{ "Event": { "published": true, "date": "2023-03-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-19", "timestamp": 1679270581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "df1d91ba-90fe-4b0a-a37a-856a161e493d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18d9221-c673-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679243652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243652, "uuid": "05780697-e517-4d6a-bf2c-5c68180da7a3", "comment": "Malware payload (LaplasClipper)", "value": "f5d957a42f578847664cacb8a4c3d695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243652, "uuid": "819fd792-c2e5-4a92-bab7-2d87a3ad6049", "comment": "Malware payload (LaplasClipper)", "value": "00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243652, "uuid": "003ef1d1-37b5-4fe2-a3e9-9510011caa2f", "comment": "Malware payload (LaplasClipper)", "value": "5affbea912936570480b7a6a0a7e67c6a2f62ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243652, "uuid": "27f87cff-c61f-41d7-903a-c36a603f5e69", "comment": "Malware payload (LaplasClipper)", "value": "ddcac948008d27a5085db273744a4b1d23740551e550b4fab26fa744fcc646389dd176804f0b82076da63e7e01c90b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243652, "uuid": "0eae5115-dfdc-4353-be65-b72a0d915d50", "value": "T1C98623A3A64112D0E97EC8318237BEE472B72E7FCE81A87C51DAB5C124774E59233857", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243652, "uuid": "c0069a90-a68f-4ee9-9f33-7099c7cb480d", "value": "f0e8db307701582115b12426e04e3928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243652, "uuid": "15099789-8f8a-4587-95a6-50feaa09cd1f", "value": "196608:ZOtzW0BrGc/4GmLcBh8YSZIEqsyZr2caC78:kVW6Gc//B/xEh+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679243652, "uuid": "1a781208-0276-4c74-bc8c-0bcc04ecea50", "value": 7832064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679243652, "uuid": "3064c4e6-8814-48bc-83e7-19959c3e1abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243652, "uuid": "7e2a20ad-6bd3-4672-bb4e-ac93b9165c3d", "value": "SecuriteInfo.com.Trojan.GenericKD.65986477.30295.30638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d8750c-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212286, "uuid": "a35bfbea-a5c0-416d-9aa0-4844cde0f0b3", "comment": "Malware payload (RedLineStealer)", "value": "b55334fc7ac579d6aa4c47ac29b6d4cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212286, "uuid": "c942102d-1fcd-4c29-bcd2-1b08dcb9227e", "comment": "Malware payload (RedLineStealer)", "value": "00fc6700a74876a4990dfcc5f49ae3aad7e8182bdfc2f12d4cb27eeb30ad42d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212286, "uuid": "d2f18d24-148b-461a-9f44-8bef8bebd5ab", "comment": "Malware payload (RedLineStealer)", "value": "1c3de777d0d4432c5c805a0f7c0e15801d4acb33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212286, "uuid": "7e362e02-a4bb-49ab-b8bd-63d06c0ff809", "comment": "Malware payload (RedLineStealer)", "value": "67e0c252ca1a5e530d5a89bfe3cb893e9befa77213f0e7784f82da12e14a9a38f9bd747ad370ff651299750cc80f6c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212286, "uuid": "80cba132-00c1-4b34-8fbf-731d12bc9754", "value": "T1C2052302B7ED5223D9BA5BB014FB03C309363C918D7493AB23A6686D4EB26C5757173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212286, "uuid": "2e20e97a-90d0-4833-a27f-9ebe3c77d0d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212286, "uuid": "07fa05d5-9fe9-47c2-9278-8c3c762e038f", "value": "12288:FMrdy90tOfI4JrZjh6JGNFhOA+Hd3Iand+3JbaAApY1c4F+d1nCrqQTuJ:oy0OfIgXT7+HhISoxaq1JFuCN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212286, "uuid": "3217765f-dfbb-452c-acb7-f5e34c168939", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212286, "uuid": "012f8a00-91d5-43b4-bafb-e0fd742b5398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212286, "uuid": "5943e553-ff26-4c5c-a302-a01e51d1a28a", "value": "b55334fc7ac579d6aa4c47ac29b6d4cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e90cd1-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679212808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212808, "uuid": "0e60a779-706c-4129-9c43-694feeff0caa", "comment": "Malware payload (Mirai)", "value": "5da43fa0bc764f17e04d3c7396a93f99", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212808, "uuid": "bc0dded1-441e-465c-9ae3-b443c3f4b3bd", "comment": "Malware payload (Mirai)", "value": "02751cd1777a3c188fefaa1fe58d7e096e4c7f1f76ca54ce2ea655215227467a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212808, "uuid": "93ff8c07-cbea-4fbb-b14a-43ac1ce7220d", "comment": "Malware payload (Mirai)", "value": "817931f5442e2a158814444a4f88db763f961a56", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212808, "uuid": "bdf99fdc-35a7-45bf-9e18-d42a14151e6a", "comment": "Malware payload (Mirai)", "value": "d41852ee3eee9c7e5fbc86553e26e0a6153ff06325f64bfa26adc00bda0c2940d90a51d9b1b73d4fb48286f97f8bf527", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212808, "uuid": "6ae27dc1-1837-419f-b464-7ca8b8bb4578", "value": "T19123F681FD41C906C5D56173BB0E568C371603A8E2EA3307AE2A5F607B9EC6F0E37555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212808, "uuid": "40b65967-683f-420a-b8c5-80d5da93fd65", "value": "768:IidtKf6o+DXfBKWpJMKI5TVJDYRNqna9EpV6gdPfj/h5LVE0LNAkx6uDk9TKgncR:IJfR8Xf0ab4TVm3ypV6g1fj55LVEop6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212808, "uuid": "39f6c752-1e28-465d-bc91-152c569cb62d", "value": 47200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212808, "uuid": "8505347f-e550-4a8f-a29c-377d5a7a3e1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212808, "uuid": "0406f23c-abf0-448b-af2c-173512b6058b", "value": "zed.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33ecfe9-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241400, "uuid": "e9137cb7-e629-4785-9bec-33815f78b16a", "comment": "Malware payload", "value": "5087ed60960438ffbed0c72510f29028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241400, "uuid": "4b1be4dc-ea1d-4935-839a-d03e8abc367a", "comment": "Malware payload", "value": "0354ff20b145535cfd2e4c20b9c039171416f5035ad4c838eed631367aa3064b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241400, "uuid": "1c2c7e1c-6d35-499c-8f06-c0f9e8ea0be5", "comment": "Malware payload", "value": "27bd6e8efe215653ef6fdf899b2a82a8cd0d70cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241400, "uuid": "45b3ec75-57b4-47a7-a78b-19ca4dcf9f01", "comment": "Malware payload", "value": "b3d7aa3cf9293351b6ce636c2484ebf047a936d334e331d4214ddf1288de781ea84a19ec414d6a7318374c5f9ad092dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241400, "uuid": "9b826848-dcc1-466e-9a91-3032cf7d205f", "value": "T1F515336B81D42C7EE4E3CFB80DB29E0657A7307F984E43C455698C15EC1BE29716B2E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241400, "uuid": "d1ab98bf-3630-4ffb-b238-665285432f36", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241400, "uuid": "3b249563-59ae-4a4e-b78d-ff07fff68cbe", "value": "12288:7+dZKYE7zmyIR+aYui8tNkdzkWyoNUSDBK9Sw7uyL/oEHocYBEDc/sWAKnS86AQC:ioSIa9ikN4h3DEQA/NO8c/lAKbcxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241400, "uuid": "6539143f-07ea-4433-9a9c-5f91a5eb1f9e", "value": 892796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241400, "uuid": "921c6c32-6546-47e9-a45b-972594a6860d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241400, "uuid": "3028032c-be84-4ce1-baae-8ae1cca5790e", "value": "5087ed60960438ffbed0c72510f29028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600fd45c-c651-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679228832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228832, "uuid": "8b0ccebe-b4bf-4765-8d97-3c5cbda19e1d", "comment": "Malware payload (Amadey)", "value": "b33f2ce73b974d02739cdf66f007d384", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228832, "uuid": "ad9a4669-82a4-4ce8-999b-10a417b11c2d", "comment": "Malware payload (Amadey)", "value": "0398bda48f8ad44ae7da387f65dd9fecb0975dc863380c8e357594cb843f3057", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228832, "uuid": "0c3834b1-ebe2-4d6f-8d50-fc592b24c33c", "comment": "Malware payload (Amadey)", "value": "f254ceecb9ac8098dd2af3d9098a5e6aba73bd00", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228832, "uuid": "0736a7ce-0c5f-4ef2-950e-ef04de30edc7", "comment": "Malware payload (Amadey)", "value": "807c155cff81ecfffe2a70c045bb23bcc3aee751eb5f00b1e1bd79bc6e65fc632454d98f163b8063232de718f2dc1c8c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228832, "uuid": "d62988a2-1c23-4b92-8896-c2910d83672e", "value": "T11754F70397E17D98F9268B739E1EC2E8B70DF671DF497B6532189A1B04B0172D163BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228832, "uuid": "95b91760-2d6c-4bec-9887-24aeb20685cc", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228832, "uuid": "92a0b891-e9db-455d-97a4-434194f04814", "value": "3072:FDfNXoL7+y4/xB7zzL+Z3jcUVbBbqmXYt5ZLn7txxh/:3XoL78n7z0FtlXejnxh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679228832, "uuid": "c87ec300-1157-4096-98b5-133f746e7ae6", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679228832, "uuid": "b5a1051e-f861-47a1-b068-c2d9cc715b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228832, "uuid": "cd114026-fee6-4a3e-af4d-dd12f17954d8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2095f14c-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679241181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241181, "uuid": "2cfb2835-14c3-4da5-9d72-7e7916e5158b", "comment": "Malware payload (AsyncRAT)", "value": "0747b82b235f4d06fc693569fac9ffbd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241181, "uuid": "cb67baf7-60da-435b-b9fc-432155cb9f26", "comment": "Malware payload (AsyncRAT)", "value": "044cacd5ac37289f51cb2560deec5d5eb2a299f37cc7632673fefc70196e5452", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241181, "uuid": "dafd222e-5cd5-459d-a638-a5d78e0963ce", "comment": "Malware payload (AsyncRAT)", "value": "d639f2c7345800ae12b6dea8655cdab16df64daf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241181, "uuid": "dabd1b6a-6677-48f3-8073-25c65b16a267", "comment": "Malware payload (AsyncRAT)", "value": "c32a75fc899395b1b21ae717c5033b0b0830b10467d72364df3b36c81a4f5e37e4e594e60d1ef70c339190f6504337ea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241181, "uuid": "c4ab8958-e6cd-4a85-b174-ae60783c9413", "value": "T1ACD4F152FBD244B2E5731A355939BB11687D7D301E30CA2FA3C4796DCA321C1A636BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241181, "uuid": "5f43e976-98f0-4f15-8396-98f7a8a615e7", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241181, "uuid": "ab14109a-d77f-453c-a43b-c1690d2fe8c6", "value": "12288:NcrNS33L10QdrXjcDn6gl1f6NWU6TvfXCT8NqRu0VWYQw6zx6TaFOo:wNA3R5drXoD60ZMNg3TuWYJ2x6/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241181, "uuid": "65c02869-150f-4721-a61d-dbe3222edc52", "value": 653219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241181, "uuid": "f79bd9f9-a1c5-4570-bdf2-1fb55c1a0fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241181, "uuid": "473cafd6-08bf-4890-90a9-294454083bfe", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0772390c-c633-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1679215798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215798, "uuid": "40afe52a-ab9d-4bb0-b37a-70b855398923", "comment": "Malware payload (SystemBC)", "value": "f359b9b14ce8e2063db2e24bc2bdba83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215798, "uuid": "a159504c-32d7-411d-aed5-7fe103ddc0cb", "comment": "Malware payload (SystemBC)", "value": "04c08c78eb4cc7375326de67ad6250261f27a2e062a7034322e7828eb46b94bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215798, "uuid": "16cded25-31b8-4a0a-8510-79ee1b463cc7", "comment": "Malware payload (SystemBC)", "value": "14949ceebc8c27303fdb6aada0475f2e7051cf66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215798, "uuid": "ccf26884-8d82-4c12-8e3e-b08061f510cb", "comment": "Malware payload (SystemBC)", "value": "e643abece5c2f96a7cbed2b4b6756e98cc61009d93abbbafe4ae88bbc4a46c946f3144c2504017e9307d009f836dda97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215798, "uuid": "bd094c5e-24cc-4fcb-a8a5-ad4b5d0a9da4", "value": "T16EF1D526AE514063C327D6BE7B4F9321E47F6A3353306009DFB21C5024B58B3DB66A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215798, "uuid": "577f3e24-5657-4f8a-acb3-603d1571513c", "value": "c43eeea4eb37b541724563a3273bc88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215798, "uuid": "257256b5-529e-47da-a8c0-3e67babd1176", "value": "96:PNoCMDnHFBkGNutaR/3Mnh/MM4odWLqhZAoUyLh/b9U/oo2i4gPpdf0Vqw:FoTH7kGsaBc/ZbdNdh9i4Gpdf0ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679215798, "uuid": "bc162abe-cf2d-440f-89ed-727d9a1a17a0", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679215798, "uuid": "103d6b7f-b023-4e2c-977d-3619ebb7c6ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215798, "uuid": "5f6b7fee-5a81-43c9-81fd-51d246469b8f", "value": "f359b9b14ce8e2063db2e24bc2bdba83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca55514-c63c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679219834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219834, "uuid": "80c83ee0-cc4f-4780-81ca-d8aae6790761", "comment": "Malware payload (Mirai)", "value": "5169b23ff178ebc83a34d2d9f9eb3ff2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219834, "uuid": "75ba3287-8e92-4322-ae38-6b3a66cfae54", "comment": "Malware payload (Mirai)", "value": "056c6cfbb844a09be58f2847ad65faadb98dc6cec98b58d896ae4eca4e49cff3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219834, "uuid": "33ccbdba-f257-4f6d-a94e-5b2055e6ec94", "comment": "Malware payload (Mirai)", "value": "5a0307f890038e1804fe3fe0bee7cabafef16c55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219834, "uuid": "fb5ebbb4-96ec-4d2a-836b-9a1f0628a545", "comment": "Malware payload (Mirai)", "value": "da85fd2a802659f496143bd5c2a6e6d484e82c2050c835db63d886ae759e3de68672dae706998e9d573b1f099eebbe34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219834, "uuid": "68f1210f-08f6-4f78-aa4c-037583c4bacb", "value": "T120E34C46EA808E03C4D61776BAAF424A33239754D3DB73068D28AFB43F87B5E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219834, "uuid": "22b3d4f7-29e0-47ba-9571-70395459bd33", "value": "3072:NRR6WNMvnOKwaVDV2uiGUD/vzdMvEi3cxgM/9yD+Sf:/MAMvnwaVDV2uZUDhQEi3ceM/9ySSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679219834, "uuid": "12f6d066-ab59-41d5-9212-33c0c9b72996", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679219834, "uuid": "e6a0539a-5ba5-4979-b8f8-df9b3a3626ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219834, "uuid": "d93f5465-e530-4157-8fd2-243a16d41003", "value": "5169b23ff178ebc83a34d2d9f9eb3ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c89bb97-c642-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679222437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222437, "uuid": "bb155f6e-60bb-4f67-b844-e255bc7ed5bf", "comment": "Malware payload (Mirai)", "value": "fac5b528bd80c50df57cb800ca87133f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222437, "uuid": "0c3e1afe-e908-4c78-a57f-296acd47b660", "comment": "Malware payload (Mirai)", "value": "0585c64c339b2fa34c003e2f1ecf60a52d72bce52eead8799886d43b05e47b36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222437, "uuid": "3d7de3a2-145f-4235-bfd7-7faa946e7fb1", "comment": "Malware payload (Mirai)", "value": "0e0ff2d0e7f652fc049c35276fe4dc48403797fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222437, "uuid": "5b50c85b-1ad6-4f9f-a617-b791080d7863", "comment": "Malware payload (Mirai)", "value": "d2393a5c260452ccb41efd89b4efbae5fba35ad24656d7a0f43bb10608e4b8fafdf576c1f52bd4357fbb773a80cbf4c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222437, "uuid": "b1d79c28-b7d2-45eb-851f-fd3bf2d298ab", "value": "T18B43F946B8818A16C5D413BEFD2E118D33126778E2DFB212DD106F147BC6A2F0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222437, "uuid": "302d4e15-1349-4325-b07b-933417ae6570", "value": "1536:pNng6w2GW5Mxcd85hiO0WRJWdHfPwFBSLoIiiu01rQdx:3HGWS2dUh9WFfPm01rQdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679222437, "uuid": "8da86864-3a57-4094-9ea9-9fa78145eab5", "value": 58700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679222437, "uuid": "418b8345-ec69-4242-b8e7-b6879b5bd62e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222437, "uuid": "ec812478-1560-45d5-aed4-7a5d02bc1aaa", "value": "fac5b528bd80c50df57cb800ca87133f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803c70e2-c619-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1679204834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204834, "uuid": "33a06312-8112-4726-b6e3-2f3d573b9253", "comment": "Malware payload (Gozi)", "value": "700d3ea5098e7b7f45fceec4df9df798", "object_relation": "md5", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204834, "uuid": "69a5acd7-c9f3-41f8-a9fe-4d13ff93bd9d", "comment": "Malware payload (Gozi)", "value": "061c271c0617e56aeb196c834fcab2d24755afa50cd95cc6a299d76be496a858", "object_relation": "sha256", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204834, "uuid": "303890cb-fb93-4e40-b33b-407bc76dd83a", "comment": "Malware payload (Gozi)", "value": "8796dfe929e1f9d507a4c7da048fb80eeaed94eb", "object_relation": "sha1", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204834, "uuid": "59226842-3dbc-4a6f-a310-dc71063883fc", "comment": "Malware payload (Gozi)", "value": "941b30a2106c8a6ad16de3310486dac3020c272a8e31facc49f2a6b6d214c9ed7e5d0f5983cee7c7e1003d62377cc4de", "object_relation": "sha3-384", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204834, "uuid": "fe6b3e16-3900-472e-b81d-073687c2216f", "value": "T12403E1230D24A0ABEB0FC7F0675FA1BED3F9810536149867D6223A366DB3475823B685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204834, "uuid": "accb9c88-80dd-4396-8451-1150bba0efe4", "value": "1640d668d1471f340cbe565fe63522f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204834, "uuid": "b3b11930-5d10-4670-a622-c2625caa4f4f", "value": "768:4gYKd2Usr2yS5PLHBjderMpEvpZi7/kMPWq9aky77XTm9:4fKdpfh5zHzeApsnI/eZDLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679204834, "uuid": "0b982cd9-d939-462c-a6b5-436f21eb3d8b", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679204834, "uuid": "6715625c-3fc2-4907-b6f8-2e95ed41346d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204834, "uuid": "07cad068-3a59-48c0-b2ff-558565310793", "value": "gozi loader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8740be1f-c630-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214724, "uuid": "932d7576-bf0c-4dc6-8a8d-1b722d6d79e9", "comment": "Malware payload (Mirai)", "value": "e79614164f8206b54afc268eae394d95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214724, "uuid": "2bc103f4-8d49-409f-8147-d6a14e7d424f", "comment": "Malware payload (Mirai)", "value": "06b9f422a52c390f1804cd28dfa60c66f07b372a020e93ae44cb0083ffa466ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214724, "uuid": "61b3a6ec-1311-4521-ba43-94ad13e71d61", "comment": "Malware payload (Mirai)", "value": "b08330ec8ba55a400d1c245c3d7aeea66b333f57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214724, "uuid": "8c1ef2ce-5617-4d4a-a74f-3c0ccae683dc", "comment": "Malware payload (Mirai)", "value": "4fc0ce180a222a9475a4df8ee6d2346ccca2c768f6dc192bde09000f52d2c3f9e71f1135eb497e0c89a9d5d625caa024", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214724, "uuid": "6cf66c2f-7f9f-449b-af07-c19e60b51f68", "value": "T1D7932A0388258F77C0456DB126BB5A300767BD220F4F0F89766C9AF44B4B8CEB51EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214724, "uuid": "0d846adb-895b-44b7-b078-d44cc6e93bd1", "value": "1536:o/Yb4wmn64LK1hmB64CmiHVIUjXCZ5h1r+IWLtQE4WWcMnhR090jUeQfXm:R06J1EBCmifXc5h1SIWxfycMhR090Qer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214724, "uuid": "932b9f9c-7a4e-4337-a64d-c174fa0b5a88", "value": 95918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214724, "uuid": "e3bf3cde-24ae-4fd0-b17a-5751e1d29667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214724, "uuid": "81bf7df0-2d30-4df8-9d98-fd3875cfe01f", "value": "e79614164f8206b54afc268eae394d95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301495db-c694-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679257528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257528, "uuid": "32c220b4-fc6d-4a2f-9e7b-85c837349c2c", "comment": "Malware payload (Mirai)", "value": "460002f4e084f9156a41a004dd595324", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257528, "uuid": "e763b883-6378-4a67-b888-bca14f3430ae", "comment": "Malware payload (Mirai)", "value": "06fa36a5e10a8574d6971a657a571d3d5fbea66ba6fe4a855db73af848e8284c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257528, "uuid": "b499d3bc-e89a-4cc8-8799-604810735693", "comment": "Malware payload (Mirai)", "value": "4bc3c000ad41cf232a54b7187fc4dcc4bcf8bd63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257528, "uuid": "7756d052-76cc-433b-b2a7-e5261a2f1f92", "comment": "Malware payload (Mirai)", "value": "cebdfae726c39382cfcaa6ef9d8429ca9f448ad36277f91d7d0e627fec85ef7a60f306ddb61f90d51f6bdfcdc1a71cd1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257528, "uuid": "143e9b29-c792-4b72-9ea6-b086634b077f", "value": "T183D2E0B1117A5E77C3904932F27DC944B08A5DED8ABE302A2D1109BF69D1A0934FE95F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257528, "uuid": "d5a97611-96da-4494-94ae-212b8d6cfea5", "value": "768:lUV8NkawCHbGFyUvMs8+ZpcKQcus3Uozc:lUiNoYFUvM6kUTzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679257528, "uuid": "1bdea00d-b029-40fe-8962-0f162dd835b8", "value": 28848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679257528, "uuid": "90f654a1-1533-4cf1-b6d8-c728d116c67c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257528, "uuid": "8140e638-a4b2-45f5-9695-1168b7ffec45", "value": "bok.