e46bedf", "value": "T114B3C40ABF610FF7E8ABEC3745A92B05249D510B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640949601, "uuid": "8f0ee0e4-13e6-4cfa-8f5e-ed54d9af92d6", "value": "1536:g9DYWFx+xx+AaEPiRMR2jk2EkZ+BzYojKoOvDBgplbngVZ14hvG:gqWFx+xUA0yR2hEkZ+BlpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640949601, "uuid": "ea4227e2-a59b-4d3a-93de-620f22ffc839", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640949601, "uuid": "d6d4d64d-de1f-4ed2-84af-73f12fadc2e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640949601, "uuid": "044d793c-f864-4691-98ca-d9f11e0d4835", "value": "f844fc424553022e60065b537cabac5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689e5b09-6a02-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1640931911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931911, "uuid": "85dbb8a0-d946-454e-9f92-6fc9b4d02324", "comment": "Malware payload (ArkeiStealer)", "value": "c46e7e24b453e720fc33dbff75c106f7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931911, "uuid": "60496253-de68-432b-8528-a63fe61ad917", "comment": "Malware payload (ArkeiStealer)", "value": "2e24fa4b77253c4d1828ebb67824b0a891917bb79fde0accef9ca9576c4b30c2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931911, "uuid": "43a7ff05-949c-455a-80a7-b99fc5704430", "comment": "Malware payload (ArkeiStealer)", "value": "fd7cc0cb27ad684dad3aaa77f2e6e79358df330d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931911, "uuid": "104351de-a482-4815-8d20-a48e7de43535", "comment": "Malware payload (ArkeiStealer)", "value": "47e47244b74d5781662d42fefe0317db4e652ad2172c1f5b80ca448d863af4fc298db7cb02b4278b17d03b0a543661b9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931911, "uuid": "cc17b85a-2191-4392-8558-1f95990b0263", "value": "T100848C00B7A0C035F1B666F84AB99279B52E7EE16B3490CB13D53AED96356D0EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931911, "uuid": "5d3df45a-643a-4f12-aada-31c82e11df4e", "value": "a1d60906524f91b271192826b907b691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931911, "uuid": "f9ea6256-ced2-4dd5-9f49-6c9934e81fb6", "value": "6144:jT3xupxyWQfxR5lHoANMwCWUbQZIFWwwL/g/Z9e1nQP2:jTMpMWQ5HlHXNMwCLb0IFWwwI9e1O2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640931911, "uuid": "557cae0e-d4b0-49cf-8371-cf98d1650ccf", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640931911, "uuid": "27b6cc51-f9d2-4caf-beb4-9f285dfd5618", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931911, "uuid": "b2ee73d9-4c52-460a-b883-9e95e8f0c110", "value": "c46e7e24b453e720fc33dbff75c106f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6de7a0-6a94-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640994603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994603, "uuid": "ad9d01c7-aef7-4de3-a6d9-acab2f14b5c0", "comment": "Malware payload (Mirai)", "value": "20f8316e6524bb86bcc1f6fa54777032", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994603, "uuid": "f3d08623-b900-47c0-bed2-6107dd811be2", "comment": "Malware payload (Mirai)", "value": "32b4db9ffd04e2c44d49f66e9d3ac2ef56e8c6828e92f97fc7783c6d1e70d10b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994603, "uuid": "c1fda0d4-88b7-4d23-b6e3-d586542f2aec", "comment": "Malware payload (Mirai)", "value": "b28ad4da392f6003f874822364fb1ac88922846b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994603, "uuid": "bc3ceefd-55c7-4a8d-b61d-82bc6bfadd3a", "comment": "Malware payload (Mirai)", "value": "333479d6629441b4df8534799c420cc84e50e5b9021f0fe13c2187ca236b188331fde78a97a1e7602e22704a776915e8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640994603, "uuid": "84e7106e-d3c3-46bd-a681-ce0a1845e68e", "value": "T1D5536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640994603, "uuid": "003b6eb5-0346-405b-bcc1-4b5f7d9af744", "value": "1536:Z7qARubgzY/bEJySRcpp80LDHhklv4JQC9DSW:NP+eY/bEJ4LXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640994603, "uuid": "38b1e899-bea7-47dc-8a2f-44ebe79e25f6", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640994603, "uuid": "88ed0023-b69f-4c41-9ed8-52c72f875436", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640994603, "uuid": "133ecf3c-cceb-4a1c-99f3-dcfd8d38ff9e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177f04e6-6a40-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640958404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640958404, "uuid": "b8017682-cfb8-4339-a05c-9d2f5a88e10a", "comment": "Malware payload (Mirai)", "value": "fb9d5768d6432a0475566af4c65cfc0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640958404, "uuid": "ee3cc512-196e-49fc-92cf-d6475877f7d3", "comment": "Malware payload (Mirai)", "value": "363bb34442127fee6bdf85eb1758a46959fab80b6dce0bfa909dfe73ec43d5ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640958404, "uuid": "4a884dbd-5ade-4b75-979f-89f8a7155f4b", "comment": "Malware payload (Mirai)", "value": "e97abcc3ae5c7d1436dad39ece7744538b5fad78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640958404, "uuid": "b4d0b9d8-5120-43d7-96b6-3871108b4601", "comment": "Malware payload (Mirai)", "value": "5e7b7dcb44ab278cd0fe5c4ea1c0a961ffc4023fab43ac4d5dbf18b8c3911aac6deea3d05cf97969ed77ee0f7e94f834", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640958404, "uuid": "3f6197bd-d667-406e-9c84-6973bce19baa", "value": "T1D6833924BC391E27C0E4A17A21F7C722F6F5228D21B4866D3D710F4EBF656407A47AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640958404, "uuid": "4bafcbf9-4c07-4f21-a244-7fe17d92cac5", "value": "1536:FrWZnHJSkunDANOJpkm51+fUH4ZtNMMCcz75ZXbtAR:xWZQJ0cSft2zczVIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640958404, "uuid": "7e434b78-7550-4ff6-95e9-9f504ddcbd7e", "value": 87844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640958404, "uuid": "4378b4c3-50bd-4b32-b981-a9d20e4b7d2f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640958404, "uuid": "ff9a4bcf-c1b3-4ca7-9373-0471f95aa0a0", "value": "fb9d5768d6432a0475566af4c65cfc0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876121a4-69f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1640927668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640927668, "uuid": "a9f189dc-9416-4f02-b379-f55fd29344ed", "comment": "Malware payload (Heodo)", "value": "80d09b32f252ad3efdb3a3baa8a00998", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640927668, "uuid": "7aedc4cb-06fd-4159-a76d-32306e8ad13c", "comment": "Malware payload (Heodo)", "value": "3797469ca947bba552ee31ed4502dbaa5a471ab5c35127d87c4720a8ec344690", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640927668, "uuid": "199ac909-cbe7-4393-80a6-8fc2d6f7079c", "comment": "Malware payload (Heodo)", "value": "388bc2b0fda761b1d00464c140979fa7f86b2ea1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640927668, "uuid": "9b10838b-bd5d-4e6d-8e93-70067d3d8597", "comment": "Malware payload (Heodo)", "value": "eb68593257a3474f0f540fb374dfe6f24a02f6a79853702efe69eace2790097be3c32756552ba3e2e5bbb15df16c5c4c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640927668, "uuid": "deffc8cc-602b-447f-ba13-554df44dc7d3", "value": "T16524CF10A540A132E9F714BA86FED97E8A3C67500784A5CF83DC6C759FA66D1BA301CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640927668, "uuid": "81b6581c-2008-4dbd-ac3d-0f3e444be5a5", "value": "6144:6jpuMD/HpzhetkHmYZU9dbJ8K3WGsceBKCUvqHR2JP9WTBG:6jIG/pjjuLbJLmGshoCUnWT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640927668, "uuid": "67646d3b-4867-4d42-b667-9700bb4a05cb", "value": 228251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640927668, "uuid": "c8e9f7cc-5772-4898-a1fe-1bac173f160f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640927668, "uuid": "a30cf007-38c8-4403-a92c-0ce3b475b1f0", "value": "emotet_exe_e5_3797469ca947bba552ee31ed4502dbaa5a471ab5c35127d87c4720a8ec344690_2021-12-31__051424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445281be-6a15-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640940011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940011, "uuid": "bcca1955-6781-4168-8aa5-3d94e931fbf9", "comment": "Malware payload", "value": "1de62a4bd248b9abad56ea140edfe722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940011, "uuid": "bfa14c5b-ca86-48bf-83bf-5d59bfc84c29", "comment": "Malware payload", "value": "397f9ab686b19752fd2dc2333c64309d1235cf7143a43f9212dea4c7beb1cc3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940011, "uuid": "713055d1-ea72-4267-89bd-5c0cf099a46d", "comment": "Malware payload", "value": "b2dff17b4646f9251fa12b1d74c022bdbad7c4f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940011, "uuid": "c84d1ef6-fec7-4c22-932c-0ee4aa4bb42b", "comment": "Malware payload", "value": "5dbfef4bf56bce550c2f42cff780d63fc1a6252ba8f31a85d6097332227ba56f31c4122684b0772a52a5153f8e6b3371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940011, "uuid": "edf79adb-bb6a-4be6-8a17-4e481571e1da", "value": "T14FB36A5B77E130F8E1B68678C8A11A05E7B6B43607219B9F03A443561F273E19D3EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940011, "uuid": "7b6366d5-71a5-4ed2-8321-1c96b446aaf7", "value": "3263dd4b7655c735bd3641ad927a215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940011, "uuid": "50257d0a-8651-4121-81df-e5552e167f16", "value": "3072:prAOBKqyjAY5yANULSkfZfA4a/wj+wOiaJFg:prPKqyjlXYSkfZDj+GgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640940011, "uuid": "08d2edbf-c811-40cf-807b-3ac3e481a118", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640940011, "uuid": "ea0c3713-4e5e-47b3-8653-6cfecd9799d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940011, "uuid": "a836636e-a401-4ffc-a0b5-0f7725fe8655", "value": "wd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7093b65b-6a3c-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1640956836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956836, "uuid": "c03b3fa5-8501-4677-ac7b-f6ff478705dc", "comment": "Malware payload (Amadey)", "value": "b04abfd2132529f6403373d94201be9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956836, "uuid": "c06ecb0f-5cf0-4589-9f49-957897ea9fcd", "comment": "Malware payload (Amadey)", "value": "3b4e9d9fdb7262f1f62072f7f9b7d48086fcb39b3343b21ae7bfa8f633ee2166", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956836, "uuid": "da2f93d4-0575-4fa2-90f5-d498194bba5c", "comment": "Malware payload (Amadey)", "value": "47280750a924e1b39b686bf4266e686884ea3ac2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956836, "uuid": "934e22d2-a4fe-4b86-a336-abf18a2c2b50", "comment": "Malware payload (Amadey)", "value": "5ff5c33217e32ff472182d9b856acf78a5e31831c642c665582f72d66bc574c2b9b68804541fc0e51b6347abbfd0a456", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956836, "uuid": "57d6c088-d042-4532-ac71-358de96d1e56", "value": "T1C335481BA5D95007D48E40B1A6AAC7F6D6CE58704F7833FF5F2C64EB002B1A199F2972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956836, "uuid": "73a6b5e4-5d34-4856-8066-430622e0491f", "value": "de6b00f815fc961d1fb62c17cb2861f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956836, "uuid": "337e072e-e659-4b9e-a323-d3c75a8d3720", "value": "12288:MYYdm+VSrxJ+5yxwe/7X0EEEVgKJgI6wAuxQ4sk8k8k8k:HiTSD+y5EEVgKqEKIFFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640956836, "uuid": "3e8f2945-f3ac-4b4e-91cb-a81833dd1b8a", "value": 1114366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640956836, "uuid": "597bd11a-2393-43a5-b8cf-2f3aecd37cd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956836, "uuid": "ddba3656-8297-425d-ac31-62886ad575e8", "value": "b04abfd2132529f6403373d94201be9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82aadd37-6a39-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640955577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955577, "uuid": "c8758050-d603-4415-81c1-e75fe04c5d94", "comment": "Malware payload", "value": "5f469eb17d2ec1b59200f5bb9564252d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955577, "uuid": "ffc3d49a-7ca6-402e-8d1b-c33ec2bf7173", "comment": "Malware payload", "value": "3bd95206f91a4b66160472ed2acd94e1875dd2450cdd0f7deec4fbabc088ee05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955577, "uuid": "a8786856-dd2e-4067-bb84-4c5e8c56a63e", "comment": "Malware payload", "value": "35b0dba097242d5a3631b05e14b2bcc601abb431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955577, "uuid": "fadf9e60-eb37-4109-b74d-07d1f32cec9f", "comment": "Malware payload", "value": "122c03525ccb925aba5ca439bb4c2898e9a41da997777be08780699c4c267238cb33421bd9e72e308f0ba379b5d58156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955577, "uuid": "545979e3-6479-4f39-9ee4-50cd53c69e78", "value": "T13EE52387FC1FABF4D452E177E7A1C436475320457AE614EC2B41631DB9C322A0B8B6AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955577, "uuid": "65073527-fb57-4f66-9bfc-1ace228b1da0", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955577, "uuid": "5b69c131-0ec2-4f2a-bd72-1a9855ff1c17", "value": "49152:3Gxnivwcr11F8KooXlqEVJyQOwHsRdAPYPfj7oPuf/VHen7DjUVEVin:38io41/+oXlGwEdAPYP7HHV+vjUein", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640955577, "uuid": "32c0aa5d-9516-4aa4-a66f-53de718e6a56", "value": 3318784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640955577, "uuid": "c6deca19-9ca8-46e6-98e5-44ccaf55c1a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955577, "uuid": "438d1652-20f7-45f4-8699-d92e08fe8aa8", "value": "5f469eb17d2ec1b59200f5bb9564252d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0962a2-6a14-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1640939516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939516, "uuid": "798b4e0b-ef8e-41cd-a0df-2fb2d65194c9", "comment": "Malware payload (CoinMiner)", "value": "64db5220376d31141429386c52417569", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939516, "uuid": "0470c60d-78db-424f-b432-2c1255f9a4e1", "comment": "Malware payload (CoinMiner)", "value": "3d04ceaf7ae2e6cc653d527b4c4d744484fa75d69e248f4006233e0b8f3e82a6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939516, "uuid": "71bd6281-b1a7-4f07-a61d-b72f93435b29", "comment": "Malware payload (CoinMiner)", "value": "55aa2b7a137bc859b44377e3bc8ef68af0862cb2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939516, "uuid": "90129422-855b-4ed0-b59a-a070cd26e290", "comment": "Malware payload (CoinMiner)", "value": "7157eb5be9cb7871f7be57fdc0ddeb5f55b3625fda5d3fa8029c57264cd65403b8b262372d6de19690a4f31ffd6d1dd1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939516, "uuid": "5f0b1bd9-aec7-4233-9f7d-b9c438b56743", "value": "T13DE5231BBDDF3FF5E32280735130D1344B5261812DF68509971AA36E59D220AAF8F6EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939516, "uuid": "65cc89ef-1cb3-4058-9044-27e2d4dd6a0b", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939516, "uuid": "7edff198-a47a-411d-8967-f2a68b5712fe", "value": "49152:5tR/Sr9McZ3nFe0WM3dK6FLdOtq/9Hqjf3TAT6c9mKDPaSiI//sL2o0PIRe:3crKG3FzXDOtZEuchjfX0CkRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640939516, "uuid": "78c287db-d51c-4f94-9ad9-160ceb01c00f", "value": 3198464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640939516, "uuid": "27d7e796-8104-4842-8080-f2541caa4cb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939516, "uuid": "1f46bd68-938e-47d5-812d-c38b2063b7fb", "value": "xf2FOjfee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9765fd07-6a02-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640931990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931990, "uuid": "8681d53a-c85d-4f43-ba79-38557fa5437c", "comment": "Malware payload", "value": "ebbe6b49f35c90ee4d5bc66764e1f473", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931990, "uuid": "edff6cdf-1d59-49c3-867c-f4e5cee73933", "comment": "Malware payload", "value": "3d962ce6599cb18e4fc195cd3fc69186d635936e0c7c9fef683b34d4b7d76a40", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931990, "uuid": "963df6ec-4129-48c7-b899-ed0e404db621", "comment": "Malware payload", "value": "08c18d8aa34cd89974c0daa2ad28515018de5cbb", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931990, "uuid": "1ce5ef74-7494-4b39-bf37-6639f37bb16c", "comment": "Malware payload", "value": "8b79a3eeefd6e9df961f4506a5ef2a0594abf572ea7e8ba25ed50cdc3bd9e38492dcda75a07d0f195910bfa2ae4a1faf", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931990, "uuid": "af718687-14ce-4ee4-a94a-0428ecbb2293", "value": "T11C64128471C0032BD05F47FA9552F851D322DEABEA7773FAE216BA9F0533946804B89D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931990, "uuid": "ac290187-58dc-4a9b-bd55-64260bd5ea16", "value": "6144:O3WpnZUN0aZLTesGj2j5rVImH2uetcoo6Ae2znjOjUzW:O3WpiPLTew5rVZWuScJ6v2zjO4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640931990, "uuid": "209b7db5-d574-46a4-8c61-262adb9b229f", "value": 325080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640931990, "uuid": "a2a7b875-edce-4e24-bea1-2e842e22643d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931990, "uuid": "67d5cc50-3066-42bc-8989-c40b0c2c64aa", "value": "RFQ 11732021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6b31c2-6a1e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640943809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943809, "uuid": "604ba4b0-aebe-49f1-aced-c840fef04eb7", "comment": "Malware payload (AgentTesla)", "value": "43d72298a9fc8b975b147c255b9db948", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943809, "uuid": "eae3fb75-bf05-4870-9a7c-944ad7b5bc99", "comment": "Malware payload (AgentTesla)", "value": "3e86890d2b10a352ddf62a98f0444be28c96f16a8fe2363e3ea0e477f5ae6d6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943809, "uuid": "5e9e722e-dc84-4c10-9b3b-4bd48ba365a6", "comment": "Malware payload (AgentTesla)", "value": "96f4688399248d2e0e200d0264ada1cc421cd543", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943809, "uuid": "47b5cc45-9ebf-44f6-b159-c2bbeab537ab", "comment": "Malware payload (AgentTesla)", "value": "23a8250036e9cc151b08d76ef8bfda37f367edef9f5d77c68544e5579b677a5cd08a9a2a974dc5937d8684740c7ae95a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943809, "uuid": "e6f1d148-c3f4-4ce4-bf58-0947863380f4", "value": "T1EDC408F9D7E357D3F8326A36CB91523460323FC9A4E45DF556C8B62C49302DEA21A92C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943809, "uuid": "b4da065f-597f-4365-93c7-a24635f0043c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943809, "uuid": "63b3e781-6d8e-46c7-a5bd-e8bda1782b46", "value": "6144:Msovr6HBxA+jSzcCmC6TqfBfIMIRrXHkdPmKU0HppelQ:MzvuHDe9mTSKriH7JpaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640943809, "uuid": "fb7eb699-9df4-4635-8be1-5896b76f4662", "value": 558568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640943809, "uuid": "1e673836-2a9e-4358-90c9-888aafda7eda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943809, "uuid": "257ff0eb-28c0-4f81-9305-e77aef739942", "value": "DHL Delivery Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98022667-69d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640911805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911805, "uuid": "55f6a427-9aa6-40ac-84c4-d6206f9848ad", "comment": "Malware payload (Mirai)", "value": "d8179f299e2e808034a39d24c86ae961", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911805, "uuid": "1b3673ab-f4bf-45ef-8f51-b652b38291f6", "comment": "Malware payload (Mirai)", "value": "4469d0e625e09f83bf980b9718b89b4d9fb9c9c7a8d5aab30f589f23f2aad6fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911805, "uuid": "21e91529-8b23-460b-88fa-5dcbb78576ee", "comment": "Malware payload (Mirai)", "value": "6b31b34b91c9698c68b967870082bb1ee5e2f521", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911805, "uuid": "f4461dc4-dbbb-4557-95bb-f1540d0ba0b6", "comment": "Malware payload (Mirai)", "value": "9cb7ccbbb84965ff87261467cf5edffaee0c3c98db96c2a35527e5ba1b0cd1885859bf9104aa2e1055615a1b5de9c8db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911805, "uuid": "96f85d70-e689-475e-a017-88e454b08c6d", "value": "T1B5B329C8A543E9F4DC4545743026FB378E37B0BA623FDD97D3E45A23AC91A42C805AAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911805, "uuid": "40610620-1b7f-47f6-a032-74f633dbdfc3", "value": "3072:geY4/qDuj/BPF+eczNuvT0A7lYro0chXhb8fkWzp513g1zCHSr5AF/:M4/rzJ8HzovTJ7lYro0chXhbK9X3gVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640911805, "uuid": "fd713b77-d7a0-4b91-88d0-c80f38e47f7d", "value": 115600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640911805, "uuid": "052aafa5-7317-461c-8e7b-6182a88c435c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911805, "uuid": "4a2a2f90-b11c-4ec3-b345-2bab0fca5956", "value": "7ega.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6310c9-69ec-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1640922361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922361, "uuid": "8a9b5e38-735f-43d2-bee0-87462e49654d", "comment": "Malware payload (NanoCore)", "value": "86e5d27120f6b7221c0f9b867c7d919d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922361, "uuid": "8e5389e2-f184-4ef5-aa40-b4c5313be1a4", "comment": "Malware payload (NanoCore)", "value": "449b9ec963cad8086e2f99c6ffd28c7e8adad0f17f8beea55d887093846f4e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922361, "uuid": "473d0c67-a21d-486a-a4db-20cba9681bd6", "comment": "Malware payload (NanoCore)", "value": "599eb6af6de0710fd8e5c26d7ed5b0676aa4f016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922361, "uuid": "b58d559a-a67d-4526-87a4-109d8d4a1d0e", "comment": "Malware payload (NanoCore)", "value": "66dbdab9e5e2eecfccd0e9ada9a6da9f165bd1e1a73b8b594b62ec60f002ec8bbff1c2bb261c6825ec73e79e05761bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922361, "uuid": "99f09035-9d9c-4f5f-9076-098ddde6560c", "value": "T1FD55F458B14060AFF8FBF6F9CB981C5897946DE682168356D0373D5BB93B583DE000AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922361, "uuid": "41259b80-eab0-4dc7-b633-84650b9dcca6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922361, "uuid": "50d7a977-9471-46f7-b714-443e6a9a9127", "value": "12288:d/lDvnPmuXFLNfo89sCSPo2EANh0wxh4q0JhCdx2x5XjHTOpDr0m7w0VKpc7KJi6:d/VnhXBNfePokNpCq2qx2x5XzTe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640922361, "uuid": "88604bda-cd1d-41e4-b17b-96ff883e54c5", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640922361, "uuid": "c86f28ac-0b1e-4f24-9058-19a556037bec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922361, "uuid": "6c8dc6b9-701e-4d0b-b606-04641eb9d352", "value": "neworder-enquiry (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3221954d-6a3b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640956301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956301, "uuid": "0e6e963b-cfea-4d29-8bad-115518132e5a", "comment": "Malware payload (RedLineStealer)", "value": "82690f160f8a50e58d1620e91450637e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956301, "uuid": "a3ae318e-fb06-42f2-87fe-b4ed985b7959", "comment": "Malware payload (RedLineStealer)", "value": "44e612077d6910fcd7524c6c87029aff62842eef075f0d6061cf4b84a677df30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956301, "uuid": "b1c635b6-95dc-440b-b670-069c3a4a0bba", "comment": "Malware payload (RedLineStealer)", "value": "52ae1e21101a216b8452806a4b731e9a53548549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956301, "uuid": "fd04aee5-e99f-4fcd-85ef-c91baf806543", "comment": "Malware payload (RedLineStealer)", "value": "c1a8c533ae1157b918a7fab0ab01781bfab7516a8dae659c2bfdf4270a3d1c407dc2af77b4b8690b67d9e550d4582fa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956301, "uuid": "d9384e52-a682-4346-8236-01c711e7a4a9", "value": "T1C0F5336AC9D0394ED4CEC9BC720A6B4B3140D1F9CDE4216F91A9AB0BC1E92F59F18593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956301, "uuid": "a951625f-ef75-456d-9615-36d34f607d9e", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956301, "uuid": "ed66c6af-8490-4283-9fba-2f5acfd07f5b", "value": "98304:z3UFXGaPqJIcuDOzOfJCoNKp2BO/6HxcEFQR:O7PqJI1D7fJRwH8cEFQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640956301, "uuid": "201e46b2-dbc9-4d1b-a96a-a8f0335d551c", "value": 3613696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640956301, "uuid": "74fa9bd4-6421-4d01-8f9e-013b77c7fd0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956301, "uuid": "ecc7e916-050b-42de-9a88-3e6ab71e04d7", "value": "82690f160f8a50e58d1620e91450637e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caa85ab-6a38-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640955004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955004, "uuid": "a8edef0e-4d60-4870-897e-c2839fbbe542", "comment": "Malware payload (Mirai)", "value": "7e457fc598a0e663c6fab256ae4fc6b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955004, "uuid": "f3425d9f-ddfc-4ad2-ae19-37403a31749b", "comment": "Malware payload (Mirai)", "value": "4733b9a70c102accedc0443db60b58a5c08b5916467a68951fab8fa175124a89", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955004, "uuid": "e6bcf13a-f015-4fdc-9327-058454e5c2b5", "comment": "Malware payload (Mirai)", "value": "219ee824adfffe97a03902063679049ce978fbe6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955004, "uuid": "3ac251bc-7264-4225-8d7a-c12b47ad4355", "comment": "Malware