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2894eaa-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679223414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223414, "uuid": "ef409e42-310d-452c-8e80-78faf4fe6a82", "comment": "Malware payload (Gafgyt)", "value": "e2ffd67364b10ef7ff4d5287169c67e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223414, "uuid": "018cae1d-3480-433c-bb52-5215adf101ba", "comment": "Malware payload (Gafgyt)", "value": "07860de590b55150850d14c4abea95bbdd5dd4ef4eb4e681720be24daaded4e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223414, "uuid": "92301857-e96c-4bf1-af30-85490e667972", "comment": "Malware payload (Gafgyt)", "value": "e2309f99623327ab8647fff7e5d2585ccbafb18b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223414, "uuid": "1dff3196-80fa-4b15-bfff-22d6a7cb8739", "comment": "Malware payload (Gafgyt)", "value": "4122f76f9110bf60e2ae397ecfb72f034dded586270a32280d8acdcea26b941102d018b4b7f880013f4a10066213c31f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223414, "uuid": "961e1053-654d-44a2-bcf7-8e9358d71492", "value": "T12EA33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223414, "uuid": "201ff491-ae47-4ed1-84a3-429d8a319d6b", "value": "1536:xfRuqNM5h7t/RiRt4ndphaQoRKzO6F6OXj6ufeRTe:OqN8jRiR2phaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223414, "uuid": "b7d764bb-f11d-446d-900d-ae0b4fca92a6", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223414, "uuid": "24002ece-317c-409f-87a5-cd10c5f5596f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223414, "uuid": "1d9fab1f-2568-4296-a8fd-2612d92f241e", "value": "e2ffd67364b10ef7ff4d5287169c67e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11722cf8-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214097, "uuid": "ee3c2bb3-6e17-4ea0-b2af-cca2729cc381", "comment": "Malware payload (Mirai)", "value": "b54ce075be65da6c9eec89e607d6fc56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214097, "uuid": "cc36312b-9adf-42c3-995c-81dc465fb92d", "comment": "Malware payload (Mirai)", "value": "084c722d5807ff9624ed07e5eec95326ed46f58e35772882c94561e53b32c013", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214097, "uuid": "8ee1b579-ab50-4106-8b6c-66c9283f339b", "comment": "Malware payload (Mirai)", "value": "ece8cb19db726a9a5683332e098c7095661e6155", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214097, "uuid": "0944919d-826a-4a01-80b2-76bd2edf3328", "comment": "Malware payload (Mirai)", "value": "b8bc34ded594b1ce84b0006291d9ca0170467cdb5420d13fdfda4ce8a050c7c3276744741b95b7d33827496027aab80d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214097, "uuid": "1817b8d6-0307-4725-ac9f-9c465e4a6641", "value": "T183F34B09EA408B13C5E12B7AF79B428A73239B98B7D733055528ABF03FC279D5E36105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214097, "uuid": "323994c2-b2a9-45e9-961f-64157ed807d4", "value": "3072:JG/rmPd3pGeQj+UcH1rkr8AawXFBD0chCmlmkgDY345hAsPN7xM/9/FECmQw9B1t:9H1rk4AawXFBYchX9gDx5hAsPNtM/9dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214097, "uuid": "c4ec88a1-9ea1-4ecc-abef-d259211275b9", "value": 169738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214097, "uuid": "89d408bf-cac2-4498-9c2a-79ee5e141a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214097, "uuid": "2b118450-64ae-4961-ace3-c170e2c68cd0", "value": "b54ce075be65da6c9eec89e607d6fc56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8f836f-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679214416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214416, "uuid": "91d69a51-fff3-4751-8ceb-0180500de2c7", "comment": "Malware payload (RedLineStealer)", "value": "fc6b420cd8dbad766a31d347ca1484cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214416, "uuid": "7040fd64-feea-4a3e-a343-d9566da5dcf7", "comment": "Malware payload (RedLineStealer)", "value": "089a4c4938dcfeec6b8b7b09c18e38429bce18162a40f8b1c69f971d43b2b668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214416, "uuid": "953f9947-dcc1-4f27-a175-baeed94e6216", "comment": "Malware payload (RedLineStealer)", "value": "340d7b89b453c60912d2c93810568c3c7ce32ab3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214416, "uuid": "29f7027a-3813-4bd5-a718-826a2b48b691", "comment": "Malware payload (RedLineStealer)", "value": "d871e6a4a4e25c2cfc0e048175881bdcff72a17c4fc49b597d4d61561d90cfd1d5ed65d399b2fab64cad170d81fc0ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214416, "uuid": "547aea07-7aeb-4527-ba76-188d89b9a0b5", "value": "T1EA45F10392A17C49E9664B739E1EC2E8B71DF2F1DF5D7B653218DA2B04B11B2C163B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214416, "uuid": "67553f42-e622-4068-92ea-b492c3779bbd", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214416, "uuid": "fecf936c-9f27-4a6d-93a3-ba9cc4adb6a1", "value": "24576:BdrxnnySqJxCY2MNaboMVEQxSrvmK9ch0dzt6Jub86X9mkR:BPnnoqdlbVvivmK9che6J48q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214416, "uuid": "75148042-4af0-4342-b2ff-d59179444712", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214416, "uuid": "eb7242c1-f78c-4f89-9f5a-ed1875b0c4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214416, "uuid": "a6d1ba93-c9c6-44bc-aeda-a4b544b9694c", "value": "fc6b420cd8dbad766a31d347ca1484cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d211d1a4-c699-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679259947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259947, "uuid": "3b9c73c7-1cc4-402e-a749-0e5509ea5dc7", "comment": "Malware payload (Gafgyt)", "value": "5eac949ea218159d57e391a03e8e20e3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259947, "uuid": "f8d51cde-627b-4978-bacf-e429e02b1889", "comment": "Malware payload (Gafgyt)", "value": "08e3a4fd6260dab4de45fe1da2301c52ae8f7ec9cf02f755e54a666d745c4d59", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259947, "uuid": "e642bf86-5c47-4d77-bd86-0922b3a76478", "comment": "Malware payload (Gafgyt)", "value": "8cc754e75838ab44e6d1a82ccba0e95a6446f8cf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259947, "uuid": "45b80ac9-61b9-4413-99d1-c607c8e0d88c", "comment": "Malware payload (Gafgyt)", "value": "8febc2c40c880d6838d0540c3649f3d7829027fb9097a64fef9289d6683d84b8f52ac57bb2279832eb681c89924e288e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259947, "uuid": "efacef7a-fa41-4807-992d-06bbb9b67881", "value": "T167836B23A552C67BC1D747F91BEB95214423B8791F33620A73D8BDED2F1A8C82E5A305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259947, "uuid": "0dfafbc8-e197-4443-96bc-3f138143ef42", "value": "1536:A74X+IUTRuGwiwp4eRPgCpR3apWU4aa3S3CTVeJxYmoImu9GjDD2Yre:WaUTIvtRP3fCfa3OCTVeJxYmrmu9G3Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679259947, "uuid": "19c5a7dc-cbba-4906-8f45-9b0700b3bdf8", "value": 82332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679259947, "uuid": "d909d01a-c268-4ed7-b059-31bd20e149f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259947, "uuid": "56255bca-7424-4982-8a25-d19fb437f8af", "value": "5eac949ea218159d57e391a03e8e20e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d21158-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223421, "uuid": "98bf1d7f-4615-4253-8ae1-23088b7eb6c2", "comment": "Malware payload (Mirai)", "value": "8792f88746d1e1244483ba4669420f05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223421, "uuid": "373c8989-542e-44e8-bdeb-2703720d4193", "comment": "Malware payload (Mirai)", "value": "08e5eba5e4888c6994e5b02254b06458108f57f55fe4d248d1bc7dc8d83f489a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223421, "uuid": "b7716866-b0a3-4d7d-b1a0-afc05bab0342", "comment": "Malware payload (Mirai)", "value": "c594c1c1d967d5a92b5c9ad9c215ac07d8bffd2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223421, "uuid": "212d01e3-43f4-4d19-a5fc-cae52776863d", "comment": "Malware payload (Mirai)", "value": "e1b2d7050112b4e82aef15052c602ff90d5c288369ffeec931f6cfe97a8f4a1092e8798d3bf52709793b4da121f536e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223421, "uuid": "41ac239f-5d03-43d1-a12b-d29d792e23c0", "value": "T13E43AEA1C0A9ACA8D64845B8B614CD3E9323E00456A33DFAD65AC766F04F9FCF41D3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223421, "uuid": "33e43460-3552-42c1-88da-e99b712d3276", "value": "1536:e/IlPAgaaxEwtMw3Eo7a1vnhFfs3/bj1LA5yCzCO+:eAl4/Be3/7a1vXf+DRAQCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223421, "uuid": "d221aacd-3226-412b-a8b4-2cb00fbf7c25", "value": 59296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223421, "uuid": "c7733678-9fa2-4222-89ec-2d31ffb2e455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223421, "uuid": "1048f24b-98c7-4077-96e7-cea8481b3b23", "value": "8792f88746d1e1244483ba4669420f05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3328081d-c62e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1679213724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213724, "uuid": "4cc95fb3-c0e3-4786-9bbd-753f967c8219", "comment": "Malware payload (Gh0stRAT)", "value": "e2b41d74c9b417aacaf1cf0e5b0df5db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213724, "uuid": "a3b70564-08cb-4b20-98de-97fb04e79d39", "comment": "Malware payload (Gh0stRAT)", "value": "097b0639eac5dce89da4f863e328cb7cdb59dddb97874056d5745baa6aa549fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213724, "uuid": "9c675de6-b366-4176-970b-adbfb4526afb", "comment": "Malware payload (Gh0stRAT)", "value": "31c5039f7a2534f8a8b0915b62f3a6f744c1f0b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213724, "uuid": "00242e15-951b-4655-9912-e640923f4d62", "comment": "Malware payload (Gh0stRAT)", "value": "7b7b54af67330328d9c735f8a54cbc5ed96ab80c855b3cb002027c81d92448fdb7d726edc4c7c1bb73b48569c9a41590", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213724, "uuid": "566b7702-91f4-463b-9ca1-5c90aa243609", "value": "T151B4BF127AE70815F7A66A741FD2A4FE4B22F4670B0B629F315C131E5B22E518C9237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213724, "uuid": "262dc804-013e-4b54-a4da-d861609bace9", "value": "b9606ccae7f25235a598b6c63c59eea3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213724, "uuid": "4265e9a2-67f5-4763-bf79-7b4f6e468648", "value": "12288:hh9rd3EzdxmW/MW9W2tBKDeUlQBPoriT:z+xBLIHtQGiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679213724, "uuid": "8a5bd8c7-8d50-4fe1-a08a-45d581ca9b53", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679213724, "uuid": "cc8a3774-45f7-4bd8-9d4e-e6192f31d10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213724, "uuid": "c9ffc0ed-169a-49b1-a67f-798e1f174ad6", "value": "\u4f18\u8d28\u5ba2\u6237\u7cbe\u6599\u8bdd\u672f\u6846\u67b6xlsxp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78077688-c65c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679233597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233597, "uuid": "8b67d381-2259-4cfa-8b55-bb65b85ab550", "comment": "Malware payload (RedLineStealer)", "value": "5aeb282575caae1e3d29ab49ddf1ffb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233597, "uuid": "8181669d-7d8a-489c-a431-3f82184f207c", "comment": "Malware payload (RedLineStealer)", "value": "09cfe8bdf28850d0ea52d9aaff906ee7f30300d1f1dd3e87641c1252b16bcc39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233597, "uuid": "76da7afb-ca87-47db-bd8a-a78ccdccd4c2", "comment": "Malware payload (RedLineStealer)", "value": "fc371de3cb73f98dc7c9934ef356f5c3791b688a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233597, "uuid": "487f7b63-d9c1-4faf-9b5c-b2273a716cfc", "comment": "Malware payload (RedLineStealer)", "value": "430daf088006461053aa18127ff81969a136097c7b0c77462249d5d6e8dc767b9df21b2fa4e165e9d6675639a971f1ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233597, "uuid": "1a7c2473-9d98-4b61-89fe-c846b40ac163", "value": "T168352207B6FC8123D8B543704AFA03C30A377D906B71579B225E58AE4D72B78B53276A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233597, "uuid": "590af34a-1c95-40d7-8887-ad572d4592ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233597, "uuid": "4909b4c4-46f4-4ea4-8aa8-77a7cadad650", "value": "24576:ayyjhsF7TSIFYu2cE+zg/aIzbJWwphj4Nxs0InD:hyjhs5OIFDF/Iz4QhixsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233597, "uuid": "d1a19de0-7a58-4a26-8b39-9167c98975ce", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233597, "uuid": "8560824e-c111-480c-94bd-44dea5ac4256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233597, "uuid": "b345a8f0-1fc0-4599-bbb7-e5464cb4f93c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987ea611-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679223343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223343, "uuid": "e557d44a-485b-4bba-97a4-155beaf5d0af", "comment": "Malware payload (Gafgyt)", "value": "3eade75d8cf6b887c270398d53eb2421", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223343, "uuid": "f1432fa4-de50-4cb3-a803-150012300921", "comment": "Malware payload (Gafgyt)", "value": "0a7069d2151c31dad9403f26db704b8003678e96ec6b5a56a2fa8f67684aa8ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223343, "uuid": "1e30cb9b-eacb-4869-abbf-726538d41521", "comment": "Malware payload (Gafgyt)", "value": "684d9b3a9f3c1106167757a112542c67faf3061d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223343, "uuid": "89ade20e-e31a-46ae-b385-cd910076fb4f", "comment": "Malware payload (Gafgyt)", "value": "579cfc6ccc784a5f0b56585e7bec546e63f11f7d310bc2b8e9810b4ecad81872bfa9e59646b73d6ef4de316454da9d7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223343, "uuid": "f608d74f-2215-4a70-b159-0285e2d10164", "value": "T141B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223343, "uuid": "3f27d7d0-a1a3-4924-b870-c558e26fdfff", "value": "3072:Cr5W3CDJrl5h5dVEgwxhKdwwjF9GhsR1Ae:KQStl5h5dVLkKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223343, "uuid": "778cc17f-435d-4f3b-99a9-ce566f526cb5", "value": 116519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223343, "uuid": "d454a63f-67c8-4168-a394-97480c3402b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223343, "uuid": "b2c097d1-0ba0-4be5-863d-bed9d1d233a6", "value": "3eade75d8cf6b887c270398d53eb2421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c0852e-c694-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679257529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257529, "uuid": "a53fb215-eb57-4b48-a60d-9c91b69dfccc", "comment": "Malware payload (Mirai)", "value": "77b7e232f77e413b428f472566b95c27", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257529, "uuid": "e7dcffde-e8eb-4e1b-b3c7-d8ede2a1f90f", "comment": "Malware payload (Mirai)", "value": "0c3784f1ad5ac4de3d59fc81c84f297699c762829c6c9a4cb1c8aa4c994b0beb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257529, "uuid": "e24c5127-f7b6-459c-8831-fd61d6d50af8", "comment": "Malware payload (Mirai)", "value": "836f60239e35e9541cb24d62cf745e01ca036923", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257529, "uuid": "82e2b124-a8ba-4f43-b581-6e41261e5a4a", "comment": "Malware payload (Mirai)", "value": "6073f3b0acd5628a57df03d8b1d2327bc35f2103175b767a3258268af17fc08bd2aa2e1dc6546621ca9efeee04e7544d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257529, "uuid": "44092861-a180-4ea6-81cb-7c3e576e0b9e", "value": "T1C613F297DB2BC9B0ED7554B48CA90CC5A6278EBC807E34624E708F7833C64192B77697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257529, "uuid": "406167c3-ccf5-4ed7-a480-50896eeed0d7", "value": "768:r0Zlud93hp1zhmwWlLgjZI8SXXEVpkuPq8Ta0dfXDCiKGuMWtcdZ2JgG5Y9q3UEw:r0TuTxz4raI84vpwpJTCiKGHWtcdZ2JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679257529, "uuid": "eeb9eca2-fb4e-4f3e-bf9b-9ae87449392c", "value": 44564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679257529, "uuid": "7b505f2f-073f-4719-b824-f36d6f779489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257529, "uuid": "bed62ac3-5c8e-4caf-ae6b-5cd4f34871a7", "value": "bok.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0455c3-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679214409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214409, "uuid": "249a7227-a2a8-4a27-a9ed-72e188eb6867", "comment": "Malware payload (RedLineStealer)", "value": "74ac3e8f09609dd1de05364529eb2d6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214409, "uuid": "009d801e-ab54-4b75-8c78-535478c5ccf8", "comment": "Malware payload (RedLineStealer)", "value": "0c803f7a23919acf63c2925a954294932b193f0e5e0897cd39914af661f2da7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214409, "uuid": "6240df04-e2b5-46c3-9744-2c6fc9eaa447", "comment": "Malware payload (RedLineStealer)", "value": "74db95226e0e80f352d0cb9cc4175e476d5b6ad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214409, "uuid": "915de967-08aa-42ed-8670-4b7f28186e70", "comment": "Malware payload (RedLineStealer)", "value": "8e4457ddd15115589d0bef2a868d35884b075a93b5c669142f88b6ebd6ca65f06ee3bbecf759c713b87916ceb7eb799b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214409, "uuid": "361cbf81-89a0-483f-92f8-63d9e3efd26c", "value": "T1FB45F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214409, "uuid": "d874332a-7d07-4014-9714-0d85d8d7f5a0", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214409, "uuid": "c5106e3a-6124-4348-bbea-c89ab9400499", "value": "12288:gxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:2bXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214409, "uuid": "a989cc1f-0edb-412d-8d5b-47d6515f88cd", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214409, "uuid": "24bc3839-1bd1-4f58-b6d7-a1b788864108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214409, "uuid": "94116028-b3a3-44eb-ae91-6fca540c58ab", "value": "74ac3e8f09609dd1de05364529eb2d6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574d9ea7-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226670, "uuid": "f5eed2b8-b46f-480c-93e8-fc52e4f68dae", "comment": "Malware payload (Mirai)", "value": "32ed410c8a4a46fa5fb38637d77ac3cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226670, "uuid": "df4a0f74-a73e-449a-bce8-1f924d9cbf90", "comment": "Malware payload (Mirai)", "value": "0ce96bb60eb8889dc26b6d5a1f3d48511234d377a933c62fb9983e4000caa6b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226670, "uuid": "95c6f4fe-8574-4ffc-8013-b6c3a566a3c9", "comment": "Malware payload (Mirai)", "value": "d1e0449262ab7e6f719d2bd9b46d596632cc3cb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226670, "uuid": "30589483-6210-4ded-ad19-cbcd75587aa7", "comment": "Malware payload (Mirai)", "value": "ad0d113b893a2c8c05df3ecab17dccdbcc921031eea5b202b9cd56288e478820857bf11ad8d18c115372b2472367b0ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226670, "uuid": "b942e49c-96b1-48ce-b004-5cc3cfe24d80", "value": "T10D73F819BF610F77EC6BCC370AA92B0529CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226670, "uuid": "a5da2b31-e252-48c6-872e-bffb91e3c901", "value": "1536:7J5dbFB4x92nKoI+a98M26ofWU+UZ9CYXzdJa10o:7J5dxBu9uKoDIUXd4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226670, "uuid": "34ef3ca5-9024-454a-b8a7-1027d29bf28a", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226670, "uuid": "de96a533-efbe-4284-8748-e91af1f3f2eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226670, "uuid": "8f51b251-cf7f-45f7-b0e7-3c4177b97348", "value": "32ed410c8a4a46fa5fb38637d77ac3cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0159e1-c61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205741, "uuid": "bdbc8383-19ac-41f3-904f-c14d51aac253", "comment": "Malware payload (Mirai)", "value": "1f588679ef2b97bfc38b8db3ed42fd79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205741, "uuid": "87a75570-fd90-456b-9a10-dbdee220004f", "comment": "Malware payload (Mirai)", "value": "0df418ca8b39c9cd365bd5c9331d48fc9320db6f1d082132f8eae53c5ffaa5fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205741, "uuid": "c4c206d0-2136-47c8-9512-06e3365fbee6", "comment": "Malware payload (Mirai)", "value": "92aee284366790c373b0244f1fba443d29c40a08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205741, "uuid": "a48630b3-6964-4484-9eac-42246ce22982", "comment": "Malware payload (Mirai)", "value": "48b10e11a242fac9ecfd90d074ed98b964ffd162dcd921420d3808525aeb589f7239ec19b80de2197b4a02f15f64ca05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205741, "uuid": "887b688f-19f3-43bb-bc33-5632880e145d", "value": "T1CCC2F1F63E773997DA280039389DCE3792B5F062D79EA713A240524920171BDB7319ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205741, "uuid": "a72b91ee-a804-422a-98f4-547f5ab0be11", "value": "384:Mn1DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8QFQ1+MVNyY:CMwKDZOFbBy6sSHRYfeAxdd8mQhu0NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205741, "uuid": "c024cb53-49ec-48ae-a86d-26ecb941b133", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205741, "uuid": "38ac49f5-ae2c-49a7-886f-48771614bf61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205741, "uuid": "8ed88597-5d6c-429c-89ae-7f4735bd84b6", "value": "1f588679ef2b97bfc38b8db3ed42fd79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d312a402-c637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217858, "uuid": "1faa4f7d-836a-46e1-826a-9d07cd2ab432", "comment": "Malware payload", "value": "d38303ac972b4b18842b72b482da0016", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217858, "uuid": "9fcedae4-85fa-4fda-b944-9f23313fa06e", "comment": "Malware payload", "value": "0e16ec7019e34e4bdbd5f5f75cb91cf2b20eb96979caa227cb0825e186b73163", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217858, "uuid": "28e71997-9b29-4b70-a673-d047683ffa7b", "comment": "Malware payload", "value": "3d33aeaabc196c112b572144c9468c6702ea0844", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217858, "uuid": "5eacda3f-527a-4db4-8823-f5ed53087dd1", "comment": "Malware payload", "value": "021577ce3ce09de54f480c106c411ed9e5a48fd7062d250e30eac8f98ca87ee00f1ade691d8a56a08a074c38854259a8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217858, "uuid": "42df1132-e18f-4dd1-b24c-0b065eaff1c4", "value": "T15D66F26B7DE6A93CD0BB903149A18057BC180E58D446F4FB3BA0988DAF39DC14752EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217858, "uuid": "830a3113-8f92-4703-ac16-e13e42255f19", "value": "98304:xSYMKNVLZek+6Piezkev0s0dXInBY/C5wJY765tY6TkYFCw1fnxJPw:xvMKf1T+6PiM8sUsBECOJM6LVCgfxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217858, "uuid": "64f5d780-2271-4ad8-acb4-8ce36bbb9810", "value": 6802234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217858, "uuid": "658ccfa7-cdb5-43da-961e-6a4ec814cf76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217858, "uuid": "953f9253-a05b-4cfe-b570-e0d9d6c3699b", "value": "extra.