payload (Mirai)", "value": "04bd8b5204fdc8ab2b9d21e48d263996a782c6a41f6bf8f85cf3d10a3746da3b6da1b9d48c8aeab7329a83e564ef669b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955004, "uuid": "14f984a1-2ef8-440d-a1fc-81e31f7c8520", "value": "T114F2E2B2B59A1F1B64C441F74E3B7B898000911CE2067EB3BDE5753796B3E289E7424E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955004, "uuid": "9f7c8aec-c3d2-400c-bfa2-fdb4eea304d1", "value": "768:P8k9MxlxMRFXTFzhb8rNrY/AaTNvlEji1Q/aignbcuyD7U0/25:UiMx4tphb8hrla8jiGpgnouy8j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640955004, "uuid": "e93efde4-7eb2-430d-a29d-c2d13d49e1a4", "value": 34276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640955004, "uuid": "d1fed935-295b-4355-8102-cd81dd2bc751", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955004, "uuid": "72ce9ece-f1ce-4f04-ae3a-9647ba2fb33e", "value": "gx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81e3f0f-69eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1640922274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922274, "uuid": "a8891544-f404-4efe-9f11-d693699f274a", "comment": "Malware payload (Formbook)", "value": "18fbd8319f9d3ab5011d52b026e0b9b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922274, "uuid": "362ea0d9-cfca-4194-953b-40f8b8619199", "comment": "Malware payload (Formbook)", "value": "47c82ea8fa2149641ac9406672616f32285a9be86689d74edffd2a546816452b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922274, "uuid": "05ccf897-40c5-4f31-ba52-5293bf27f68e", "comment": "Malware payload (Formbook)", "value": "9e70d9ca4a54efd68888f739a6cb26c244391b98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922274, "uuid": "325fd1e5-0c68-48cb-84b1-8dbc1410e323", "comment": "Malware payload (Formbook)", "value": "dfd984914301c5923c45dc67edcbe65c89a8f6f22462104892eae22fe3868829b0db76c34fcc63c3ee6f4fc01b13657c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922274, "uuid": "199661f9-6488-48b0-85c1-264ad6809fa2", "value": "T1EFF48D1A7256BF84E03D5F798827124493E5E85BB733FA5B2AD47CC81C33B848A5F252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922274, "uuid": "083c1530-62f6-4599-8ffe-1e115b660b50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922274, "uuid": "b43a2719-5609-4c6a-8d86-87f2d3d6540c", "value": "12288:xmpiZNfc7cNGRQG3s4yz8RTZQp+/FbogW9VESksuNKU3m:xlFNrf4A8RdQAFbgTESksnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640922274, "uuid": "6824f7c3-700a-4fb8-83c5-7d6ccff6f26b", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640922274, "uuid": "54b3fa54-d086-40d3-b623-fb786ba4615f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922274, "uuid": "f8b5aa26-85c3-4d4a-9153-81fca3cf485e", "value": "0rder_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6e9343-6a7d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640984744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640984744, "uuid": "96483ad4-9a38-4b18-b428-d2850bdf6a01", "comment": "Malware payload (RedLineStealer)", "value": "abf60d26f7062fa3ed554d4ed437c8f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640984744, "uuid": "0b40371b-be55-4ae3-a80c-e1e022b5f9ce", "comment": "Malware payload (RedLineStealer)", "value": "48267b826fa7ec0cea8be878f979a967d0a091cccea9f226ad8d87b29dc94800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640984744, "uuid": "441cc838-dfb6-44c5-b016-1a4b82db9d1e", "comment": "Malware payload (RedLineStealer)", "value": "7751ce911e1b45f925f214fe1fb6b96e5fd9204d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640984744, "uuid": "40d4812d-dd29-40a6-b168-2eb7e48506ad", "comment": "Malware payload (RedLineStealer)", "value": "6bd4e3e2717f45ac551c98206d9fa4eaac5e4b9251d93b7bd86d5f97257b4654d63c50d53d059adee438ace5bc85e4ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640984744, "uuid": "08d3a09f-e279-4df7-8299-7726e238058d", "value": "T192E633793AF096A3D90244B1DFA9E2DBB23F54A14A447187D310B1F86F38596F64BE0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640984744, "uuid": "8da23a02-414b-440f-833b-76d540491630", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640984744, "uuid": "d9ff1ae4-512b-45c5-ac43-d440302a0e78", "value": "393216:xkY58Sudkv7xjt2H69ZahHIqLWiMtrLeYqWia3Je:66EdkvRsNPLWiuLiXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640984744, "uuid": "aa6892c8-604f-46bf-b061-8d84a1e9600c", "value": 14424344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640984744, "uuid": "b0b75ef8-ccc2-41c8-ab2e-26e88f4da94a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640984744, "uuid": "d86f8bc2-d98e-4b2c-b85e-e3e5fd5856df", "value": "abf60d26f7062fa3ed554d4ed437c8f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e9feec-6a03-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1640932474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932474, "uuid": "57491224-b49b-4202-a45b-405a6db7bc9a", "comment": "Malware payload (CoinMiner)", "value": "f86eef2e0508facf5dbfaff72051e743", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932474, "uuid": "aa37b9bf-da03-45ed-a033-a162d7887578", "comment": "Malware payload (CoinMiner)", "value": "48eee6e4eedb7291e09cd68d3ff4f1608df7fb538be806d785a4e99cb77a9da2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932474, "uuid": "d1835f9c-ca5f-4450-bb4b-f8dfae3dbc0e", "comment": "Malware payload (CoinMiner)", "value": "b5daed890c606c70fba5d54921018d81d40ea5cc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932474, "uuid": "a90e5c35-06b1-4ed9-918b-64051ca83bf5", "comment": "Malware payload (CoinMiner)", "value": "30c42bcc2edd2e4a7e90757470d4216c1664210d570cc258aa891cfefdcce4b5ee548216e70446f4eabf2c050b5f315f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932474, "uuid": "0fd0816c-484d-4083-8514-d659d69812b9", "value": "T17A733A00F550D53AF4F740FBE2FB08AE59299FE4434598DB23D0689F6B31AC1AA32597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932474, "uuid": "723f6e29-9485-4c7a-91e5-9bf89f3936a5", "value": "2184d9d3a232034fe754f63f14b273e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932474, "uuid": "6dca81cf-fc73-4924-90b6-0b22da78617e", "value": "768:R3MuYuJJXY8a59wbYSBoxiKvC9ilC7U1IMnTja7qFGIFZi956zYpg6xsIjC9YzZj:R3Mz8gQuVvSACSjA3IJd0dkgMGfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640932474, "uuid": "58f355fb-1131-4eaa-a0b7-6e8e6c297c58", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640932474, "uuid": "dc7c7e1b-d487-4214-9402-b995669d75da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932474, "uuid": "72bb3e01-b276-4923-9705-7418de8f7c87", "value": "f86eef2e0508facf5dbfaff72051e743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61de2fc1-69dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640916009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916009, "uuid": "d3849e1c-1286-4250-a50a-8559fea6f2dc", "comment": "Malware payload (Mirai)", "value": "1bb0147750907a0322247a1d98b1eae7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916009, "uuid": "5a936f8a-8b16-4a63-abbc-df74143ead5e", "comment": "Malware payload (Mirai)", "value": "49258e643f2b628caeacb7ba113709a07c971428dd22aa395cdf54cdfa253773", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916009, "uuid": "bddaf9d7-03d4-4875-b22a-b37747172fc0", "comment": "Malware payload (Mirai)", "value": "9c8ba4d0c8dfdcca9f41da4a6ce51def82d1db72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916009, "uuid": "5fbd7998-4815-4df8-b90a-72f0b8b8f87b", "comment": "Malware payload (Mirai)", "value": "bd73acddff3cc8520487b2bde12f432614ce980c0c0746d4fe268235f325071bb82702947d3c922ccf34ebcb82a84ec8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916009, "uuid": "8d97dbfc-9b53-4d9e-a51d-8674f43a544b", "value": "T14F13F126269DF4608F254C752D748A4EE3469EADE5703252DE32CBBC20FA116427EBC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916009, "uuid": "3d3c1633-80e8-47e9-8dea-992d485df790", "value": "768:PT/o9ysvAq08WVSMoKtGGkycdQ3VS3I1EsV9SzcjWN88otBYPqoGFLfx03U6SFsR:PTQ9x4WWVSFNGkd0SsbSIjI87+lGlcU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640916009, "uuid": "0dd05669-1321-4d95-b527-e69dfbd8d72f", "value": 43984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640916009, "uuid": "241d15c0-da96-462d-9112-d9180c1070f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916009, "uuid": "084ad75b-64c4-4f55-983c-b4776f670794", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156c17ad-6a60-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640972145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640972145, "uuid": "f41797a0-b07f-4d03-aaa8-e303e32ca12b", "comment": "Malware payload (DCRat)", "value": "08164c1f3945abd09865251df8032ddd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640972145, "uuid": "dba78a67-2d1d-4999-8f39-290d71330f25", "comment": "Malware payload (DCRat)", "value": "49cfe3e8ec06fb6fc1616f2113eec3aed85ec58a24798690a493a23d0a85f7b0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640972145, "uuid": "abad4fff-dfdf-4b02-ba4c-c83aaaf19568", "comment": "Malware payload (DCRat)", "value": "81d87d0623c34d5b57daf97ba7dc4d0a5a685316", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640972145, "uuid": "691673fd-9905-407b-a207-c24f42a2795f", "comment": "Malware payload (DCRat)", "value": "d171a3f2664cda95328b9fbfdbb6cc0e6d78dc9c02faf5dda3e4dc43d0c115aa911245fd98c92582b561b8104a09b0b0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640972145, "uuid": "71730559-13ea-4387-9a8f-29ac1d821dd9", "value": "T15C6533EE2C532638FF252977A2F11DA0F3311274FA3C14ED6D957419822A21EB6D3C99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640972145, "uuid": "2b0662a9-5d16-45c7-a330-c8e6df08c70b", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640972145, "uuid": "8547d589-a569-4927-a87b-3fb04b027c46", "value": "24576:X5D5znHhOhhZt1yju+LqKi9xutCI24rf+s2kTXOyPB0s5qQ+UxTgP:XPznH+7a7eKi9xwxr2sbXOK0s5lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640972145, "uuid": "2985aabf-b46a-43ba-ac62-e26190b5465a", "value": 1422848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640972145, "uuid": "fc724c43-c7fd-460d-a3c1-d54aa4711276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640972145, "uuid": "a06bc807-8b1b-46eb-970c-ed616aebbfdb", "value": "49CFE3E8EC06FB6FC1616F2113EEC3AED85EC58A24798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf71e1c5-6a6e-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640978443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640978443, "uuid": "c8f7c401-c1d6-4e0f-a01d-cbab7099d267", "comment": "Malware payload (DCRat)", "value": "8caac22d4633ec337ac78286ac77adf9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640978443, "uuid": "269e2b40-b7ba-45fe-82c9-1246fa8ee2aa", "comment": "Malware payload (DCRat)", "value": "4d041237f6dbd08e6d88a1a526fa2dc3f1e4ce19348200105a0fa749195bce36", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640978443, "uuid": "6e7542ef-60a9-4c60-b01a-887ab7be9bf1", "comment": "Malware payload (DCRat)", "value": "23539968a355316becf0ec004e222a109f7dd1ff", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640978443, "uuid": "1faebbbf-dc93-4ecb-b733-757df4de1a9b", "comment": "Malware payload (DCRat)", "value": "227c59d7278afc6ba5e0091996b82eca9c0676bcc07e9f7ae7f4c93d48d7e3b419182a28e5107c98b1c1c8f225fad8f9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640978443, "uuid": "92c99b2b-f8fc-49e7-9193-f1b3c7cb0ff1", "value": "T1461528127A54CD02E22A163BC9EF405447A8BDA16662DF1B7E6F33DE20517A74E0D2CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640978443, "uuid": "a2ea0de5-4424-4c70-a7b1-65d9d4ca03a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640978443, "uuid": "5055e3cc-d04f-4233-befc-e6015a270946", "value": "12288:NIlaXLP+vPN9WNIh7tCMeqJz9MrKfwDPlrFHhLTqn4:NIlsKl9NbCUNf4PpT+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640978443, "uuid": "8867a96e-8db9-4fb8-a232-7d69f1a9a397", "value": 932864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640978443, "uuid": "cfd230d2-4202-40f0-9bf1-288cf874f105", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640978443, "uuid": "5326d08c-146c-4e28-a9fb-21e74dcb1535", "value": "4D041237F6DBD08E6D88A1A526FA2DC3F1E4CE1934820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80394549-69fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640929804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929804, "uuid": "0d7b7276-705e-4530-9797-ab4b0599d823", "comment": "Malware payload (Mirai)", "value": "9217e337bf69f72d2cabf1e8e3e29482", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929804, "uuid": "2a341c5a-2016-4c49-a0cb-71539d601cc2", "comment": "Malware payload (Mirai)", "value": "50b48870e855deb84c3faf476da042a8d350639d71bef6eebd5c9b4b18181eb7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929804, "uuid": "52b119ba-2a87-4218-a26c-335429c1ea06", "comment": "Malware payload (Mirai)", "value": "67cbb1bf06d90adf9db70eeda50d7f25b030b630", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929804, "uuid": "d05bd2ed-2be7-4258-b85d-50e1500fa193", "comment": "Malware payload (Mirai)", "value": "421c5fbc4d4bea5133a540e6fbb8261dbb7d84dc89e94acad2bcb5475eaaadb094c8bf5a8cb293892dd968aea3e532c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640929804, "uuid": "e14d4994-80b7-411f-b32a-957c7140ce02", "value": "T1D2F2E2B1F5D62A1B65C441F70E3B7B898000D11CA2067EB3BDE5753746B3E289E7424E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640929804, "uuid": "1da8a71b-c4fb-44a5-9991-00a6d5160aec", "value": "768:P3k9MxlxMRFXTFzhb8rNrY/AaTNvlEji1Q/aJnbcuyD7U0/27:viMx4tphb8hrla8jiGSnouy8j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640929804, "uuid": "e38a227c-ff43-4c95-8f93-3f21163b4902", "value": 34276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640929804, "uuid": "aea66ce8-9654-4051-a4fb-aec888a5530f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640929804, "uuid": "8f94009b-8625-4a8e-b9b7-6daabe0991e0", "value": "gx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae44f47e-6a02-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1640932028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932028, "uuid": "d240c5ed-a45c-4739-af4f-db1705c7095f", "comment": "Malware payload (QuasarRAT)", "value": "9e1035f36da93aa7089f12702c221c05", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932028, "uuid": "09ed3634-223a-475d-bc7e-42f380645de4", "comment": "Malware payload (QuasarRAT)", "value": "524a2c7a97d8323f5de3ca9ba3190e372d6f6e076522283a9697324d94ffcd38", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932028, "uuid": "5c71e750-6aae-4f87-b8ae-152cfad009d5", "comment": "Malware payload (QuasarRAT)", "value": "a9372f041ad8e773e62b7708d5e4302c276964df", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932028, "uuid": "73f71529-a6b6-4fab-81f5-c2936abb3f57", "comment": "Malware payload (QuasarRAT)", "value": "d479eaaba9eb6e11b371a17a002936a7ee60525fe43f4a8590eed0ce2ec57b5210843640b69f1f96c0a7c1395e39649f", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932028, "uuid": "7366b64f-5313-45b0-968a-a150847dfea1", "value": "T155F3BE927681C855D98807320CE6D2D63B23FD519FBA878B31A4F71E2E77790CA4261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932028, "uuid": "01e9dee5-0c59-4e35-bda3-5878a51a2a4e", "value": "3072:UTxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAXi4VYhP7QSuNDxEVbuHsQn2KsO37KDa:mxEtjPOtioVjDGUU1qfDlavx+W2QnASo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640932028, "uuid": "4376e05a-d150-4b92-b300-4be74f13c6b3", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640932028, "uuid": "b8c916ea-9ec0-4154-9c8b-ae41b164347e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932028, "uuid": "1e90aef0-d7c6-4d74-95a3-7bb602ba922f", "value": "Pago.Diciembre.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce94300-6a16-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640940535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940535, "uuid": "36d582ba-220e-4817-85ed-8cd7a33c96a4", "comment": "Malware payload (RedLineStealer)", "value": "b6e994574711d4aed3d782efb3913ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940535, "uuid": "f6f892a0-dc89-4b1a-93a8-94ce234501c3", "comment": "Malware payload (RedLineStealer)", "value": "552af0c3439b42dd76539758ec159ea370b332991f2066682ffd53c4c5d612aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940535, "uuid": "8af995c1-de3c-4fa3-83ca-8c1e1d3abd0b", "comment": "Malware payload (RedLineStealer)", "value": "a17ad1357bf5a6298f77411198cdc120c2cc5489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940535, "uuid": "e7a1addb-5aa2-4f74-8e4d-c488dd9f2c67", "comment": "Malware payload (RedLineStealer)", "value": "69960358143718b58602ce2eabe06c2c7a0184d838d41e811b6d2aeb5816f2ef6b6fa45b4fd8070f89c4135268704922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940535, "uuid": "4b7279aa-d185-49e1-9f2e-3444a4f1ed64", "value": "T149A4AD10B7A1C035F1B252F449B9A275B53E7EE16B2890CB13E52AFE96756E0EC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940535, "uuid": "04a6fd74-038f-4b39-a50e-ea2c4478a4c4", "value": "021e0e648770094d2ffa72010dfd32ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940535, "uuid": "26460eb4-acf9-476f-bd4b-92f9efd99789", "value": "12288:WPAIYFRuQIk4S0EEzQwrYZRw15cYD2Dv3FO:WPAhIkv80oYs7D2Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640940535, "uuid": "9ff2ce36-9c21-42ef-838c-acce02447692", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640940535, "uuid": "15f0c5e8-cf2e-4b5f-a5f7-418fef583939", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940535, "uuid": "59f4f99a-4883-4666-82ac-1a0f409e6211", "value": "b6e994574711d4aed3d782efb3913ddf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fde464-6a0a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640935239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640935239, "uuid": "b23b7064-6bf4-4f35-8bce-b82d62528c50", "comment": "Malware payload (RedLineStealer)", "value": "a43dd4236e3dd511025b8c01433877b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640935239, "uuid": "e563a969-2296-45be-b63f-24f676511bd2", "comment": "Malware payload (RedLineStealer)", "value": "5585be42e18c05eaa86ab18e955b2a93cfc98f18bc0911120e951273ae62079c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640935239, "uuid": "18763c09-23fe-4608-ac4a-fbd522bd9875", "comment": "Malware payload (RedLineStealer)", "value": "971cb051796759d061f7a26775ac4c1481c7439c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640935239, "uuid": "1f9466a8-e744-481f-912c-6c010a4e7260", "comment": "Malware payload (RedLineStealer)", "value": "8a4a8ffc27c2bd2b3b8b117ca187421c7e4785c4bca72f0023aff12ccc9b68242bb70bf8f98dac54adf3515a05c789b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640935239, "uuid": "85b54042-5fbc-48a1-a4bb-a6d8f7fbbf16", "value": "T1D9E51A6437CC8914E5BE0F74A8B051A883F0FD536502DB5F5EC574FA1EB2B80AA619F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640935239, "uuid": "27190574-70bb-46f3-ac91-4c9c9d28e0e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640935239, "uuid": "5cf740c9-39fe-4a2c-aacf-afe6c6c3e069", "value": "1536:OUVrE5Rh6B+HDNt9A83uhQCllawuNqbYpfHxSRuLvsSg00eV:OUVIf7HDbi83NCduNeUEP1MV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640935239, "uuid": "17c297c1-d54b-4a10-9022-20d580bfdd89", "value": 3156472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640935239, "uuid": "f100275d-4449-4648-9ebc-b15bb75e5699", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640935239, "uuid": "097104fb-25df-41b8-8682-3a3d2fafbc7f", "value": "a43dd4236e3dd511025b8c01433877b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b8d9a4-69cf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910246, "uuid": "d762b34b-9c23-4b02-8aae-b1d5a45fafc2", "comment": "Malware payload", "value": "99705ed3c25f41e5f7a5e0cf722b9ceb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910246, "uuid": "7a9d06b8-20da-42b2-b945-60c0ee2de346", "comment": "Malware payload", "value": "5982611d561bda1c90d85ca1cb1b99deb62d85d3bfb198de1a4c265f2ed90bf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910246, "uuid": "2c5594d6-27bc-46e7-a224-32872d4b07d0", "comment": "Malware payload", "value": "94d875a472cb26e517c246b82db0cdd20ca7b4de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910246, "uuid": "e1009d15-5e0f-4174-af66-d00ce80366be", "comment": "Malware payload", "value": "1dd895746d57e02503190b6e3a48b62f0ca6a8848f7f3a9dbab93b64a8397bbf5ed4ffbb37f4b50196e0a868f24e571e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910246, "uuid": "b05717c8-6565-4022-8b45-cd166e3c8e6c", "value": "T17A13E16C010218E9EC379E39EAC60253BD2E4B997B5EEC0B7E969E47CD2054136E35B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910246, "uuid": "45730c74-bf99-4bc3-a42c-a7c72b8bde5e", "value": "768:ML+NK672iw0tuOREaBu5VjsYs31k96HM54cJgGlzDpxYsNLQ2X/D9A0OU:MCNKi2NuTngbQ096HM54UVrYyBX/D9/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910246, "uuid": "2863799d-93b9-488e-b670-083a69784641", "value": 42008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910246, "uuid": "d1adf582-43e2-4e78-99ab-0dc82dd420ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910246, "uuid": "519c0956-08f8-43eb-8c09-da3a5f93aea4", "value": "99705ed3c25f41e5f7a5e0cf722b9ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9ac71e-69cf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910225, "uuid": "445a4e41-1214-4e26-9ec0-636a18ba887f", "comment": "Malware payload", "value": "8cae013e4d9f943e3298ca8b4eefb15d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910225, "uuid": "371f1427-9e28-4f9a-ba79-eb2389670102", "comment": "Malware payload", "value": "5a74a8e00925773edceb71be94c80404578c828e72cee43b92273f75e68e59ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910225, "uuid": "037334a8-453f-4004-8669-eb31f99e03ec", "comment": "Malware payload", "value": "4b76b41f68b714a5ceac18fd0efe802c6f703741", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910225, "uuid": "8195e90a-3434-42cf-abc5-10c76fe7e26c", "comment": "Malware payload", "value": "720c70f5944347d54a6e41a57ae12cab2a6c4431e828243759ea25eb3c1aeb28017923826577b870434a0e0cdbb80bdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910225, "uuid": "2c3a842d-726c-41db-abfe-bd68634d94da", "value": "T1600301E4F952A872F3C51D2AF73C858621969479FE3EA95491508E3CC4E7C8233FA1A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910225, "uuid": "0ba1c3c0-8845-4e98-bad2-dd3d10a00414", "value": "768:d62ReiH0tC1CgjMZCGbnRwqoU5tPAIH3UKpoImN9i0Z:dBH0ibj5G9wqoUXt2ImNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910225, "uuid": "410a4f19-ef05-4128-b4a2-5fe279217673", "value": 41280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910225, "uuid": "13b5acdf-3f5a-4a1f-a4f1-b1860ad00025", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910225, "uuid": "d1265b26-ec6c-4347-8353-d4f01b37495d", "value": "8cae013e4d9f943e3298ca8b4eefb15d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dc0494-69d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640911803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911803, "uuid": "99d932c2-5097-4326-b5d6-3702247fc7b6", "comment": "Malware payload (Mirai)", "value": "e02dae676407023b8a2a7a904d77e623", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911803, "uuid": "398f7e12-b9ae-41c4-bf62-9d40fd6db105", "comment": "Malware payload (Mirai)", "value": "5bb50d577e75bdcd8383a4cbca2212f4e8f22e2792af2f19a17b167c21451841", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911803, "uuid": "94822be7-6c3a-4410-b3e3-8accbc3740b1", "comment": "Malware payload (Mirai)", "value": "b0684391dae8914fc8c4be57acac87422fa4d3b0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911803, "uuid": "6d98c137-0103-4921-901a-ce44266910ef", "comment": "Malware payload (Mirai)", "value": "b56c057fe2e28aa898457c7492677f8f42f06080ae870538828e2081134b7216a6cafdbbcafeae99c85799510cd44aa1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911803, "uuid": "33a4b39c-ac24-4017-8fdf-530ee80ac808", "value": "T18C143A41F9408A27C4D7137AF9AF418E3332A7D5A3DB72068D146BB437C6A6F0D63A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911803, "uuid": "cffa995a-aaf0-4fab-95ec-bc76dbafcae3", "value": "6144:puGmnf1C+gP1HuRuWm/iJb6LNFbbZJk5iXolirffRM/9npJdzs:p/cf1C+gP1HuRuWmJJJk5iXol+W/dpJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640911803, "uuid": "9370c110-4f1f-4620-9b33-bf64cffab027", "value": 206294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640911803, "uuid": "73187636-2527-4237-bdcc-607c10534002", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911803, "uuid": "99e1e743-3ee2-42fa-b183-f6ef936e0e9b", "value": "7ega.