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f05177-c669-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679239370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679239370, "uuid": "5ae4eb6f-b25d-4c62-9d0a-6a14acab556f", "comment": "Malware payload (CoinMiner)", "value": "72ac13277f6e64cb10e5b7684906bc30", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679239370, "uuid": "19876157-5b1f-4731-a68a-c8d085a0a2e6", "comment": "Malware payload (CoinMiner)", "value": "0e979575a6a8f2a3515db0a58b43f409165446583bef5baed93ef4c15f9ef2a2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679239370, "uuid": "aef2ad4e-1268-4925-ba87-a96b39ce918e", "comment": "Malware payload (CoinMiner)", "value": "c24f1409bed497ff3029f2036e56485d39b022f7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679239370, "uuid": "627f8a2d-1006-4e09-8bc6-222cc4393557", "comment": "Malware payload (CoinMiner)", "value": "8cab59449b6a9b1cc74df57eb68cb2461b82f6d152ec7afae623e44c413ebd996cadd00f112ba68810add8ee24e9f8ba", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679239370, "uuid": "2f2627d4-1018-4fbb-ae79-61ee4a17bc71", "value": "T1E1B4DE616B404CA4FDF404BEA73753D94B3E5DD69523E14E1E0A714322BE5B0BACBB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679239370, "uuid": "49f60174-1af1-4c9f-8263-c63a68e0e8bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679239370, "uuid": "343945a6-6cca-484b-a054-2e5c66fc49ca", "value": "768:5tIY3mn+1uwUstacsUPQayXOxoBcpALX3Dy6Mt:5N3mn+1uwURj5a6Oh+LXzy6Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679239370, "uuid": "c0533ddc-e1c4-4cc9-bb46-a8f609322dae", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679239370, "uuid": "0ae641fc-1e4b-4409-9617-5e7585a9580a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679239370, "uuid": "05d3c87f-1d72-4705-a6b3-bc8faa0265ce", "value": "CC_CHECKER_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28342c2e-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211988, "uuid": "ff2a00e7-895a-428b-9570-951f5fec973b", "comment": "Malware payload (RedLineStealer)", "value": "8648c324239ee09594a054a16908ae5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211988, "uuid": "7de692a0-2d17-46b9-9654-efd1fcb29a0c", "comment": "Malware payload (RedLineStealer)", "value": "0ee0969404a31e304d15a5120f15df1ffb0ec0504937190a769fe3b39ca15652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211988, "uuid": "9feb6016-595f-449d-851f-62428c8b6d1a", "comment": "Malware payload (RedLineStealer)", "value": "6ad0541af3a670baca26365adc1ee2e1aee47471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211988, "uuid": "af5d497a-f26e-4871-9d2d-8374b9658c1d", "comment": "Malware payload (RedLineStealer)", "value": "01bf901b041274af46c30f1019faa04c48b20136fdfe7f44f4ee6f66bdb9a5b076c8acf8a7f8b2b3a979f39879e97879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211988, "uuid": "6cad558b-17df-494c-a68a-9998aa0d2b96", "value": "T1F145F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211988, "uuid": "826ffcc7-c860-4ef4-bed7-498171545fc0", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211988, "uuid": "1ef2b2aa-702d-48f6-9a35-bdbf434908fc", "value": "24576:m1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:m1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211988, "uuid": "51b6d494-3e04-4125-a98d-b98aae389cf7", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211988, "uuid": "3586238c-17c9-4eb5-a997-995ceb129b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211988, "uuid": "073f973a-95dc-4cee-b001-0e9e3ad9074a", "value": "8648c324239ee09594a054a16908ae5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005ad58c-c66d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679240697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240697, "uuid": "6e9fe882-e148-4310-8309-b7ff925b184e", "comment": "Malware payload (Mirai)", "value": "d37282f999006eaaf7bc0be8e59319cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240697, "uuid": "dfcb7109-dec4-432c-8e48-9ac405b18e14", "comment": "Malware payload (Mirai)", "value": "0f3330366714516c9d337fdd3cb52af03d86ef2a7ded3e3e3be5dc0e6a1e1beb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240697, "uuid": "dc77e30f-9e83-42d7-8180-95714016564c", "comment": "Malware payload (Mirai)", "value": "84954ff5c59516252ce5f22943da248df9836e5b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240697, "uuid": "d592b1bb-22ce-4a7b-8641-0804b6d2f9f8", "comment": "Malware payload (Mirai)", "value": "f1bd8c64c80ec90ac9c0ac91231f1ebcf5f9ff9227e9f555ef1c709eabb5341f22c1141608e219242eda623933c48303", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240697, "uuid": "44e4d8b3-fa4a-4797-98a3-ea8d17c6fcf6", "value": "T12E83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240697, "uuid": "cd24425b-b617-4322-8986-8a2065dec014", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTD7ZDYovZ73x/nL8y8QZ:Rakdn2Eo3ePu5GTDRYo99Be037Wm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240697, "uuid": "c2688b2f-9f8b-4054-b9aa-9711d99a030e", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240697, "uuid": "8e060afc-3ea6-4fa5-a01b-46e240ed22c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240697, "uuid": "38430e77-258c-44c5-830d-485fafd35f41", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a04dd2d-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212581, "uuid": "b2d366d2-ca18-477e-a4a3-76c146dc0c6d", "comment": "Malware payload (RedLineStealer)", "value": "c0fa34219c589c4b817b28e3c664d331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212581, "uuid": "f06c0654-2fca-4f48-a41c-a68a228df5a1", "comment": "Malware payload (RedLineStealer)", "value": "0f5180f0a46093d20e48801e630f42ee550c05d8daa8e7f651d0df69d36dbd4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212581, "uuid": "f49a8dac-21d7-4bd6-aac1-e312b1f8f2d8", "comment": "Malware payload (RedLineStealer)", "value": "05224f4661b2ef7095676aa25c42bc67deb5b610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212581, "uuid": "3098fc91-a087-4546-ad12-7f05e766260c", "comment": "Malware payload (RedLineStealer)", "value": "7bff8630c9c1d6333fb8fbd221c1eeadeade18dfc90ca2b9167c9a112c65edf47064b437531a1a344cf85882ae02ccc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212581, "uuid": "b1f172e1-1f44-49ee-9daa-b99d9d5b6e6b", "value": "T12F45F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212581, "uuid": "6c330173-407f-46ec-8a2a-c6053df2cff8", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212581, "uuid": "e765f8f9-a529-4524-9417-f9dd10fc8091", "value": "12288:UxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:6bXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212581, "uuid": "974beafa-efd9-48ab-95f6-efd92c8293ca", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212581, "uuid": "5ae30135-4daa-4223-9c6e-908e9de4d536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212581, "uuid": "127a632e-909d-4e81-b1eb-c95f395c4925", "value": "c0fa34219c589c4b817b28e3c664d331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da9f3f8-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679241391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241391, "uuid": "f7cf4d30-1de2-4d79-af97-d75a8017c16d", "comment": "Malware payload (Rhadamanthys)", "value": "9db400bd2b2a3c0a78f62bf91bba6b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241391, "uuid": "6c37f0d0-3124-40e9-8862-e463d44d5632", "comment": "Malware payload (Rhadamanthys)", "value": "0f69661a8399c27025ee50f6d984f7ad9fdc2c2b5f8af971f0968a86934e98ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241391, "uuid": "d8b6df01-bfcf-4183-9730-b83fab4070aa", "comment": "Malware payload (Rhadamanthys)", "value": "7f2417d24aa524a1927240a62e244b8a04ac1b7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241391, "uuid": "d50cb24a-afed-48af-9767-13a2dfe3db3e", "comment": "Malware payload (Rhadamanthys)", "value": "a484319f4267b8b372f5a93751cb8da12db01738793e1354b1191a38e86cccb8da8c3cd80afa51546f6291a3d0c7c877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241391, "uuid": "3c0e05b8-79a6-4e3d-963d-5022b72a191c", "value": "T1E075E060DB00413DE0AEE5F85579479358483A32056E819F74CC2FFF2B9589A8E3EF99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241391, "uuid": "b0723e6b-a496-497a-aa8d-d6ef12441c2a", "value": "231e93d6c38d93827fc1150514e60423", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241391, "uuid": "0ec7e2e4-b829-46f3-aa3d-d79a3e9494de", "value": "24576:bZpSiJHaIw3ZFeOvC4x8iexyBknL2i2djMS1DkWtA1vRI2we6LGcg03KvsO9dlB8:tHaReONwy6nLQW64vRI2wvLGcSsOB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241391, "uuid": "0f896a64-33c6-4ff6-a7da-f0bd89a648eb", "value": 1638312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241391, "uuid": "dbc34b28-1f8a-4eaf-9e1f-b57085b787e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241391, "uuid": "38fadcde-48d6-4d60-b361-01ed05d05526", "value": "9db400bd2b2a3c0a78f62bf91bba6b62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c790a0-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226696, "uuid": "fe16e343-2f07-4357-8358-d71e60bdbe7e", "comment": "Malware payload (Mirai)", "value": "9268691f787a576ece224dd11273426d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226696, "uuid": "3af1688d-6fb7-447e-8943-df57bcfc9f8b", "comment": "Malware payload (Mirai)", "value": "0fe7d7c3965db614aa7d4208da75dfcecbbee0876fb66f508f55b93b68ccf07b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226696, "uuid": "fb6bbf07-4249-46e1-9be9-76dcb312c1ce", "comment": "Malware payload (Mirai)", "value": "7790ccb5c10d149506b760931954c275b7e09d46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226696, "uuid": "c031c94c-30aa-4544-a33b-5b3eff7ab0f7", "comment": "Malware payload (Mirai)", "value": "caa556928f4b250223c510c51f19d4267646eb435fef636369cf02c3f40d6ce36086c485f739b34e3ee0cedc2e768b49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226696, "uuid": "25b2851e-f89d-454e-b828-511e8f7debfa", "value": "T175B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226696, "uuid": "c7f355be-808f-4b18-b65f-d032aabeef73", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1a/LWy:c9sSyzz36YaWWgg1aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226696, "uuid": "710c5f26-1f03-46b9-8693-8928f1709302", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226696, "uuid": "282e0d6c-4220-4f3c-9bc6-738e24819a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226696, "uuid": "005b59b6-6a08-46fa-902c-c145b059a7ee", "value": "9268691f787a576ece224dd11273426d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10107182-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679212806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212806, "uuid": "bb778d79-e0c9-4014-b769-008ab17be58c", "comment": "Malware payload (Mirai)", "value": "1d5a1ddb972fbff21edb2177c26b872c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212806, "uuid": "33ca2bc2-022c-4910-ae92-b8f74b90663a", "comment": "Malware payload (Mirai)", "value": "0ff6c03b303d6a0aff5877928bd8fd3610b2b8fec7a5319aa08da91cf0245261", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212806, "uuid": "c726fda2-4331-41be-8f5c-0914e5eef393", "comment": "Malware payload (Mirai)", "value": "282bdf2c01d45a5bea0ce416ad3fead6131e73e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212806, "uuid": "57dbb10c-2dfc-4043-a4d3-224ff1826e69", "comment": "Malware payload (Mirai)", "value": "0009f927bbc98b43e63c494a7ce32ef2df05012b72b3ec13dd2abec9473fac5efeb84c745722b25e9dc22adfeffb1aeb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212806, "uuid": "c228aea8-98b2-4c87-9d25-e1636e7df45d", "value": "T11DC32A46FB418B13C0D62775BA9F824533239B54E3EB2306592C9FB43F86BAE4E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212806, "uuid": "7f56c541-49f9-4be6-bda6-0da3c48ac5c2", "value": "3072:i4cVRRpTJtuvjO0DP4ipNdITqpr+u/Vl7M/9Wr:i4cVRu5DP4ipNd+q4u/n7M/9Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212806, "uuid": "7111b1ea-6579-4a80-97f6-2e7d5d9808d0", "value": 123375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212806, "uuid": "4827f906-1b89-4b56-81cf-cdc8104db0ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212806, "uuid": "82a7a5da-a754-4ba1-bdf2-5ca63043322e", "value": "zed.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f792f941-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679213195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213195, "uuid": "ed92a13e-6cdc-4b5f-adcd-1d70318f8965", "comment": "Malware payload (Amadey)", "value": "ee88587c110b84c4d8a72cbfb5af59a4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213195, "uuid": "2c148850-d008-4e3e-a787-757a5ed2a719", "comment": "Malware payload (Amadey)", "value": "108ff4f2772c608cdf93182d5a01be3da75f3c03107dbea5413b066b0ba6e843", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213195, "uuid": "dc0425c8-2e45-4da5-8bd2-f6bcd696fec3", "comment": "Malware payload (Amadey)", "value": "3b9e0db34cb6b35c926f20fd548b77fa27017625", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213195, "uuid": "27a44cf9-d51f-48ad-857f-3f5b78405e63", "comment": "Malware payload (Amadey)", "value": "4a47025fafaff394c360cac4ad721064738524cb18aa86e75200f29fd0c2625b80b643e7bdf5e56f10d1f95b60090f06", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213195, "uuid": "d391d3cf-be0d-48c4-bf11-ddf9f5071deb", "value": "T18A45F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213195, "uuid": "079d8735-b388-4ad2-886e-d8b84b32436c", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213195, "uuid": "9ee077c5-b410-4d8e-b940-af5e38cd7480", "value": "24576:ILdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:ako0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679213195, "uuid": "05eebbe0-af4b-450a-bfd5-9ebcb54fe0fc", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679213195, "uuid": "c3d4c1bb-371f-4bd6-a68f-cd5ad0a5ed73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213195, "uuid": "6daf55c1-6ba7-4290-af50-083333c323bc", "value": "ee88587c110b84c4d8a72cbfb5af59a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd046847-c637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217848, "uuid": "115fe3a2-49fe-427a-b797-9ad6fc54ba2c", "comment": "Malware payload", "value": "3dbca37507617b0c9102961ac6e03e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217848, "uuid": "f3171c80-c6b8-4795-ae0c-dbca1b9ca4ff", "comment": "Malware payload", "value": "11680e4aaae731dbfc6133681b72c8bac28b2e54bde1b2680b71f86ced6aefce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217848, "uuid": "fac0a96c-c6dc-463e-9dbb-c3c8b1c93a20", "comment": "Malware payload", "value": "303eb70e2200a1740f6b0dece0337daacb314214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217848, "uuid": "6d89eb16-9885-4008-bd39-aa76974f6580", "comment": "Malware payload", "value": "b5ea93f3d0a0191bafbfa17ecf22065c313806eab96c573bbc714457704fb197c09d336da7fcb055dcc384bda42c43ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217848, "uuid": "5a8011c8-df0a-4088-9e7f-1b04c247cb26", "value": "T1D5B2394683F018A9F9778A74B5B14107F7313B8337B0C6EF8294C9699FAA381A538761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217848, "uuid": "bec97a6c-7433-413a-9c80-d313b0f7ffe8", "value": "9d4fb833b3cc691293ab97be58950f4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217848, "uuid": "e96e250f-0909-44ec-ba6e-ea913e0c855c", "value": "768:EBW3Ugr5y2iZj7q0iWNLEy2THbqhlnLSLEbGGNET7T7T7T7voODG6KgdG:EhhiWNLEy2THbqhlnLSLEbGGNET7T7TC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217848, "uuid": "1a820a8a-df10-4355-9bb3-670ead78698a", "value": 25168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217848, "uuid": "1064f126-c7ad-4d17-862d-36b3a7084d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217848, "uuid": "fa248e94-71db-49e7-9a0e-8bfc6ac2b3d8", "value": "w2k_lsa_auth.