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625ebc19-6a94-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640994607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994607, "uuid": "9734a868-1d28-465c-b4aa-5e82661ce1c0", "comment": "Malware payload (Mirai)", "value": "1fcabe8b63d68ee44662e8002c73d087", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994607, "uuid": "246d2c97-8c6f-40ea-ac4c-1550f0f25430", "comment": "Malware payload (Mirai)", "value": "5bdb9c700add26bfc9bbea9fbbe55e41ca5bc8e7ab00b91341941e80288b5949", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994607, "uuid": "3e977efa-d2f1-4fc3-b647-865728ff23a4", "comment": "Malware payload (Mirai)", "value": "29a829b8d0d79981ff6d8da45cf7525484ad74a6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640994607, "uuid": "0510a2bd-a138-40eb-92b4-2b12a2a920ef", "comment": "Malware payload (Mirai)", "value": "32ca017af107fd7a8897fa99e9b72a3f9d8dc53f09fbcf47ad46ca9c3977b29c06df0a8dfa1569f92a85bbc77e719abe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640994607, "uuid": "8f8918ac-f8a6-4edf-a4a7-5593b34a02bd", "value": "T111633A92BC819A02CAD412B6FE5F518E371623D9D2EA3207AD15AF2037CBD1F0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640994607, "uuid": "903e424e-8909-41f3-a697-0b3b83322488", "value": "1536:/WloK05nJ7xkC0ztNrB28kjEWwq04FVW84lx1RVvH:/WNY7635qTEfXKVWp3dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640994607, "uuid": "fd6d591f-e4d5-46f5-9d1b-f43ed316fc03", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640994607, "uuid": "1b513ca8-c453-49b3-9557-9c43bfb6dff4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640994607, "uuid": "95174231-0259-40e0-8685-90f5e5a9427c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d36394f-6a2d-11ec-9275-42010a9c0029", "comment": "Malware payload (Lu0Bot)", "timestamp": 1640950253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950253, "uuid": "b34085de-0984-46cf-89bc-1d77d39364e4", "comment": "Malware payload (Lu0Bot)", "value": "d0d3a7c95eb711d275f029253458c323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950253, "uuid": "4ab63119-21e2-4aa4-ab24-334ee8d47c30", "comment": "Malware payload (Lu0Bot)", "value": "5de7148d727fec09a0597b5f64cf1719968372a21c6ded90c51cae3f42b4c26d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950253, "uuid": "33df07e4-0f1e-484a-b64d-22b47fd751a9", "comment": "Malware payload (Lu0Bot)", "value": "e8ff4bba2d4213566c2a8cb0f5da96c339a1e022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950253, "uuid": "b822ec7a-3882-4eeb-9944-58d71e350972", "comment": "Malware payload (Lu0Bot)", "value": "842ee4b0c8e4b6d83cfcbc60263ebde4a13582f5abda93bc3997ce27aa969456d161557cbddb5866457d85fe6ef86edb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950253, "uuid": "b775bf36-1d5b-48d2-9c7c-9fb3ffa8a515", "value": "T1B751B83FA5040EB1D00B843D0D424B14FB77A17295FA42910F4314D75E78D99687CB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950253, "uuid": "2a0dde6f-6e5f-4bcf-8492-7be2299bdd16", "value": "f97df3d5a90de804311f27d80db8f6d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950253, "uuid": "946c1cc7-532e-4163-8457-cdd8ece3f281", "value": "24:etGSB8Ci0ZCP2/T0J6gP1w+69CdsJn3X6wCyHWoYpUCkaxFYZc5tYamaGnpFp2P6:6V7M+/+un2w75Y2aHtYx1pFpupqJ/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640950253, "uuid": "f75d9083-d60a-40e2-b03f-85ee59e003c8", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640950253, "uuid": "097ebd4d-5378-4d7f-a33a-0d45178a529a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950253, "uuid": "8a95b36d-486e-4cda-9d12-c1776ae7d6cd", "value": "usfive_20211231-060231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0778af-6a76-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640981744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640981744, "uuid": "37e91560-6369-493d-9b76-7a5917880676", "comment": "Malware payload", "value": "9c94821692214afe03d56b4381380dfa", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "ramcos", "colour": "#258E13", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640981744, "uuid": "903d0938-afc5-4e4f-bb2f-0018f615ce37", "comment": "Malware payload", "value": "5e3c4c2a4b9753b6d328e39b3add5aa959036194583f4489117eefd10550e933", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "ramcos", "colour": "#258E13", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640981744, "uuid": "3b6211f1-548b-45ee-a2ef-b6c5e5c21290", "comment": "Malware payload", "value": "069dd5e73c965913b037030902ed5ff4c12633e0", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "ramcos", "colour": "#258E13", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640981744, "uuid": "2dd1367d-8847-42f1-9da6-95a1a4bd518e", "comment": "Malware payload", "value": "2d3bd99f5ea2e0ced2649602bb505bf172c5934cdfb5605d0685bb1d7a493e24c5a19ed8f2122a4bdbfec6d3d08831cb", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "ramcos", "colour": "#258E13", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640981744, "uuid": "850f9b4b-e731-4559-9a63-e87f91eb66da", "value": "T168059FEC69FB47CED6008BC4C65229921ED30571199B8831BBDB7D436A1642AFFD983C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640981744, "uuid": "8836dd4b-9c10-4621-870c-a2dc58eb20ea", "value": "12288:wXEfHPUzEkJhixfZPCYKW7AgA2ft/MhGL/aegK396uRk6Z:mhsLkD2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640981744, "uuid": "c0146849-9fe1-4ec3-9474-9f554e00f1cf", "value": 837218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640981744, "uuid": "2ebb255c-ca45-41ac-bd0d-53c12144f2e1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640981744, "uuid": "190b562d-226e-49d9-88ae-5d57ab0403f2", "value": "Arteria.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe174de-6a04-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1640932964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932964, "uuid": "f6422395-90f0-4e53-80fc-cd366ad347e0", "comment": "Malware payload (AsyncRAT)", "value": "42b06b07fad7fc3a7e329b96d161e0e2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932964, "uuid": "8f1ea966-315e-4805-adfc-1745b689931a", "comment": "Malware payload (AsyncRAT)", "value": "623d540650334252993512edd449549a6208f10cdcd9bb6967a98ce1a06ca448", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932964, "uuid": "f95c1809-e3c8-4e1b-8a9a-63f6b5133452", "comment": "Malware payload (AsyncRAT)", "value": "62cef1c21587e52a66664693acfdacd84d1e01ee", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932964, "uuid": "27cf1765-7f49-49b0-824c-d0afc6ceb7fe", "comment": "Malware payload (AsyncRAT)", "value": "4f11988e323d4950a8658d868160105d7cf7c7fae081e7dbcbd1c4cd1d02d0807a47bdaee73872abf68241f8802899f9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932964, "uuid": "dde0e87f-2f08-4564-b944-43b2f1d2f055", "value": "T19153F2B33F326D36E01DC2310AC2D7A9ED206841FA1A6F1E6DAD5C325BF07A661D8548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932964, "uuid": "b1dbe11d-f17f-46f0-b701-3cb74524a55a", "value": "1536:jPJlmFUC8nDyxAcOscTjCboLw8gp21R9fXPz2ANgyFk4:DmFUC8na/VcTjwzaxfzVNgyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640932964, "uuid": "05acae75-9780-4769-ad8f-cc7dde1f7bfa", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640932964, "uuid": "8af78aca-f488-4f19-a3c0-7ac38aa6d60f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932964, "uuid": "6da13071-5590-40c3-b60c-a8c4d7155bd6", "value": "42b06b07fad7fc3a7e329b96d161e0e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fa857a-69e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640918108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918108, "uuid": "8cfa1102-63a9-4ce7-b95a-c8eaa29a2bda", "comment": "Malware payload (Mirai)", "value": "76bfd9b80244f92f89efe85ec5fde010", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918108, "uuid": "53619b72-0f0e-411f-ab20-7ef34464e38e", "comment": "Malware payload (Mirai)", "value": "675301eea1ea4a6bf64886dff0a5a6663c21d360191d97029451418316fd9719", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918108, "uuid": "fe6b9f50-02f8-4610-b883-91d656f9151c", "comment": "Malware payload (Mirai)", "value": "09a1ace4752cf029d480c9b1a7104c840030a059", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918108, "uuid": "f56a5c0e-da79-43a9-a276-d1800e4eea5b", "comment": "Malware payload (Mirai)", "value": "d49a514065630abd3d6ab81d1940565ec227db81340b7b070910cfc7fa2f57d62fe6b3f9ce8b81c9970e644b59df5aa2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918108, "uuid": "39827c03-de8c-4a53-b91f-d1a64836bdc5", "value": "T1C413F11442951B86CBECDBB93DCA9F4073BE5EDF31788F9421BA51E39A4A43303869D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918108, "uuid": "73dbf249-87d6-428f-82b0-f30d18df71a3", "value": "768:DxVfR1NMJ+u2/S5ThiT24h4MmYpOgp0s9VjQQpTBpFcwhL4uVcqgw09F:DbfB9u2/z2jcrzxfd4u+qgw09F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640918108, "uuid": "769d358d-c5ec-4146-8458-583d8042f3f7", "value": 43180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640918108, "uuid": "9995c9c8-930f-4d26-af0d-7cdcb11e506d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918108, "uuid": "511e8704-aa4f-470b-8a5f-046c7910189c", "value": "76bfd9b80244f92f89efe85ec5fde010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce822cb-6a16-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1640940643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940643, "uuid": "2a2b353e-4b66-490c-91b5-67396efea8c5", "comment": "Malware payload (Dridex)", "value": "a5eb3426e582795b6393a328cd27bf94", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940643, "uuid": "2097d542-09ae-4916-88f6-2edbdfe9fa6c", "comment": "Malware payload (Dridex)", "value": "67dd305f6e4cdfaa395ca06f30d971b8a0d4bf3926bfb140b258f0704b31f92b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940643, "uuid": "797e8fdf-c1e8-4197-8ca2-5074cc9793c3", "comment": "Malware payload (Dridex)", "value": "a2494b972f175cadc7e3b43d67af4c7f7efebb19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940643, "uuid": "f672195b-6fb9-45d4-861a-23aa41d828d0", "comment": "Malware payload (Dridex)", "value": "9998e199e2c4c0f3e38c25a996bbd9faa4c1194cae14a53f57735d46ab15bbcfb8defd0223ae5d0b46bb8adc25bb4ed4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940643, "uuid": "b4028af9-5604-41bd-ae39-6a4484273f1a", "value": "T1C5E48B29FCE50FB7D80AB4B800A7C665327CE4D53B15D9736B804265F928F316A9B81E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940643, "uuid": "daf6daae-6a90-4057-aa37-0d03926c74fd", "value": "63ce49b1645eb1a9eea5e13edd6aa00f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940643, "uuid": "66af9770-f79c-40a7-8c8f-f9998c172ed1", "value": "6144:9oZ0CO9gNUkcYQySZi6GZf3wfWaLaYefOG2uttS6JIhNuttS6JIhz:WZ0tuQ0DZf3wcFVtrJIYtrJId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640940643, "uuid": "bf2b026a-89e2-4d1b-9b80-e7097a02c45c", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640940643, "uuid": "9f703a92-29c3-4ea3-8478-59f28e4aec9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940643, "uuid": "87633b86-27bf-4106-bd40-26ec8aaecf18", "value": "a5eb3426e582795b6393a328cd27bf94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334753e3-6a03-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1640932251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932251, "uuid": "d37daeef-3009-469e-a42b-480ef5715298", "comment": "Malware payload (QuasarRAT)", "value": "85b7072e4d4e7929d8b3febe13ca4e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932251, "uuid": "b3ce5967-5140-4af6-ac61-a7197954e5f8", "comment": "Malware payload (QuasarRAT)", "value": "695722bddb32724a102d8d12aca0ebc841c4944f52632c3ea595941a6e988759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932251, "uuid": "d035903d-b5f6-4f2b-9d97-88be9c1169ec", "comment": "Malware payload (QuasarRAT)", "value": "7afd5de60d72b96d47e208689fb8086e2bb6362c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932251, "uuid": "276230c9-8954-434a-9964-a465f45984c4", "comment": "Malware payload (QuasarRAT)", "value": "512dd089111eb81fc73afc2faf2e70407bd18b4137c7f1762ec9b3323414f8b45e00d48d7018cb3785656eef9a41b3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932251, "uuid": "bcea5264-46e9-444a-95e3-ec93220ce166", "value": "T156C47BEB2F9AD060D66A19FAFDEA0FA02332DA381523F1658D851DF401B723D5F4B560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932251, "uuid": "25452d1e-e4f4-4043-b795-ceba6afbde8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932251, "uuid": "4d069228-c471-4b6e-809b-86b628abc30a", "value": "12288:enPk0NeOADdkeQ94BOJu+0G0RHwbp1L9xvmFTRlDK2BCVRq9XEbXR4QQFjci8Ttz:enPk0OlkEOJ0G0RHwbp1L9xvmFTRlDKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640932251, "uuid": "f8c1cbdc-1132-4654-874b-608896fe2189", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640932251, "uuid": "d77531d1-e49b-4dcf-a3a4-0dafdb59d26f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932251, "uuid": "277d15d4-192d-42b9-a7fe-bab79a24a95f", "value": "85b7072e4d4e7929d8b3febe13ca4e9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81820d38-69fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640929806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929806, "uuid": "0c4d6c58-ca4d-4e3d-b7e8-e3b9df9baa04", "comment": "Malware payload (Mirai)", "value": "aff621ca0616ca06acbab2635e088b68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929806, "uuid": "5f3c7f06-de5a-49ca-9eac-4e6b0df7e67f", "comment": "Malware payload (Mirai)", "value": "69a21304fdfc989f7e466f76904ed68288d7de834e89a437b69e2b8d5ac327a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929806, "uuid": "fa64db16-dece-44f6-9f13-3eaa2d5896cf", "comment": "Malware payload (Mirai)", "value": "fdcbb08544ef893875f9bc3e9067c1f28084806f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929806, "uuid": "96517248-f341-466e-be90-7d2289bb6197", "comment": "Malware payload (Mirai)", "value": "b6ab941658372927fdd1ec065ef342bb3afeec3ed95e5610553a57e21898ab2370d5c96ee419e71636bb1f25780a2011", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640929806, "uuid": "295a63fc-a5d8-49be-a31a-0f957eaeb7ec", "value": "T1A3E2E1219852A858D5A049329C46C619B3CA43B9D1EE7131929FF5D4FCF5813ABEE8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640929806, "uuid": "782619f9-645f-43ac-a23a-cd685a0138c0", "value": "768:Ixb/ZT4XpHbXYXcWwyug6DSFk05uuiCLV5tufJ3Ui:IzT4XNoXcWt/L5pAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640929806, "uuid": "b5ca9ac4-e3ee-4fb3-b7bb-1f456fffc225", "value": 34052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640929806, "uuid": "2aea92bf-2b28-4250-bd62-ebe44a7f1d70", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640929806, "uuid": "a97b7093-c97b-45ef-8063-e4827098f773", "value": "garm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36d0b60-69cf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910186, "uuid": "40ca1d00-5d37-4c35-b875-ad51f1454fc3", "comment": "Malware payload", "value": "b9cfc17a1f1bcc31309c957192f8961d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910186, "uuid": "e7e844e2-ce8b-49c0-ad72-9fa492257092", "comment": "Malware payload", "value": "6ce5df69346900a5f79a3093ef698c240322e73a6db00ba29346c07c9caa6f84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910186, "uuid": "61f7838f-ed00-4e6d-b638-e700cd2a842c", "comment": "Malware payload", "value": "624af7178a0d12b1445954c14372e219adb49d47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910186, "uuid": "0339bed7-1bf3-40b9-b9e7-a2ab237a2cc5", "comment": "Malware payload", "value": "47a1c3d272e88287e85e5e9a696a45148ce6ff1dbcf646f5fd2b8160967513e2a2f04c1c8a8960e601fe278a62f54bf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910186, "uuid": "01ac45ce-941f-4573-9ad4-5fcdff398765", "value": "T1FDA31996B800EFB6F40EE77604D34B247270FFA65E93163273177966AE362D42826F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910186, "uuid": "57cfefe1-8589-4770-96b4-f167f10dab74", "value": "3072:dDbLrqYQ1FsAqbce0yA+mAxmm/Npbxs1n6KNH:daYYFsAnyAlAxmm/Npbxs1n6KNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910186, "uuid": "9dc395a5-3861-41b9-92d5-4d77b501fdd6", "value": 101549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910186, "uuid": "a6b18961-d4bd-4166-abde-7c0147fff265", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910186, "uuid": "3d7b8d06-b641-4555-8cf1-40cb6a5e4da5", "value": "b9cfc17a1f1bcc31309c957192f8961d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e7941a-6a16-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640940488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940488, "uuid": "50f49dde-dc21-4baa-a568-018690ba448e", "comment": "Malware payload (AgentTesla)", "value": "5b3adcab18753fea411adabd696a0ec6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940488, "uuid": "8e01d97e-3966-486e-a0ec-15d896e866c8", "comment": "Malware payload (AgentTesla)", "value": "6df77c0f8991ed1bdd9a4a317e54351362037de7ee9d8b3ab978ae0a167c1e36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940488, "uuid": "1a454885-7fd5-4ef9-a42a-c6e26d2538b6", "comment": "Malware payload (AgentTesla)", "value": "7559347c8b4bfae0de4384c101422cc5a28e8ba3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940488, "uuid": "1eca5400-02a2-4cb5-be54-065401a62bf9", "comment": "Malware payload (AgentTesla)", "value": "d31729ce2a02518054164b5bc814bce79e8a85ede517bebc026a8bbd956673502bcef124fca046b6f98c3f6453f6421d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940488, "uuid": "700ca716-3453-4edc-badf-4ec2abd17144", "value": "T1F5A412303BE86791F6FAABF5217182801B32762F6523E31C1D89729D5C36F95C6A0B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940488, "uuid": "2d2f5623-a585-43dd-8068-c009a591f9c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940488, "uuid": "131034da-5b2e-48f4-ba1a-522df2bb5e62", "value": "12288:Ech3lncPkO6ypr39SIQFl12FzyBDUcun4Nd4u:EchVcPkXjb1wYu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640940488, "uuid": "486981a7-6f3e-45ec-82fc-ebea3c71a20a", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640940488, "uuid": "818e6f06-c416-44f8-9ed4-fb67def0aee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940488, "uuid": "55ab1ac4-9801-4978-9d97-4eebd3c7ebb8", "value": "5b3adcab18753fea411adabd696a0ec6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6786419-69de-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1640916553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916553, "uuid": "24fcc0a3-04a8-4ceb-b334-2311ed5342f6", "comment": "Malware payload (QuasarRAT)", "value": "fce0a2c1e3120330f10a9246281849f3", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916553, "uuid": "db285f34-c8d2-4248-887e-b9d86ef944d0", "comment": "Malware payload (QuasarRAT)", "value": "6ff685e5acfd946101b558f9f9d47a0d515c62e7476f5f83694609d64343315e", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916553, "uuid": "30cfc74d-afea-4b2a-8869-49488fe65762", "comment": "Malware payload (QuasarRAT)", "value": "4249f81e15efde7046cdda21aca642ada5d08fc7", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916553, "uuid": "46d6dda6-7300-4c3a-bbd8-85517f312214", "comment": "Malware payload (QuasarRAT)", "value": "7c642498bfbb47b8e7c8bb3baea5dde5a4b5286a5e9e8869aa42812b06cdaa1b9518ca17521e5253a0136f3dbef3dc3e", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916553, "uuid": "160b60ee-9b4e-4896-8e39-fb23f1623286", "value": "T18113D03CCE8A4AA4CADB8074493EB991CE55BB419E41DF4B0F2ED20E1484CD1536BDAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916553, "uuid": "9e707ae3-9679-4fa1-81f3-f4495b4ed376", "value": "768:/vxZXv1ssnDIBIJYfTH+niSpZvDHx9wv+nWmFFiKk/fSqt+U0sRe+n4RUUay:/v3v1TDIG1BzTx9wv+dFFi3/KqY5s/4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640916553, "uuid": "5e3ffbe2-d4ff-43a6-85ae-9b713a8af55c", "value": 44058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640916553, "uuid": "87f822d6-32c7-46d4-b43c-746206d40f66", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916553, "uuid": "0e17b0fc-f448-46de-87bb-f2bd054fe437", "value": "6ff685e5acfd946101b558f9f9d47a0d515c62e7476f5f83694609d64343315e.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c52920-6a67-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640975529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975529, "uuid": "4b4699b1-f828-4a67-9ef4-b5a71fe42ac1", "comment": "Malware payload", "value": "a9d67e3d5fac90537dbfca3654f17293", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975529, "uuid": "fdc4ae87-c1b6-4d0f-9fa1-a1c9a0fe5435", "comment": "Malware payload", "value": "7275bed26859a0b971d38c61e71cf6a2176f1a0c6af9a8391f94ec8372ac1198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975529, "uuid": "091497e0-7cfc-41d3-90ed-ad553bb0d839", "comment": "Malware payload", "value": "bbfa6f986a6ecd1950a669a41139a37cfbf5015c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975529, "uuid": "73ce8821-75ba-4194-ba81-5dba9131cace", "comment": "Malware payload", "value": "e8d27e9ba828c5c40d3cd0d7b177e0548a2b5f9557322153733d69a17bdef185b764ced3be86f3ed5151b7e94059dcfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975529, "uuid": "66ee2a9d-53e9-46b6-a1c7-3018655b03a5", "value": "T1AFF53303F89FBFF1D852E0B7A2141166972360046EFA44693715872EB5C363A87CB7AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975529, "uuid": "feb9fac3-1a77-4f6e-9794-6f9d9ab13832", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975529, "uuid": "eb870ca2-ee92-41e0-98c2-105e889d0d42", "value": "98304:V5ceygU7I+M0AauZbklL7oLU2A0DZNE7ZoPzTzR:rSgqM0Aag4V7oLFAyXEOPrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640975529, "uuid": "e15f3d77-82e7-4fd9-b6e2-fd45dc548b28", "value": 3321856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640975529, "uuid": "d5526a17-8e2e-474f-8fbb-908e4fdd266f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975529, "uuid": "590b690a-31b5-44ca-8a71-1e1ee00d2e47", "value": "a9d67e3d5fac90537dbfca3654f17293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc62fb80-69cf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910255, "uuid": "f53da546-045f-4c8d-9f8f-8ab6a2010bf7", "comment": "Malware payload", "value": "fb81e1ef08205a2dcc603d2fe9652e17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910255, "uuid": "510ecf52-f5df-4b73-9e20-e4644fd424ae", "comment": "Malware payload", "value": "75c134005ca0f2bab5cc36adbb602876b5140ebe784ffd2d9c72b11833ea0d8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910255, "uuid": "3174049e-8380-4743-849e-bfc048ab00bd", "comment": "Malware payload", "value": "a78d7bb9e3a7c0934cbc123dcf394d5eb81ab074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910255, "uuid": "a62682f1-ed45-4abf-a82d-cb29864c10f4", "comment": "Malware payload", "value": "d685ecebdf0d6186be42ef593768164f9ea6f9871cffd984b1f7dc9d143d8640c6bbf4b0a1490bc72d806afb064998f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910255, "uuid": "6c16d6ee-8515-440c-b416-b4fcf44f41ed", "value": "T13E03E190A359CFADC4E692B15C9F3CCB4C28F04EE7B1969372EDB46B44B1E91131CA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910255, "uuid": "00a2281d-4ff8-42e1-9283-e271b9464f52", "value": "768:wV7HvdJdoERLk7M+dtMfKgcNE/GsnbcuyD7UryqHyUqpGbIFm90:E7PvdvRL7/znouy8mqHvWGbFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910255, "uuid": "0b62049d-5f0a-4a58-b287-54684231424a", "value": 38484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910255, "uuid": "2057a3bd-cee8-46e1-9d24-bcad55669303", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910255, "uuid": "32cb1625-d594-4472-a633-db0c7b81eaf0", "value": "fb81e1ef08205a2dcc603d2fe9652e17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6f9414-6a53-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640966578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966578, "uuid": "f3bec30f-188f-47ec-b7c3-662f505b6c2e", "comment": "Malware payload", "value": "c88b15226ff88040d226d64b375ac12e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966578, "uuid": "fcad34fa-dfdd-475f-8a7e-44538281de18", "comment": "Malware payload", "value": "76960749ed11d97582923e31d59115910ae74d8753c8e92f918f604ca8a0d26d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966578, "uuid": "600164a0-9b6d-4bd8-a90b-77763f366f90", "comment": "Malware payload", "value": "64a5dc3748c94576dd508231d1bafce59bc3385a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966578, "uuid": "b7a949f0-3076-49da-bec9-5fde5022004f", "comment": "Malware payload", "value": "cb1af5c8120754724546190b4f3881adfdd20a737aa5218695d9ff9db1330e1d04ec88c5771f8e2a83a23a91e3dc1d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "TellYouThePass", "colour": "#637808", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966578, "uuid": "b84928c2-d808-4c5d-ba2d-7683654735f1", "value": "T130E54B13F89146E5C0ADE230C66992537A7278A9173023D73B50EFBA2F36BD46E79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966578, "uuid": "b12c611d-e66b-46bd-8a33-0c68459acb93", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966578, "uuid": "7c5e210a-9727-4bde-b835-e081345409f3", "value": "49152:fyXC3Y0KGJrb/ThvO90dL3BmAFd4A64nsfJvm2FsGmq3ihBe6Q2KbkSgAUIOGwTd:fyp7m2SGh+Bd1IRwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640966578, "uuid": "e8ecbed2-5131-49ef-9012-619f60ae520c", "value": 3190272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640966578, "uuid": "0e36102b-d24b-4c4a-b50b-e47d0194e4b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966578, "uuid": "60f4d93b-b990-4743-a7a8-a60fd10616e0", "value": "tellyouthepass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078a1e0d-69d0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910274, "uuid": "563b2ef9-b616-44a2-a6d0-a0ecbb88ad77", "comment": "Malware