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ca5c87-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241532, "uuid": "bf4a3644-705a-4d5f-88cf-2b26445c3492", "comment": "Malware payload", "value": "ba4be7f719bf64b702ecb4fb5b87e9fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241532, "uuid": "f8b7a82d-e734-4970-a200-13811a133692", "comment": "Malware payload", "value": "12d6e48b5774cf84b7aef916405078219b10924c0527692f4c235799c533d390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241532, "uuid": "744a2a5d-0907-438e-ba60-23f7de65a0d0", "comment": "Malware payload", "value": "263dd3f1390afcb9151383ecfd415eca3ff2d197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241532, "uuid": "1a1a6417-ae51-481e-9301-5f7c2a847c08", "comment": "Malware payload", "value": "e6dd6b2fbd4ad9e27d7d8d098c71b3d4458d49938ab0c300d2feb3aa3e89bc424d35d4698484013bc0145eed8316b59b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241532, "uuid": "3653ec21-de2b-42d5-94c5-1ec57f020d78", "value": "T1C02633480279A4E8E02BBDB619EDD1B6590077D756FBB583E34B3F90B6043B1D8B43A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241532, "uuid": "00e7f7aa-b0bc-45c6-967a-411877dfbf70", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241532, "uuid": "00ffb5e4-4cba-405e-8b83-a5b84527fddf", "value": "98304:ru7HMEGcgQWBmi0mcYv+yPcdsNibHARcU78gdXV/xzJ:NcgN0mHv+yESNiLPU788v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241532, "uuid": "cdd73a5b-fa5d-4399-9aa5-70d6ba2ed736", "value": 4510208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241532, "uuid": "303cfbfd-9ba6-45c7-95ca-c23466986064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241532, "uuid": "70646fe2-c2f8-446d-88fc-e956f3eb8873", "value": "ba4be7f719bf64b702ecb4fb5b87e9fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc6f660-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211969, "uuid": "65d6d4e6-2f02-4aa2-8db5-99737945b8dc", "comment": "Malware payload (RedLineStealer)", "value": "595c1b979f6319b87f497bbdccb749f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211969, "uuid": "69b911b3-8735-4afa-9cae-792e21c4e811", "comment": "Malware payload (RedLineStealer)", "value": "12fddbdd061660bded549350966344eec5d25022d1825082b9b72d3847e01579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211969, "uuid": "d81c6cf9-a1da-4753-ba57-3d24b960d5b5", "comment": "Malware payload (RedLineStealer)", "value": "c5cf4c591217d747d300eee7900718e2c7822a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211969, "uuid": "66c839d6-5b42-4def-ac36-0d544a6b9f2c", "comment": "Malware payload (RedLineStealer)", "value": "7adb835f7b7923e3b6c638596e2c1f0c89e797b9d6b058f4f63258fb682bbf82026702ea235a2ce9362f3fdfb8662b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211969, "uuid": "f2dbcdcf-1eac-4999-b878-fb4ecf6e6175", "value": "T1A945F10392A17C49E9664B739E1EC2E8B71DF2F1DF5D7B653218DA2B04B11B2C163B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211969, "uuid": "9f2be3cb-c61e-4247-b695-3c31c3b8489a", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211969, "uuid": "f81bf426-7821-42f4-9902-fed7f9ddc51e", "value": "24576:WdrxnnySqJxCY2MNaboMVEQxSrvmK9ch0dzt6Jub86X9mkR:WPnnoqdlbVvivmK9che6J48q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211969, "uuid": "cca75efa-330d-4fae-b185-8e5f18aa37b7", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211969, "uuid": "4fbd7766-5b67-4193-a9b8-4cfdbfffeddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211969, "uuid": "0bc4da15-c106-4cfd-9d83-eeec1d49da39", "value": "595c1b979f6319b87f497bbdccb749f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d6ce29-c65b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679233165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233165, "uuid": "05963a13-dd29-43c5-a5ca-c8fa4a23b09e", "comment": "Malware payload (Rhadamanthys)", "value": "085e4e146e6d59a89f8da11d37a8cb90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233165, "uuid": "5f8aca95-2783-437a-8133-bef32054afc0", "comment": "Malware payload (Rhadamanthys)", "value": "13153ae03f0fc4c762a29a76840cb5ff889e51776bd80e7970c600306e1931eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233165, "uuid": "832e63bc-88c9-49c3-972b-84d8a24674a4", "comment": "Malware payload (Rhadamanthys)", "value": "10e44377d75550aa574f2b522c32ecd0a14df90a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233165, "uuid": "8fe027f6-631c-4fc0-81a9-07f647385073", "comment": "Malware payload (Rhadamanthys)", "value": "3f5e847b25edce6e195f5e3bd34e05c498b9f6198b95d4cb98cc8ea7ff8ef6ff29d84a033cd94ec976db14cf3a55ea3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233165, "uuid": "85d47cfe-d82c-4a2e-829c-99fada26ccee", "value": "T11C955CF25193FEC5A76F2D4890042A449C00189797BC969CFCC93A97A3E5574EFACBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233165, "uuid": "6ef49668-38e8-498a-8c4d-b4dd171f8ac5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233165, "uuid": "c9579974-f95e-43b0-9506-e4f6503190b0", "value": "24576:dJnPaiWqL9Ot09OX7l348A5NyxlSuvVUfAC4O9FVP8twASavn1xLcTFeYwRLNj8f:KkIlyUsFeYw1Fz7X+uaA4wU7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233165, "uuid": "91d249cf-0239-47cf-a171-e436cf1b47ea", "value": 1891840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233165, "uuid": "e75b8505-c7dd-43b4-a51f-210cba71ace8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233165, "uuid": "a6dee508-2180-47f9-a5c6-588622f1fae6", "value": "ppi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec842cd-c612-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679202013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679202013, "uuid": "5394e11c-6062-462f-a889-bf69d82be41e", "comment": "Malware payload (Mirai)", "value": "6e04f7c36b5b3b91576511b881973044", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679202013, "uuid": "cb11f5cb-5bdc-4795-b3f1-803e40cc79e9", "comment": "Malware payload (Mirai)", "value": "135e8686cf3596b141d568008c4fcd9865476e3fc3086426b3e8f525b1e7866c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679202013, "uuid": "95b48797-0c51-4ce1-b76e-8ab7611bb464", "comment": "Malware payload (Mirai)", "value": "6b0b29e50aebfb99c3364eeb41fb5d5b0918d227", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679202013, "uuid": "917a8aea-8297-49ff-ba71-800bc4de3774", "comment": "Malware payload (Mirai)", "value": "6b8e771e9ce2ea01805cbe2b8c041c625971913e1ebc9549f744db09c5c8a26a242d8d819deca5fc98f991dc8d510f62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679202013, "uuid": "1f7042e2-18b2-484a-9548-0cccfb1b2586", "value": "T17633026267AE2AE191B09777FC33FC1A56EC16E49C6730DA2CF0651977C54024EF2782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679202013, "uuid": "13a23746-dba6-4c02-8a02-c8f2f6ff54a4", "value": "1536:s9O/ZMAXIxNUk0F9rMLcPqF1aBexo4opKZbD:s9O/ZNKyxaLGqFUFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679202013, "uuid": "97ebd697-8657-4ba8-9796-7cec9210b405", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679202013, "uuid": "a0e988db-a3e7-4a8a-8569-17971a2735c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679202013, "uuid": "de7982a7-8ba8-4615-b12f-39d782843619", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f4f3cd-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211984, "uuid": "232a4b63-f47e-4d8f-be37-4086efb52b4d", "comment": "Malware payload (RedLineStealer)", "value": "7dc4daa7be4484aeb69d2e60face1c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211984, "uuid": "1f292d48-b0a8-4b5a-9aec-b3bb75c7d753", "comment": "Malware payload (RedLineStealer)", "value": "13b1212e65f9afe499505edbf3d64ea491cd24ad9307ca04ef83baf2f369cd99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211984, "uuid": "8873f0ae-2fba-45d5-aeca-548ddd0bc34a", "comment": "Malware payload (RedLineStealer)", "value": "5c7bd9907ad844de2e9fb66afe6bfb2ca66581b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211984, "uuid": "428ad841-ca61-444b-804b-51093e061c1b", "comment": "Malware payload (RedLineStealer)", "value": "8b73dd7f7281b7f9a041f7fb0c93929ed8aa192328dafb851f1b63589b5f4d5370d4841bd229ae09454fa4f9df3fd2be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211984, "uuid": "2f596de6-c0b4-4bcc-8eb9-0035dcb1cd43", "value": "T17745F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211984, "uuid": "ea388a50-9e60-4b07-b3d5-b7e133880a08", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211984, "uuid": "9629b4fc-ae9d-4567-be75-d20091512f09", "value": "24576:XDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:X3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211984, "uuid": "a644168f-eabd-4b9e-9d2c-288ae1da1752", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211984, "uuid": "82cd18e6-ade4-4c58-9384-8c55572b247c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211984, "uuid": "939a2414-2684-4837-a3f2-4b30ae13f8a8", "value": "7dc4daa7be4484aeb69d2e60face1c09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de9a362-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679223325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223325, "uuid": "1a7e40b1-b80b-472d-bd2b-4967e1d02bf8", "comment": "Malware payload (Gafgyt)", "value": "14daef52b2df156a138c92ddf66ffa58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223325, "uuid": "fe1fe90c-63f4-4ccb-bc96-e8f26c47e370", "comment": "Malware payload (Gafgyt)", "value": "13eceb4b809cb883fd19b3d549bd853c950967e5431323b2fecc2824f6392906", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223325, "uuid": "ba5daf32-fa8a-4179-a934-b7391bf5d16d", "comment": "Malware payload (Gafgyt)", "value": "e9b4d469faf5e24308fb9f844b0ba1dc73baa02c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223325, "uuid": "eef6b240-9b2b-4af8-81d8-36ad4704d8d4", "comment": "Malware payload (Gafgyt)", "value": "7a1ddc532e707411bfef5d2063ec2b2018a605a43dd70b6e4309e4c08957dc31e2ea829d7f9deb548cbc8bb78518e6d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223325, "uuid": "2bda7703-1682-4ac8-8722-954871fb69dd", "value": "T192B3E857FB11CEB3C85FDD730AA68A01108DA99756D57B6BB3B4CA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223325, "uuid": "b7d220c0-c8a1-4cd8-8de4-5e14c76d34b6", "value": "3072:UmJnlmfYvJMUyNhr5h1zKdwwjF9GhsR1Ae:NdJMUohr5h1zKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223325, "uuid": "e6a68cae-7b79-4261-9401-355a0c9858f5", "value": 116663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223325, "uuid": "c05c5a2a-8af8-45b9-9bbd-154be3c705b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223325, "uuid": "10443b01-f7fa-4cf9-9e7d-a559cd47b0a3", "value": "14daef52b2df156a138c92ddf66ffa58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ce104a-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241426, "uuid": "9f0a928f-c505-470d-a07a-8d58f2068f5b", "comment": "Malware payload", "value": "7d2bdf7ba8291db19189933a84fd1adc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241426, "uuid": "4d63a590-baee-4aa0-bec9-0efd3fc9b262", "comment": "Malware payload", "value": "14966a7a72a99444cae654f28e2bc4dbb92b7af8e75e98045ba5ffedce4a3407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241426, "uuid": "0f9417d6-f283-4f1a-b2ad-4641ede8240c", "comment": "Malware payload", "value": "646f17481734991b82c1d79391c0f5373a90b815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241426, "uuid": "4b7e91d2-d1e0-4f55-a560-94bf3673327a", "comment": "Malware payload", "value": "4198f98161dfc9b9e6750d2198ebde974b93665255edc5010c86a531d0416699b618b4ed8311cb5fa5769e59d03aee81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241426, "uuid": "d5ef85da-13eb-4053-95df-79801b2d9f5d", "value": "T17A46121AB9644C64D493D4331015D6A3A205D29EBA18CFCF23B01D06FEF59EB8B16BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241426, "uuid": "b7f8e012-3da1-4e0b-8ba6-f56da7c16aa7", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241426, "uuid": "84f8058f-5bea-4a66-80ff-86fc0b4e0b77", "value": "98304:1q29KaNjf5rBIZU86Ch3/NCFBdkPo3TsWVBGAa31RAXHp+TmX3Gt2U6cjlWtU:h9DNr558bhV8dkwDsiBGAa3cXJ+yX3G9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241426, "uuid": "957a0eff-84a1-44ad-9540-d511cee96449", "value": 5586280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241426, "uuid": "a9ebe5d1-a606-408e-9e69-48948a9b1030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241426, "uuid": "ff647911-99a2-4caf-9e20-1e11a5526a75", "value": "7d2bdf7ba8291db19189933a84fd1adc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee87f158-c607-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679197288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197288, "uuid": "568dd059-a089-4654-b517-bd6bd826ec52", "comment": "Malware payload (RedLineStealer)", "value": "ba78ccb2eaa08c2f386904e441100355", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197288, "uuid": "0f10156a-679a-4422-8937-b80c032d5c92", "comment": "Malware payload (RedLineStealer)", "value": "15514d38db0afb2ccee2d80c9c4043199423be4af69b1fc05c93cff8936a3487", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197288, "uuid": "b46d54fe-5ff7-480e-abb1-f044e480ca94", "comment": "Malware payload (RedLineStealer)", "value": "5feea9c4f4fdc8ae7f74456d027e4f0655a31f54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197288, "uuid": "be13c2b8-3bc8-4d86-bddd-cddb75bec2e0", "comment": "Malware payload (RedLineStealer)", "value": "36a86a18834a4be7a35d34374dfd905d9b8038e8b452c1214409f0defca6c2e4c632b5e3c6b89c16738d600e1dd051be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197288, "uuid": "7b88004b-6358-4b1a-96d8-bf960eb9cfdf", "value": "T167151257B3E8C096DC74533028FB03D3093ABDA19B7557DF225E1CAA29721A0B53276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197288, "uuid": "d5190111-9665-4c44-9593-aca06b511085", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197288, "uuid": "81d9a597-74e1-40f0-a620-1384ac31f127", "value": "12288:lMroy900WuDEQMBWcieR8qQ/hEoqyzsISWO+862VbJ+11XFfCqx/DNGE3DI:Vy/WuAQCTZKhJETIo0zkJ2fd/pD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679197288, "uuid": "0c7a5d76-3184-4ddf-ae42-e3c70c069f53", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679197288, "uuid": "ac93731f-a3fd-4923-8ae8-5410dc55ff74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197288, "uuid": "054a51a2-6fec-440d-be62-7f7f683001c6", "value": "ba78ccb2eaa08c2f386904e441100355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c693574e-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679214401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214401, "uuid": "7041d363-c20b-4d51-ba8c-c70fddea350b", "comment": "Malware payload (RedLineStealer)", "value": "3af8936b4010aa6ac8f28773cf83c79f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214401, "uuid": "37008543-fa8e-40f7-b6a9-27985ba15b30", "comment": "Malware payload (RedLineStealer)", "value": "17392d6dfc81b0631b28779ac11c6e2bd91213d2a4584e792740955ed7d7c9fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214401, "uuid": "0863c85a-c3f6-4893-a07f-cc37330164f6", "comment": "Malware payload (RedLineStealer)", "value": "e1c30184c17fd1620ddd12eefd492979ceb95070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214401, "uuid": "23841639-ab17-484c-9778-0a846c344bfc", "comment": "Malware payload (RedLineStealer)", "value": "61667fb9702e47ba83f13aeb0c8e7b05a9dbaa4276477e038975481c519c6889fa029e3cc62477b9056982236e89e1a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214401, "uuid": "5579fed8-2283-4490-8db6-ed30188268c7", "value": "T19545F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214401, "uuid": "ae53cc62-e47e-4d9a-acd6-9b48ab61c73c", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214401, "uuid": "90fd1213-b907-4011-9377-f1ec5effb778", "value": "12288:UxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:6bXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214401, "uuid": "527170ba-362a-4954-8526-522c5626a004", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214401, "uuid": "f45cba7f-abff-4aa2-94fc-12180660998f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214401, "uuid": "1d7ed1da-064d-4ea9-b619-b095a5b4b266", "value": "3af8936b4010aa6ac8f28773cf83c79f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996c4eed-c61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205735, "uuid": "feda37c0-01cc-4015-8ece-7c795db8e7f8", "comment": "Malware payload (Mirai)", "value": "c8cc802ef772d2a1a70dfae4b79ead5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205735, "uuid": "00de95cc-d64f-4a79-93be-00a977776ffe", "comment": "Malware payload (Mirai)", "value": "1896f1209ef745d8a48d6477e6233c124ab6488223215ac170d2b21415d182d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205735, "uuid": "d07f9ac6-54fe-405a-991c-db63fab49758", "comment": "Malware payload (Mirai)", "value": "ca2a84312c199adc3baacc3d57e8d7e03920fd26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205735, "uuid": "30beed2e-e6c2-4a25-aec2-6b9d79829051", "comment": "Malware payload (Mirai)", "value": "5b9264bd1fc1a9fe84c98b11f08e27ef5d44e9cc6678117813c9db96cb500a4e8f75f892a2504677fcad4ce5869def6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205735, "uuid": "fbbc91dc-bf21-4ecb-88f1-0de5dbf888b6", "value": "T133D2E18D76D392FA8CDDC57E721E403630AB34A9B2B29317B306D443477A181E686D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205735, "uuid": "e3c23583-d13d-4deb-a125-d4b126f32b85", "value": "384:MPd/PxEDLd2TwM4zb6lowYcEaqsU9lcC450LQixBfE4jdlz0lewZ9/FaoAr2NyH:0lxKd294CxEnsU96IHE4RlY99/wNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205735, "uuid": "662b0ab0-6e0c-4177-911f-5a349ed62e8e", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205735, "uuid": "99bd49eb-d79b-4e11-b5b4-a21cb58170f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205735, "uuid": "ebd8e228-17b7-45e5-88f1-619ab064fab6", "value": "c8cc802ef772d2a1a70dfae4b79ead5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d6baa4-c66f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241733, "uuid": "d34b2840-f495-4703-9ec6-dd2cf80a968a", "comment": "Malware payload", "value": "1a620e88f04763cede1fc2fd92a7d84b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241733, "uuid": "d30cc642-3558-4d1f-bcd6-35f021d826a5", "comment": "Malware payload", "value": "18f3d8d8d8048a1124bb3ac796995e90a089d27300b9a1d4f414c9c2b420bfd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241733, "uuid": "31a41f1e-201a-478a-8337-587f229be76a", "comment": "Malware payload", "value": "253af41a2baa4c2ca9c8857f9873a21a745addc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241733, "uuid": "014c3d42-7aaf-43c4-a89e-f0c215d61d8b", "comment": "Malware payload", "value": "aaae667219205c119f7cb2e475e9d7c5d63acf6c7ed081891f6b34f971f2074ea570d189ae8985725f2d304cde965b1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241733, "uuid": "1d27b051-c638-46a0-8cf4-53c7f8b1f80d", "value": "T12185AF725DBAFDA6E2DD3FB4A0112DD8DDF804179B5AF644F84228925EDD3888E011E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241733, "uuid": "a35ca7c9-0061-4b39-95a1-f10df4ff0e9a", "value": "24576:oafQKgqtAyrUFdRZTbwcXE1Rw2qs9kpu2ny/v/LtGZsYjot0+iEzyLU/E5h8bV27:oNwcXFoaU/E5h8bKlsyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241733, "uuid": "e89f6781-d542-471f-a218-d9ee4cfc793b", "value": 1774239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241733, "uuid": "0036c8a0-7154-46cd-b735-4d6443446446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241733, "uuid": "2e66405a-26bc-4c9e-b1ce-c97bb98a2355", "value": "1a620e88f04763cede1fc2fd92a7d84b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5850c50f-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212928, "uuid": "f580e9c8-8c43-4d24-90b1-c0fce8809385", "comment": "Malware payload (RedLineStealer)", "value": "c6fb73a4e24a2bee896f609da68e9f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212928, "uuid": "b84baaf1-6ab3-4c14-aa27-b2d7d9bd725b", "comment": "Malware payload (RedLineStealer)", "value": "192e4438e3dbaf28408b694d2aa2014d266f63eb37cbd51313470c211b2323d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212928, "uuid": "556f169d-bc87-4e8b-a3a8-20dbe140a7ab", "comment": "Malware payload (RedLineStealer)", "value": "57a1d66aa3c4e3e9420a3320f9cc9c8b5d9a11de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212928, "uuid": "a7d02513-9b0f-4f40-8504-a7fe9de00196", "comment": "Malware payload (RedLineStealer)", "value": "854ee2d64c194fd75ebaadf5f47d37dec33a3bc93781a02828660c7064d3ff7b4bbaf9089295005f255148d7b6f7aed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212928, "uuid": "2b5a4411-ea88-4f0f-bfcd-d03d7f8f97e9", "value": "T10645F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212928, "uuid": "5b7649cb-1095-435f-b837-9037e91e26b8", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212928, "uuid": "8329e81c-2d43-497d-87c5-113b697e707d", "value": "24576:NDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:N3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212928, "uuid": "55a22bc0-e5ba-40e9-86aa-fac6c92aa711", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212928, "uuid": "5d0add95-653d-4bb4-a873-a1de6d210a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212928, "uuid": "3d685b4b-d844-4cb8-9573-503c8cdd7e44", "value": "c6fb73a4e24a2bee896f609da68e9f45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9e2e2c-c637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217822, "uuid": "d47bb201-63c3-4351-804c-9240c50ffae4", "comment": "Malware payload", "value": "9cc7c674494899d32c3a2b15960f0044", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217822, "uuid": "77ea3e09-53cd-4c9a-b058-d1a8e4416518", "comment": "Malware payload", "value": "192f42e3b3929457150e7e68ab38a3a6bdcced98e0642df07cdcd16871bc9fc0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217822, "uuid": "035d3c52-76c5-4c2c-bdaf-c43025625fff", "comment": "Malware payload", "value": "65be173c311d810a7ca5097fe1d20c63b39ace3d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217822, "uuid": "d4560ec9-7645-4c80-b2ca-6baaf33f7ad1", "comment": "Malware payload", "value": "cbdcedea12c7085230b5e3a09530a0896f4465c18b6bad2c6c74a2d25903336bd632c3c3d3ba08d175e1531642cd0019", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217822, "uuid": "e082db80-8db2-480a-a284-1dd074ea9669", "value": "T14D44D10B7DD1E42DC16BE23450EA845F7C6809D87B16D1D72A6037EDE631CC28BCBA99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217822, "uuid": "fb16b11a-6797-46aa-b903-c6c6cfcc0682", "value": "6144:OAolRYMvvvlTSlA+NxICXZVb5hu4vgey231HVzpNyzOdLy6NuKO:4LXv9x+vDpVls4IetlHZvyzOdLy6NDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217822, "uuid": "390c7630-d15e-49ed-8977-9be27f0e4ce8", "value": 262482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217822, "uuid": "95b3f3b3-5ae9-4b02-9606-614e0bc2ec24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217822, "uuid": "c59ba971-e3b4-4396-a878-67e6553bb0db", "value": "launcher.