payload", "value": "12849090a88b0bdd4dee4990376d3d99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910274, "uuid": "cdeeff24-9629-4508-b206-e836449784a3", "comment": "Malware payload", "value": "797796005b5dd3ad00513789d6e93588ac29417750faa2524c69f69e6de5e0ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910274, "uuid": "d8691f46-9fda-463e-915e-866f5451eabb", "comment": "Malware payload", "value": "6f625770f04e35b063c1158d1d18e3df7a1c5900", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910274, "uuid": "78c11078-30ea-49fd-9d68-459207d09760", "comment": "Malware payload", "value": "cdae54090e6f96896c3d27c34865c358660f776d033d8953131a8094c211be7c145ae853d1795776c6a9abc06d680def", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910274, "uuid": "2e6152cd-71e9-40f9-83ee-4334a56076e3", "value": "T10003F161E3BF5C19D0FF58F03DA85A4293E6DE920A1AD6B536248FA44516E3312C87CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910274, "uuid": "eb3b171b-cc80-4cc8-8981-507f12cb78c8", "value": "768:khECa/Zo68yjwEKX7atJN5GrweB1jvnpAG1ed4uVcqgw02NWXoQHQV:mEzZo68Iw9rwzUpBl/K6ed4u+qgw06W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910274, "uuid": "1ae4d65a-24a5-44f2-b2be-8af5d1fe5213", "value": 38308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910274, "uuid": "b5ab5d11-358f-4e97-a507-386214889fe4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910274, "uuid": "f22c2ff4-ba38-4012-b5e4-b0c79a5c557b", "value": "12849090a88b0bdd4dee4990376d3d99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f42d0e-69cf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910209, "uuid": "ba64911a-4fc0-4b07-be9e-88ca586e6b80", "comment": "Malware payload", "value": "bfd1d7f2e10cdae17399233d748eed04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910209, "uuid": "d1af8359-bc05-4c01-a4cc-9d78fe3e069e", "comment": "Malware payload", "value": "7d1b13fdf99c7b4fad9dca54b617e7c4c30b5a43394c4e9ed6ec905232016751", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910209, "uuid": "46bc043f-2276-41f1-b42f-ecaa0b725077", "comment": "Malware payload", "value": "5bedf4b2439c4bf12698d616ab6f1804647753ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910209, "uuid": "b6c35874-196f-49d0-b3d3-86e6b1e46d8a", "comment": "Malware payload", "value": "614e41f13b940ab20b8d3a76254339fade7c095239d1582632048fd8ff9249f75d64420ac9d6e0203a735ec7ce416ad2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910209, "uuid": "d8e63023-77e0-4be0-890a-efc02cd3d7c2", "value": "T13E13F22798D23184CCDD7B3ADDD516F42DA8714BA60E8797C3119400DE76A0ECABF827", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910209, "uuid": "9c650bb7-d039-4158-bf38-eea90b8a153f", "value": "768:58S4QjbO6fSrbvkCx2OoLEi7tl+50cGXALMPlWRf95CP73+:51b36nsCyLEsn02E95+73+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910209, "uuid": "078e18a9-6eba-4318-b962-0e3fdb3c5bd8", "value": 42420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910209, "uuid": "9b5622cb-f1d8-4474-b175-cfd7ed9ae67b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910209, "uuid": "86def025-6f00-4c73-b816-cbbd4c3c6970", "value": "bfd1d7f2e10cdae17399233d748eed04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be22f22-6a2e-11ec-9275-42010a9c0029", "comment": "Malware payload (Cerberus)", "timestamp": 1640950654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950654, "uuid": "5df984e8-23a6-4e77-acd3-ac7a87599fd0", "comment": "Malware payload (Cerberus)", "value": "94900fcbce6801a6f6c7dc751a7496c5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950654, "uuid": "8b89591c-1b7b-4ebf-b59f-1403f659385d", "comment": "Malware payload (Cerberus)", "value": "7ee960512983796848c432aacad8b8eafee37bce6a16d031726672bb611dad79", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950654, "uuid": "21c8f258-79d4-42b2-ae14-e9c3b8cc4c8a", "comment": "Malware payload (Cerberus)", "value": "578a7afec658622d07579883d4760340f49bffe0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950654, "uuid": "a5d07451-03fd-48cd-adea-a658a9ed4966", "comment": "Malware payload (Cerberus)", "value": "a6b96a5d5aada72996ef3a7948bf8695ef75942c9566b978ca063ce21be0973e5a1caedea04dfaa704a37286d62b4b82", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950654, "uuid": "7a5d7b4f-95d9-40ef-9c45-3473fc82e509", "value": "T1948533439BD6A447C58F46BD094B218BD509830263E6BFDF3A0D582B2F975DCCC61EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950654, "uuid": "1682062d-9e19-4c10-b36a-8428413d8bfd", "value": "49152:zs+zkezkr4yIijU5G/9gehJ1hPMA1spjgqXyi7OrUAW3QOjIlegV00I:zsykokslijU5w9g4JbMA12j0fpKQOjwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640950654, "uuid": "f8b322b0-fe44-444e-8b51-f1251411b8bf", "value": 1765734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640950654, "uuid": "171ece24-a90a-45de-a0f2-3ffc214f2c91", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950654, "uuid": "d884e45d-0a4a-44bd-a093-79b2e52d1221", "value": "porno_video_arsivi.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc4fb96-6a13-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640939461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939461, "uuid": "9ec7dec5-ea1a-47cc-85f1-e6e13a591a9b", "comment": "Malware payload", "value": "b2993b2a7a1edba14742564de7e85cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939461, "uuid": "6ae68387-fa5d-4903-84c8-7c4e4a627c5e", "comment": "Malware payload", "value": "800b4455105a08833332092017909f9dd47bd4ebfb1cbddbe0b95658d03b8d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939461, "uuid": "c3fda5df-d30f-4940-930e-6d4d71ac745c", "comment": "Malware payload", "value": "cf7f1085978128cc082aec921d34d6d25e4ab19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939461, "uuid": "ccaf2aed-76b1-49b2-b9f9-ebfd4a85d080", "comment": "Malware payload", "value": "68d6265d1a87b086cf2323e72d90f14353f876e8498ccc00e7c6bf61beb489b7639da02ba8696e11e9329eca4484fe53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939461, "uuid": "6dc6754b-6082-4386-92a5-35c9fe103dc9", "value": "T18F334B15AFBCD881D4A402F1F8D3D9F805A4ED11D42ADA3BE9E53E0A3937346690A7C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939461, "uuid": "79a15ad3-dbb6-4f88-87c6-de49706b8b37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939461, "uuid": "c58b6898-1ef4-4f10-a8f7-415ebfec15a2", "value": "768:9ULV4TaW98YQuGwpWlsHF3mqjIAxyLVGEQW:9mJuDQ+MlsHF/sTVXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640939461, "uuid": "f567b709-1860-44cd-a4e5-b79cdb24df90", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640939461, "uuid": "eb75b8ab-c1f2-4770-affd-d32c34bd0eba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939461, "uuid": "1491bf09-51ce-4f6d-810a-5a169edbb05e", "value": "ConsoleApp7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8c043e-6a67-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640975539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975539, "uuid": "be7f41c7-de97-42b9-bacf-639b3876c2d8", "comment": "Malware payload", "value": "d3f2cbcaac871314b6923e9c31a2b2e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975539, "uuid": "a8553ad3-da05-4fae-9130-e3fef016164f", "comment": "Malware payload", "value": "81fe52e70e3f0562d02591313a49d2b353bedc557fcc09d3d6093160de68f3d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975539, "uuid": "4a452717-239c-424f-89f4-584e8950390c", "comment": "Malware payload", "value": "e14c205d486af944b1909549db5f62bfec739e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975539, "uuid": "31a2cbec-3b18-4bec-ae2f-b11bdd9490c4", "comment": "Malware payload", "value": "fc786d10a78a81983eaceb0dbb4e1e1ecfa22a3b99a45de5200cfa3c193094940be76500b24022c918819ccb63768db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975539, "uuid": "45c3144a-f814-4103-a1f6-860d73378df9", "value": "T1BFD523043EE858E9D922493C8C518575A672BC110E3DD66BEBD07B1FCE37290AC2B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975539, "uuid": "4240cd64-6a45-4c61-837b-9f190ce243e0", "value": "49738ad0bee20b817dabab783acdf71c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975539, "uuid": "0861f9cc-6ee0-4d54-9f7e-cf222a463305", "value": "49152:XkD0+cjlJ6yyVt4rY/HYAit4kwPuG2ULx+A0E9jtfUOU94V5hY2iTkk:UMWDCrY/4Ait4kwWGzxN59jtfUOI2b9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640975539, "uuid": "4e913831-d444-4230-927d-3d2df7b25617", "value": 2776064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640975539, "uuid": "2cacc995-6b8c-4468-acbd-bace5ee8d9aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975539, "uuid": "8bed24f7-85f1-47a8-81da-57fd2912bd5f", "value": "d3f2cbcaac871314b6923e9c31a2b2e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada08579-6a7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640985285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985285, "uuid": "b7e7a1eb-cfa9-4766-9e95-94cfd1b83e0a", "comment": "Malware payload", "value": "ee7a7f3b9c700d5ff6ee8767eaf5ed9c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985285, "uuid": "71febe58-020f-458b-85d3-07e36e2fa0b9", "comment": "Malware payload", "value": "827bf0a595162a8a385ae04c2acc5ab547f14febe3b9cd89c8cfa5313b3a71de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985285, "uuid": "719111ca-bb19-46f3-bcad-44249a6251fc", "comment": "Malware payload", "value": "fd741679ff7e24d38f6591bed677967131779552", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985285, "uuid": "1bbeaf15-6847-468f-af4e-9624a9e3bd2e", "comment": "Malware payload", "value": "d1be8db4032a0834367a1e79f77d1ed44f9c8d7c4c3501d00b8fbda7819dadaa621261fb81ccfe480c422a9e4d6d0bfb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985285, "uuid": "1366aa63-b01c-4946-99a1-61b2ea5f214f", "value": "T1DAA2D034BB29A2D6C2302232E66D57C666446BFCE5F9B0B385A4135CF3D3289643D48B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985285, "uuid": "d9e8f339-88e1-47ed-b7f9-630da477c8b2", "value": "384:V5f1mrFIAFEfH7urPQHVQ6wQo9qvwBPVh7qmdGUEpiaVr:7f1mFFEfburMVJ3mYwBt9q3UELVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640985285, "uuid": "d4ec115d-6b79-4f16-9775-35e91fd0bd8a", "value": 22056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640985285, "uuid": "77f087c4-3199-4e65-a36b-5f1bb29cc69b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985285, "uuid": "9a71370b-0b84-4f37-8960-f0a379a8dd74", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d85320a-6a2e-11ec-9275-42010a9c0029", "comment": "Malware payload (Cerberus)", "timestamp": 1640950656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950656, "uuid": "18d874f2-257a-4e48-8670-40f58b99f418", "comment": "Malware payload (Cerberus)", "value": "51340f9236eaf895b9e0160dc579baf1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950656, "uuid": "0ff7e51a-15cb-40f7-a15d-d6a414da104f", "comment": "Malware payload (Cerberus)", "value": "8c8d7c0f5296b7f8a4032c30e0dd2af0ff985713c3864fdfaacba6615d02b241", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950656, "uuid": "68ecf9f6-02b7-45b7-a5ce-645b8dbbf169", "comment": "Malware payload (Cerberus)", "value": "29b400d6b7856370e5f38286cbd2fd46080c373a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640950656, "uuid": "5178571a-b7c6-4b52-b0b1-f62798401281", "comment": "Malware payload (Cerberus)", "value": "e49cb2c9a785646aea770f3da84066a081e2b79dc131cdc5dbc18d7334c8d06e937a368da63b485242602c5c48710940", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950656, "uuid": "9e4e8b8f-0e29-427b-bc64-064fe25474a1", "value": "T1F1853382E2CA7577C0F85A7F762A12030A13416BEE559D7B362E540E7F77EC14D20D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950656, "uuid": "6cf0e0de-ccd4-43ad-b210-ac2d3ba14f62", "value": "49152:LXRk13tlqdBDfFFacrSn7QOyBxbNcqmahk:LXRkflqfDtFacy7QOyBxS4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640950656, "uuid": "c99e985a-e83c-431c-a1ab-97c5a72c905d", "value": 1863604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640950656, "uuid": "e92672b7-1c09-496e-902e-b42505eb7e80", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640950656, "uuid": "81530d7d-5c5d-446e-b690-fe6c8b84bf35", "value": "Hadise_Ifsa_build_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c63034-6a64-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640974241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974241, "uuid": "60aadac0-3709-4878-86ac-df4520e01612", "comment": "Malware payload (RedLineStealer)", "value": "4eb8aaa41fc2ef6fdc3432cc47c09c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974241, "uuid": "e3c27a1d-1e81-4f81-98f8-7172ed33a10b", "comment": "Malware payload (RedLineStealer)", "value": "8cedc3fb74185394bbf60d2dc1f9618b1e576986f13031b9e29ef12daa6eaf2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974241, "uuid": "238ba679-3b76-401b-9c9c-f7e7f38933cf", "comment": "Malware payload (RedLineStealer)", "value": "6aa99adf337e5db142aa3a75c416bad6e8f7a2ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974241, "uuid": "fd1c0205-858a-450b-886c-4fecba516681", "comment": "Malware payload (RedLineStealer)", "value": "1818d1f033d993a68c7cab6e92ed759171ba862db223f08bb885af15849a26f0a66126b4d409a542b1d5307058c441c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974241, "uuid": "0a54c569-cc44-41cb-93ea-a7f1971b9256", "value": "T199747C10B7A0C035F1B752F849B962B4B63F7AA16B3491CB53D52AED96346E0ED3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974241, "uuid": "3c524625-94e3-425b-84aa-a9369cf6daba", "value": "c613013e8ec93eae360257b5231d0949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974241, "uuid": "2db28086-5cff-4881-81cf-95f0f0cb0c7d", "value": "6144:soI4eh8PycOOhu/Apcrt/Yb8xL4HCAlJdlSg5JPm:soIVWPyrOhu/Apch/Yb8xLulJdPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640974241, "uuid": "558d4071-10de-456d-b5f9-bdbc9ac43303", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640974241, "uuid": "5736d14d-4991-471b-aeed-fc151f1cd470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974241, "uuid": "d9164e70-ff17-4469-bc30-38afb86d1170", "value": "4eb8aaa41fc2ef6fdc3432cc47c09c66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb7e3d6-6a02-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1640932054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932054, "uuid": "8c5de604-274e-4e62-a21a-3973405f4198", "comment": "Malware payload (Socelars)", "value": "31f6b2929bd25668ffcfc8216af735a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932054, "uuid": "a37fc368-2b96-40d1-a8ea-a3278ce1c3af", "comment": "Malware payload (Socelars)", "value": "8ea9c5b6af17446b164b3aab8e52907d5c31b16c3e71690a40832a22a9fc8a2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932054, "uuid": "363f8a82-886a-4431-8f90-ff8a07fdff27", "comment": "Malware payload (Socelars)", "value": "f77aba621c36609549a97ed8f8592a501e040f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932054, "uuid": "4da9a582-8c2b-4cb3-ab4b-688de7862bb9", "comment": "Malware payload (Socelars)", "value": "d7f20d95eba4c3f2969a13e00837188e09357aab447c1792372f3840155c958b076889a632e83b9a7dcf7e0424517499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932054, "uuid": "4dfacf81-dccc-4452-a0d0-2fd01d634356", "value": "T17E657D11E6C2603EE8E3107281BF46BA9DEC66210F047CD7E3C45B6D5A615E33A37AD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932054, "uuid": "b38caf67-cd95-4937-aaf4-cf9451280345", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932054, "uuid": "cace64c2-c0fa-444d-b198-c583b7ea5515", "value": "24576:0r/phkCUyl+/LCBxJmnljksTnpbU2xbVhtpJCnBhq7zPo87:epny6Wxdl3LCnBhq7zA87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640932054, "uuid": "99b3c534-b43a-4214-849f-43f4292414e8", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640932054, "uuid": "2f5608b8-7b39-4249-82d4-3d1c9de16562", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932054, "uuid": "347a4e68-e73f-43be-89b9-2484ee563cd8", "value": "31f6b2929bd25668ffcfc8216af735a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48de2294-69e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640918114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918114, "uuid": "6e68b5e6-8fe0-4d8f-a6c7-a056d5c9f495", "comment": "Malware payload (Mirai)", "value": "4ecccd8f8b736cc9893cbf266e53dc75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918114, "uuid": "066efcd9-b191-4fc1-a220-c976a61481b9", "comment": "Malware payload (Mirai)", "value": "910779e4fae27a553a9fa39614d7642791ccfa68bcaabc7b2576279669be115a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918114, "uuid": "720c8d7d-f557-4f79-a88e-890bd4d115d6", "comment": "Malware payload (Mirai)", "value": "fb5303e950be700d6b3665bab24651073c7f0719", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918114, "uuid": "ad2e22d4-cd71-432f-a557-0387e821552a", "comment": "Malware payload (Mirai)", "value": "6263936451e03685f3639209c020db3a282bf960bd0ea2f734ffbe6edb5c5f0f1a14f79e1e680c767f09bdfd9887bbeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918114, "uuid": "4c4e06da-c5be-4efa-94db-ad21149a4b9e", "value": "T12523029EC50875E4D9605CFEDB5A83683C9D22FC952E321369E105909FC9CB38EF7580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918114, "uuid": "e6c861b8-86d1-471a-9efa-1ac23adc3ecc", "value": "768:j4Ko8N8VXGN07MdnoAdz/BFrZQKAAKJsDjdDIoZLCgyL9q3UEL7U:jWvWSYogF93xpl8oZLCgyqLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640918114, "uuid": "37504eab-ba34-4d9a-b52e-7d2d483ec623", "value": 48388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640918114, "uuid": "5ada0c73-c01b-49ae-9df9-3c92b1e04b4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918114, "uuid": "a21748b5-6571-4d95-ad19-9df389b914ae", "value": "4ecccd8f8b736cc9893cbf266e53dc75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42e4850-6a1b-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1640942802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640942802, "uuid": "02b034fd-f6b7-42a9-a96f-1db4121a8fb5", "comment": "Malware payload (Quakbot)", "value": "3f4a3552f982e7bbc33eae19a6cb84a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640942802, "uuid": "efa84855-6f1c-4a82-a973-08956392744f", "comment": "Malware payload (Quakbot)", "value": "912ecc18a7ebccff88409d1b50fcc83d664e77eecfdee269ef8f7b77f7cf5d96", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640942802, "uuid": "269e2636-f6ae-499d-9110-4a6145ee192a", "comment": "Malware payload (Quakbot)", "value": "c2835d0f2ce159aa7fd1d552ddf5fb460c6d18bc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640942802, "uuid": "59b6aa74-69a9-403b-a424-7fb89377f10c", "comment": "Malware payload (Quakbot)", "value": "7d1505ef4b643af0cb1811031b9517a46921fe4cea468e7f5e377338a78dab4c5656dbea6244c959943c51f76400230b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640942802, "uuid": "fa49900f-d0a0-4e52-a045-2eb5913f2ccb", "value": "T101A4235876A5AC0BC36C18386B1DA8D67D07629EF400F61A529DB13D012B4DE47CBEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640942802, "uuid": "da238264-0356-4dad-9cdb-6502a7a0b33e", "value": "12288:TbZao+zcm0lTvLeK60sI+B/VONLb15i3amcYVspp3waIrWOOt5XaV:TBTvLeKoIK/VeLb3i3a8Vk9Bt5XaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640942802, "uuid": "23c91775-515e-4469-acf9-d42d57329a65", "value": 491603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640942802, "uuid": "81394174-84c4-467b-ab87-405f9bbd3356", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640942802, "uuid": "05900acd-08d5-47be-94e9-fb777c53e6a8", "value": "3f4a3552f982e7bbc33eae19a6cb84a4.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d75b914-6a17-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1640940805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940805, "uuid": "d2e7f7a3-dabf-4539-88af-6f34fad44ed1", "comment": "Malware payload (Tofsee)", "value": "c9bb0263f1f8bcf29205aa8c41184fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940805, "uuid": "0ffd87ba-2d92-4891-a44e-bd7b787f7bba", "comment": "Malware payload (Tofsee)", "value": "925c11560a88096bc28480d802d69da132ff883236e0d8dfaf9a367fa07cc245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940805, "uuid": "387aeb89-51fc-48d6-9052-be6a7c404460", "comment": "Malware payload (Tofsee)", "value": "0cc3469ecce6c9989c491acc306de24c0ca75d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940805, "uuid": "89913bfa-23fd-4087-af2f-20cd31dea6e4", "comment": "Malware payload (Tofsee)", "value": "a2e23a9e01d0b6b351a584b57d8d362a08532d1acf179b6a649b3cbbdd89b2360307133219beed87a683ff79c9157548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940805, "uuid": "04c31896-f604-492e-8bc4-8cd715bce300", "value": "T185748E10B7E0C834F5B722F849B9A269B93E79A26B3491CF53C416EE56346E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940805, "uuid": "718fcac7-0712-4693-bf5f-288bd8b99624", "value": "6eb8e72489447d8b01e1ba0c6688d0ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940805, "uuid": "f856f151-d25c-47fb-8d29-3fd743cd8c55", "value": "3072:+jrGy/MZiASroHlCWps6rzEtVmSvjaafXmqXnWdgxUhR+PrcrLjBbDqp7aOkHYcK:PgASroHlTps6rzgxXheQrcHdby7cWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640940805, "uuid": "a795f94b-ae77-43d8-ae1f-111ff2270e79", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640940805, "uuid": "eac90b6f-35d0-41fd-9a10-c67040d01ebb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940805, "uuid": "05b2d4e8-039a-43e7-9be7-77fac65006a8", "value": "c9bb0263f1f8bcf29205aa8c41184fe3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdb6488-6a02-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640932004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932004, "uuid": "f66daff1-9e89-4458-9382-6fb1c3061abb", "comment": "Malware payload", "value": "07f291a2e55f6b16afe630910b4288aa", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932004, "uuid": "f5590a61-e3a8-4ed3-ab82-fc8d637d65e9", "comment": "Malware payload", "value": "94a3bd842d98d78523550b8877f859562bb51278411b37ea3e725c12b7992c99", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932004, "uuid": "b834fefa-0990-41f5-a7e3-5b55bf978aa6", "comment": "Malware payload", "value": "c907154b04f9c642082bd1e157454eaf8c446161", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932004, "uuid": "eb1a5db6-13b8-4588-aa1b-42276966fa06", "comment": "Malware payload", "value": "cbb0f420938c463856b82fb4da7fbcf3f0c7457a47eb0bcd6ffd2b3922bbe97d93f4d09dac46dcb32e52cebc80a70248", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932004, "uuid": "01f4c67f-b76b-4183-9ab3-d25b168f75fb", "value": "T1B6B36C1BA649CA87E13C4770AEE74F9E3B13BD159E8722D331097B5E3FB5140891E12A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932004, "uuid": "c151818a-175f-4c39-a49a-b959ab233afc", "value": "3072:SOKpbdrHYrMue8q7QPX+5xtekEdi8/dgxhjvH6f9+H5uUyLtC76:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640932004, "uuid": "f644e953-c430-4dfd-a9e7-39719c242a51", "value": 108037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640932004, "uuid": "47fc8d47-afb2-4237-992c-8baf1785e767", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932004, "uuid": "73cf3447-2697-4bf2-a230-4be2c387fef6", "value": "recip_conf_14817.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ade8299-69e1-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1640917581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640917581, "uuid": "1d25382f-f6f6-49d5-a55b-46e888bfc849", "comment": "Malware payload (RaccoonStealer)", "value": "4c5f6c6776f158daf343d7b8fd0ec9ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640917581, "uuid": "07f03382-58de-4a79-8f3f-7aeb58a95732", "comment": "Malware payload (RaccoonStealer)", "value": "97c3fc48c8ecb71c1e9d251edd6ca458fe194efbfb297b254b354b3236963a9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640917581, "uuid": "065a7491-ae3b-42f4-b2ec-05b55e87ff60", "comment": "Malware payload (RaccoonStealer)", "value": "2f430bee0b0e06993918caa64a70f58b496dd41a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640917581, "uuid": "287c79f5-12a7-4b5a-919a-089395898bbd", "comment": "Malware payload (RaccoonStealer)", "value": "dce3a4c105d880e27e61d45de31e77547d4c9abc1a00c97d023f1e964ed980743846ad078c2e152fe3d2864ed6478a36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640917581, "uuid": "de04f53e-d497-4a09-8577-ba06e7a39966", "value": "T150D4F0E57691C972C045353044E29EA4DABFBC61DA20758B33B43B5FAFB22C05522E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640917581, "uuid": "d1872209-ea74-4f2b-9ea1-5f74f1b5dbfc", "value": "1615937a2e607eb15adb042a4174e80b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640917581, "uuid": "fddee269-c68e-41a8-8634-eae9e259731f", "value": "6144:eRYGLiMlpEg3s0vGXuUXSWsnmqW4JE+e4U5xQeA5S4XWA1nE7bHCKmd/HkdX6AHc:HGOMlpEQUSnA4JmgeAcfAHvkdKO877", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640917581, "uuid": "23a464ac-bc02-49bd-b44c-52c2722fe4e1", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640917581, "uuid": "c3b1d2da-54f1-4968-95e3-d8dc4d237d0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640917581, "uuid": "02517d63-a8d2-414a-8642-a1771d785838", "value": "4c5f6c6776f158daf343d7b8fd0ec9ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f434b3-6a53-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640966809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966809, "uuid": "5541a872-1918-476f-bc00-470afab96a38", "comment": "Malware payload", "value": "d10eecb5cc502806778888a887b81c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966809, "uuid": "1151348b-026c-4902-9655-a3c45453e9da", "comment": "Malware payload", "value": "995f60fa20fabc4943aaae2cc8c906eace61fc2d2940642c16dda037f5575e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966809, "uuid": "c2b2f676-3c0a-4629-807a-53366374d8d9", "comment": "Malware payload", "value": "46f128cb98d95fac7d88c397d032ba84e6a2d0fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640966809, "uuid": "a4aefea9-32de-4482-b73d-ad5516672cf5", "comment": "Malware payload", "value": "31ae76928b97233660645136103348d86c85d41780f396acd701a9cf23c1dd4a1484ac265ef4b7259f2e48bd1da15e3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966809, "uuid": "cc3c4f1b-3146-4fa2-9f89-0b247964bfa5", "value": "T115B44A09E6A844E5E963B239B95EC206D3B1BC1F4B61C74F03A47E6B3F336904D29716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966809, "uuid": "02b8da23-9e4f-4c53-b0ab-d49bbc97e79e", "value": "c6efe717c6d1ba1e8476234661c7c7fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966809, "uuid": "6adca821-0e7d-4355-9344-532aae802dc0", "value": "12288:DFlrb4eWr1aeMl2yxgVTpQmjJz2n9Pqu8iqRo4T:5B1SRMwyxgVFJ6n9V8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640966809, "uuid": "8d6357e9-fd31-41e0-8a60-0626cb26cb49", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640966809, "uuid": "ce13c925-d529-43b5-82df-dfa9da6c87e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640966809, "uuid": "6f47a5c6-8e38-4af2-a48e-0c2d1262bdd8", "value": "imagedisk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992b3c9a-69d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640911807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911807, "uuid": "deb56015-6c6a-4e82-866a-592cf11ec6fa", "comment": "Malware payload (Mirai)", "value": "e2ed3e7e520580ad9fb3d72df180fa38", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911807, "uuid": "f19cb4bc-6d83-424b-896e-e2aecf9b3ab8", "comment": "Malware payload (Mirai)", "value": "9ad46bce1d9e16f7c4db8a16a81fa5e2525a4f923153abe64d94f2a5c758d4d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911807, "uuid": "753a656a-9532-4a8e-a69a-c1f680fa9b03", "comment": "Malware payload (Mirai)", "value": "9098c541e637cccbe0d907d6fa0abafa732997d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911807, "uuid": "01826b5d-c14b-4579-aba3-1e52ba236510", "comment": "Malware payload (Mirai)", "value": "4c1abc4554098f0cfbc6becac46f3e0e7b416372e422ce8119af0f4cbbaa053626bb6911295bae95a72d270c239533cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911807, "uuid": "1fa0cf68-a51e-44f0-a306-c9435f17fc68", "value": "T160D30882B8819A26C6D2237BF97F548D331427E9E3DA72568C211F647BC580F0CA7F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911807, "uuid": "c6a5d132-dcb4-4768-84bf-cd0805d65b2c", "value": "3072:r1mVuGpwQBcdEwKN7bmGQd7C84U/o5JSib:5m5pwVTGQdzToy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640911807, "uuid": "ee8ab933-009f-47c6-9863-e00c6b781272", "value": 136272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640911807, "uuid": "90f42cb4-2012-4e43-943e-6621c46871b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911807, "uuid": "ce2b8b14-5d75-4f93-a9ba-67f4b281e4c5", "value": "7ega.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c9a4b9-6a31-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640952234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952234, "uuid": "855c8014-590a-4ca8-9bab-41f0e1717bcb", "comment": "Malware payload", "value": "6df2a3b5b2fd8964e57a267507a98a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952234, "uuid": "c4fbc057-95d4-4c08-9e2b-637633e18f1e", "comment": "Malware payload", "value": "9e0785461cbede89dfb962bbabf87b0cb89aee40d2f4f171fc29fa7e438d06ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952234, "uuid": "f01a572b-e0ad-49b8-ab7d-216dacd7b737", "comment": "Malware payload", "value": "481b55ceef0c66d9a784a95d655740b0f1894324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952234, "uuid": "bd901c99-2f46-4b8c-85aa-5a85ee668024", "comment": "Malware payload", "value": "ed74a82272a98794f15d8b6ebbc65816126a1e86f0756122b481b79421c32a59cc9a617451550890d854115baaad9a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952234, "uuid": "3f37aea4-0e83-4267-a258-a6c0ce29a885", "value": "T19EE53343F95F3BF8C552E433B2245068121620402EFAC8995391A7AF69C7BB54F8F7B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952234, "uuid": "233fcc69-34f4-461a-9a6b-7eca7c52cbf3", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952234, "uuid": "b3c7009c-ec68-40c2-9566-c1ca5e960eaf", "value": "49152:79qTHLl6/Z+/FrTnSTNLsdccK4QX2b1cENGl9aPQsmQi+93RDj9z:5Ar4h+TnSRc/m2baEIl9qQTQik9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640952234, "uuid": "55d6a0d5-071c-406b-8ba5-8b71a472daed", "value": 3283456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640952234, "uuid": "e10856c0-5646-4dd5-9a8d-772ac803e6d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952234, "uuid": "cd834cb2-a10c-428a-a16d-4ffe53b662fc", "value": "6df2a3b5b2fd8964e57a267507a98a02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedc8167-6a7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640985287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985287, "uuid": "9e21978d-75ec-41fd-9eff-a587681e37b6", "comment": "Malware payload", "value": "cfd2ab49e1e8b51a1746021eebdf312f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985287, "uuid": "a7501062-b516-4e46-b684-98bc6a0e3b54", "comment": "Malware payload", "value": "9e7d8737a1a630e69f669e4de8d5b05b2d1d173dfccb91cff0e5ff468ecfe99d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985287, "uuid": "396ab1b3-c416-4d5a-a057-c54b505f18f6", "comment": "Malware payload", "value": "2a22f0d6908ef544a9feadf32452481cb607bb14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985287, "uuid": "31c5a93c-2016-4760-8d66-58e1aff9172d", "comment": "Malware payload", "value": "26fedcbbd9c403e8901ae3bb45fb3f21f5d08c11d0a60e2fcc8450ebe784ac911d43b342167337eee41c4fba7e424a20", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985287, "uuid": "67aa9724-4d39-4e1e-b9fe-48769ef816a4", "value": "T1D322BFE6B6430604E378913224DDD9D59692396C209EDF07A6440E91B7064CAAA3FFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985287, "uuid": "fff207df-5f73-4b7e-a6d0-d9e18614428f", "value": "192:hB3WNKgqQ1WzhNItLzv4yB6vYVl8+IkBzwXhTpWOltZZEaBHKEA:/oKU1WFut3vUva89+IhTp/ftBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640985287, "uuid": "e1748ca5-960d-4ea3-9f64-d8ed15ab92b2", "value": 10632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640985287, "uuid": "6a6fa989-8eca-44a4-89fc-c4c30b662af2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985287, "uuid": "0ddf5e3d-e1a7-46ad-80e2-bb5b1bb68203", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63abcbb4-6a1c-11ec-9275-42010a9c0029", "comment": "Malware payload (Expiro)", "timestamp": 1640943070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943070, "uuid": "6b914c57-0e78-4cdf-be18-8ce4262307e8", "comment": "Malware payload (Expiro)", "value": "ab2ebeea801d46bab2ac75b7b9574e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943070, "uuid": "e5f6c301-2209-452f-a62b-0bb0151d02e8", "comment": "Malware payload (Expiro)", "value": "a2648c0044dd0c910d9176445c297fd3c6f457478c2a4492ab4e504566c053a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943070, "uuid": "8ee3a373-7f3d-4dac-a917-40b2f83ce82e", "comment": "Malware payload (Expiro)", "value": "a58649f0f6d60ec4a9d3d47ab783d8523881d14d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943070, "uuid": "c76743fd-9aba-47ff-a27e-f68659cf85f4", "comment": "Malware payload (Expiro)", "value": "36f09c137ff07da652e954883e0f2479b7e4a40d8cbcf57f9552bf330c256836b6d9af94a7fc84d86d488e20577df5c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943070, "uuid": "ed230e32-3136-492e-9903-52e5eade155f", "value": "T14E551262F78EC1F7D41602718979FB28401AFDB94B2105DFF3D67A2E1AB12C04636A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943070, "uuid": "c153954e-bf34-4962-9717-94a2aef3c08e", "value": "174400a01b268a209fae2074e85ffe34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943070, "uuid": "e6b64fd9-4004-4554-a106-daee2eb7b68f", "value": "12288:Uk5Hghz0DhMSUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:NeJch8sqjnhMgeiCl7G0nehbGZpbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640943070, "uuid": "50b0cbd4-d094-4c21-bd76-9b65b9ae62df", "value": 1374720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640943070, "uuid": "94165a62-d96d-437f-bf8f-8e6138f753f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943070, "uuid": "d3f96f87-d460-41f1-901e-a6f621b9c57b", "value": "ab2ebeea801d46bab2ac75b7b9574e2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12acf30b-6a04-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640932626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932626, "uuid": "bca7564c-5c0d-4c02-aaa8-3d338175fdf6", "comment": "Malware payload", "value": "6004f1fa128876bcbe91bb7ab94e3072", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932626, "uuid": "add6171c-71a9-46e9-8268-0d91ffddc9fe", "comment": "Malware payload", "value": "a3a9f15797ae3ebcf6502985a3caa3a81ffb1cdd5c67f8a42c15347571efa56a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932626, "uuid": "f4016d88-5882-4608-ad05-40708988f855", "comment": "Malware payload", "value": "c12287cf4903f5909ddf924ee8c39127a2664490", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932626, "uuid": "e9bb4350-0dcd-4dd4-9948-54e4fcb1a966", "comment": "Malware payload", "value": "bf948b777501feac5d465f5db2da748ce46d6c8940542cef59d676d051854fcd6480b5873c4a7d2e7cb1c6f9fe33ae0e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932626, "uuid": "915fdaa6-0aec-4733-910f-7eb15e3783c4", "value": "T104D2D13DEB15A834CE2A1DB9E80A157AE34E9489D727E11F2627D78FD350C130B1B56C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932626, "uuid": "7007da7d-c1c7-49f6-9b15-08ff004a6c4e", "value": "768:ei8fHkQfOQQWB+2NPxllNZf4eeT9j+3BpArIX:eiwOQvVNPBTAFIBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640932626, "uuid": "5d4e809a-cac6-4ffa-aa36-b271afa24279", "value": 29333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640932626, "uuid": "01eb714d-1543-4e83-94b1-d283a954a64d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932626, "uuid": "0f670095-6739-4d9b-8a59-d394b454ec10", "value": "Original.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0f235e-6a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640949607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949607, "uuid": "83271fa6-0e67-4973-bdac-5756ab83f8a9", "comment": "Malware payload", "value": "5c37a3698ee2e156e1be00105e9e56c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949607, "uuid": "3a5f69a2-fdc1-4b31-a734-5498b605dfae", "comment": "Malware payload", "value": "a43fb15cfdda857eb772fd0c5c206518156270ffd74a64401bb1e6e1410acbb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949607, "uuid": "9dd4736f-3435-4afc-820f-85150020b758", "comment": "Malware payload", "value": "557e13f12a6bd707d97319fb752b0423e7ee69d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949607, "uuid": "87c6e309-8b24-4cbf-bba7-f137afbfe14b", "comment": "Malware payload", "value": "b8f32ba0a0eda3f89c9587ed75bc8c1506f243ddab9aa88efb274412a0c873e71dd8fdfc48588da32b69f276cb67bd65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640949607, "uuid": "ab8e9893-151a-46ab-a67a-676a021a631e", "value": "T1E5213ECAA58A9E24FF28D5385E6057557B17DD79C68BE3CF8E048451282728CB7680A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640949607, "uuid": "ed1dc613-223c-45e5-91d3-5da5f17cbe98", "value": "24:XL8wdGtCyDQUpnVpsDQWplEIM3qnktmEFmn3GBkC7m1+NfLa3:7zdR/UpnDpWpiJ3cEFm3GB772+NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640949607, "uuid": "458b7252-7457-4b0a-afd2-d56a80ff8250", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640949607, "uuid": "3bce52d0-17df-462b-82dd-144787b0b49e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640949607, "uuid": "164f0fa5-96b2-4c07-9297-b5cb5e7f2c94", "value": "5c37a3698ee2e156e1be00105e9e56c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9307043-69df-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640917068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640917068, "uuid": "13f26e5c-59e2-4554-9d25-050c226180e7", "comment": "Malware payload", "value": "486e0b145b1380c28bf5b7b054c17f37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640917068, "uuid": "d11f7818-28f8-46d6-b0cd-d4b43b1e4195", "comment": "Malware payload", "value": "a679d2ac48b9a66c9bb0b16df6b20576cada60bf300a4da4a409d409275c3041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640917068, "uuid": "22c43c76-d88d-44ef-9aab-5dfccbf981ac", "comment": "Malware payload", "value": "d5b243e0245bdb40da775ac0790e377bfb69f114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640917068, "uuid": "bd80ff0a-9d5f-4deb-b0af-d9e9e78ebf88", "comment": "Malware payload", "value": "397643a648f35c6f2ef9244d11ae982ff221c7c641e0be94bf0728c7f6228eb75dc431c4166de373456a7b1c1e25d084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640917068, "uuid": "47dda4b2-4a9d-441a-88d8-94d61a838165", "value": "T10905122813E90F67E7B88B7D90E61381DBB5FD13E201CB4D49DA81EA444275C9DA0B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640917068, "uuid": "6b74ab34-3d5c-40ee-be21-fdb3020f02b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640917068, "uuid": "bda6fe9f-0e87-483e-82bd-5a6450ebe686", "value": "24576:aUaJF+NxHFFaKYBQM+mFlsc0JwwVhh17Iry:aUaJF4xPazCM+W/mXLh17r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640917068, "uuid": "07506f56-2bc5-448c-b36d-be05228d5050", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640917068, "uuid": "6428acfe-cad5-4efc-8606-f2f0fbfea71c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640917068, "uuid": "9084930f-40ef-44d4-b027-07d94c5b26e4", "value": "RFQ Product Inquiry Catalogue.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c73d961-6a3b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640956292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956292, "uuid": "162e2f7d-586e-491d-a108-5551b464dacc", "comment": "Malware payload (RedLineStealer)", "value": "e4118ddd922e892acb8e8c1fef49354f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956292, "uuid": "62d0fa4d-3139-435f-8bd3-4083968cdc6f", "comment": "Malware payload (RedLineStealer)", "value": "a6c03e7b69ffe6152468171e8669db1915efc0f225449dd2278f0c7e40e15ee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956292, "uuid": "cb79f6bb-16e1-410a-b87a-d088f5ce0aa5", "comment": "Malware payload (RedLineStealer)", "value": "79b8050b9dbcae58381df858a26af7c68b38d67c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956292, "uuid": "632b4b81-3f1a-4fd0-b4f2-0213127095b1", "comment": "Malware payload (RedLineStealer)", "value": "c67d11801dd1aa0a9ef4ee5c1aebb95e119e02d4501edc60192a9cb9462d1b36931e38efc8d113fb04fc2029a9e78480", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956292, "uuid": "f927aa5d-b4f7-40bd-a4d9-bd3f76dc9194", "value": "T137853331D34AD67CC06E15B87D6F8EBCB2B615D98C4871AF3C774A3A8E1D942424263B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956292, "uuid": "4ca1ef18-4e45-48b5-950a-7ae7fbb3b325", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956292, "uuid": "1912cf73-984f-42a0-8fa7-52e2b68c1121", "value": "49152:QMmKLWNT/I06726ZJRwU7yRoj+daHmvjhD0SWCtkfeNamHJu:Qf0ETQ0yzMs+daHyxlbFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640956292, "uuid": "ed3c2867-7f17-4c8a-9fc3-e0c8d6c1bb23", "value": 1787904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640956292, "uuid": "ebc473d3-a10d-4059-a142-5eb39ed4c38d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956292, "uuid": "baede9d3-e241-4610-b1e3-1183116c396c", "value": "e4118ddd922e892acb8e8c1fef49354f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063d8ddc-6a2f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640951074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640951074, "uuid": "f5ad1139-2f95-4cb5-b51b-7210bb3ddb74", "comment": "Malware payload", "value": "dbd6c8062b457783d3fa6358013aa962", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640951074, "uuid": "ef53459b-53e0-4e4f-a58f-c5c547d8ad2c", "comment": "Malware payload", "value": "ac6e923a1eaa98d99933693c8207ba24815da2001bb19058d0338da7990e1327", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640951074, "uuid": "876bdb60-8e2b-4f55-9e5c-06e13f1f740d", "comment": "Malware payload", "value": "e9c5a9b10f80059c25ab953cc3534db559fc9e61", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640951074, "uuid": "e6277a51-7c5a-4f1b-b532-31a2dcbd04b3", "comment": "Malware payload", "value": "cd039a34a023adb2bd46601966c9660740413676299e52e67660706c82a4900dac3cb04c3e241a3563a6ff8e2a0d7fdf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640951074, "uuid": "3a2b809e-3d3d-4a57-a434-f61fab84219a", "value": "T19CB4CF02F582D0B7E96F0070292D97BA093D79605B1849EBE7C85D3F4EB05E19E34F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640951074, "uuid": "a8167690-a496-4282-8d51-3776899d3d78", "value": "12288:74UuFuNB2bvR0Iva6qREvKMHBM8i/Da7VpxmIr:7riuNsVC6qss/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640951074, "uuid": "8d643448-35c4-49af-8e32-dba376dea789", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640951074, "uuid": "64dfc38d-279b-442c-bea3-95b491e5177a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640951074, "uuid": "fcb453ce-f855-479b-8f8e-2b6c2951b00f", "value": "emotet_exe_e4_66bdbe2874e9307f2fada42dbeba87ed4197f9f6bbb606ec1a23e249ab92856a_2021-12-31__114429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae7e51e-6a31-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640952209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952209, "uuid": "b9adcd2d-86e9-4a57-ac75-402940930ec0", "comment": "Malware payload (RedLineStealer)", "value": "1f56ff99bb8d40828c490c0c45371652", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952209, "uuid": "0a33fcfe-3100-4923-89af-c7cca512ef23", "comment": "Malware payload (RedLineStealer)", "value": "ade44175f9769fe9eb39588ce0d33707f75ea44ea15cb1e7823ff49725ac24aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952209, "uuid": "c8f00f9c-0d2d-4c08-b26c-fb6d872457e6", "comment": "Malware payload (RedLineStealer)", "value": "81b8d0f895e14b4dbe75a8180ae8586b07632dd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952209, "uuid": "c835f70c-08ac-4807-94fa-385ed9c118e9", "comment": "Malware payload (RedLineStealer)", "value": "d31433b0c882e3405551f3dfdce0a41b4808b89f574b270d2e32b008e14d292af93d085f0604f3b2b0a3ec974acb2c82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952209, "uuid": "c45d3e3f-d448-4f09-b7d5-f5453578e502", "value": "T11C16338D61A8FC5BEB5E557982C9EB8C038B20BC96527D0B879D9F16EF0C014183F5E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952209, "uuid": "2c866636-f08c-4ed1-a16f-bd2616cccb6b", "value": "9a4258c5d218cf6e5c500e8415d5f5ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952209, "uuid": "c229c150-5100-4fe5-b7df-dd083dc518b0", "value": "98304:QsAOzs0LwZ2LFAszbiduH6pk5hvkAfqLA2psdhFGh:dI0L2kAszbioH6k5h8kqLLwTGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640952209, "uuid": "cd7a3a39-40b4-4c46-bb85-bd06f2f42400", "value": 4398592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640952209, "uuid": "2497c7ab-ca92-44f5-9295-90452b357241", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952209, "uuid": "be04934c-1e9d-448d-8b1c-774cd91900e0", "value": "1f56ff99bb8d40828c490c0c45371652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017ded35-69d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640910264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910264, "uuid": "2e513d85-7db2-463b-811a-571f69c6b2cd", "comment": "Malware payload (Gafgyt)", "value": "7ad0a7cf04b9ad7c176a40ceae7a707a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910264, "uuid": "838f3c14-e19b-4abc-984c-8565fa7d2dbd", "comment": "Malware payload (Gafgyt)", "value": "aec8d7ee04c4d4594d5d31c074974bb2b36d2b120777b6345bc5ee9d667c0f36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910264, "uuid": "8bf4be84-6307-40e7-af50-d61b614e62f0", "comment": "Malware payload (Gafgyt)", "value": "8d93a13ab19805571b449195d625c1b9b4ff2102", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910264, "uuid": "badfb168-2ff2-4f7f-8e27-abf4c4324114", "comment": "Malware payload (Gafgyt)", "value": "55517fb0bb0fbff9e247194c5da2fd7cda4bd68010330f9296879355ef273c45a0fb03d78bc56925d78506fe8ec9022b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910264, "uuid": "e7f4c5c3-ae59-4ae6-96b9-5bb91f0d598b", "value": "T193B308277B274E63C0CA157112E30332A7B5DF4938BA5387A9A07DAC6F37A8434167D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910264, "uuid": "fa89a906-486e-4b09-8a52-44d918d2c314", "value": "3072:YuHrTHNPDeJeX2gRLhpmm/N5bNs1n29NH:YuHvlDHt/mm/N5bNs1n29NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910264, "uuid": "af22b41a-428f-4550-9cbb-ba8627ab8085", "value": 109920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910264, "uuid": "3a0b575d-c33c-4820-b593-d62f54985d59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910264, "uuid": "42a34332-52a6-44b5-964a-7590a2f31f64", "value": "7ad0a7cf04b9ad7c176a40ceae7a707a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0296951c-6a68-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640975549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975549, "uuid": "51bb6a1c-2670-4781-907f-538ba6a748cf", "comment": "Malware payload", "value": "b0e4b4595cd71510c3670556d16a83a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975549, "uuid": "375664b1-a0f0-4056-82b1-5e0a44691798", "comment": "Malware payload", "value": "b099b966cf59ae34f72150d3b49143a27c62decd8eb4d4ac38b86a85be78fb8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975549, "uuid": "58200654-d27b-4518-8105-25613f017bb3", "comment": "Malware payload", "value": "de39e0cdb7a44e5267549acf25824da4f744f7e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640975549, "uuid": "10c717e3-46c4-473d-b357-e351f7671a31", "comment": "Malware payload", "value": "65c200ac2d5c65b380db5549d48ad5d44e45e008c4e5fce2f3e3bc9f1e2e56bd6c1945cc6c1d429110c3509f157bc80c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975549, "uuid": "a858c58e-5cac-40c7-b49b-5b007a93be82", "value": "T1F455337DB39AEF3FC04D55752272274EA1801B32D3EAB71171AB87C2F52604BE902979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975549, "uuid": "b0ff177a-5177-4a4a-8587-eaa55d83fb9b", "value": "f6af73011d9ad7cbccf66eb190442910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975549, "uuid": "a8470197-44e9-4f57-813c-8e55544ff41d", "value": "24576:Iu8gz2Kw4+CcfFq7ctIAQA3KI6YOa6K0ovGAImbFGs7bZkEaHNYK3dG8A9L:IqiK5+RfKwKbYF6K08Im7XZNapA9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640975549, "uuid": "7514f920-e98c-4979-87b1-cb64cc7c165b", "value": 1379328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640975549, "uuid": "44b8692c-924e-49c1-830d-6712fb18cbbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640975549, "uuid": "9368923c-36f3-4c49-8712-73948deab149", "value": "b0e4b4595cd71510c3670556d16a83a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c809188-69d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1640910282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910282, "uuid": "e8c7def8-fa25-4ed2-994b-ee21f112d4eb", "comment": "Malware payload (Gafgyt)", "value": "00b1e4147898bbb7a2de06357b2e8806", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910282, "uuid": "ee0a1f15-0ca1-4cf2-8fb7-1553498afa19", "comment": "Malware payload (Gafgyt)", "value": "b10259fa34bf8c8311eea4240a881195a553b085ccc3342d4a25d450cdf2042d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910282, "uuid": "55b2bf65-ac79-4531-83fd-7b25350f3e23", "comment": "Malware payload (Gafgyt)", "value": "fa052263851da30805601d3ea06887ac30cbd395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910282, "uuid": "6458ed0f-15aa-4381-a18c-ebbd804f6359", "comment": "Malware payload (Gafgyt)", "value": "b2a0b9ca5e36aa47ab9e5ffb694f6915d65350f7a81a84cff37975718addfa870e4a2366599e868cb5daaa9e21285ea2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910282, "uuid": "48688479-ebff-48cc-9a9b-62752a003e83", "value": "T1F4931943A8A19FB7C146AEB566774E640753BC512F4B1B89712CBAF4033B5CDB80EB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910282, "uuid": "869b7c43-0d90-4a82-958e-11f0425fad4a", "value": "1536:UTvqUqYpUSYXcKdQX6iAJmvQU2v0CsoqEEmK4Npbsizfn61NH:UTCxYpUFXDdeAJmU0yq5mHNpbscfn61h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910282, "uuid": "ae9951d2-5697-4ea7-a2b9-e408aabc0ceb", "value": 