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454361ad-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679212896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212896, "uuid": "72fc71d7-a8ca-4f4a-aa36-09ff0ecaec9c", "comment": "Malware payload (Amadey)", "value": "ec0513dcc9e277bbbf70d775abffc9d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212896, "uuid": "db2116d5-77ef-4efb-92f5-cfd44814722b", "comment": "Malware payload (Amadey)", "value": "19525684553503f6793317a368acb72e6b577f05320548a2a74b62464561509b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212896, "uuid": "3a356553-4619-4100-9829-4d82c5776729", "comment": "Malware payload (Amadey)", "value": "67a3048c36148b0f73ce15905e9e044ad6c2b49d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212896, "uuid": "707c9928-3ec8-473e-a19a-4a7b085636e7", "comment": "Malware payload (Amadey)", "value": "9fde8c6395206c17fcf0a20e41f0ef831b376d4450eb3fe9e63d7c968c4c8db20c4af6e8d74842a8db7eddd79f62057c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212896, "uuid": "0784635c-9975-48c0-8bff-574f25129e9c", "value": "T18145F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212896, "uuid": "71553d6d-5b73-4165-a70c-b716f38a0f40", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212896, "uuid": "6b7a41e6-b13f-43b8-85d6-67c4aca069aa", "value": "24576:mDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:m3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212896, "uuid": "37923765-0aaf-47e3-856a-436553c78c77", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212896, "uuid": "57e2dba2-826c-4928-89f5-1c68969080bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212896, "uuid": "81a7889d-6cb3-40d7-85e4-628c052772f2", "value": "ec0513dcc9e277bbbf70d775abffc9d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1134e85b-c66f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241585, "uuid": "c5db5689-cf28-4df4-9a77-75041691644b", "comment": "Malware payload", "value": "e1362b5d8ccde2ff96d480bb39405198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241585, "uuid": "416ff738-bb30-431c-a564-36a24d728fac", "comment": "Malware payload", "value": "19ce61b73c029b69dfe92b6eb3695d761ebc2020c7274a7ca5f5722dd39f9795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241585, "uuid": "e8b31086-5ef9-4b8b-9b13-1f504c91f42d", "comment": "Malware payload", "value": "42bddd3b7876dc46200c74bb0acd6488eb3737c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241585, "uuid": "cba01b6e-ea96-413b-9a4d-33e84fb53022", "comment": "Malware payload", "value": "3dc7ef3c7972b648c03049ceffe26a66809090c509081d12c690e2c3926605ac3f64b2b5acb26cf6e1260a60d7c77842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241585, "uuid": "1aa1db93-825d-43eb-9300-1598766aa975", "value": "T12AA5334BD9E73277E13685701CA9C0561C4B7E9A987E090F35BC490C5B63A22B7A4BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241585, "uuid": "7f39ffa4-e627-4351-99ad-a5da810185fc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241585, "uuid": "d7514942-ce66-4a64-a6fe-8b174012e17c", "value": "49152:p98H1ZdmLYopFBhTi/5bhwH58wNxz+kABZ1XEWc84xf6N:3W13mLni/5bhO58kstEdxyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241585, "uuid": "e9ca1519-060b-48fb-9aad-11f6360b40ba", "value": 2132496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241585, "uuid": "d9ba9893-cb92-4d1d-bdcd-c18c0751f301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241585, "uuid": "840c388b-7715-448a-9098-d21b2e3d36af", "value": "e1362b5d8ccde2ff96d480bb39405198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a785183-c657-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231292, "uuid": "05ae5d43-f65d-432a-9a8e-6c29eb3fa416", "comment": "Malware payload (Rhadamanthys)", "value": "da694bea0ba6b289fc4d690d936f9a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231292, "uuid": "407ce089-ee6e-4205-b625-784de727cd58", "comment": "Malware payload (Rhadamanthys)", "value": "1a3f1b82d83a7127ddc70816989aa82a6cac50d06895516e7435451f31284153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231292, "uuid": "312dc258-5db7-483b-b266-64f48a2acde8", "comment": "Malware payload (Rhadamanthys)", "value": "9326c3e39d5cc8b48f1d53de91b01927b1b17ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231292, "uuid": "a17f699f-5d9d-4649-ac89-bebf75aeb2dc", "comment": "Malware payload (Rhadamanthys)", "value": "48745e3adab8eb4b12b985a5532868d10928a3e567f184924baa97109b32983b2f78956b764b77d4479828033606f2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231292, "uuid": "fcf2d6a1-59b3-4d19-99f5-d04ab3bac58f", "value": "T1C2743A0383E17D48E9668B739E1FC2E8B71EF670DE497B6532589A1F14B0172C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231292, "uuid": "38fc23f8-82ab-442b-9d01-753a51338afa", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231292, "uuid": "f8297074-8581-4907-b728-3194522e676c", "value": "6144:kukL9ECdi/8UMOuOBbtxtCSwq7B+SmdTBtEK44Q2h2:kukWwUMOuOBxxtOqbQHE9Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231292, "uuid": "6f53ff8f-0d3d-4dbd-8695-233f0235f1e6", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231292, "uuid": "95aebfb6-cdb2-4270-9f14-839b3cc6996e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231292, "uuid": "f8b98ee0-994f-4f90-ab51-d59458825be7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc28f2b6-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211377, "uuid": "9dd21d05-35f1-4862-9f58-95e88b1a8889", "comment": "Malware payload (RedLineStealer)", "value": "146cc74cfd12972970e3b6fdaf40a24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211377, "uuid": "79ccdf55-07de-473f-aa1c-ec728df156d6", "comment": "Malware payload (RedLineStealer)", "value": "1afb934b1e723c9dc2b8dd351dc3c311d38ff01d47aebabfb625074e43ac899f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211377, "uuid": "9764edb0-43ff-4f26-9f24-fd124520e7fe", "comment": "Malware payload (RedLineStealer)", "value": "bdb99f3ffc1075509fa134f7f4f9ebdef28ab8f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211377, "uuid": "477270b7-d958-48eb-a2d7-32802d27b48a", "comment": "Malware payload (RedLineStealer)", "value": "349d903ca50e31cc8d79d0cf80d135e00e251184f160ebd336fbbbb5ac14aaaa2fff13861ae608660b23971f31a86dab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211377, "uuid": "7232840a-e190-42de-9918-c3c0e0b2e390", "value": "T15945F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211377, "uuid": "2b6e9568-f38a-4af4-b279-6ab0493cbed3", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211377, "uuid": "44db68b4-a125-483f-b057-4aefc46ea3b5", "value": "24576:O1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:O1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211377, "uuid": "4d6ffdce-81e2-485d-84bd-911f278a84e1", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211377, "uuid": "9c633adb-a8cb-4f7a-b718-b7d848fd62ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211377, "uuid": "e24cfec4-95f4-4f9c-8cbd-e7d6ad142f35", "value": "146cc74cfd12972970e3b6fdaf40a24f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57cfe6f-c68e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679255255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255255, "uuid": "8aa70a64-ccab-40a4-ad76-8515eb57b215", "comment": "Malware payload", "value": "d76ad16b047a36a6cabc4eff55da4e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255255, "uuid": "56a67da5-892e-4e03-9a85-d98bb295cb18", "comment": "Malware payload", "value": "1bdd2a7b5541f83e6ce595afafdcfb074b990ebe166b4f6c4cc3b3943a398341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255255, "uuid": "dc779030-1dca-43e1-bc5e-dba2c8ed8a6d", "comment": "Malware payload", "value": "4d324bc46df0071a755e1ca4b787812d094be8ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255255, "uuid": "4633d6cb-e241-43cc-a8ee-220e7ec3a1e8", "comment": "Malware payload", "value": "4380c94c7bbb5627869bc439d63fa8ba60d1ebfe94fe8db96412ad361cbbdda4c486e98eed31d3fd33d084e9b2015835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255255, "uuid": "74e6ebc7-f6ea-4702-bc13-7d4114204a13", "value": "T182C5339D73D93CC1A0B7E736D2420A373383AA719877D355C2A3369981F0EC98E605B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255255, "uuid": "0074d7b1-1bae-4cde-93ef-d134f8223f2b", "value": "49152:GrhOD1vMrf2l3qu0CtzQiJaz1SpuxCTcxPJrYwtdlVnx5VKT1NNG1:0kvMmqsKiM1SkrxPJrYS7KT1m1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679255255, "uuid": "d75a7821-9cd9-456b-b02b-513f771243a7", "value": 2570392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679255255, "uuid": "51da5359-4467-4d45-8c23-a32fa48c6182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255255, "uuid": "009bed4f-baf4-4dc5-b37b-27e3ce552ef3", "value": "d76ad16b047a36a6cabc4eff55da4e01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2437b9c0-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679241187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241187, "uuid": "c01dac85-aa5a-4fba-8737-f546a71e00e2", "comment": "Malware payload (AsyncRAT)", "value": "e57213cd46e7e86a091b28a16a75ff63", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241187, "uuid": "70386238-84d8-4ca2-94aa-55dba0abf7a9", "comment": "Malware payload (AsyncRAT)", "value": "1c0a8ab60132cd737b83b2c9b502dfb2d5e3cf14174cc84e422ca1d19277202b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241187, "uuid": "1209b3f2-d0ea-4f48-a52f-1295649fe25b", "comment": "Malware payload (AsyncRAT)", "value": "530fc3194363f8aa63559a88f896aad76fdf2eda", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241187, "uuid": "a2517424-e90c-498a-a59c-48a1ec071b8b", "comment": "Malware payload (AsyncRAT)", "value": "b1834527a4dd293a8e366463356209066ca491b44b2c1f9d5d8265370d6356e13e764917e83135d7da3de2cf3f433b43", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241187, "uuid": "70bb8f66-1703-4559-90af-4272a82dc5f3", "value": "T126E40142F6D288B2E1721A364939BB10657D7D301E34CA5FB3D83D6DDA722C1A231B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241187, "uuid": "effc3cb2-142f-4073-8360-6905246d64ab", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241187, "uuid": "5e7805d8-f841-47ea-9b57-8563eaae1022", "value": "12288:NcrNS33L10QdrXjcDnFGUlwKjykzxvsULnXhzl4uZBKhmjleQKetoaLm/:wNA3R5drXoDFH9jdFz7xzCwKWlBtoaL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241187, "uuid": "879e9148-f41f-45b3-a5eb-5a02cfe1b043", "value": 664896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241187, "uuid": "ce4313cb-41fd-4d2c-8da5-3c7bab7ec8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241187, "uuid": "7ee4366b-30a7-4613-905f-940962eab052", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a41b80-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679241406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241406, "uuid": "13a83c92-650e-4e92-acd6-d88b494b72e0", "comment": "Malware payload (CoinMiner)", "value": "1b0f4c533211b28c813734a3bb096d32", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241406, "uuid": "83ea653a-1918-461d-bc2b-34886a2b00a2", "comment": "Malware payload (CoinMiner)", "value": "1c68418152ba89bcc5058280b5412c07abf9a95b25f09c1102196f45cd922f57", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241406, "uuid": "32b120a0-5def-479c-b3fb-5e1ef8a4d72f", "comment": "Malware payload (CoinMiner)", "value": "aea031237368313d66e4ed6ceea56e0ac654ec25", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241406, "uuid": "95cf18be-b36a-4782-8989-925240247a6a", "comment": "Malware payload (CoinMiner)", "value": "749d313be89ff88ffb1f7a9ad48fdb4f6ae72e899c8939d757aa45dcb1f1b81236c5ff71d0234bd52345ac37563d5db4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241406, "uuid": "cabd9c52-14a8-4644-b283-e092808f5291", "value": "T19F6533B0A7805545D6501B3584D1F71B7F8E24FCAF9304C836DBA2AD03EF5AFAE18A49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241406, "uuid": "3abc0841-cebc-4b29-a4e2-3d96864cea22", "value": "9215f5e35d28044a32583e6054971925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241406, "uuid": "cb4e0aa5-431d-4c53-a64c-0ea0615354e0", "value": "24576:QqyjfvAIxb5Kn/+pVcurgdaKVSVRY8t8XS+ZMQ7P8vzWrtlkEQtTHd9DroVwtqqw:QqcXAI15Kkc+gwK4gIOMQ7P8vyrtlmte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241406, "uuid": "3d97aced-43f5-4d20-951a-1b5fe572ca14", "value": 1476152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241406, "uuid": "d63ae084-addb-4a85-9f67-2cbaba1579a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241406, "uuid": "4e779643-0356-452c-961c-73ebd951f258", "value": "1b0f4c533211b28c813734a3bb096d32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79a675c-c699-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679259956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259956, "uuid": "ecd3ba4a-56aa-4d4d-83b1-9097b2feecf5", "comment": "Malware payload", "value": "e3fa2dbc6b572ef5617f3021ce972ce6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259956, "uuid": "af09e899-0631-4c15-9486-0721830c619d", "comment": "Malware payload", "value": "1ca6f29721044fd43c49ccc88ed4f0c70a633b8cc0263eed2593684b8b70bb61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259956, "uuid": "3667bbc3-8b14-4e47-9243-79497011e90d", "comment": "Malware payload", "value": "680a0fff0d6fda2bfab322b766bac466329a5946", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259956, "uuid": "7adaf1c3-7253-4b6a-aa72-baf462d1dce0", "comment": "Malware payload", "value": "f7827d2bb524f2b81c8e1cc19d0837ff3a73ff82df8f2f2573385cf1082702e36ba8036e545e369efe3d355a834e0cb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259956, "uuid": "1479d164-0c16-49e3-8eed-e5b1f39b6966", "value": "T1E49319377B230E23C0CA547116F30332A7B5D65938BA5347BA906EAC6F1AAC435177E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259956, "uuid": "21f69116-904d-4250-b599-a0b537c3dd8f", "value": "1536:QdXkIdNM5hgtpctARaDTrJFcmQ7FhYjDtaeQ4e:nIdN8ecgarrcmQ7FhY3tab4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679259956, "uuid": "2d943f48-425c-4953-b129-0e7c911dea60", "value": 91824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679259956, "uuid": "5e0fde6f-a5c7-43f9-9943-aba80f0a188c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259956, "uuid": "04e9af10-a02b-482a-8c67-b84ae3ffe603", "value": "e3fa2dbc6b572ef5617f3021ce972ce6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc829234-c672-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679243268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243268, "uuid": "904a9d8d-8651-4f99-9755-e92ee8e54c83", "comment": "Malware payload (Mirai)", "value": "d83d63926b325a27610861dcef593a9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243268, "uuid": "9eb1e861-5f8d-4c4b-bbad-fb267aa5318a", "comment": "Malware payload (Mirai)", "value": "1cae42f52086f5c7cd83778552ad72d19b0dc75f536dbf683faf72a05c309a0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243268, "uuid": "877321da-12bd-4117-8983-9f890010cfec", "comment": "Malware payload (Mirai)", "value": "86d80d4ca8e93a97c2c4925e4b90b61172039717", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243268, "uuid": "44339d5c-7b87-4a3a-ba60-58da1ab231ed", "comment": "Malware payload (Mirai)", "value": "3d3cf005964877a93f05df4c9409c8f9f495dde81100ec8f237379f7609a0b953096b5a0b97806be634bc55b3a53b9ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243268, "uuid": "e91ed390-cd58-47b2-b0d2-3944a8a44f95", "value": "T1BF633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243268, "uuid": "4bb0090c-5d5c-4877-ba3f-932c23c78bb1", "value": "1536:lGRaTYmol/hGIAs4PNvAYQOGm75123tStSl:lya7hJRGmVDEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679243268, "uuid": "a9516c5e-176e-48c2-854c-840de52891da", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679243268, "uuid": "66db73f1-5500-41e9-a08b-76e9e2cfe4b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243268, "uuid": "02733d1f-f82b-455c-ac60-421dd7ab7857", "value": "d83d63926b325a27610861dcef593a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27502f16-c65d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679233891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233891, "uuid": "5a0533e1-a4db-44a3-904d-5575a6473f2a", "comment": "Malware payload (RedLineStealer)", "value": "a3e93f17052e09850480382888204a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233891, "uuid": "ed6a3845-d57c-48b4-bcdc-26990c19c6ea", "comment": "Malware payload (RedLineStealer)", "value": "1d680b26c5cc4e83dc73a42bac17ed9c8cc615f2bf97eaf4b1d4e142ccfe3962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233891, "uuid": "7f700c5d-cf0d-467f-a5f8-cf1b6aea3d30", "comment": "Malware payload (RedLineStealer)", "value": "c626aea3ddade3ee15839537ba6ed345ba420e1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233891, "uuid": "c11dd276-25dd-48e4-af63-988908c152a9", "comment": "Malware payload (RedLineStealer)", "value": "e3180c72076d5f1dc6a9b3c83abb70a35e2a9163b95cbc07ac41b61deb4778526ad6370d68b7d27277d48b7981605f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233891, "uuid": "532c32cd-80b3-4aa5-ac3c-f08427e6a157", "value": "T17935230AE6E88162EC78277058FA07C3163A7D716B7983D7224B2D9E14B21F4B57137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233891, "uuid": "c57a69e3-09b7-4ac8-b379-7a426b523693", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233891, "uuid": "8e726bee-1b42-4192-9c6b-265cd575f748", "value": "24576:2yPc0CGgbkOfNfk23+9bY9hBrhnVniwAX9FCslekVe6rOqelfh:FPcFaOOqws9hjnVnHqFp7e6rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233891, "uuid": "650ea2a9-bcb0-4585-bc06-7139b6e0029a", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233891, "uuid": "c311b2d2-0dd7-4d0e-9972-3f430b3c8f58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233891, "uuid": "b2e44f00-e924-4c20-aa46-9cff09f207d5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef0032b-c65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackCat)", "timestamp": 1679234816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234816, "uuid": "abb3cb82-30fe-4293-809d-74838f34124d", "comment": "Malware payload (BlackCat)", "value": "06c88ddc3cc18c4e7d5dc7a8a5de6477", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234816, "uuid": "3c8596af-05cc-4f23-a3b5-833dfb35ae33", "comment": "Malware payload (BlackCat)", "value": "1d6d47bf20d21b860d232a358481c477c36491134ea976372c69a0483e05a556", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234816, "uuid": "83f9e745-700c-4919-bd02-aa12ad52c3dc", "comment": "Malware payload (BlackCat)", "value": "885441c9e592e5c6e23867b85a96e142bf45ebcf", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234816, "uuid": "d5dbecb8-6316-4a11-a95d-0c871d9ba7c4", "comment": "Malware payload (BlackCat)", "value": "f5f307461a17c8930ce379890844d70fb1d1f54453537e0238c2d00479906358bdbc052c023da2d94e6f8de88c86605c", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234816, "uuid": "26fa3f68-3ece-4df2-95b0-7973b1d34588", "value": "T106C67C58F84BA8ADFA7EB074707EEB3299A4081C50079D77DE46DD31669F7223C4821E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234816, "uuid": "d59f6f1e-72e5-43c6-8091-2fc1bc501840", "value": "5d766c15ecb2cd6ebc5b35487f47a64f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234816, "uuid": "acb9270b-65f1-4849-bd4f-1345d2279063", "value": "196608:oNxv0jC932ZwG0hYvzUgueRlmjcjLAUU0PHBknwy9yrMzwCq:oNxv0OQZwGLwki9TwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679234816, "uuid": "aea9d6d5-91f9-46f9-ae0f-84dc07e606f7", "value": 11708928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679234816, "uuid": "b1870914-4e38-46f9-ae3a-1de0f967cccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234816, "uuid": "a35fecda-29ac-45c1-90ea-56fbc396e147", "value": "1d6d47bf20d21b860d232a358481c477c36491134ea976372c69a0483e05a556.