91601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910282, "uuid": "c5b9227c-97c7-4244-bc13-f876bb0b4891", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910282, "uuid": "903c3643-7ab7-4269-9276-7bf15fb722ab", "value": "00b1e4147898bbb7a2de06357b2e8806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd4db16-6a18-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640941205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640941205, "uuid": "0245faa9-e57c-4457-ac79-d2e61e4c21f7", "comment": "Malware payload", "value": "3c56ae7ab3b439f62cf6bf82e284224f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640941205, "uuid": "9def2a3b-281e-441c-9fc6-5a723d02abf9", "comment": "Malware payload", "value": "b1827df76b0f86d044b89849f4c5f24e3afab9bccd4bbc66cbcb63d8671da2ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640941205, "uuid": "38ab657f-6341-4e39-96f7-8fee3442aaf4", "comment": "Malware payload", "value": "85cf8fa00fc44e28444e6e6801143b4dc695b7e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640941205, "uuid": "6d5d24c9-0da9-4aac-8449-c4989f4da4a2", "comment": "Malware payload", "value": "732f60d5feb747c419b1a2beacb782c6fb42752af3bdae2ffd45e58262373b5ef392e1d1c8d3a7a2eec6a4b36db471c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640941205, "uuid": "da94a978-9c47-4c55-b3f3-3ea023aab966", "value": "T1C8B53381B396A0769CB7624D1A85A47A39F57BE8F17D9E475CC003C2014B228BF5DBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640941205, "uuid": "0bb94b4a-60de-47be-a1d8-715037132562", "value": "49152:q1XHxnnkot7KjX0aKgxC2Iqy7/W5u5+OYyhV5TQdqBHFRX9KBnxIffVLn:q13V3a0rqRIZ+wrvNoGRtKzIVLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640941205, "uuid": "fcdc32e8-6fe8-44a9-b535-d6f49c2fe100", "value": 2420736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640941205, "uuid": "fd387321-437f-4a1f-be7e-0d33508fa785", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640941205, "uuid": "55934356-6708-4bc4-a4a3-4daec14ee7c4", "value": "b1827df76b0f86d044b89849f4c5f24e3afab9bccd4bbc66cbcb63d8671da2ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5cb177-6a23-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1640946282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946282, "uuid": "4dda6347-2e04-45c5-9f68-7431e73b4295", "comment": "Malware payload (RemcosRAT)", "value": "971f5f0675e8eb11b18475c1cc7b6156", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946282, "uuid": "0cae466e-a2b2-4019-9550-3503c54d1db5", "comment": "Malware payload (RemcosRAT)", "value": "b2e4a9f5900fa31bd7daee73fbad3b1e44fa35a75adc768a6f2236d1a8fa400d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946282, "uuid": "dc244e6f-239c-4ef6-8129-e0a8d494a4ae", "comment": "Malware payload (RemcosRAT)", "value": "be747a719af6d6be0c03e28977b0823bf23ee6eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946282, "uuid": "4ef04600-3e05-46a6-9d5a-f104ad7e3167", "comment": "Malware payload (RemcosRAT)", "value": "4f4b984e16b70353cc5a4461360b6f676c29943271519cc4093b456032253a50149d0c0370887f3cfbcfa5f5d762cc58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946282, "uuid": "adea141a-719c-4aa6-a815-a9cca81d2e60", "value": "T123A41266773C1E6FCE2D56F44260A5884BF800632053F3EC5EF9A8D622C6BD80592B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946282, "uuid": "e73c81f9-cbca-41bc-bdee-3c97f86fd784", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946282, "uuid": "00d38c6d-1c5a-4117-bb9c-1eeae8ff130f", "value": "12288:1XkigoRXdOhTfoQhEX6BMotVAhiaNgdQWguVcTF3:aigCqfoQeX6v/aNgdQFuVct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640946282, "uuid": "940ab501-814a-4cc7-a5e8-8a4a60ae8974", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640946282, "uuid": "ca041cdb-b8c1-4c3a-a57e-bc2f9c377d9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946282, "uuid": "37ba06d6-9b86-4708-9dc5-9866a43221f7", "value": "971f5f0675e8eb11b18475c1cc7b6156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce239376-69cf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910177, "uuid": "7386e269-2963-4365-8618-df11e5a46402", "comment": "Malware payload", "value": "76e1f497471e72193de3f68177fc88a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910177, "uuid": "ab855b20-55a5-4255-8c0d-f0cb003ce10c", "comment": "Malware payload", "value": "b56e1e5cc08cf19796517afaf632a7e2163fba50e9aac785f27633702f3baa43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910177, "uuid": "2543b286-d62c-4f9f-b530-5825908521d8", "comment": "Malware payload", "value": "7e9070e9a8e08e02be02abc72c024549064cf5ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910177, "uuid": "b58da3cc-0f05-426e-b028-f3e878038193", "comment": "Malware payload", "value": "9e5d44546484cf19c799020b9301e0c67b665153e757c2c5d3bc33f7a83bd7b4b3590ebedf7b075dff626010c59f6b71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910177, "uuid": "9329e2d7-2d7f-4d3a-82ae-57f3b046d180", "value": "T1AE03F2B3DA8ADBA2D2700D32176C4C0F731A58919E8F75E63A314D6651C58863DFEF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910177, "uuid": "6344ce4a-0256-420d-96b3-38cbbf2f069a", "value": "768:9ND3m8JfRabCy1RdnehPXoh4PEHFJYqLyi33UHwuNtO/IoYksUmfg+9:9ND3BjPy1jnepYuP6FOAH2Ns/IoYkPmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910177, "uuid": "52c10c4b-a085-47b4-af52-16bd60bd9ee3", "value": 39032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910177, "uuid": "b30a6d1d-e572-48c7-b782-b33571a2dc9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910177, "uuid": "9aceb637-d30c-4885-8bff-41fbf87aa29b", "value": "76e1f497471e72193de3f68177fc88a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07d0102-6a03-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1640932515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932515, "uuid": "6262d746-2c37-480f-a113-05d32fdea706", "comment": "Malware payload (Dridex)", "value": "a24919ea7bfce78d50511bac92771d3d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932515, "uuid": "8fe5da55-4813-473e-a05b-5d5a441ebd56", "comment": "Malware payload (Dridex)", "value": "b608e81d6c6a42e1c2f39b484697362ca1a1835b3a13ed878a350841aa9806ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932515, "uuid": "a0101b3c-8858-4a22-b984-80062804ea8a", "comment": "Malware payload (Dridex)", "value": "7d69da083289909d3a440989aa63c8a24ca78bec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932515, "uuid": "1c6c71f7-b654-43a8-a6ff-8ea7be3fc9fe", "comment": "Malware payload (Dridex)", "value": "877f81d3ab0cf3a960a63f8476dd27781d9e5664d03ec9852561365185290e6d943a0e71d82c75ae8dceda3379bccb32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932515, "uuid": "8dff3c66-ade6-436e-9026-a9f4ad3e3633", "value": "T16FE48B29FCE50FB7D80AB4B80097C665327CE4D53B15D9736B804265F928F316A9B81E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932515, "uuid": "4ba65836-bfeb-4705-b62d-b663592055a6", "value": "63ce49b1645eb1a9eea5e13edd6aa00f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932515, "uuid": "95e99796-094c-4afe-b01b-3fc1565ec544", "value": "6144:6oZ0CO9gNUkcYQySZi6GZf3wfWaLaYefOG2uttS6JIhNuttS6JIhz:fZ0tuQ0DZf3wcFVtrJIYtrJId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640932515, "uuid": "832b79ff-4e2b-44b3-8b9c-d0fe48c235d5", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640932515, "uuid": "6e0ff4d8-88af-49c2-b190-8b3647a0f0e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932515, "uuid": "d0b5fda0-e058-409f-b8a6-183b8b52082f", "value": "a24919ea7bfce78d50511bac92771d3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17d36e6-6a31-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640952220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952220, "uuid": "75e9995e-3709-46f4-bff1-fc4e91696bca", "comment": "Malware payload (RedLineStealer)", "value": "a06785863a6ff50fdab700d071ba18f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952220, "uuid": "c885e1a4-82c7-4750-9525-92d6f98be1db", "comment": "Malware payload (RedLineStealer)", "value": "bba80a33ec8cc3e9673a45ba08c72957b56e700846c55058e112b1d8b0fc1c62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952220, "uuid": "688f6924-6ac4-443a-846c-626b50298a8b", "comment": "Malware payload (RedLineStealer)", "value": "c178ee63207f405ab55fbfb5332311d5810762b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640952220, "uuid": "9c7d8135-8ec0-4bb0-9dc7-436ed9e176eb", "comment": "Malware payload (RedLineStealer)", "value": "2df49378b7315eaec5c4bb8e7eddd6c844f41bcdcfa74d47106bd18cd4f48ad36154fd2301db9ab799802a6de86674ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952220, "uuid": "fed65e7b-6652-4da3-b16f-03619d148d48", "value": "T140B423EF57848E06D2CF5778A8686FDD855C3C0DFFB93043A2B466976E471082A6C1B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952220, "uuid": "796a357b-4564-4435-9d6a-7ab7a6b56778", "value": "f6af73011d9ad7cbccf66eb190442910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952220, "uuid": "18dc5578-e2ae-4f5b-baa9-5fdea2fcee8c", "value": "12288:G5e5n9ScbfHZEw8QKQS03ULaHNqrxlKIQNo1TC+K5DyoxjFr:VZ37mRkEaHNYK3P+K5Dyox5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640952220, "uuid": "f0089cff-f6b1-4cc4-a10c-d8cf9d61e2a3", "value": 534384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640952220, "uuid": "ed750bfd-6a46-4234-b240-1a7daea21ddb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640952220, "uuid": "a1b01d2b-41d6-4b1e-8ccb-c6727ee4b6a0", "value": "a06785863a6ff50fdab700d071ba18f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c9ef70-6a2b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640949617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949617, "uuid": "e34c30ad-2113-4498-a61a-d3b6caf0fa38", "comment": "Malware payload (Mirai)", "value": "308bc2aeb0e1905b7126b9236c2138d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949617, "uuid": "99f924b1-d3fb-4127-9b02-9a189ddddc39", "comment": "Malware payload (Mirai)", "value": "bbaa5a7c0ac147b8f675d1aab049dee793dfdc0ea95a2d5eebc38c92a43d334f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949617, "uuid": "5be1bb2a-d665-4a46-aced-ef02017589b7", "comment": "Malware payload (Mirai)", "value": "08ef9460989912297cfff28dbb1860f5bf0392f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640949617, "uuid": "88f6f187-28db-44b7-9f38-7d91557d8b0b", "comment": "Malware payload (Mirai)", "value": "d3453b6663245e621d77b4c0b2dbc18f2b5149210b61ed23db461a10503234a1443d999610eed82fd987ac96dff5b861", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640949617, "uuid": "013a15a9-9037-4e18-8dcc-6d4dcc6cfc3b", "value": "T1DFE2F112B7924DB2DA626079F22B8183F701B2FC60E9745A771E14BF5C979CB8368433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640949617, "uuid": "a2f9cb05-8688-449d-892c-4a5ef647cbdf", "value": "768:yl5QhoyKCH0gJInRjCyNvN7LFcsUAvkbMnEnKuyEq3UI8:hbRJwJnN7JvUAvkpnKuyr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640949617, "uuid": "39b642cc-754f-446b-a4d6-da774817d670", "value": 33564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640949617, "uuid": "cef92232-8fa9-48de-891d-22f20b84ecbf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640949617, "uuid": "3e0e6c5b-a326-4d4d-8eb4-6cced1133d76", "value": "308bc2aeb0e1905b7126b9236c2138d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e42ae3-6a29-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1640948706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948706, "uuid": "6d2ce77c-961e-4092-ba76-6cfb6f597ef0", "comment": "Malware payload (IcedID)", "value": "6c877ccd6366293e8899c17dee0fd743", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948706, "uuid": "c8b441a6-72ed-463b-b808-bfa3dc521fdb", "comment": "Malware payload (IcedID)", "value": "be8e3a4d3c081e05222a72cad891c8d8fb587f5cc1df7fd29e4522a1d0979739", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948706, "uuid": "2904fef0-c09f-4852-a967-9ba321aad260", "comment": "Malware payload (IcedID)", "value": "0dd91a8200800b129503762539a1791950f21167", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948706, "uuid": "aeb6f23c-e835-4f3a-bab2-c67a07184bae", "comment": "Malware payload (IcedID)", "value": "7b0f03e6a43f2666633105fe338f5f179699dafa30e8de23f0a09cd84c1c35e23fabf3072c46c43fe678d793b0736185", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640948706, "uuid": "9c988584-9a95-4743-bfb8-49a71ffd6304", "value": "T14A731944739ACB4BD11020B84C49D2D13A88BC446893F2FB76967F3DF97EE68B506722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640948706, "uuid": "8613c872-4f39-438d-a012-9210c6ec6a32", "value": "768:N/MMMSxMxuPMMc1GFZIdJ6jtQlQNBOTHxPIz/tZjTEQMf6eNdRsqMVksDbxDzZM1:HIdPhW/jTEQMiebls56Lkd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640948706, "uuid": "4bf2aab3-5415-4015-8e19-570af29103e9", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640948706, "uuid": "f201e803-c899-4fd5-93d5-1313bba20f95", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640948706, "uuid": "894390e8-8bae-46f4-89dd-bb003c0091f7", "value": "details.12.22.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3dcb3ee-6a6a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640976705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640976705, "uuid": "3971457f-30aa-4928-9e25-9fc56cce16cf", "comment": "Malware payload", "value": "f6b589c57ed54d122c17eace179999e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640976705, "uuid": "a469a434-0a68-4cdc-a0aa-c7cb6218dfda", "comment": "Malware payload", "value": "becbc1b05321dc51b2e50fcbb6c2be8da96c2648bebc11638701a69f22b226d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640976705, "uuid": "b0b32187-3df1-49f0-b962-855293731f17", "comment": "Malware payload", "value": "712c69f3b4c46d3909f7251b9d2ad7675b00fccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640976705, "uuid": "14da603f-9071-4a4a-9b20-47c8c84873aa", "comment": "Malware payload", "value": "47319364e9b30e5ee85752047b71c4539beda35b1900e2dba82cdd44acc353dd556bce5eeb937063929ae4e55d5383cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640976705, "uuid": "e39f795f-2252-4436-873a-5a2f2fcbbf63", "value": "T11E146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640976705, "uuid": "c6282c5a-3e92-43d7-8c83-1ca9e5ad4d13", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640976705, "uuid": "e1e1944c-d88b-4e5a-95a4-95ff1e61e42a", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIN1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNY1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640976705, "uuid": "509a5382-9981-448c-8f1f-72ed5c4ee027", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640976705, "uuid": "490e2c78-84b4-4d77-803c-fa38de457eb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640976705, "uuid": "9e25752d-b6d0-4c37-8a1b-c1d18daa6971", "value": "becbc1b05321dc51b2e50fcbb6c2be8da96c2648bebc11638701a69f22b226d8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4deb7d-69cf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640910233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910233, "uuid": "acd75321-44d9-47c4-9d1c-408898799eef", "comment": "Malware payload", "value": "a96619f3d71d3eb20af2c719107a18b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910233, "uuid": "cb31a6a0-76c5-4c6f-90ec-1d0ef1f50b89", "comment": "Malware payload", "value": "c0d4c40cdc47b9f418e795d428ea7eff0da891d6670a8361fb2427fe76bca5fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910233, "uuid": "3c223531-221e-42e0-a950-d2f718f09a02", "comment": "Malware payload", "value": "3d8a4185dbe4a9c88a73fb52bc4b3544ebb2e1b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640910233, "uuid": "e69fa58d-97f2-4c04-8919-e624ca653917", "comment": "Malware payload", "value": "14b53f62ca57a61f37422284d95e3cc261345cfb22fbadea8cc72d46bfc2d96485c8cb7e636c5b09fdd9fbb4d3ef142f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910233, "uuid": "3aebaa27-2366-4e72-adb8-5158b029f8f5", "value": "T14003F1E3A4948269E07E59753CBE770388767009536536F8DFCC7936CA36F0D2E12298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910233, "uuid": "fc00a84b-23e4-4e3a-ac42-7ddcf228fd5a", "value": "768:PwTv2Y53dcoK55TAaS9rmSM6tGoDvOfAFwXC2oyJnbcuyD7UryqL8OAfnBY1KkQL:4Tv263I5caS9rmit9DvOkwyWnouy8mqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640910233, "uuid": "0e620672-68aa-44c8-a2cc-9f872a0726cf", "value": 38704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640910233, "uuid": "d923c909-fea7-4928-b2eb-b144f5c966f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640910233, "uuid": "e8730e95-ef13-48f6-b298-e321e0d57c45", "value": "a96619f3d71d3eb20af2c719107a18b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f2935a-6a3b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640956281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956281, "uuid": "52dcf2a7-848e-465d-9d44-5fa172c97dc5", "comment": "Malware payload (RedLineStealer)", "value": "53f2cd5f3b487f99af27073dc9cfbdc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956281, "uuid": "8f3724e3-2b47-4051-800a-88ab6971d398", "comment": "Malware payload (RedLineStealer)", "value": "c3ce14cd6129b778bf9aeb26799fa3387e122cede177d2b85f85fea9af5ff6cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956281, "uuid": "7d367eb3-9858-4cfb-809f-d909e068b798", "comment": "Malware payload (RedLineStealer)", "value": "14146a72421c8159a3eeca2ad08290e18a4912b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956281, "uuid": "3c0429d6-6c8a-48d5-8f0c-b4f627e7efe3", "comment": "Malware payload (RedLineStealer)", "value": "647344139edeb5b05c80ea52ea663a7cb815860956ffdc20bc72ee46b9fa0d4cfe8d82d9baafcd244a0b2bd771d4ad0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956281, "uuid": "1a4f7cdb-3e7b-49f2-8fee-95613b3a7994", "value": "T188F533B8DB338E6EF0FCB5F125A7144263F5B811BDD00071851AF94FAFEA05AB819649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956281, "uuid": "80cd7358-46ac-451d-a7f5-5339cdf15578", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956281, "uuid": "2260445d-5f9a-4543-a61d-b7906b417b6f", "value": "98304:aUW38BZy6c4IvoEz3gk2vpbVlwGlU3BkOPQE:ZWMBMrFvoph0GlURkOPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640956281, "uuid": "d42dcaf6-8176-4b6e-b972-f9e0d13f5e25", "value": 3626496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640956281, "uuid": "09c1e5a9-f204-4f7a-85f7-c1bfa6b6ebca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956281, "uuid": "21f4ad0c-ad9f-467f-8ab1-d277cfbecb4b", "value": "53f2cd5f3b487f99af27073dc9cfbdc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046e11d9-6a3f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640957943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957943, "uuid": "f50ea5a7-5236-4e0f-9252-7d4df3e9ad83", "comment": "Malware payload (RedLineStealer)", "value": "9589c93c73bb3529f9ba711a27998fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957943, "uuid": "e5453a92-e9ec-4c36-9c1b-7cba2321e4b1", "comment": "Malware payload (RedLineStealer)", "value": "c4f35392a0fc133f2607176175e370673855e25ae8ea1814b705289d3b00f978", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957943, "uuid": "725c905c-cdcb-449e-baee-0c25bd6ccbab", "comment": "Malware payload (RedLineStealer)", "value": "d5536307d1e5861bbdef3f36a7d012cdeaffb5a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957943, "uuid": "2ad77c64-84e2-4f98-b6b8-9578893fab2a", "comment": "Malware payload (RedLineStealer)", "value": "9011881db1a09d9ff1659dde12a8c4cd79b7a5f4801f9445f17e8a1b47e0f5d5a37c929e5e39b160dbda7cfc23d2a30c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957943, "uuid": "4145bcc5-f103-41af-8eb0-92e27fa13b57", "value": "T14D6533A944D1BD2FD749B5BDE41B6D6F4904342883D438C1923F379F6AC8176AA830EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957943, "uuid": "609559a6-f1eb-4696-aefa-b5b7f72fa135", "value": "f6af73011d9ad7cbccf66eb190442910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957943, "uuid": "e372e08d-6a25-44a0-8294-1606278b1c3e", "value": "24576:sE9/HxpgaqxonW5L4gHQzzxfitKZ/NLV7XDBP9hXiAN3D2XklPD3BJkEaHNYK34y:sI/Hfqx9sgHizYtuFFzBlhXJ3D2XklP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640957943, "uuid": "a4b3b6bd-a6f7-4077-a5a6-ccf2635d56f1", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640957943, "uuid": "880e3b78-9f03-48c9-b4f2-60336d085672", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957943, "uuid": "51b435c1-eba3-44d5-9274-f2906ab37721", "value": "9589c93c73bb3529f9ba711a27998fd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fffa2f5-6a3f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640957962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957962, "uuid": "9d615536-bab9-4597-ac64-dbc6db22f775", "comment": "Malware payload", "value": "97f44812ae718297224f44dbfa7b40fb", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957962, "uuid": "83da5479-4b59-4198-ba0e-f3716cbc8fe5", "comment": "Malware payload", "value": "c7042abbb28ecd4c08425162570e459bf03aa0a2dc0e23a04024a5ec78a2052b", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957962, "uuid": "cc1f6506-de81-48cd-bd66-0b1decc85a14", "comment": "Malware payload", "value": "c647231c75e310ce07ac44024cdf71aa314db5ca", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957962, "uuid": "75e418f5-fcb2-4a05-898d-b2765d8fc8a8", "comment": "Malware payload", "value": "72d88a60e1ed558fd0b6e541b59fb73c1c79a7e1e854407d86d0d239af776f23a0e0fabfc76e5d3f02711c97c0ffa68d", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957962, "uuid": "a259fc79-5864-47c1-bb3a-415a2b62767c", "value": "T1F004DF917281C845CA9803360EE2D69A3B63FD549EBB474B3465F31E6EB7790CD0262B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957962, "uuid": "edb67565-f42c-46b7-aad2-119650d42ccb", "value": "3072:xXZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAEi4VYhP7QSuFDxEVbuHsQn2KsO37KDs:pZ+RwPONXoRjDhIcp0fDlavx+W26nAJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640957962, "uuid": "101684dc-9e75-478e-ab5d-316201dc2067", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640957962, "uuid": "6617d63e-478e-4381-8ec0-cb60ce66d8ab", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957962, "uuid": "badcf404-d301-46df-9964-edb6f52fdf75", "value": "Pago.