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f858b24a-c65b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679233382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233382, "uuid": "9a846bb3-5705-4ac4-92ed-9277cfd2b50c", "comment": "Malware payload (Rhadamanthys)", "value": "e41fa2c4eb7092bc5774c60162850bee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233382, "uuid": "62298428-44b6-4d1f-9a9b-e2a87f4b36cd", "comment": "Malware payload (Rhadamanthys)", "value": "1d8e82d9abda58c9f4a0def2940e9f75921e2dce89a07b337a075ca363176cd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233382, "uuid": "93991c67-25b8-4ae7-a408-6bd3b39b5fc6", "comment": "Malware payload (Rhadamanthys)", "value": "53767637b6fa80642d6884ab6ca751ba3b69796f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233382, "uuid": "86688412-5f42-438b-b702-ed6f666e1561", "comment": "Malware payload (Rhadamanthys)", "value": "1be3c6505f9a30a2985682ad7d9b66cefdf84a0909c445199eab26b3366b915f214496e71941490a92aa5fb033f48070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233382, "uuid": "67a95f67-49a1-4a75-b152-74a51e290c4f", "value": "T148744A1383A17D5DE9268B739F1FD2E8B71EF271DE49776932189A1B04B01B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233382, "uuid": "41a8e0f4-3071-41c4-90d8-fdfc0a3c70ec", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233382, "uuid": "62d80e01-3e20-44ed-85f0-093836a77ef1", "value": "6144:iRuxL2aEVY0sf8tmKx1AC1Atrp0igRn4Iu8E:4ux5E60s5KxyHreizIu8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233382, "uuid": "4187347d-f9a8-4234-b1ca-d3ea5cd46d81", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233382, "uuid": "34287cb8-cb77-4817-b125-b6d290e12ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233382, "uuid": "112f3626-0fd3-46fd-9ebb-260d50472320", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629d6614-c657-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231413, "uuid": "d7587683-e5de-4490-9613-f6814eac7266", "comment": "Malware payload (Rhadamanthys)", "value": "7907fe8d4471135629701e65b374e698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231413, "uuid": "bfec7a05-ff30-4698-8145-fa882cd05270", "comment": "Malware payload (Rhadamanthys)", "value": "1dd548bc944f83c4de45768fcc555c0cca6ec41998c1bc7b0de25e6b62c83983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231413, "uuid": "b61ff371-0cb7-4d06-9c26-15d9597b35a1", "comment": "Malware payload (Rhadamanthys)", "value": "05162c86a9b7d233dfd6a554bbd5f4ee580ae1a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231413, "uuid": "ecd24292-bbe1-499d-a673-8d6968e9292e", "comment": "Malware payload (Rhadamanthys)", "value": "cf4a4a9204a751d49f575a179ba5265d5fbcd489c44d71d162a33cc263c48fe1c426f652175c0965f98ea5d8ddd09fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231413, "uuid": "969caeb8-a3ed-4590-bfc0-2ed5a1992921", "value": "T161743C5393E13D58EA268F739E1EC2E8F75EF670DE49776632189A1B04B0272C163B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231413, "uuid": "4d8347af-bcba-4712-8a3b-1043bcb2b64c", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231413, "uuid": "b47af6cd-9645-41c3-b6d7-ba6b43ef3598", "value": "6144:3uvLWAp62edcs3LbhsJNHBl+3MylwWwWSjVkplYA5zL:3uvvU2ObNiHBc8yi9WUxQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231413, "uuid": "7152bd79-f346-4df1-b560-257cd86191da", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231413, "uuid": "dba0464c-4076-488f-b9b8-771cce10574d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231413, "uuid": "eb355213-88c6-4668-8fda-2402407c8fb5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68b1f5e-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211368, "uuid": "e91d6861-121f-403c-80c6-948b89709b2d", "comment": "Malware payload (RedLineStealer)", "value": "0f427e5769e5c07308e1b856f23fe367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211368, "uuid": "eee2a2ec-1a3a-4ea2-969c-286ef0f85559", "comment": "Malware payload (RedLineStealer)", "value": "1e8604a9c86ac77407d94b1c3e5e829d83f9cef3f0b80a6d50271c8d3cf059f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211368, "uuid": "0234f1a7-8b25-4a00-9d82-d1c2a3f6155f", "comment": "Malware payload (RedLineStealer)", "value": "2d389d03ef38ba421cad17d999666b8f1e7edfb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211368, "uuid": "29a6944f-6779-4ed6-87b3-2f92a75d529b", "comment": "Malware payload (RedLineStealer)", "value": "d4ee1113ced2a330b2a1f0f0715326b63c45ad087ce42126566be4486cd9386c32bfbcb120122ef1671f758c43a516f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211368, "uuid": "4f9d5e30-f4bf-47d4-bb1d-e6df0aabedfb", "value": "T175152217A7FED022E8F4577008F702D30A397DA09F7896EB279AAC461972590B531377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211368, "uuid": "ad2a00f1-3bdb-4ca3-8081-b64eff529a55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211368, "uuid": "3142246d-4405-4dec-bbd0-9c2b3681dec6", "value": "12288:XMrLy90pSGDpTgPE6IU/qWWeTJyxzZLSpWGe0X5RRT91d9ZtYFm62d5++t1aOFIB:wyUSGJ4E6IUi/jG75Rth9fERg++M/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211368, "uuid": "3b440da3-787d-481c-89ff-0da70e57fcb9", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211368, "uuid": "add85552-7567-48ac-8c93-adbaba3d54d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211368, "uuid": "69b439e7-365f-47d6-ba37-8f2d8d19247d", "value": "0f427e5769e5c07308e1b856f23fe367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91fd748-c60c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679199400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679199400, "uuid": "a9d5181a-9e11-4dfa-88fe-8e5525a41fb8", "comment": "Malware payload (Mirai)", "value": "9dc24195bea6801a7c5191224867f748", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679199400, "uuid": "f2940c1f-7359-43f4-aaa4-0f5e34838fe4", "comment": "Malware payload (Mirai)", "value": "1eec1df5462cc75b4e48bd7595da5bb702c74836f66ad0dc8dee031cf5a22375", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679199400, "uuid": "4490d2a5-e4f1-42bc-9376-e6527c931e13", "comment": "Malware payload (Mirai)", "value": "fb79b24a0c8711e5c89ab8cbd42685ff3385617f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679199400, "uuid": "dda6b55f-7e58-4fb7-a766-48e28171822c", "comment": "Malware payload (Mirai)", "value": "9cc242492da2e54bfef051d5c0a33249b7f433e3a8c771c32f3e6448c898bbcae93e0bcebe5931fa5909890421082872", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679199400, "uuid": "b6abb66b-76c8-488f-b11d-fdf1be04bd29", "value": "T15D23F8C27941B639C3D0577BEEAF018E3354A7D8D1DA3397C8281B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679199400, "uuid": "1eb9d956-3bf4-40f6-ba7e-910aa3b1b58e", "value": "768:MRhKprRmnWFYVD2bxsl0K1XZl170me6WDoCerCjIxOWNkNChk7wCVy/rCxHghW1J:MXcm+KD2Ceme6aIxOokNUfhW05xCqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679199400, "uuid": "837d3453-0f40-4d6d-b4f0-2f6a881c8cc6", "value": 49140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679199400, "uuid": "97b2ba8c-4b2b-4859-a64b-2e2b0352724a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679199400, "uuid": "939c7dea-7631-4231-969f-a9808aa148e2", "value": "9dc24195bea6801a7c5191224867f748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0e162a-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212288, "uuid": "40b8b327-d54f-4062-a5b2-2f9e5c6fd059", "comment": "Malware payload (RedLineStealer)", "value": "94ad01952e4cc138390f5288780e064e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212288, "uuid": "3b727528-85a8-495f-9f9d-99100b6a0931", "comment": "Malware payload (RedLineStealer)", "value": "1ff4c87914aa2e1fc2b85a077b673420ad9a879ec7400f31ec96916da76461db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212288, "uuid": "9f12afcd-564e-4cf0-b3f9-a6b1363bb9b1", "comment": "Malware payload (RedLineStealer)", "value": "93ea3c1085d1c26df2f58ce3856b57fe9a10cb53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212288, "uuid": "0c8f0116-7596-44ef-884b-aa36d15dc218", "comment": "Malware payload (RedLineStealer)", "value": "79e223868b211c1cba9ff1386457e7491c561e3f7c2279bb6025859000c006b8cf8e201a7054a73fc0e2005b3b3e70fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212288, "uuid": "bc4ce956-b000-4add-adf7-a9489a85ade5", "value": "T1D445F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212288, "uuid": "bd0343e5-2d62-4948-93bd-1dfffc218c2d", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212288, "uuid": "8b844c58-2cdb-4405-8b06-ed772920dcc8", "value": "24576:m1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:m1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212288, "uuid": "63239ed6-6672-4c46-8c21-cc3656963fb0", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212288, "uuid": "95b77187-b188-4afe-ba04-d52c134bfc8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212288, "uuid": "b4403883-3132-4843-966d-fa31a3c7eaf1", "value": "94ad01952e4cc138390f5288780e064e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0fc730-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679241232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241232, "uuid": "a3f0651d-4e42-4380-a351-f275166bd1fa", "comment": "Malware payload (AsyncRAT)", "value": "f29019b3aff73a34e7bc870ef1210adb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241232, "uuid": "a87e6a21-af28-41ed-baf2-2254093ade14", "comment": "Malware payload (AsyncRAT)", "value": "1ff5591d677f441dd1190ffbb404a964eb3d64bed9821ed6f13c53d3050ea599", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241232, "uuid": "066735c8-4505-4d8d-8fb6-075297c8e395", "comment": "Malware payload (AsyncRAT)", "value": "fd6a72b617d26851f2fe25680d889f27f17ac30c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241232, "uuid": "085281ba-bdc6-439a-8fd1-68f579411dae", "comment": "Malware payload (AsyncRAT)", "value": "6311bcf2ae74cd097509971c036f746da8bb1e5d63955714299abd6716f889e587063aae1a86b255193f0c90744854ed", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241232, "uuid": "664b7656-51bd-4e57-b5fe-f97d5e419cfc", "value": "T138C3B327AFA76C46DD2818513FBB0C2DED3A252B6AE064F58C8692D12DD540DBDC6CF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241232, "uuid": "c3cd13f6-0229-4aa2-9cbe-04063a78b1d4", "value": "768:+ffffffffffflfffffffffffRfffffffffffkfffffffffffkIfffffffffffxfr:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241232, "uuid": "da6dbece-5d31-41ba-ad4c-b3eedf110845", "value": 126981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241232, "uuid": "ff89ef8c-e227-4583-8441-12ae5137aa10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241232, "uuid": "f24a7512-7bfd-49af-863d-79ac68fb1691", "value": "Statment 201648318503.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe03e17a-c62e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214065, "uuid": "4265346c-68f8-4fd7-81d2-3a1a5ed2c799", "comment": "Malware payload (Mirai)", "value": "12fcc4ba53dcdf548c4c0c6d2f0657b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214065, "uuid": "e5c489e4-d55f-49e4-bf34-c577473fe280", "comment": "Malware payload (Mirai)", "value": "20ce50691d1bebb2bfac1163445d895ac585f32bd72aa0c15c0f28a3d3b9407a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214065, "uuid": "86149ade-8f0d-4bc5-a1fb-f4a08aba20e5", "comment": "Malware payload (Mirai)", "value": "ad5624edf5b733ac6c718c813924e540cce74575", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214065, "uuid": "5272f42e-9156-48e6-aa72-803b5a884bc8", "comment": "Malware payload (Mirai)", "value": "63cee8577687423222f5d8e9b7e3d6510ad0dbea39c4e19226eb33862aca280965813b780017eb9ad6a151df1082e0f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214065, "uuid": "fbdac72d-623c-49a2-bead-93d21bea76ef", "value": "T14CD3D817BB518FB3D81FDD37069A460220CDE55A16E87B6BB6B4C91CE74A84F09E3D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214065, "uuid": "1efe2e75-4e60-46cc-9ed7-b6094e6dd0a4", "value": "3072:A04EFxWKgY381yU5hv73WVzhF3xemqY1fuBmvm:A0yY3+yU5hvD0zhF3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214065, "uuid": "8e4aca31-d5e6-4adb-aa02-e3a5b5d1ef51", "value": 137910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214065, "uuid": "e5831333-5078-43b1-b082-fec42a2c808a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214065, "uuid": "653efb1c-ada7-4fde-bbec-52bdbddc7579", "value": "12fcc4ba53dcdf548c4c0c6d2f0657b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de9e9fe-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211971, "uuid": "ac15c1c1-7b9f-4546-95f1-4b442866f000", "comment": "Malware payload (RedLineStealer)", "value": "7775e381ee5c9d528d4e44d4dc2ad6a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211971, "uuid": "9b7a8e3e-dc6c-4489-9b2e-d5ba74291140", "comment": "Malware payload (RedLineStealer)", "value": "21e1fb0f7abb572649e7ebd5f6407b60375dd3132131cacc4b2782d3d9011bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211971, "uuid": "e9ab5b95-a55a-49da-901f-20a588bb97ba", "comment": "Malware payload (RedLineStealer)", "value": "f25b53cd647f1da7e746b1cc597d7df3cce7e55f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211971, "uuid": "fb4df843-9fa9-4e9c-b138-f748ed5ebd80", "comment": "Malware payload (RedLineStealer)", "value": "3802d7b961b35239543eb2a16d01de730478949e31b5688e726a0d7ca894a33dfd847f0acde3e8ba50486cdbf12bc066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211971, "uuid": "eca18118-50a9-4874-8c24-7625a374331f", "value": "T16E45F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211971, "uuid": "e42bf22b-fa9c-4888-9e1f-214bbbaca084", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211971, "uuid": "435f9603-f288-40b0-b2ee-ccfbfea1d1b4", "value": "24576:dDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:d3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211971, "uuid": "5d67fb82-3a92-4235-8a75-8ab8d6bb0a12", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211971, "uuid": "90b975b4-36be-420d-9754-6a926e552934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211971, "uuid": "fd778366-81aa-4dcb-b8b0-a31240e08330", "value": "7775e381ee5c9d528d4e44d4dc2ad6a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151eddca-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679214103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214103, "uuid": "af5d5d85-fb2f-4d3b-88a4-195fe2ee4943", "comment": "Malware payload (Amadey)", "value": "1f3c6419c3ae681fa0065ec6209fa2a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214103, "uuid": "adf98c82-7cd7-4fbb-a14f-e83ff6529825", "comment": "Malware payload (Amadey)", "value": "23428ced3740c9d4cb547c927d3699428f9d8cd35099b19cbdd11c028b6bbcf1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214103, "uuid": "53c5cc39-e07b-4c02-8a67-99cf9daff642", "comment": "Malware payload (Amadey)", "value": "44693eabd7a2e8ce40ca95b2601d87580851facc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214103, "uuid": "872875f9-2d5f-46c1-8337-e7734bcfa825", "comment": "Malware payload (Amadey)", "value": "9823fa0794f5bc50b3e8490325f0277b2ae48229daabeebc9c7ad2fc8f3d4c353e97986519a83ba5de0332adf8d2c7d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214103, "uuid": "3822ee66-154a-4f4c-8cae-fde04ab17f16", "value": "T1F245F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214103, "uuid": "84123991-dbfc-46f8-9844-2d1c49a4e76e", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214103, "uuid": "b27aa0ea-ac46-488d-83a7-53700ba2307c", "value": "12288:XxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:BbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214103, "uuid": "7cb9ab99-d9a7-4eaf-99f1-2c085e1ce06a", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214103, "uuid": "8535f430-d312-4d7a-8e4b-575bf5a8658d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214103, "uuid": "db642c80-8a8d-448c-a971-c6fe6ceb4d2b", "value": "1f3c6419c3ae681fa0065ec6209fa2a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e77a76d-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214146, "uuid": "dd92ed23-c14a-4118-a734-8744dca7916e", "comment": "Malware payload (Mirai)", "value": "7569d1d3ed61d6b16d542674f17e86de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214146, "uuid": "76862417-8594-449c-947f-2e352a591fd3", "comment": "Malware payload (Mirai)", "value": "23c64617b65455f94e4ee6534b2ac1b691345308939b5fbdeaf9543fc0d6d42c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214146, "uuid": "b5239ef1-d950-44b6-bb87-1225baf95535", "comment": "Malware payload (Mirai)", "value": "2df94b925e38f1ec8fb7ba7367dfa795fab5603c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214146, "uuid": "6fa3c17b-8289-4d9a-931d-1b151270249c", "comment": "Malware payload (Mirai)", "value": "0316a4f8fb4336d36223782dd14733a526bff4b3417389d99aa87a8d7baffb23a2c9f1ade8273e0a10d902324a499258", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214146, "uuid": "7e49af11-57fe-4363-808e-07f975a33053", "value": "T1CAD3966A3E11AFFEE268C63007F75F70939526932A919785E26CDB085F7028D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214146, "uuid": "137db889-8901-46a2-9652-7fb5c60bc6b1", "value": "3072:bfnJQ/2SWmDFHlxT0ySZd04Q0tG6AqzuymRRkLECQiwYyD5hPk11eF3xemqY1fu5:7unigD5hPo8F3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214146, "uuid": "1fedd2bd-be2e-4cdf-ba79-1f00880260a3", "value": 137910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214146, "uuid": "5596343c-6cc0-4603-be60-ef1ce92a7988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214146, "uuid": "e2ed0012-0ea2-4604-b34e-7d0799d27d43", "value": "7569d1d3ed61d6b16d542674f17e86de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83df9b4-c657-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231584, "uuid": "094a32aa-aebf-4036-b99a-62990febf14f", "comment": "Malware payload (Rhadamanthys)", "value": "b962016715b011a0109b8b7df751afe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231584, "uuid": "3c38b40b-2312-4ff5-96e7-dc2459acc0a1", "comment": "Malware payload (Rhadamanthys)", "value": "23c91e8428a890b37175f1c0fe1466f881bcec938238c4ffc24cd0720ef44ab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231584, "uuid": "20f892f8-2bdd-4dcd-a910-97fa6a1b9ff2", "comment": "Malware payload (Rhadamanthys)", "value": "56aa19a17ec837c84917d2ffd58459baa31c89f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231584, "uuid": "7359a6bf-6374-46e4-9be1-52fb996dd63d", "comment": "Malware payload (Rhadamanthys)", "value": "fc16c8cff1be845af69113d52b6a5b50868e5a029841fb5690aa4776a53080d033a1bf861fcf82969c24658e0f2589b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231584, "uuid": "73e205a6-a0df-42fc-a539-f0c94bc333b7", "value": "T167744B4393E13D58E9268B739E1FD2E8B71DF271DE497B6932189A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231584, "uuid": "b8fd9612-3779-4199-9c73-bbf9e1ba5eb4", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231584, "uuid": "b399e0b2-02b8-4eae-b80a-25558809cf05", "value": "3072:+D9ugDLOo4zFW32PybkPAEnPgIg08e30yb1dMpcoT4izUmag/CioNUor2d5l4Btr:4uwLOo4qbK408SPfxJiwQaio7G4tmE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231584, "uuid": "4e170c7f-a23f-42bf-8722-f7d35d8cec17", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231584, "uuid": "dc91bfe6-105e-44b7-b530-6284d41dc3aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231584, "uuid": "00a89fab-691d-4f51-ad8e-16e5d26ce90c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5150fde4-c65c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679233532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233532, "uuid": "5007d34e-dfcb-4fe8-87b8-1b4b7251e0fe", "comment": "Malware payload (Rhadamanthys)", "value": "70a93b34f4fa64eff64c696b6ea001f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233532, "uuid": "726f04f3-a07c-413e-8583-49f6621305cb", "comment": "Malware payload (Rhadamanthys)", "value": "246360e23193c100e3e39e55364e387e7c9b0cc38bfa3ead473e51e8b04ef319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233532, "uuid": "1a31413f-00fa-41f4-a4a7-0588e480ee71", "comment": "Malware payload (Rhadamanthys)", "value": "3928ef38a0028fa7a13288ddda2eeb331dd48d4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233532, "uuid": "05464c36-bbb7-41dc-9f23-a2c56215a178", "comment": "Malware payload (Rhadamanthys)", "value": "6740f310a7dff51ac0af34063a379f0d74bbed600b39439a44ccc0e6d49f1c0ca4f681536b03f0c38097cc0e3a189673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233532, "uuid": "8a5356a6-2638-455f-b254-ff16bd22e196", "value": "T1AB74295393E13D58E9268B739E1EC2E8B71DF671DE497B6932189A1F04B0172C363B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233532, "uuid": "8922c0b0-bcc1-48a7-b181-6961f374d4ef", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233532, "uuid": "26abcb9e-b319-4691-9cf4-52de615637b4", "value": "6144:2u/LZrrd305+pjwwYgZdRmU6hTiufq7F9FcxPzh1Fv4S+xYaNE:2u/dZ3Vj6gR96hGlvFcxPZvHaNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233532, "uuid": "5a68b387-6619-4549-90f4-a4906772f827", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233532, "uuid": "ad063ffb-e520-45fe-8c8e-764580d04b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233532, "uuid": "3f94c91b-cfef-4bc5-bcf9-31cdf5e448e8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db66fee4-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223455, "uuid": "cfa91332-7d50-440c-acf4-fd3a977b7c98", "comment": "Malware payload (Mirai)", "value": "98fb2d38b8b47e568d628593a0b4d99b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223455, "uuid": "79e5e479-1df5-4295-bc6d-a1563e43a03b", "comment": "Malware payload (Mirai)", "value": "249a256baf7f6279efeabeaa28769f053d9c8989a16bfa1d7228320f3bbcca6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223455, "uuid": "010c3622-7bb2-40c1-b53f-97eeb51104ab", "comment": "Malware payload (Mirai)", "value": "769bc3856e7bea541bf2ea9d5048f2680e67c3bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223455, "uuid": "583f89ca-0fd0-4543-8f60-b5638a12bab6", "comment": "Malware payload (Mirai)", "value": "a2a0c2040c330cd68f5203a7706d0a35323f90d245a735a0636e236c1690c8fdd5a4c74a2995db0685d81be738f46d45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223455, "uuid": "e6a3c2a1-26a8-4723-a7e6-a9e222d34121", "value": "T1F0230231890E8EB125303C76EED5979376E026B5C6673113D6290A3C2F75B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223455, "uuid": "a6b4f211-ccec-4f7d-81fa-d51a97729484", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3uj9q3UELbUXfi6nVMQHI4vcGpv0:gECFd+A6YHAxuiLRQZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223455, "uuid": "48fc7c7c-ab67-4ec2-a95b-d3e67100d713", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223455, "uuid": "e67bb970-8710-4454-9880-e66bdbc89fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223455, "uuid": "94d00b2f-8693-4e98-84b8-d894e25da6b2", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865e9159-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679241352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241352, "uuid": "bf4111a8-13d6-49f5-9041-b751bec4f81f", "comment": "Malware payload (Rhadamanthys)", "value": "82acc55d7a5fb32c1ba940f5488df6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241352, "uuid": "36457459-6eda-4c0e-852f-fd7c9e89048a", "comment": "Malware payload (Rhadamanthys)", "value": "257d39331196ff22f2e16d73739c3e12dbbe012ff97b15f07c8b89c447d5adf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241352, "uuid": "9a689df9-5c8e-494c-b38b-1e10077e5d60", "comment": "Malware payload (Rhadamanthys)", "value": "64d0d1fd19a9f871264029138a633a8bc4973911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241352, "uuid": "c99b0718-a23b-4c4e-9091-61b541bc709f", "comment": "Malware payload (Rhadamanthys)", "value": "ebccc059c9c73a992b16c88ebf624c7562ca7e0418bd682d38891fe82e61b3d1f3ebe2447e1b6ddaa9b63961150ab4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241352, "uuid": "f445353d-1c2e-48b0-ad3f-03065df0b68d", "value": "T109743B4383E13D58E9668B739E1EC2E8B71EF671DE497B6532189B2B04B0172D163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241352, "uuid": "1bfc7e66-5037-4ae8-8cbc-e88a6a1baabb", "value": "8b512f0a0b2cd54ff600ee8ace8b2bd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241352, "uuid": "a3d1c6fc-3de9-47e5-83d8-78b5d6d9e6aa", "value": "6144:aJM1LOoER9Ti8Wk6pTWtgwfi3Pgy/nKXMZRUK:aJ43E7W8bhfsPgGnKXTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241352, "uuid": "4575240d-1db1-4ab5-b2fa-3ab5f8fd2800", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241352, "uuid": "08e5031e-97d7-4aa3-b43b-acf9f48b1c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241352, "uuid": "08e6188b-e1c1-4721-8665-42e82732868c", "value": "82acc55d7a5fb32c1ba940f5488df6df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682c00b9-c6af-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679269218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679269218, "uuid": "a9117ce8-d233-48a7-a0df-d753ceaba178", "comment": "Malware payload (RedLineStealer)", "value": "c9b80a43283f73cdef9f4de8df02eda8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679269218, "uuid": "85a64181-cfc7-4041-8b9f-0e678e558000", "comment": "Malware payload (RedLineStealer)", "value": "2668e63ef3d506d617dec39e6391e9ff39cbd86bc6e18a5f91d67cff8bbd8c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679269218, "uuid": "2f4c34be-3b46-41ab-8fa7-1bcd99535c1f", "comment": "Malware payload (RedLineStealer)", "value": "756e697ea228f99f6264a98af3eef230068350e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679269218, "uuid": "4334b0d1-ae31-450c-8d77-56b1e313b362", "comment": "Malware payload (RedLineStealer)", "value": "c5d175ecbd4703de520421923bff2c1a6a09017147f47b925a439a1231de57b2cbd04250bb1f1d86234b1918329b5c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679269218, "uuid": "2e731286-fe67-4f10-a59b-3dd27e61b9b4", "value": "T145252311A7D84432CDB12BB06CF306C30B3ABCA2DA2946A71756B8475DB3A91793177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679269218, "uuid": "2e473e88-5c07-46ca-b31e-83cc7ddc0ffb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679269218, "uuid": "a45058ea-7cad-46bf-98e7-e8d65c2c1c5e", "value": "24576:ey5v4MiAlpCdMUWpNldeZTnuNUvIkzegMCvBLcCnyL09:thhpLbldeIGeYpXy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679269218, "uuid": "abd45971-ca04-4f88-aa48-c79a6cbfc00d", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679269218, "uuid": "2e2f2593-937d-40fc-8af2-c1a70c8fc41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679269218, "uuid": "946ac850-10fc-41a1-a04d-05d39eb85b1e", "value": "c9b80a43283f73cdef9f4de8df02eda8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43948ee9-c636-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679217188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217188, "uuid": "916a0393-0752-478a-aaf9-5ae80d8698c0", "comment": "Malware payload (Mirai)", "value": "2b569b670cf4155677163a5dd340b6ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217188, "uuid": "aa64e736-b100-4ec2-9663-16a16ce24ecb", "comment": "Malware payload (Mirai)", "value": "2706cb8ff340745a5f5545b9344089e0c7ed43425812726631f3eb04688dfc6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217188, "uuid": "a8cfb8c6-7024-46c5-b613-f72bf911c862", "comment": "Malware payload (Mirai)", "value": "790dcedae522aed09a459175f6ff910052da4f89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217188, "uuid": "80117cb8-885f-4c33-966a-ad1b3a1d4eb8", "comment": "Malware payload (Mirai)", "value": "fdc92978e7221e71fb9484364fe1541efcbdbf435fc1c65f3fc72bf67311be09a557c3772808e2b75a7528673c19085f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217188, "uuid": "00a15368-861c-4479-a8c6-a2e8d0aaab13", "value": "T11423F681BD41C906C5D46673BB0E66CC371607A8E1EA3307AE2A5F607B8F86F0E37555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217188, "uuid": "d59561ad-5f8d-42e7-8c78-d5f95b412b20", "value": "768:QNRnWaFUCMrqHPUPMppET31wh3YB2KiJlW/DdPkc/hjUcaVuNAwfEghFOFn:qnLzMrqHcCaT3gywlW/D1kc5jUcaE1+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217188, "uuid": "48c623d4-873b-4d74-b3f8-f40719875ae0", "value": 47160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217188, "uuid": "6d57cda0-b57f-4a2b-a42f-7f80c245a95b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217188, "uuid": "7c00b4f3-5ba9-412c-8058-6ad7d2b3e707", "value": "2b569b670cf4155677163a5dd340b6ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5361405-c699-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679259925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259925, "uuid": "d963910a-b442-46b0-b892-99326bd6c720", "comment": "Malware payload", "value": "8bae0bab5d934975b36db8ed047021a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259925, "uuid": "09f37244-274b-4e19-b385-5dbc7e073397", "comment": "Malware payload", "value": "27b0d25ae2e99043fcc44dcdc4888b6f1b28a6806c68be9b059e99ae7c5d3199", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259925, "uuid": "e9212985-495c-4524-a1da-644a001264a9", "comment": "Malware payload", "value": "baf29328e1e182ab5cd98efc0212750f4a2b0427", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259925, "uuid": "ed9363e2-9a31-4997-9fa6-1b45089fdb78", "comment": "Malware payload", "value": "cc685989c2cbc6629cd4649793c57d4e5391fa7946211c9e4c0f1edad01f22ea434902a74b56513ad47c286cd6e6b6c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259925, "uuid": "451a4264-dfeb-4b40-acfe-afac16c83488", "value": "T16D832A41FD418727C2D337BAE7DF435D37356A54A7973301AA286EF42BC6BC91A2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259925, "uuid": "738493ef-4967-4ab1-a5c1-7430d4981c50", "value": "1536:gIjDVhNQmvfzHfvfekyjGe66fxtOgy4ePPxoNemR2qQzK/2AKtIe:BjvfyklP6fjePPxPmR2qQzKOAKtIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679259925, "uuid": "edc5a6af-1381-4ebe-89fd-b4f47a488760", "value": 88243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679259925, "uuid": "712812a4-debe-4c25-a3d8-e86d73d320d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259925, "uuid": "7876c43d-50c1-48b1-bf1c-8d0549478bd2", "value": "8bae0bab5d934975b36db8ed047021a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43c18b5-c654-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679230342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230342, "uuid": "417e7b74-de69-43f2-8985-7ce9e6deeee7", "comment": "Malware payload (Stop)", "value": "d7cc6c563c1e59d4f88a6c2d0cc87098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230342, "uuid": "3a5e3f9c-f5cc-43e7-be7c-b779350b77d7", "comment": "Malware payload (Stop)", "value": "28c3528b809644ab676d16c1f13ecf970b7ae087f8387006112fec79db5052bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230342, "uuid": "14df7dbc-5f3e-49f2-aa2f-6eff7f46bdce", "comment": "Malware payload (Stop)", "value": "5ecab5fcbd50583328a9e71487a97d888f5be2f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230342, "uuid": "6dbdc2a2-6d39-4267-b18c-a0568a654a7d", "comment": "Malware payload (Stop)", "value": "2a00b459beacc722872102b29aac275a762c441d84eee525b83d569683d99def0ab0c23a79a6c22aaaa3bb28a99a5dc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230342, "uuid": "27ea5d49-e16d-416b-9bea-fde6a69cbb89", "value": "T18005C05393A17C49F5668F739F1FC2E8B70DB671DE493B6932188A2B0471272C267B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230342, "uuid": "582e09a8-2cb8-41f2-97ab-cc917fd2be89", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230342, "uuid": "27ae1b8d-abba-414a-97cf-f3818181ffee", "value": "12288:hPKujoQqc+P0CA9TIHRjF3059mi5Yk4Lh07RW4O4pAoBkfFE:Rfo1FP0jZI70a+E6DO4TOfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230342, "uuid": "0d428325-d9a5-4155-aea1-4865809ad5f3", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230342, "uuid": "c488f646-886c-4346-a93e-51112bb7ced8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230342, "uuid": "237e5c0c-f7ba-40ad-85fb-aac0199f37bb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1f5819-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679214410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214410, "uuid": "626bb6d5-add6-4e26-b89c-ee4f8ea5d149", "comment": "Malware payload (RedLineStealer)", "value": "ed7c0ab68024de1dddfb3d268fa5277f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214410, "uuid": "a605f651-49d5-422e-aee6-ded287f3ae9c", "comment": "Malware payload (RedLineStealer)", "value": "2933be3878abc4dd812f99e140c04ba6e3097ee948261e27b97e72ee78772636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214410, "uuid": "5c903770-ea7b-4d25-b404-75805bd1b474", "comment": "Malware payload (RedLineStealer)", "value": "d75ccfc338201b363783e3ed11ede2fcad169f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214410, "uuid": "509cb97a-a593-4574-888b-9079383dde1c", "comment": "Malware payload (RedLineStealer)", "value": "fddefdd55c84d0fba1f261ad658470794800c347fc46a458ba9c9318951ca8dfe699c9d5357ad1407513c7301c41f233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214410, "uuid": "ef68a71f-8260-4bfc-be65-c89a38acf11d", "value": "T18945F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214410, "uuid": "ac043128-1b0d-4e03-ba74-8bd7a4f299a7", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214410, "uuid": "e4610244-41aa-4a48-940f-3187df4b23c4", "value": "12288:OxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:QbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214410, "uuid": "bd20adb6-a817-4652-b96b-113c3562705c", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214410, "uuid": "e664144f-c587-474d-90bc-b6bd300bbc8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214410, "uuid": "909d2aa4-920e-4177-9ed9-39895df38383", "value": "ed7c0ab68024de1dddfb3d268fa5277f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dbd522-c694-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679257531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257531, "uuid": "87ec61a6-d0fb-492f-aa54-7b660a550635", "comment": "Malware payload (Mirai)", "value": "e6df40d7a8466659262ba7ccedcde3f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257531, "uuid": "ca2de60c-d665-4756-8133-8425a682f8da", "comment": "Malware payload (Mirai)", "value": "29ccf8a259158899ed74ae8ed63b9dc78a7a42a38c775f907426829c22dadb45", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257531, "uuid": "87cb8d7c-3f13-40da-8366-98eb51225223", "comment": "Malware payload (Mirai)", "value": "02149fef9322b9d27d4f524f695530312318cb9a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257531, "uuid": "3eeaedaf-74e4-4337-b761-f61bf0631eaf", "comment": "Malware payload (Mirai)", "value": "1e0be46bee3862191809d5199056baee397a46dbd0d96cc299acf2a4ce4b6cbaafd57b41cc92e0fe87c815d664feda3a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257531, "uuid": "5a1c7ba2-86d8-43c5-a49a-787349eeb292", "value": "T1E2F2F1AF724440F0EC8AC3FE1DE807869B3507AA5A52DC061542DB7BDD6E4E83D62C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257531, "uuid": "f5b048e0-3065-499d-800d-bf95fc376787", "value": "768:elMB/UAIKEfqGrWwGUezx0ip2bT5oApNyBhvtsr1RzeyjsQ7SO0RJgGlzDpbuR16:eiBsAIurwGXxobloAybvtORz9jF4VJu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679257531, "uuid": "60550bed-93c2-42b3-ba73-7db2ffab6d7a", "value": 36640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679257531, "uuid": "e10e9f9c-6201-4b3a-a91d-a5c68e6af3b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257531, "uuid": "3c42e288-417a-4588-a2ee-b540ee5969d2", "value": "bok.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c98a45-c633-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679215814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215814, "uuid": "deeda53e-d285-4e22-b02b-9dbf74ac921f", "comment": "Malware payload (SnakeKeylogger)", "value": "0ea8662d4d004e96bc0c6092bc6f44da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215814, "uuid": "017add07-888d-4946-a82b-d07b421a3205", "comment": "Malware payload (SnakeKeylogger)", "value": "29df2f47f012a0b1f3228a8f3df284abf8aac4a0a0ac9e54ae9a40503ffe7143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215814, "uuid": "5c4d226a-cbea-43a5-ad36-be1c5771eaab", "comment": "Malware payload (SnakeKeylogger)", "value": "694be6131d4bf2ab7cfe110cca5d640f82a532dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215814, "uuid": "53288417-8aa5-4a37-9de4-2cde9483a226", "comment": "Malware payload (SnakeKeylogger)", "value": "5d68865f6c33fedcaeb851df2270a0c182f1bce7ee49a9f2747baec4bdca84d3627a4a2e248e38ef5caec8db4c5b4361", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215814, "uuid": "45d21276-0b37-440d-81b0-eefb31c6b1ff", "value": "T1A305AE83E8CB72DED9185A35C6C16AFD7B145EF160E6C73C2FF981D49014602A6863EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215814, "uuid": "94c54833-9105-49b4-936d-3a67334bb2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215814, "uuid": "01394bb0-374e-4d17-bc02-cb4a5177f591", "value": "24576:isMSz4oqtm1VA3JmgNFkGgA/KHcSslhgrqMc:zVAlkS/HSNrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679215814, "uuid": "beb931de-f92b-4123-a342-71719a777065", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679215814, "uuid": "9effb7f6-45d1-423e-9435-e33236bc3763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215814, "uuid": "adc6fc45-5475-4af7-92c0-3f687f42fe39", "value": "0ea8662d4d004e96bc0c6092bc6f44da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6996915f-c655-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679230566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230566, "uuid": "1e1b6363-a570-44ac-a451-957bef1f54cd", "comment": "Malware payload (TeamBot)", "value": "ae4bbdec91eba4871eee93ac61410cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230566, "uuid": "0346f64d-b452-4ee4-a83b-605524d3b20d", "comment": "Malware payload (TeamBot)", "value": "2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230566, "uuid": "db2dd2b8-6e22-45b8-bcb4-01d72bd0ee30", "comment": "Malware payload (TeamBot)", "value": "abab472cf9573513955898956c0e07bcd8807b9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230566, "uuid": "2eab85f8-b591-4524-bde0-27ec675b61d0", "comment": "Malware payload (TeamBot)", "value": "8a71fe50f492fb23b649242cf563d47951351c302628fc9329d0070cdd023aded5d3b5fd7b08c3c13fae72fe572c951d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230566, "uuid": "26d65d42-fe5d-40f3-9be8-7b3e767b56af", "value": "T1E254090393E13C48E5268B739E1FC2E8B71DF671DF497B6932589A2B04B1172E163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230566, "uuid": "c2e40978-ed4b-4a77-80a3-cf326529c331", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230566, "uuid": "5e5fa34b-9a43-49b0-985e-43ce10a21d5b", "value": "3072:T5xCowcLLxW3JUMnFG+6K8azyIfvTIfgDGJRn5EnttGr:TvwcLLw3JbGtKJzyIfLIfgq32/Gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230566, "uuid": "68d3a1c3-df49-45c7-b988-57d20b315727", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230566, "uuid": "312ca51f-887b-4380-bf53-178caf6342d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230566, "uuid": "7f979182-9281-40fd-a35d-bf8e32d9d748", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0ffc0a-c66d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679240905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240905, "uuid": "477e48fd-cf3b-4bce-9fff-60abbc1a6dbb", "comment": "Malware payload (SnakeKeylogger)", "value": "c8e5f304628ea2be932730c9db713dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240905, "uuid": "981e48b8-9f88-4c71-b4d2-8dcdbd165b2e", "comment": "Malware payload (SnakeKeylogger)", "value": "2ae62a904a42345e91103d004336258dcade22cdbfba99374bc04f85fb960dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240905, "uuid": "43816548-ffac-464c-a13f-9cdeb77aff23", "comment": "Malware payload (SnakeKeylogger)", "value": "7f255780e5ed9a387c43917680c08e1078b4cb8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240905, "uuid": "fbf64caa-be6d-4036-89a3-f2f560566604", "comment": "Malware payload (SnakeKeylogger)", "value": "7803913449810737cb0f1ac7f2ab3876d33f9fad5fffc62c8b42bd33ffb62b795fe41d58a99b8c77d76c48c3be4f964d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240905, "uuid": "b3d009f3-01a4-4e48-8530-c135ea11a1f5", "value": "T1D1157C8533B19473E99A05775634A49E1D39A10B709BF33ABB273741E20067BB36EF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240905, "uuid": "8417d8ce-f957-4e43-babb-1e6e52627d49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240905, "uuid": "67ab0c58-2728-4097-968d-f392d95b73f2", "value": "12288:kXbMh6oP5tt5ARXvPhBjqXd5KR6fo+/hgl8LnhpyevEkQycmhVDQ:NIZhBjqDg6g2hRLfEkQyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240905, "uuid": "15695f37-c252-4cc9-b067-b712e93b350c", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240905, "uuid": "d30963b1-ce32-44af-9b60-c73b3975652b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240905, "uuid": "e07f8e97-f9e0-4ac2-ae68-bf8cce15519e", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e172bb45-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241504, "uuid": "1d1e185e-77d9-4d79-9e33-ec072ed0ad88", "comment": "Malware payload", "value": "85dfb3535a10b2c1a5688de6cc3d8240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241504, "uuid": "955f9f05-622e-426d-a765-0255293005eb", "comment": "Malware payload", "value": "2b1f51db0db5312003d88a9098344664f516cc3d6fee0fcc05dcb4de74521e88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241504, "uuid": "8d68343d-3346-440f-9d96-0c97e1bf5887", "comment": "Malware payload", "value": "16b2f3641ef3e1e94a437b1cf6ad8999eec367e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241504, "uuid": "4e56738c-b757-43a6-a433-d9e048deb332", "comment": "Malware payload", "value": "d984f8130cd89e33ed35ec1233905eef350ca980bdda0d0c42bb398a619ac12f704984652a01a6a1aa8fd4ae0ae33641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241504, "uuid": "82c12592-e6d8-40c1-9355-f7a0717b659a", "value": "T127842328376E9C35DE111230AF7644FD57D93086D3EEEB248182444FDF76B82A8E0BA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241504, "uuid": "5b629fa9-459e-4334-9f2a-99f478202b8a", "value": "f12d8b251be05e4edfe87a7ba231b1f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241504, "uuid": "d5f834b7-6899-404e-aa52-0c03703e3a67", "value": "12288:PX4fljUcdN3yWSxAQQouKSFglssknxP4My/SmfV:PEBb3QpjOF4X/Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241504, "uuid": "93bf6cdd-c3c7-47bf-ad17-0a43f1639617", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241504, "uuid": "dc906487-e4de-4d4f-941d-f0349e1acd74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241504, "uuid": "8ea87b70-91b6-42ec-8672-0d908cee6bed", "value": "85dfb3535a10b2c1a5688de6cc3d8240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8c0aa7-c607-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679197282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197282, "uuid": "be4579f4-16ee-4d21-aa04-5b0fe89179f6", "comment": "Malware payload (RedLineStealer)", "value": "523402816831a0bf99ef7d15ba77ebb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197282, "uuid": "3d6ab3f8-e9a5-41af-9039-1c21363a6417", "comment": "Malware payload (RedLineStealer)", "value": "2b36f8eab457b8376464cd92286b6fa66a8dcc35a48ecff5ffd52e24aafc5ce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197282, "uuid": "187a148b-07e0-4c5c-876e-e9d7f0cb91d7", "comment": "Malware payload (RedLineStealer)", "value": "53d198120784586eaf212ce040c8485ffa6b51ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197282, "uuid": "a461dfd2-5609-456a-8680-c52f81a69cd9", "comment": "Malware payload (RedLineStealer)", "value": "8f3e411257f3b86ff8989921bbc92eecebca8ecd6f1d543a5cea30e81df60153e569df5f2bcc5642938631a4bf5c23a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197282, "uuid": "7ddc4025-a358-4f23-b81f-f0b909447be9", "value": "T12D15120BF6E4C122D9B187B025F706D306357DE66F7057AB278E6C6A19726E0B03136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197282, "uuid": "b97ed38a-66a6-4397-bd70-0fe42b27829e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197282, "uuid": "4928a21a-b681-47ad-b790-d50985e12aeb", "value": "12288:eMrBy90vul9hzOTz1kDNUA5yTM3Hs+EWFW9Oe0cj3bApps62BNU+r1sLd1Okc+38:/yN9h+KUT2HdEWoF0cj3UXDgUGt+38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679197282, "uuid": "a325a880-1de2-434d-8bad-dc6bfd4358c7", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679197282, "uuid": "9bb200a2-b61f-4b6b-a277-6f1c64ebed9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197282, "uuid": "28b6f934-a382-46d9-be62-f8cb50fec055", "value": "523402816831a0bf99ef7d15ba77ebb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2153833f-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211976, "uuid": "14c9c872-0b44-40a1-9b68-42af37c967f0", "comment": "Malware payload (RedLineStealer)", "value": "6f9f7aae1d02ef15a943cab1c538b1c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211976, "uuid": "0fee7cf0-c228-462f-88bc-bd892703eb22", "comment": "Malware payload (RedLineStealer)", "value": "2bab0d267c652080d420cf7e6733d45fa27507d2abf7369c27cb4671c3fd7b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211976, "uuid": "14a4e9f6-786b-44ab-a21c-e096dbb891e1", "comment": "Malware payload (RedLineStealer)", "value": "1a2453270e3c6ef983cacbbae3186daf879d721e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211976, "uuid": "2fe00b4b-b2c3-404a-9156-201e6828fbf9", "comment": "Malware payload (RedLineStealer)", "value": "e4fee69c163b90a2edcffd5010fae21be7013f7e367c7953f4b8185dde81ec79278031b3dde44886bce57babfe9dd9ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211976, "uuid": "79405ff8-b217-4d54-9aa7-7663cc14b0c2", "value": "T12045F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211976, "uuid": "75c15cd5-4df4-4bea-b0e3-d84868488b47", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211976, "uuid": "b3044f3c-6b5d-4348-8ca1-d974fa62db20", "value": "24576:mLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:8ko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211976, "uuid": "9bb3ba50-3ac3-4f57-9a2e-589e8d1b2026", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211976, "uuid": "b3d16a35-f3c4-499d-adfb-dbc96efd23a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211976, "uuid": "5233c5d6-43dd-4baa-936c-e7d39367a391", "value": "6f9f7aae1d02ef15a943cab1c538b1c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cbda52-c66f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241599, "uuid": "a8826c26-3d4b-447d-a4f3-44b82a375f88", "comment": "Malware payload", "value": "bb96abe16620666106095e9cfa4a38c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241599, "uuid": "8bdecb04-b454-46ed-b521-9d21eee1305c", "comment": "Malware payload", "value": "2cc6ce1728eb5f4838f10933928342846e3673847fdbddfb72848308b2ed23a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241599, "uuid": "9b1eaccc-6c7e-445a-b9fc-acbaf7288ff0", "comment": "Malware payload", "value": "d9965f2e248a6372931a01263847c005a6aa14e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241599, "uuid": "9e72f7d8-747e-4e86-bfcd-8a2bb0496d4f", "comment": "Malware payload", "value": "ffcc1ff3b719e9e346abb3d20c7101b52b33f4836c42450e4b1e18dc067b46a6a78ce9f1d7639ce8178e7f7117d5d43c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241599, "uuid": "c9e02b9c-7aee-4a74-a96a-66805ce56dee", "value": "T191B5D06911BC01D9E1BAD13D8A869A4FE7F17C851334DBCB45A149EA1B23AF8367F310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241599, "uuid": "045cba7d-b233-4875-9058-b8c4d312039d", "value": "24576:VeeYql/FhIMp2uujwvTRa3j0Q2TVqck0BGy1zZDbyB68viSFzdY8la/VdPiE7puI:Vv08Ro21Buk5/xgXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241599, "uuid": "d38798f9-b3ee-45ae-a7ad-26948297ab29", "value": 2485961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241599, "uuid": "a1c271b6-0d56-4492-8e45-c15f36d8f347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241599, "uuid": "b44bc54e-b2f1-4f86-9e18-70b3c38bc318", "value": "bb96abe16620666106095e9cfa4a38c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b05893-c678-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679245486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679245486, "uuid": "89124b4d-ee45-4bef-a566-6fba53d187e2", "comment": "Malware payload (Gafgyt)", "value": "a4ea13ef051384e3aac26c8bd3a2fb40", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679245486, "uuid": "e87a185d-9d37-41c7-b3f0-c1908098583e", "comment": "Malware payload (Gafgyt)", "value": "2ce5eb2235aaf5476213a6dcdc7627524fd9a134b81dfda3e857b24f300ccc6d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679245486, "uuid": "98cf8fe7-675b-4d81-a2ac-c7cbf38a1aca", "comment": "Malware payload (Gafgyt)", "value": "532bf97ed3feb029c94763ce3abf2cf97dfa1e7c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679245486, "uuid": "02b06aa7-41aa-4354-aeb0-24c4ccdd56f5", "comment": "Malware payload (Gafgyt)", "value": "6fb3ceb110a66cdc89711d2e697c2c5eab1f3bf18428a919373d77d85c5ccdff658c12c3640f4ac000594ce07129341b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679245486, "uuid": "52f4c7a8-4de7-437a-ba30-68e63bef166a", "value": "T10A934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679245486, "uuid": "40b08805-fbac-4ad0-8a7f-d1b6d92e2369", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3CphauH/VPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdCphaE/XVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679245486, "uuid": "76b2ef65-2932-43b6-962c-614d605c15b0", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679245486, "uuid": "7a252137-be55-48cd-aeaa-48f4df6bda1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679245486, "uuid": "404de7bf-452d-4a79-999c-4e7d0564e044", "value": "a4ea13ef051384e3aac26c8bd3a2fb40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65845a6d-c66f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241726, "uuid": "06678016-9508-4e7b-b07d-a5e0d94560e4", "comment": "Malware payload", "value": "0fa76caa17ab914ac74fa6fb310ece3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241726, "uuid": "d7d9a86d-ab87-4c0d-922a-9db21c62a9dc", "comment": "Malware payload", "value": "2d375d705eba9a464fd1ebd8d4f15adf3e7e62b16fb0f5b41f96d1872040edf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241726, "uuid": "34c4c0c8-d9d5-4a3a-ae16-b59e35f7db22", "comment": "Malware payload", "value": "6ef0a7fe2a3d44f05469353c5ca877b4bb9ba1de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241726, "uuid": "e84e2f85-6935-4c01-af1a-0dcc3ad74df5", "comment": "Malware payload", "value": "cb439a5ea270d70a8de77829d231e1141fb33c049ce43e2bc01b343206cf85d01dc09b85b3befded8f8cd4ce28183303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241726, "uuid": "8197d5cc-5987-4bb4-b71a-fe319d1820e4", "value": "T1A1E57CB102D3FE91D36F1F31C1502741ED608823A7AEE348BDC8199F96CA7649F996B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241726, "uuid": "ce949e1e-7640-4376-9b05-77bb42ef71df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241726, "uuid": "29a8d470-3c52-41ef-a185-7fe31d7a811b", "value": "24576:T2J01lpxrM1oGyT4qj62XGMugroiKtu1Dze6HDpLo2HBn42mA/PgGEX9KO1AkH9m:CMlpxwpyEferBB3v/eUZWbck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241726, "uuid": "c1a65974-ef79-428a-a59b-3185cf48e7ea", "value": 3075584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241726, "uuid": "4e57c576-f824-4446-a20a-85512f5d038a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241726, "uuid": "c64145ac-7199-4214-9987-377329f63d36", "value": "0fa76caa17ab914ac74fa6fb310ece3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9288f9dd-c639-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679218609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218609, "uuid": "444bfe56-360b-477f-baa9-6a5acccc4f78", "comment": "Malware payload (Amadey)", "value": "45d4053f96ae947bef2930731d9a1939", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218609, "uuid": "6a0aae87-4836-49c9-a1e5-2a4defbada00", "comment": "Malware payload (Amadey)", "value": "2db7380c11eae856290e1bcffe4acd9710a5db17d8322c8320c0c36b95499ee7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218609, "uuid": "5ab88317-18aa-47c8-b322-6c63071b8077", "comment": "Malware payload (Amadey)", "value": "02a1f9eb2e6c6e082d5ea86ca9abf3554486d198", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218609, "uuid": "2865cb4c-d3f5-4765-8e43-567ac2abbaee", "comment": "Malware payload (Amadey)", "value": "b9846676358550f6d13ce804b4ed9c3673ffa21032a6062ef10164f139726de11555058fb8fd9247b7ee067592b7b8c6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218609, "uuid": "979bd0f6-0cf3-451c-9732-7b5df97342d2", "value": "T1FA45F10393E17D48E5268B739E2EC2E8BB0DF170EF8977653218DA5B05B1172E163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218609, "uuid": "a1f912a7-6e2d-40c6-ae57-adbd4ecc00a8", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218609, "uuid": "08528aac-76f3-4543-8665-ca4bf581741c", "value": "24576:bWksAUpYGbPrZhqNdhHkLPSPiBKo7LZvLtPY8GOCGRAR:bWkUYiPrXodq6qBLBJAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218609, "uuid": "ab962761-4d0b-4756-8770-41a4a1977085", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218609, "uuid": "c2f46a18-8d35-4dae-9c43-3ad0ef29516d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218609, "uuid": "2c923de9-7fe0-44bd-a7c6-852389693cf0", "value": "45d4053f96ae947bef2930731d9a1939.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1af8003-c686-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679251813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679251813, "uuid": "d78d0cb8-8b86-4e18-9952-166ce3497ba6", "comment": "Malware payload (RedLineStealer)", "value": "29cbc6cd016ec9eee60e755435f62fca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679251813, "uuid": "b255ae27-f03c-4842-b476-9e5f03435006", "comment": "Malware payload (RedLineStealer)", "value": "2efdeec65ca57ec88ec6ea486a08fe50dcc883177ca3667e45f1ee76daa7033e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679251813, "uuid": "95b0c064-cee4-4444-9cdd-3261c4724717", "comment": "Malware payload (RedLineStealer)", "value": "21aaf734e00346245a0625d483803f2c31465d24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679251813, "uuid": "577fbee1-704f-4d08-ad63-470346e0812a", "comment": "Malware payload (RedLineStealer)", "value": "257c5ab5ce953a6a39b1467e8c4eb158d5b1ff76e05745adc61276ec38cf51dc0acf1a1a223f996f3c02a5ae99b57934", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679251813, "uuid": "4ae18e69-5a20-4229-812b-0844af9c0dd8", "value": "T12974A3E3222010C9FB8C04F994FA865D444DFCBFA3CF6B46A7D9347E56046964A97F88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679251813, "uuid": "f08a7f38-65f1-4ff8-b28b-68fe4b282536", "value": "69fa33e0c59aebacd3a57d4f9c05031f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679251813, "uuid": "57c77d98-44e6-42b3-8657-84f9557466e9", "value": "6144:FcvflJCtPXg8/+3dVnnzf4GArE6INIu/u/u3BF:gLCt48/8FztNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679251813, "uuid": "e58720c0-e30b-4187-8629-fa28d7ddcd13", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679251813, "uuid": "4de81c05-4ddc-4634-bee4-a3d944e26aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679251813, "uuid": "8fedb002-3611-415b-a46f-c2514d19d185", "value": "29cbc6cd016ec9eee60e755435f62fca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f836a31-c694-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679257527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257527, "uuid": "3f54456d-4dc0-42f8-ba15-43baef365cda", "comment": "Malware payload (Mirai)", "value": "652f39d83929fe3ca6cc6842db1fe578", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257527, "uuid": "b375cda1-3822-40df-8049-b28a63404f94", "comment": "Malware payload (Mirai)", "value": "2f02ed3932201bc49eba4d41538ea5c78ca5d9c392e93e3713786da230673817", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257527, "uuid": "d1a248a6-b381-438c-9e16-981f37f6a394", "comment": "Malware payload (Mirai)", "value": "87a33a17534e7adf55ea6e7300cbd44442c15cf7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257527, "uuid": "10b74b71-76f2-4b94-9dae-d584f8e26e17", "comment": "Malware payload (Mirai)", "value": "ecbe61ffd1570682be00732665d80d2d7c7203c7034b2391125125c85bd0115707ccb81d061ed520c91ec15a2d215819", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257527, "uuid": "3070e5e8-c4a1-43c7-b677-8463314a0719", "value": "T19BD2D07233F2DA71427074F7C7FDD19172E61EB566E1B22414282D68E39208B15F91CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257527, "uuid": "17441a6a-5f94-4f3f-a0d9-6f4a4770b8d3", "value": "768:4M2YIqt1g9WOSMXOr5jEsH1MaVBLSgCs3Uoz3:4Mn3g8MXO9gsHykxn/z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679257527, "uuid": "25a34412-1266-43a8-9211-e1a9bba7ccb7", "value": 28904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679257527, "uuid": "d6eb224e-9ae1-407d-ae5b-658c4cd7e339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257527, "uuid": "304f17ae-8562-489f-a1b9-00991ab9be6a", "value": "bok.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15728ef-c657-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679231572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231572, "uuid": "40767702-b526-4be6-93f9-72d4b48611ae", "comment": "Malware payload (AgentTesla)", "value": "d7bbc6ef7a09d615e3b8c864b83a03f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231572, "uuid": "ad29df79-2be9-4540-b4b4-d5551b0d1ce8", "comment": "Malware payload (AgentTesla)", "value": "2f40f6ef3c46c7e7a51531385abc337e60fed2a22d4a604e39c94ac05e95e03b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231572, "uuid": "ee555750-9cf3-481d-ba81-81d0cc3993bc", "comment": "Malware payload (AgentTesla)", "value": "e5c05e7a380017c40eb766d7029414c4edad264b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231572, "uuid": "e0aeb049-fec2-4146-96c0-1ad8aa92f947", "comment": "Malware payload (AgentTesla)", "value": "85b1f2c1eea2f53c4bd92e59fc3e668984593d14656f88e7af39d850d6ef35d28345df8b0863928f75aae68c85df8c9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231572, "uuid": "2587b94a-9f81-49ec-b087-cc5354b725f9", "value": "T132B422A47984D636C69E3BFDC0E2351263617E192A13C70268BD32DE683BB97DF4425C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231572, "uuid": "c86bda4c-14f2-43fb-b291-7c27d69d934e", "value": "12288:sPqlMdaMAUQ1wQhHV7MyEqqpeabdcfOYuMAv3npMovIn05dqrlb:sikqTfrE3PbdlY6Ghb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231572, "uuid": "de33162a-47b0-445e-b073-6ba2215533b2", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231572, "uuid": "04d0584e-c0f7-4ed3-af70-d8e4dfa74422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231572, "uuid": "017e278f-3c43-456e-b604-5962a14788f6", "value": "No. I20220052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cffdfd-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211982, "uuid": "24367661-9a94-4c8a-b8a8-b8c25e7523af", "comment": "Malware payload (RedLineStealer)", "value": "28e7cabb3f8c76a55bfde5f69851ace4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211982, "uuid": "84108a9f-2e2f-4c82-ab6f-f39fbf808ccf", "comment": "Malware payload (RedLineStealer)", "value": "2f6162010919f28839f23e72ce83c712e35afb63606d1ebcfeae8d5c3bf8751c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211982, "uuid": "7ad25ebd-d7b8-4a8f-ac55-05ee75054ad2", "comment": "Malware payload (RedLineStealer)", "value": "33e64d9d31d9936237ce1a19c816d7d219144dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211982, "uuid": "ab84808b-8a5d-48df-86de-86445cba0180", "comment": "Malware payload (RedLineStealer)", "value": "6603aa66e1a2880db8014e80bd23c0ff45933efb8a80a048f86816d272535dad0b561c7e74b3e34679eca591d47fe1f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211982, "uuid": "7fe9f1bc-8c46-4399-9407-c745640f7100", "value": "T11835231BF7ECC473EC714B3059F602D30B397AA51B79C7EB365AA89909701A49A34327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211982, "uuid": "2672dc7f-c51a-4839-84c6-b2922f821ad2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211982, "uuid": "74c4913f-b9a7-41c3-9ade-071d22179ff2", "value": "24576:cyfbFocb2YOVQgFmkAPWA9ixdHDIEp2HIfqe97qkv:LP6J9fYWA4xFIE2Hmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211982, "uuid": "88ff893c-3443-4a72-917c-eb7e46b1e565", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211982, "uuid": "1f08f5f6-fbfd-4a09-8d5d-aa1a874d8157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211982, "uuid": "d0d94399-c9f9-46aa-b82f-78d1c6b26d25", "value": "28e7cabb3f8c76a55bfde5f69851ace4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b052f4-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211663, "uuid": "db22a99d-ab63-498c-8e10-dcb11380be6d", "comment": "Malware payload (RedLineStealer)", "value": "217ea6d66373e04c925225973af7f4e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211663, "uuid": "e4f95438-0f9e-4d1d-ac18-0223ba439432", "comment": "Malware payload (RedLineStealer)", "value": "2fc4fba86b5450db891b6a4fd96067e591707f4a8730313f9e4e77b5d06777ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211663, "uuid": "c72e9ecb-6646-4f0b-b0a5-528174838634", "comment": "Malware payload (RedLineStealer)", "value": "67b2ef7b51b217d7bf5ac0d50ad49d69c2b57ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211663, "uuid": "36043309-8cb3-414e-af4b-a6ad4d55ea81", "comment": "Malware payload (RedLineStealer)", "value": "9793709238e61fe865a2019e47c1960055b2ca8d492e7f0b368c0817f5e08e8ee0574e7053817c883eafa75a83855abe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211663, "uuid": "4bcd6793-7b65-47fd-a633-ea69288da06d", "value": "T19645F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211663, "uuid": "bf78a1d1-a271-4e63-927c-d9200816638b", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211663, "uuid": "8922d39b-1cb1-4d12-a855-efb55b330c71", "value": "24576:e1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:e1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211663, "uuid": "35ae6a3a-eb4d-4921-a723-910811b51f10", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211663, "uuid": "bc3b3cc3-483f-4e4c-a555-8db21315dc77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211663, "uuid": "a28821ae-7b7b-42d9-90a1-0d69b2221c96", "value": "217ea6d66373e04c925225973af7f4e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b40e8d-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211370, "uuid": "4f78a1e6-93b3-4127-8c16-6de6210167e7", "comment": "Malware payload (Amadey)", "value": "24f32fe119b078a8fe778cb95a84676f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211370, "uuid": "84ddf25a-6e3c-4424-b658-7c672ef6b92d", "comment": "Malware payload (Amadey)", "value": "30eee3064c05ba337253f32ff8bf633d84cb7d91f7fa1d3d8c6c852322d04bf2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211370, "uuid": "5836ac16-511f-480b-9f25-912c6b26acbd", "comment": "Malware payload (Amadey)", "value": "4c40280f0ba80301681a3259fc8e2199e19a6a4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211370, "uuid": "c17ec89e-6cb6-4313-ae70-7ed63bc78fc8", "comment": "Malware payload (Amadey)", "value": "483856856f751a50a4bdbfd2344c6089a8034fac1fd787e3df689fd4e572490fcb7146c6253d304c2402816b1c7bd571", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211370, "uuid": "4ab7b6eb-9c06-4a3c-adcc-2159029a5c2f", "value": "T11645F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211370, "uuid": "78551213-4717-4d23-a20e-b6f69f4a9547", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211370, "uuid": "a8dfbc93-c932-43de-9eaa-bb7fe0442b79", "value": "24576:kDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:k3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211370, "uuid": "af68c06c-aa6d-4781-9450-4bf77b7195c0", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211370, "uuid": "ab3a60f1-9d18-429a-93c1-7486bf4c07c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211370, "uuid": "e2a4c8ea-9f66-4419-a038-5290cd14f568", "value": "24f32fe119b078a8fe778cb95a84676f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a8ccb8-c66c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679240684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240684, "uuid": "c9b535a9-b022-42a1-9256-f5f94f306933", "comment": "Malware payload (Mirai)", "value": "270b2a86f4f48843eade4ecd2d6568c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240684, "uuid": "f81ee16e-cfde-44b6-9908-1cd349d2170d", "comment": "Malware payload (Mirai)", "value": "3118903e1bbc225ee5147411ed3f524514ab9f5afbf5b7cf3eb9e5f5e2e7beeb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240684, "uuid": "0dfb339a-97a5-4621-885f-7d5643e9dd36", "comment": "Malware payload (Mirai)", "value": "dd7f4f981c72c67c2d28980dd24d5453e9bfe7e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240684, "uuid": "619b33cc-8543-424b-a4b6-339d36fc7c40", "comment": "Malware payload (Mirai)", "value": "f20aaf1a06b0d752b198ca1f0135ac92573237d4342e5a2920718283a078878a8fde957e853e032f090b83a928725978", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240684, "uuid": "c04058b6-5da5-499e-932f-5e20ef618b22", "value": "T1D8632951BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240684, "uuid": "e615fc09-020b-4c0c-a72e-fef01f9cc753", "value": "1536:qNSlxYmii8N1U9uO//kWEjFu8ikg/QA83NRuxAvjWq:qNnK7kthdikg//29jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240684, "uuid": "6566504e-ccea-4c69-aaa4-1795950c1c09", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240684, "uuid": "3aee2b44-d04a-4de4-96e4-64281c98014c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240684, "uuid": "34b6e70b-1cfd-4e82-9978-00cfbad6072f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63e0d3f-c66c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679240680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240680, "uuid": "78412b1c-895c-43fe-8690-5f20dee01e24", "comment": "Malware payload (Mirai)", "value": "db80751834267cafc820d1f8ee9530ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240680, "uuid": "5b0b67f1-e072-4891-847b-633c9