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e571bb-6a16-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1640940337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940337, "uuid": "cf58b8e6-0e06-49d4-b708-c7fd48a1cd7d", "comment": "Malware payload (DCRat)", "value": "a9a0d794210461e5555c097a68bd73ad", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940337, "uuid": "76c68fd4-7370-4714-8fc1-06b2d5ab3e27", "comment": "Malware payload (DCRat)", "value": "c71439ec2f01c3e2a79ee3c88f0d7bd905b8be3b0de1cebe587500149c23a0a3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940337, "uuid": "af4214fb-dfb5-44bd-8f56-9f5ee847a093", "comment": "Malware payload (DCRat)", "value": "6bd61eedf82768a0457f65dfbf39ffe9471e9368", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640940337, "uuid": "742caa20-1d08-4eb1-b94e-9c1088fee43f", "comment": "Malware payload (DCRat)", "value": "31c57cf13da3d63fa7ef35c1627303522c1664947d7de4f46e0d7f03ada467457e17cdd703cdff81735cdc7a0249aeaf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940337, "uuid": "e494e26a-37ea-4fd6-9a8d-919ee3fe4291", "value": "T1F8C5CE037E4CD902D0696677C9EF801447A8EE427B63DB1A7E9E339D65423A72C0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940337, "uuid": "abf8171c-bc85-471c-b70d-19f55655b166", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940337, "uuid": "5d43cf9d-8b8b-44dc-8266-84ace5473c6f", "value": "49152:WeYU+63hq4Peal7Ry49F182eQQQnEHPcFdAkg6:5YU+m8B49Y2lEUM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640940337, "uuid": "06dab4c6-ef97-469f-865b-3402fd1cfa86", "value": 2586624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640940337, "uuid": "72b329fc-06fc-4563-82e3-7bd9f5483e7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640940337, "uuid": "55e9ed11-d534-4a11-a885-de48649f7123", "value": "a9a0d794210461e5555c097a68bd73ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb8e794-69dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640916005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916005, "uuid": "7cb85e95-d9b7-4d86-9ccd-f891b0855230", "comment": "Malware payload (Mirai)", "value": "3b65456c3b53eca875761469e2e13d7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916005, "uuid": "4d957a89-24c2-4932-a2c3-188a55a9fd84", "comment": "Malware payload (Mirai)", "value": "cb690ab279f2f4ae9243a94d1a837e349bb0ebd4c1d14e796c02c43a7d5cab92", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916005, "uuid": "9886800f-958d-4944-b5e9-7c8af2ac2bf8", "comment": "Malware payload (Mirai)", "value": "295926f19344b2f0f2185231910afd59271863df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640916005, "uuid": "e9b0c297-7025-4543-a5f6-1fe1b8fafba8", "comment": "Malware payload (Mirai)", "value": "74b6fd6ed032111e98fce6fa575db036a81687e78dcd54babd2b9dc7b233269ce44ff24bddda6be1f99a92655539cf6b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916005, "uuid": "b5623cd4-3176-4951-99be-add71f600660", "value": "T13263022A25920E5318A85F714BB6294C6D092AFD284F30DE305BC1FCDDDDA8785EFD4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916005, "uuid": "9a8e0430-6758-4f6d-828f-cc12830fbb22", "value": "1536:0OF4cbtEENCVmTqrKWHaOxnxLssCEhi0cMWj6:0OFNbtEEgVmTEH62xL3CDnM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640916005, "uuid": "b6eafbe0-7ef8-40f5-a008-955fb524d19c", "value": 70900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640916005, "uuid": "af3da1d8-7a5c-4fcd-9c69-d05c1ad9091f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640916005, "uuid": "a2ae4210-faa5-4615-b977-e6361e0f0022", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf982f02-6a19-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640941963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640941963, "uuid": "b5c71036-f579-4fa6-8c51-e06606e77555", "comment": "Malware payload (RedLineStealer)", "value": "32169c42d576e7bb79261d69338c4058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640941963, "uuid": "cb868110-2867-4965-b5a8-e194acf841a6", "comment": "Malware payload (RedLineStealer)", "value": "cbd2e4d355d89e4ee867270ff57a6602d33cfed8eaab417e63ee0ba25d788abc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640941963, "uuid": "3df9ec82-4ab1-4e4b-9f40-cf555131e1b9", "comment": "Malware payload (RedLineStealer)", "value": "2f7d5361bed4c870e4bdf49e939c3a445073ff34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640941963, "uuid": "8319d0c8-5802-4bf9-a59e-554edad0d0c4", "comment": "Malware payload (RedLineStealer)", "value": "b99562811162614aba7cc4bd66f404807f32aa73885eb07fda7161ed50f7d233cee397997836d252115766842206904c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640941963, "uuid": "5b1ce62e-9975-4c51-8faa-c0d545592764", "value": "T11A8533BED0549EE4E02E39F3F20FA94DD191A7571EEFF22C4177A4941288663B1127B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640941963, "uuid": "276081ab-41ba-4676-9e89-3c8d56934fc8", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640941963, "uuid": "ae654c5c-66fa-45d4-9f3c-da02370c27da", "value": "24576:rnVBDAHr9odQUeSS1q8GYWGSCMlKkCVRWkv9cmfLH+2VaXMC0oUkEaHNYK30iypw:rnbMHbU1FfCMe3W3ma2Vs0bNaCisb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640941963, "uuid": "3d6d3163-bb01-4f15-ab0f-75e4e61c60d1", "value": 1740496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640941963, "uuid": "bf695253-6263-4e36-862b-5357f2c2dc02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640941963, "uuid": "9431c737-7439-4536-84a6-761fee0d7e46", "value": "cbd2e4d355d89e4ee867270ff57a6602d33cfed8eaab417e63ee0ba25d788abc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f0ff24-6a58-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640968943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640968943, "uuid": "f9395352-0493-466c-bd39-394fb83a6e1c", "comment": "Malware payload", "value": "43f58cf8d3954325d018d0c96a80648a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640968943, "uuid": "965ed0c7-d339-4547-bc40-bc1fb5527d0c", "comment": "Malware payload", "value": "cbee6701678f9540be9fcda93fd63ef7aefb9535545d37807db470dc49c46877", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640968943, "uuid": "3b30d2c3-1ce7-4d99-8dcf-f3226b12e1e5", "comment": "Malware payload", "value": "4330d9b6e4f50d5c4c349106293dddd39bf0740e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640968943, "uuid": "3094acaf-2bfd-4763-a914-30068ab2aff1", "comment": "Malware payload", "value": "7dbf7f8ecb666fe9ef843c2e8734fb9138d6503e72e8a3dd928ef5afde5ac63af8b63db5b278f41727abcbf0f25bff5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640968943, "uuid": "dc87ab26-f27b-4138-9b67-84e5ebdaf8bf", "value": "T19225F041A7F89129F0F73FB15EB906625A3ABCA1BD74C20E6249789E4C71B80CD71727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640968943, "uuid": "c16954e4-04d3-4c35-a856-3df562bf803d", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640968943, "uuid": "2140a93e-9a27-4a65-82ab-b8fcc2e3e775", "value": "24576:VEdr6QC2VVxBT3x2R/yQjttVni1hTbm0YnDJY:Sdr6QVbT3xs/ywjFETbrYnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640968943, "uuid": "fa33e12b-4c3a-448f-8fb6-b5d0f3e6d9e7", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640968943, "uuid": "9a2be97e-1b7d-4558-ad5d-371dda34cd8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640968943, "uuid": "42321963-77cb-4c98-89a7-99f80040ead7", "value": "43f58cf8d3954325d018d0c96a80648a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1db73b-6a3b-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1640956268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956268, "uuid": "2f1854c2-c8fb-4a16-9d31-164e1aef6ee8", "comment": "Malware payload (CoinMiner)", "value": "35ae29573894a10ec1702014333cf2f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956268, "uuid": "4028a634-fdc2-44c0-a54f-17c82669d950", "comment": "Malware payload (CoinMiner)", "value": "cd716a11679b98b42382e72283c0fa785d8a4b041bee8044a2c7dffae2142446", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956268, "uuid": "e5d445f2-2cdf-4e3b-ade1-69fda04cc7ee", "comment": "Malware payload (CoinMiner)", "value": "9aa58433d3986c33b89e8e0707c64e093a4938ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956268, "uuid": "8ae5c591-5d65-43f2-95bf-80c73ffe84b2", "comment": "Malware payload (CoinMiner)", "value": "be29fa0031a7c8c1cef13992da6a00259501bb272d15a49097fbcddc68ef2c1e5e01c5f269afa638b7dbd92919916303", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956268, "uuid": "41e70514-b23e-4b96-89d2-36046e0834ea", "value": "T169963331EA85CDB0E99229741835D805B17FAE301718CA5F37CC74A849F77C1A7E8E9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956268, "uuid": "58e30977-785c-47e1-994e-30f630e8d0a5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956268, "uuid": "811c27c5-d375-4bf9-b039-28ccb6cbff17", "value": "196608:UliwYryZ1rD5xSePS6S83xZ0yW3oD9ebH3DMbl5pb6SLPx02rNlS+yj6Yi4kM9:wLZ1rDPN6jix+3oEbH3DQ/O0W2rNlq6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640956268, "uuid": "de342027-c532-4e11-a1cc-c2d484f63a2e", "value": 9403634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640956268, "uuid": "1e47d7eb-dfb6-43ed-901f-cd5a107f3b97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956268, "uuid": "9d64ce71-e594-45e5-b931-039f40b64c0b", "value": "35ae29573894a10ec1702014333cf2f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf5124d-6a13-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640939356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939356, "uuid": "64e4f3b3-6def-4186-b494-3180224e5130", "comment": "Malware payload (RedLineStealer)", "value": "3d2de2a6844ccb71b796ea8d45d425fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939356, "uuid": "fd6fdbb4-2d84-47f6-9008-540709cb0c74", "comment": "Malware payload (RedLineStealer)", "value": "cfe1a9cedf12e5c01c4727d0b12de8ccecf696a64bf895daf2b71e4131f1e1de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939356, "uuid": "f9f41895-0394-420e-a95b-f8887be8a222", "comment": "Malware payload (RedLineStealer)", "value": "c6a84c596965914e5fec000be17ace81712beda1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640939356, "uuid": "a17b3e69-8b4c-413e-bdb7-e8f8cbad75e7", "comment": "Malware payload (RedLineStealer)", "value": "2ee2b78b8ffeeb49de7934e33a2939b82b3ec5569a624404a20be93a07770a76892fa99169c931bd44e5707ca610d84d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939356, "uuid": "eed983c8-943b-4403-b780-f06f9b6ad944", "value": "T180163354A3CD64F9C80D01F2309748DFE22F5817E82AAFDE0A0EFA7A8D90953D7594C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939356, "uuid": "e86585fe-b1b7-476e-bc0a-0968fe564a16", "value": "9a4258c5d218cf6e5c500e8415d5f5ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939356, "uuid": "970bc569-b295-4ad4-bff6-98ca227096c5", "value": "98304:c9eiqMT+X7ic5fO63dQ7reGHt4BHWqXK7xwAi1wHBRFmUHIBPPQb:czqgMha7iG6WEK1wD16sUoBPP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640939356, "uuid": "a94772cb-bebe-4f22-ba32-09bb857169e8", "value": 4383232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640939356, "uuid": "beaebfce-6434-4a19-a2fe-f553c7a84ef0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640939356, "uuid": "3139ff09-a4b5-4d2d-8931-1042c8e9501f", "value": "saved_photo_12_30_2021_14_32_nvidia_replay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e97edb-6a37-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640954689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640954689, "uuid": "c9da31a1-30bf-4307-a3c4-df41033ae3f0", "comment": "Malware payload", "value": "bb46b854b4a367e40e51c0cb4f9ebe1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640954689, "uuid": "03c5980d-8d0d-4da7-b416-f4756ff51bd9", "comment": "Malware payload", "value": "d0fc379c7df252a133c75a749c1d8906599db2e7fc3fba0c929abbca25e41579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640954689, "uuid": "5597be1a-7252-42bf-bcc7-1b9acd464571", "comment": "Malware payload", "value": "06155ea03a72b52d502d7316d74e58c73750ccdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640954689, "uuid": "f3a08709-4cf4-4bc8-b0fa-3cb9a34f30fe", "comment": "Malware payload", "value": "f4fa58a0d610bd7e3516b57b2ed1ba69fa1d23a49402660f35a96c5e7d4606b5031d3fe4a95100400f587c74575e13f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640954689, "uuid": "6e48eb49-bd88-468b-b97a-f76d9fbc1ad7", "value": "T12CE53303F95F3BF6D2216473F922813487432001B9F694899B05A35C7AC797A9B8F7E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640954689, "uuid": "2249dbbb-9be2-48a9-8e66-6ff8e22acad2", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640954689, "uuid": "4894d58a-1d12-4d85-baca-81a0d5242a4a", "value": "49152:Nos1K+OKUipLYjCNt/3ttBdiKliUk9cVNr0du2RmR2GADyxak7:2s1K+p+jCNt/dtPlIcVpwuSwNak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640954689, "uuid": "25e055d1-3b67-4abf-9123-b84992a37c8a", "value": 3309056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640954689, "uuid": "c612e156-44af-4c92-b141-dcf9e776fcb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640954689, "uuid": "36aae4be-9189-46d7-8ae2-aa8e661b6947", "value": "bb46b854b4a367e40e51c0cb4f9ebe1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cc8ae3-6a77-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640982287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640982287, "uuid": "b43c7588-c6a0-40d4-99ea-c4d32835d934", "comment": "Malware payload", "value": "d08ce6e5c9d78d61b6a0b42be9bfb6c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640982287, "uuid": "a2af457f-509c-4545-9599-d8767cf36e7c", "comment": "Malware payload", "value": "d13ce6327fc9c409413ee81f479a89b24fa40640c68123288cfe9e827805e5fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640982287, "uuid": "bc6fe07d-bcea-4374-8a10-155bc90a7adc", "comment": "Malware payload", "value": "c20eb41ad361dde850ea32da82e7e27c79276f30", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640982287, "uuid": "8f59a23a-00fc-4b9c-8116-2f77c97b4957", "comment": "Malware payload", "value": "675c043052ef4531ff0bf76d2828266eb249889a66e323830ba34faffa67a6a30b433e9f4713a6dc928626c6c22cb49a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640982287, "uuid": "51337c18-b999-4025-ab0e-39094ef261f7", "value": "T1FFB4CF02F2D1D0B7D07E05302669D7294A7A7D649F18DDEBA3C89B6F0D716C14E30EAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640982287, "uuid": "156d523c-1588-4163-9c97-c0302140190f", "value": "b5dc9ad96b513c24df30cb14bee2b2dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640982287, "uuid": "7a5d64df-72ed-47b2-a299-1af85051e2a4", "value": "6144:GRQUWntghU/R+WtlgxTGZE7AIeWTBdRml/7/AOkcNl8+jOUTWolWVS/NeCcS:OUtghUkiKiZkANWT/INKX+iQVsV0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640982287, "uuid": "c041d280-f42d-49c1-9256-a353581d5c40", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640982287, "uuid": "3fb59c8c-4203-42a6-9f47-f0d1e8bec44f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640982287, "uuid": "5721c412-85aa-48dc-acde-13a14694c40e", "value": "emotet_exe_e4_4b7893b758bc21d5fffb664a1bddf29fabd61ffbe1dfcb89bd0164cb913a26e4_2021-12-31__202441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38565cd7-6a3b-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1640956312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956312, "uuid": "da00c455-61f4-4cff-a68b-089d1d39d26b", "comment": "Malware payload (RaccoonStealer)", "value": "624d31288ae6f8c9ad42860d20548d84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956312, "uuid": "43bfd077-882b-4314-90b3-220ee36b53b1", "comment": "Malware payload (RaccoonStealer)", "value": "d2e3ee0fb1010c733e1bad5ee3a2432d207ef711da9d45031a0752411d14b0f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956312, "uuid": "8c7be848-3fb4-4afc-a76e-6bd415a62796", "comment": "Malware payload (RaccoonStealer)", "value": "fe0c50fa1a09b4c267d85d5810a01e1d34ce9558", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640956312, "uuid": "d90c1382-01d4-4fdd-a51d-54fe7d205abe", "comment": "Malware payload (RaccoonStealer)", "value": "56c83555d9e0fcd2f0cf4fe9309727c48f1f877a582b4bbdd5f83abe8cb23e5062578553567504e5616c9f0c8e5dc5a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956312, "uuid": "988694d4-f7d3-46cc-a6cd-c60fad02be0d", "value": "T119D4232C0243F30EEF553D7FE9271950A65E367BDEDBB3087387E60C58A6A1042509A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956312, "uuid": "bbb472e7-109c-4544-a2b7-07ee73808037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956312, "uuid": "88f5a630-4cea-4320-b4a3-55caded25b44", "value": "12288:jy4VQVXjvp1i7jDyMpZlpR25dBZbxAPowlyhOmFBtS4y/HpF:j/QV91BMpfpRuHtwqOmFyD/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640956312, "uuid": "6017b7ae-1c06-4cdf-aaed-b1bfbbf8bc4c", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640956312, "uuid": "0e6f4ae4-4da4-48b7-8f5f-08700e8bcd74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640956312, "uuid": "06308776-065f-4150-a38f-8d3babeef0d9", "value": "624d31288ae6f8c9ad42860d20548d84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b53d6ce-6a02-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1640931862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931862, "uuid": "590b2c3d-b5bb-4190-9d11-a7506590b964", "comment": "Malware payload (Socelars)", "value": "1a71de2680f8cc3d4ec01148443248cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931862, "uuid": "9ac3b2ab-b642-4217-a8bd-a5930f380c0e", "comment": "Malware payload (Socelars)", "value": "d43e2527b5845601a050ba2125880ca1fa79ab5f187f699e9a0242aae6b839e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931862, "uuid": "467fe0e0-756c-4c73-8f67-fc0b252f857a", "comment": "Malware payload (Socelars)", "value": "b07eed7be1cbfa5c62a464503acb7983fe789c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640931862, "uuid": "f917b2e5-cd8b-40ee-a508-acce09ccb085", "comment": "Malware payload (Socelars)", "value": "1bd3d6a991b479fb429f93f5b14f2daaa0b888269e9bf2e198760ee72d2b8cc0d1e921f4b498913f878af919c34bdb65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931862, "uuid": "4c2cb0ca-1bae-4088-a1d4-c5a9ce364627", "value": "T1BB65AF11F6825036EDF30077C2BF5AFE9D28A6210304A4D7D3C45E695E619E37A3BA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931862, "uuid": "59eb3156-e592-41b8-b337-d582f1e75b97", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931862, "uuid": "8775ccc6-c5ff-4b4a-9487-e5fc81d84859", "value": "24576:0r/phkCUyl+/LCBxJmnljksTnpbU2xbVh1pJCnBhqIzPO0tqtH7:epny6WxdlnLCnBhqIz20tqtH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640931862, "uuid": "2bdc6ce1-bf43-4468-a8d5-b0e18a0f8dba", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640931862, "uuid": "f91dd4a0-a801-4822-92bb-2db20c798a54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640931862, "uuid": "8097f715-0fcc-4221-a41d-4f85d2d5b31d", "value": "1a71de2680f8cc3d4ec01148443248cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac91e9d-69ec-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640922332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922332, "uuid": "50c2ee9a-020c-453e-a265-dffd8db8b7a7", "comment": "Malware payload", "value": "9bc8f01f0c17a926ccdb53484be2d765", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922332, "uuid": "2f80597a-f63c-4b71-ad46-2862ed5e0c9c", "comment": "Malware payload", "value": "d4a62858eadebabc11434a4a7939a9d482e3737dbdc892f0702ec37070ede3d8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922332, "uuid": "98361942-6193-4066-a5ea-23cff4055edc", "comment": "Malware payload", "value": "bf212bdf92b457a633fe1b98911b4ec35f1fd82c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640922332, "uuid": "6bade142-3e4b-45a0-8797-64e35e9d1720", "comment": "Malware payload", "value": "4a687b3ee5edded4bac3fda5ad6bc5341597f6caee1dfecd7f538d341a8920a0ba850cb49abf7891b04a85a6c87d848c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922332, "uuid": "faaf6373-b325-49c9-849d-484a19cc5452", "value": "T11F457B2132C79B32D493127155AEA3611A3EEC704B718287729C7B9E2FB27C0673579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922332, "uuid": "b7474c6c-30a4-4174-b2e4-3b8226ac10e9", "value": "24576:Blgq+3Nn7BjlpOu3LBCvAq23Nn7BjlpOu3dATtL:BlgJ3Nn7BxwubBCvAF3Nn7BxwutAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640922332, "uuid": "9c34372b-2bbc-4234-9795-44fb854bc855", "value": 1169380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640922332, "uuid": "9815e755-204f-4892-9498-ae673d2a1a40", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640922332, "uuid": "d96c9ef1-731f-4c40-a8de-51d53b3610b5", "value": "delivery-content-file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703e8453-6a30-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640951681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640951681, "uuid": "933b4263-7d26-4eee-b0e5-6191b9cb2197", "comment": "Malware payload", "value": "b2e413ba64b84041c9d6e2f4527b4ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640951681, "uuid": "dcf0b4cb-320c-4324-b5d1-b529dc287cc9", "comment": "Malware payload", "value": "d5069d544f3ff1efe1851688b9625cd44fe45c6f1a9792b30f5f28c74af1d6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640951681, "uuid": "c3747564-247a-40f0-9708-3df0f4182ddf", "comment": "Malware payload", "value": "39fbc2093fc5cba490fe0360494f8ead6b1434e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640951681, "uuid": "40af1652-11e4-427c-9bbf-cc06e566347c", "comment": "Malware payload", "value": "0b2506d46dbbf4370a193d8af5ac97d364d93af40058f1e918cc48c7c72d633edcabb6d443f04023596ca290de1836c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640951681, "uuid": "267a677f-d488-433c-9596-f32ac69b204e", "value": "T17F5186FFE46818B8C44785780E470954FB2373329AE6C2644F5704E35AF8E9819ACB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640951681, "uuid": "23ad1a41-31e1-4a33-bb81-127da5906eeb", "value": "f97df3d5a90de804311f27d80db8f6d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640951681, "uuid": "cfe735de-64e1-4eb7-9490-bcb44ccc886c", "value": "48:6O7NtU+wipn/YERWeCoQR6jYx1pFpupqJ/B:XU+win/YER26epFGy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640951681, "uuid": "dab70893-b2f3-4c6e-952e-d23894e20d58", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640951681, "uuid": "f05a8bad-2348-41ba-aec8-e36714891bfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640951681, "uuid": "683f4a16-5288-43e5-8bee-4af292a77443", "value": "b2e413ba64b84041c9d6e2f4527b4ba2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30800242-6a22-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1640945561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640945561, "uuid": "198cbd8f-a6c3-4e27-a500-2b01c0af4d0a", "comment": "Malware payload (AgentTesla)", "value": "b491699152d15a9b2f1ac37fdd05771c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640945561, "uuid": "030e4a4f-284b-4c00-ac94-f2726abf8790", "comment": "Malware payload (AgentTesla)", "value": "d512daa0ae47e6e6dc5c3521d7797f61eac5c9fc202868f04fc078c06c912828", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640945561, "uuid": "8f2ecadc-1870-4f60-8c37-2df1ead468f3", "comment": "Malware payload (AgentTesla)", "value": "601fdea3520ee3dae91622cc0f9a3218e9d66477", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640945561, "uuid": "a908484c-09d9-4134-953c-e25d376f4b53", "comment": "Malware payload (AgentTesla)", "value": "451c0a5a6cb7e1149bd637287b0d7bfc395a53c32ccd07c02fddadf19797675342eb886ab0978bd21d08af0b621af4f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640945561, "uuid": "6b582ed0-bb03-4b6a-85ae-1b997d46eaa9", "value": "T1489423E29103DAD0F935C94120FF7FE22606AD99D84E10995C3AEC526E831DE33BDA57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640945561, "uuid": "781da98c-fd8b-4a96-992a-4af9fb63a8ee", "value": "6144:v0Cq5iBEGcoTwQ8AdMmrXX0bcW40nV+PdVkUQS+u4SruCN0lq3jzcqF/ZhWwq39l:/q5irPkQ81+0IW4rPISsS6tW/cCwq2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640945561, "uuid": "739249ce-ca80-49ee-88f7-0cb6c6377c0a", "value": 424484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640945561, "uuid": "842af70c-4c78-4d22-befb-da38b992e085", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640945561, "uuid": "ecb44d30-d61e-45bc-a65b-c547c07a3ab6", "value": "SHIPPING ADVICE 4084301002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3cdf5d-6a02-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640932050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932050, "uuid": "74b15a66-f0ae-4409-ab7d-f9ef95d9d854", "comment": "Malware payload", "value": "53074ccaf36bc24fd4286062f0cdac98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932050, "uuid": "528c2637-7959-486f-9c13-7df0bc79121e", "comment": "Malware payload", "value": "d654c6c1643997b6c6d8e8133e867e52c3176f3e6ed3827ea5f4e29023817115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932050, "uuid": "4b4e9a06-7c01-453e-b5b8-124c42e1a172", "comment": "Malware payload", "value": "2ca97c4d5dfacfc29d8feee90cd7de2eff651225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640932050, "uuid": "fc020600-a651-4c65-8270-a82903ef59c8", "comment": "Malware payload", "value": "c42823b4818f8f7e3d4947bf94e496768f0d26a66f910e94f2fe87b1028e220b3c6ccde5307a37dce8b106ed7e1af4e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932050, "uuid": "487464af-0902-4450-a311-51f208a797ed", "value": "T190952342B89191B3C6711C731A69A61234797D301F288DEBB3D46E5DE2341C1FB3AF66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932050, "uuid": "8f1c7dc2-3a52-4bc9-9e1a-80140594f36b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932050, "uuid": "51d9627d-bc7f-4bed-b529-77ba256f3755", "value": "49152:78492ViONKb0EK/vxtzuViYcqePo2GJKFg8764CTaCowwvgv:7fDuZDHr6ctUKFj764CTa1wggv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640932050, "uuid": "448a3edd-560c-4ea8-b4d6-f027e8cd2018", "value": 1935916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640932050, "uuid": "894eb1ef-41c0-45a1-aa2e-fa9adf562a20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640932050, "uuid": "35622439-f3c5-4a31-868c-03e60a8ee96a", "value": "53074ccaf36bc24fd4286062f0cdac98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3f5c26-69d3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640911835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911835, "uuid": "d937ce95-eefb-4792-b58d-e96d91d49886", "comment": "Malware payload", "value": "346b3c83128f1918b162694eec15963d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911835, "uuid": "cf737dc0-c81e-4bda-8f61-b815b4bde94d", "comment": "Malware payload", "value": "d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911835, "uuid": "a5685c43-e039-446f-af88-81de9cc6ec2f", "comment": "Malware payload", "value": "8c363d01e47d6dffd66044b1a34a78c5a1aac59c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640911835, "uuid": "e884a2cf-dec4-43a8-a961-2b4b7a032152", "comment": "Malware payload", "value": "7a1c91b752e6643513d69b91c44634b9c273d48b70f75fef1821099a65a0af0c838d7f5a7617356df6de8ec14a2c68bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911835, "uuid": "c843dcae-ca16-4df6-b116-349892bc4927", "value": "T14A4733579B910E8EE45D0332E4A9DC78D571F8241BB1E62B27683AE2438B5EC3C79713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911835, "uuid": "37946551-a0c1-4a16-83a7-fa74b2f2fd0d", "value": "5324ac1e1bceff69ec8d4435c50bfe0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911835, "uuid": "04a9e60f-5e37-4d79-aa93-d0e3b98ad874", "value": "393216:7YsI/ECt9c5hlER6GRGsUgu7QiDhDnwrJBjwPoc2O5rVWeRMRFJzFcguYtN3ZW7n:8sXQEhk6YGh9esoEWMqZtN3+uaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640911835, "uuid": "6e4653e6-9cd5-419f-80df-0f53d9c3bfd2", "value": 25518389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640911835, "uuid": "2205cecf-213c-47d5-9b33-22f1f1fa974c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640911835, "uuid": "767a733d-2848-42af-86a7-3589d2758697", "value": "d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1ee2dd-6a38-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640955003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955003, "uuid": "a6b786bb-08f3-4e52-ab2c-0fa58c391f40", "comment": "Malware payload (Mirai)", "value": "85c563fc26f09424cdb3bea67d72f765", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955003, "uuid": "9d54d460-30e2-4336-b532-a09e5e27dbb5", "comment": "Malware payload (Mirai)", "value": "db50108bd20d0703fcb64b00667194c6f62f38473fec28545b794ec546f595dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955003, "uuid": "e8089b39-9429-4d14-8214-c06afdc25832", "comment": "Malware payload (Mirai)", "value": "7315b1921347dfa7f8b6cd151ecc1a7acead664f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640955003, "uuid": "936b0728-9686-4ed7-8262-2eea0da55ad6", "comment": "Malware payload (Mirai)", "value": "adfae747da9fab9491269dc5b0a8d8242ba5939dbc73491c3b3b4c567777a5c43729582f9604628ff819bacfbdb83657", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955003, "uuid": "a2eccb9c-24e1-42e5-8da0-366b9fcf46d8", "value": "T1E04302F882D48163E7747834ED4CECBE2BF16B75B138A5651E011E9D1E8C818B5EB286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955003, "uuid": "06a0a5e3-0038-4282-9ebc-c0a521958844", "value": "1536:AUkNgNrtWcjer9wulz6MOHBKfWCRoczqg:AUiMwc0lz6pHofFzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640955003, "uuid": "5573d916-6bbb-4273-af5d-8d29c9c21a96", "value": 59008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640955003, "uuid": "df6537ab-fb0a-4301-9938-82fe1cd0c84a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640955003, "uuid": "18346deb-f083-4ccf-b694-dd2414e1da7f", "value": "garm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e918c7-69fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640929805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929805, "uuid": "70091f6d-65be-4b92-b839-d2a55a1769bf", "comment": "Malware payload (Mirai)", "value": "62f3e480ff8bc9846209c32d761527e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929805, "uuid": "8dffebb8-6ab9-4c12-933d-8b637e20e47b", "comment": "Malware payload (Mirai)", "value": "dbb2824cab106171caa5def2663c3f17b8ee74893666f06be5440e9df5187cc2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929805, "uuid": "7fa2bce8-4ef2-44cc-b289-e38d1fdc9438", "comment": "Malware payload (Mirai)", "value": "013723e042196b12478f1d5520f6aebb9f5aebb4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640929805, "uuid": "c982bb92-34c2-4d55-93ba-8e2265d6ec2e", "comment": "Malware payload (Mirai)", "value": "e358a3836739415b2ae60d841b76163840feb352dd42c2c9f0bd8aebe0139f6a4e208c36c33ff2e89d2d1db9e13e768e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640929805, "uuid": "d2287e7f-9a7e-4574-b2ec-1e7ccda826f0", "value": "T1F24302F891D48163A7743834ED4CECBE2BB16F74B178A4651E021E9D1E8C819B5EF386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640929805, "uuid": "ae9c42df-22d3-4b05-ba3a-82b219cb18e0", "value": "1536:AvkNgNrtWcjer9wulz6MOHBKILnWCRoczq6:AviMwc0lz6pHoILnFzW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640929805, "uuid": "a0f8afe6-a1b1-4ac5-b5a2-a6bec1b91a3c", "value": 59008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640929805, "uuid": "fa2c5c4e-32c7-4c4c-b885-ed5a2bac7378", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640929805, "uuid": "ef46c6be-af7a-43a4-9a69-bc4049151929", "value": "garm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef920bc-6a7b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640983864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640983864, "uuid": "1741a1db-479b-4009-8ecf-a18b2aa7dc5b", "comment": "Malware payload", "value": "f148850575eb0825a5b94c0862b22b3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640983864, "uuid": "718a2c58-deae-48b5-9b7e-1413b0fea892", "comment": "Malware payload", "value": "dfaede00df102e0e4117a2732ccdba401db15662aabe13d9b7e60c87e032e8c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640983864, "uuid": "387cc75e-cc3f-4f23-bbb1-de3bfd5e4aa0", "comment": "Malware payload", "value": "c18ccf1750860117ea69955bc155ba6d152cf4af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640983864, "uuid": "3f4154dc-7535-4039-8948-7452238a677e", "comment": "Malware payload", "value": "1121b7a9da60d6e75003e227ead7186d9431b0d99b14f73a0af37b1f690870fba641992402ec36c8272ffde86c90c700", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640983864, "uuid": "fe9ecd00-7a1d-475e-a067-232ccb4b8a5f", "value": "T123F4E010BAA1C035F5B352F489B592B8A52F7AA12B3894CB53D52BFD4734AD0ED3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640983864, "uuid": "40e60a07-2649-4252-8151-6d53c5ce7bac", "value": "6350208d7bb708f91d85a9d922cb915d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640983864, "uuid": "752e6132-5e28-403c-88bb-a7a959ad56fc", "value": "12288:2RvV5sIQ1WZKgR5BNlg4eiAcnEtAfyvVtuq1XqbI3/h2W9UYw1p7sBeug:2v5nQ1gycEQIVkAXq6UYw1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640983864, "uuid": "0dc484ca-9e02-4e0f-b9bd-6678b281e1fa", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640983864, "uuid": "d6571cd0-88df-434f-b23c-ea1776630eb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640983864, "uuid": "c2810ea8-649e-4b19-833b-181753394f1d", "value": "f148850575eb0825a5b94c0862b22b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d75d6e9-6a25-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1640946818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946818, "uuid": "48e2e968-92c2-4e4d-8903-b4226ad065df", "comment": "Malware payload (RemcosRAT)", "value": "e4ba36fcf921ec5f3edb0e7db8411a5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946818, "uuid": "020cbac5-7505-4671-9862-2e7c1e6c9d05", "comment": "Malware payload (RemcosRAT)", "value": "e1ce3d0ef342503dc9f20c5b4ac43e0c32b64fe27e3cfa6a17ed06392fe02781", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946818, "uuid": "7867a12b-c0ce-46a9-8884-a4a6257379e3", "comment": "Malware payload (RemcosRAT)", "value": "d1850d1c72a0ca0c5c14143ee2acc75023047f91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640946818, "uuid": "4ce93cc4-3163-4c59-a6d8-c2fd72e86578", "comment": "Malware payload (RemcosRAT)", "value": "d5981beb22b2088479a4e4b46acf721cca0d03334e4ccfd926dee47afa8b5d93937b8da57d12f44a44a9803b70a51bf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946818, "uuid": "14a814a7-bff5-4a24-80e1-a912cf5b9f8b", "value": "T181435D16AFB8D841D49402F2D4A3D5F80670FE12E42ADA3BE5D53E067D3F34AA90A747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946818, "uuid": "d612b63d-f002-4591-9d47-8b6192267f05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946818, "uuid": "5a27634c-bb2d-43ff-9a2f-63102109528d", "value": "768:sLcB3ISyXwLa8fvB6gEXDuRxmqjIAxyLVGEPX:sLcryUBHEzuR5sTVXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640946818, "uuid": "874f28a2-3ca5-44a6-9682-773ea1a3924f", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640946818, "uuid": "61c43375-8d5c-4882-bd00-1f7b17ec9a9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640946818, "uuid": "64874707-ae55-4bb0-a1c1-02223f9a639f", "value": "e4ba36fcf921ec5f3edb0e7db8411a5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95dcfc0-6a28-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1640948448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948448, "uuid": "d3caa8e0-837c-4be5-a230-a50142b1c616", "comment": "Malware payload (IcedID)", "value": "553568f406c8d0d06e0ed08a1579a243", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948448, "uuid": "51572412-d905-419f-a6d0-17ffb52f0f1a", "comment": "Malware payload (IcedID)", "value": "e657f699fadc9b66d192a72bfd8a9e50f2a8100661c391819b6f83675c94375a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948448, "uuid": "b062fbfa-3a9c-4bec-9a34-6bef00f83808", "comment": "Malware payload (IcedID)", "value": "b92e0a65988432ef22831d2be13195997bd84f4a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948448, "uuid": "4df79a00-57b4-472d-9a81-c14a69626765", "comment": "Malware payload (IcedID)", "value": "72947ae7d567cdaac3cfc6c5dd8a1742c7514edb7d6dd7b72bae90dc2bd07f5c1bb5c20196c63dfec7e8f0e7c1645850", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640948448, "uuid": "ad6c469e-6f20-44a7-92a2-4a084b353fd4", "value": "T1CD732A417359CF4BD11060B8485AD2D53B887C446883F1FB7796BF2DB97EE68A107722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640948448, "uuid": "f2fa931a-d511-46b1-ac1f-b1f9fedf65ee", "value": "768:F/MMMSxMxuHAtc1GFZIdJ6jtQlQNBOTHxPIz/tZjTEQMf6eNdRsqMVkaJDDEl1p3:2IdPhW/jTEQMieblSQkd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640948448, "uuid": "9aa8301e-981d-44a8-bcb8-d6fa5832afcc", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640948448, "uuid": "7edc594f-5f89-43b1-b2c1-4123c1d3f4ea", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640948448, "uuid": "9b0dcaad-49bf-439e-b0a4-c9477e0b0529", "value": "charge.12.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6428ccd2-6a66-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1640974854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974854, "uuid": "f03c5b65-6720-44b5-8b43-4ee8db3c85cf", "comment": "Malware payload (RedLineStealer)", "value": "720b195655e0a571c4d511088b51202b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974854, "uuid": "40513b20-3863-4520-92d4-518180755987", "comment": "Malware payload (RedLineStealer)", "value": "eb24b3b9375f0b3272fac6eecc9329f79eab274d802b2ad37037cc83a46fa3f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974854, "uuid": "e184a5d6-8cbc-4cbf-8c10-572a3a8af17e", "comment": "Malware payload (RedLineStealer)", "value": "f171845fe7b3ae9576ea0f698edd8d65d6bf6ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640974854, "uuid": "d24548dd-d278-428a-ba03-e2476233d23d", "comment": "Malware payload (RedLineStealer)", "value": "bff717eac63f6204e3eca46640865fe5ef1b741765ea0ea62e81389afe0d0e5d2e3785892f6e87e54bcedfa2ca888f27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974854, "uuid": "bdde2162-6970-4734-957a-3ee2539c4fba", "value": "T117746D10B7A0D035F6B712F84AB962B4B52E7AA1273451CB53D52AFD96386E0FD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974854, "uuid": "5e7ea9d6-3076-42b2-954d-e72ca419239e", "value": "c613013e8ec93eae360257b5231d0949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974854, "uuid": "6e9c5b3c-0501-4426-ab2d-02afa679d931", "value": "6144:gnjd+ZnJMz+HPYYys+J7huIPCUrM/YbKwj4Fy9FVUHc1FEu:gnjdZz2Qmm7huIPCUQ/YbKwjRFVUwFEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640974854, "uuid": "639615e0-b466-4b1b-a76b-81cbd72e9b4f", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640974854, "uuid": "fac927e5-3679-4939-92ba-c7ef475718f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640974854, "uuid": "9e3073cc-f052-4e55-816b-3c4fad34b76d", "value": "720b195655e0a571c4d511088b51202b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b039d1c-6a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1640948934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948934, "uuid": "e7c9d6b8-525c-4865-b673-ddae98bb55d3", "comment": "Malware payload (IcedID)", "value": "7044bd240219ec2f83b01c532e2ce5ba", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948934, "uuid": "c421689b-9fa2-4245-a506-db4d5a58ec0c", "comment": "Malware payload (IcedID)", "value": "ecd84fa8d836d5057149b2b3a048d75004ca1a1377fcf2f5e67374af3a1161a0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948934, "uuid": "7d3d02c6-38fe-4513-bece-fe2b3d87029b", "comment": "Malware payload (IcedID)", "value": "745cdbc4a826c5960eef3f4a9aa307ff94e4b7fb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640948934, "uuid": "838ab539-145f-44e6-b11a-9804fdda4975", "comment": "Malware payload (IcedID)", "value": "606a26837c052d18f9734d7ab8a3b8c924559895f9b0799623296cd04d0c9ccb7656b7b471230eff1b9cc9590703bf9b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640948934, "uuid": "3e55e057-d69a-4f17-9e1f-942a40e2e292", "value": "T19C7329B57193DD9EF4800D385E46E290EAB83C654D05D8C376F37B0E98B12B499ABE13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640948934, "uuid": "7966a4b0-a92f-42e1-8e10-99a48a94aa94", "value": "768:P/MMM1tMFur3Be1l3Jeq1awypEuqjuy+uqezc1GFZIdJ6jtQlQNBOTHxPIz/tZj8:Zja8IdPhW/jTEQMiebld4Kkd6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640948934, "uuid": "d8875787-2cd0-4c30-840f-f99cef4a65f4", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640948934, "uuid": "7f76ffa6-1032-44a4-8628-5e6c82eeef7b", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640948934, "uuid": "a00dac8b-d5cf-4c79-bb1e-9a952e31b20f", "value": "enjoin,12.27.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a80dcab-6a43-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640959671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640959671, "uuid": "7ea7c16f-415b-4788-bb3e-f512a35d14ca", "comment": "Malware payload", "value": "f0624abc6cc498b8ed3d3f4dc341240d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640959671, "uuid": "07db8eab-f80d-4fd7-b09a-81856cdc0527", "comment": "Malware payload", "value": "ee1869a4c8346e495891f8234258e1112363538bd84b102f5e57df6902488293", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640959671, "uuid": "56e2b5cc-8999-4b8c-972b-f5aaf3450a3b", "comment": "Malware payload", "value": "59e4ad050e28959d0081f5e40625a2181cdb51e6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640959671, "uuid": "19cc0d73-1953-437c-821e-7a5f2b0df5e6", "comment": "Malware payload", "value": "d2d17829ea8e06c17899aa2d2f8c7a829f1042dae07938edccd5a23b9e9e9cf2d3e3171497a1f2fe3c5db26c2fb33bd2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640959671, "uuid": "df9b04af-2869-412e-8f4c-7b1e66664f19", "value": "T1B0B012154290C2617B861727C038341093D4597CAF40B1DB58674ACA8594A7204C78E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640959671, "uuid": "38b3e27e-5f14-49b2-8bc4-a6f0fe44e8e0", "value": "3:nX7YF6I9l/CgG4GRx4HOLdRX09JMwsA:X7o5agt2KOL709CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640959671, "uuid": "0e5dd4ef-68fa-43ad-add0-5f76c40f977f", "value": 109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640959671, "uuid": "c6b35344-af0a-44d2-a016-2df7ff666207", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640959671, "uuid": "0425de2f-76fc-4831-bbcb-36236f4f6bc4", "value": "c881.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0219ad3-6a7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640985289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985289, "uuid": "b3c81d06-c986-4775-8858-d17406186bd2", "comment": "Malware payload", "value": "16bfab9d596f8e6958ae62f4970fffff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985289, "uuid": "431b9c2b-cdca-498a-88d9-873216672ea2", "comment": "Malware payload", "value": "ef43e6c4a43f3087eb6875e265b98f4f849439cfd6fa2c205a3b4501feb06ca8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985289, "uuid": "958aba47-8cc7-4ba7-b9c8-f43625f9d636", "comment": "Malware payload", "value": "6bcb2c17cb8f9954980bc72f96d97a7172d9087d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640985289, "uuid": "3d537fbf-7c70-42a4-802a-a51ccdf1115e", "comment": "Malware payload", "value": "cc9616345d6787f86134c11819dbd2eb0b3c2ae477effaaa95a6ecb305d4d17bdea72a7f6e340acd471c1c2fc5c13220", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985289, "uuid": "7cf722e2-56d0-495a-bb16-cba4e766390c", "value": "T13472E1EAB307919BD253437A4A02DBD59DA4ADB83EF1A34B42801F08161F4B3D50CBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985289, "uuid": "4b35222b-942c-48f9-b534-052258e6826d", "value": "384:nhAAg2OeV3KZoFLQV0PS4u3MmYRrDSGJha7CprpW195oK:nhfV3KZgLyu8tbYg7CE95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640985289, "uuid": "886a7566-66fa-440d-a7df-7af59eeebb4a", "value": 17532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640985289, "uuid": "d5d2c11f-1970-4a90-ad71-86775dfa45b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640985289, "uuid": "60942920-b78b-4b2a-aacc-bbf7b84a0e60", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66394716-6a7b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640983877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640983877, "uuid": "61e4016c-9a5b-40d8-9c3f-1131732a05c0", "comment": "Malware payload", "value": "7fdb0e110b4cafeb10afb3d634cf7aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640983877, "uuid": "c67924c5-a792-44fd-823b-2111ef5c9d08", "comment": "Malware payload", "value": "f41dfa0eb3511990f54ac6327718659df1c67ebf3bf919c09e4afc17bbd1cab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640983877, "uuid": "58e0f51f-126c-47b0-b5f0-913a0eebd9e3", "comment": "Malware payload", "value": "797980e5d859725d6971ae0edcb3c3802c37e770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640983877, "uuid": "d4c31096-5a72-4190-9dce-4177a8b34014", "comment": "Malware payload", "value": "a60fd8eecbce274cabd6736b371786e5ffbc2c1c01177e811a4cf6063014546d6d8111f6425edcb6420a6021ff3fd3b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640983877, "uuid": "0b7320e1-fd17-4172-a060-d7e92dbc2732", "value": "T158E53303B96F3FF4E2029437917AA43586172C402EFDD8846750139EBAD16549B8FBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640983877, "uuid": "5ab6a06e-dd2d-4487-b03d-fcdb515cb012", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640983877, "uuid": "02586e50-4a1c-4f4c-9088-6763b1e4c76d", "value": "98304:LxQDqEC/tjY1NBamZJ+SCMFEuroS0uP8qD0mW:LIqEE1eNbP+SCBusS8qoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640983877, "uuid": "d8f98a72-295f-4cdf-a8b2-868bad852d78", "value": 3270656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640983877, "uuid": "cc4773ee-c4a3-48d1-bea0-a014a153f082", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640983877, "uuid": "5075ea63-9933-4175-b4a9-a1ee52599718", "value": "7fdb0e110b4cafeb10afb3d634cf7aa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee232f7-69e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640918071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918071, "uuid": "6fe7162e-9f2c-40e1-9aea-089778bec237", "comment": "Malware payload (Mirai)", "value": "f353d05b7a7cef5330045179e5a41361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918071, "uuid": "5a9cb77a-dd12-4f1a-ae0d-3c83137d6089", "comment": "Malware payload (Mirai)", "value": "f4cc0e1c60746ec747bb2dba2913bbe2b2b14bd33a625df1be79b554387814ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918071, "uuid": "e75eec38-ca87-4567-864e-9ba0fa546e85", "comment": "Malware payload (Mirai)", "value": "48ecf5cd9555fc2930812e619e1802df68033cef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918071, "uuid": "782dd01c-5f4c-42aa-ac7d-07fca54e8741", "comment": "Malware payload (Mirai)", "value": "51ead762253134ddcf87eb4d22c4307e302fccb49f34bdb267494daaf3e20ddf12e825b809d304416acbc2d19f948ff1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918071, "uuid": "87a020db-d97a-42a6-9282-6943867f9ee8", "value": "T13523E1B15A2656FAC02881F56AF027E33597870A8C81ED15F124E517EF8BB762CC2BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918071, "uuid": "e029f5b0-5b6a-4788-a069-ad82ef461883", "value": "768:YXLL88BFQrRKBP1ZXX87yQy3Mb9KgZ4myMlyneZ99Hx7p1SH8QJgGlzDpbuR1Jq:Y7RFyEBP1l8m3VQFyMlQU99Hz1SpVJuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640918071, "uuid": "b938fb55-eb7b-4211-a904-3274a038425e", "value": 46144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640918071, "uuid": "40f02f13-0651-40eb-beef-f68262d12110", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918071, "uuid": "b63b3e21-ca8d-4530-a6d3-02b699ecff31", "value": "f353d05b7a7cef5330045179e5a41361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee240d2-69e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1640918071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918071, "uuid": "ddf3bb72-5408-4ebf-b686-5dd5f8479ce6", "comment": "Malware payload (Mirai)", "value": "4fa3df871b6a9a3909cb02effb206dee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918071, "uuid": "c49c97f0-7cf5-4a3f-85ed-f5be46060728", "comment": "Malware payload (Mirai)", "value": "f99e10dd4c05461820e5a68cb8b925ddcb4d186cd8ba5b6343fe4e1ed7fd129a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918071, "uuid": "5a84a056-2c64-413b-a557-e88a406f922e", "comment": "Malware payload (Mirai)", "value": "0403ef21d7db5d07f6639e3646366aa5b742e69e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640918071, "uuid": "58e2fcf4-95b0-4210-a0d7-c8cd9150980a", "comment": "Malware payload (Mirai)", "value": "423b4f2a625b33d6dd19eae04fdf452b9bf7bc9c913cef43db6bada3bd103c56c6c093178a67a28fd8ca2bb80338f13a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918071, "uuid": "b1549675-7550-4951-a43c-d4223b57abbc", "value": "T1EB23F1ECE704A546EBEC8CF9316C16A6068C7940369D5F5DA324CC4D922DB83B60AD7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918071, "uuid": "4ff663a9-882c-4b92-8c53-c156175e145c", "value": "768:SzVZHXaHTmXG8aCRy+et6ettkksOVRpudQ3DpuDeb6qb5GKYlarw63WI:SjKHTmWvCQ+NktkkzpFDpl15B+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640918071, "uuid": "735f2082-80bb-4926-a3c0-a50191580486", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640918071, "uuid": "c2c468d6-dcb3-4fa1-bdfa-67d67f0fbbad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640918071, "uuid": "5bd37ea0-acfd-4b04-8b1c-c2901b02ac5f", "value": "4fa3df871b6a9a3909cb02effb206dee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24ff9f3-6a1c-11ec-9275-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1640943283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943283, "uuid": "911fdeb1-0351-4bc3-9706-137ac6b6f192", "comment": "Malware payload (TrickBot)", "value": "218c5b56132ee73c7a5ad2e5c96c64d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top166", "colour": "#4BDA1F", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943283, "uuid": "ab26e0b2-6c24-4b7f-b2d5-fa4a93c793b3", "comment": "Malware payload (TrickBot)", "value": "fcde8f225a14fe70009f32c4acfba0407b5fd6b0da5c2f65778434359962e5c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top166", "colour": "#4BDA1F", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943283, "uuid": "b163ae97-afaf-4156-b7e2-d9a66ed74046", "comment": "Malware payload (TrickBot)", "value": "c1a72d736eb870684a190bad60d1da7d1292c37b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top166", "colour": "#4BDA1F", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640943283, "uuid": "a3bc2065-6dd5-477b-99d9-cd3f41d02f64", "comment": "Malware payload (TrickBot)", "value": "df687c25df1e6c99177f9422b8c921f25bd24b3520555687fc42c0bd44afdfcfb5dfcb13b4c1d6c7e9624331a1685a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top166", "colour": "#4BDA1F", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943283, "uuid": "9fde5228-9ebe-4b46-8f60-95a6557e2f36", "value": "T1FD94F120B3E5C071D18721718A62CBB24FBA7C722591BD8F6FD656794F38A90972831F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943283, "uuid": "1fc5ae4b-9980-4825-b3eb-e5b87a4777f4", "value": "297ed3de0a49d4831344ce5a84729097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943283, "uuid": "2d8419f4-141b-4940-8da8-11e5e2b6a697", "value": "6144:YFn61kciCuR6b15sZwkst8K5YHJHJ4wX4wp16SiVyaE6Clb4p:YF61k9CuRoaNK5Ypp4wo8OVlE7R4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640943283, "uuid": "8f3a0a14-f1e7-4ee3-86d7-fb572864556e", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640943283, "uuid": "14723fed-66ac-47f5-a7d2-914b2bce3a09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640943283, "uuid": "6a407830-fd86-46f8-905a-70ca8e70fb52", "value": "218c5b56132ee73c7a5ad2e5c96c64d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96cd23f-6a3e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1640957924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957924, "uuid": "41834cad-b763-45fd-936d-4f9d33246e47", "comment": "Malware payload", "value": "98b2bfc7075ebe5624ba134cc5f86d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957924, "uuid": "b89fd00b-110c-42b7-8a46-df1e3804bc8d", "comment": "Malware payload", "value": "fd787521a78a8c0c855e2bf5bf162eef857802008ce95b4a37f5c29e6158e7e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957924, "uuid": "52b6d5f5-99cf-4f74-b63b-782338c715fa", "comment": "Malware payload", "value": "10a1fad9eb1a076bbafc94b70af3d288aa070d28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1640957924, "uuid": "94baec8e-d53a-400f-891a-36965c231086", "comment": "Malware payload", "value": "ea3683e40241bb764a5e1eede3f8204d18f607341dc19533d01c3dd110b5211df8af9dd1f21d4ac6890e8dd71fa83103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957924, "uuid": "82b9cac5-a9a4-4229-b8e5-a746e6724aba", "value": "T17FE52347B86F3FBCD302D43BFB25E2355B4609519EE9D968974483AD70C243A8B4E368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957924, "uuid": "c8be10fc-8320-43f6-91e1-81bdc854f4f4", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957924, "uuid": "aad49ab1-f190-4c8c-960e-7116daea7488", "value": "98304:dsZAFyT32GNwrqcsuDeCdBtwTGrn9gLJ:YtTtSucsuVByipm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1640957924, "uuid": "d411945d-4ab6-46f9-a002-6b1923156364", "value": 3238912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1640957924, "uuid": "084dbf9f-1849-4842-801e-8cdc6d896a5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1640957924, "uuid": "48647aaf-12b1-4b27-9de7-43f4900a197d", "value": "98b2bfc7075ebe5624ba134cc5f86d43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }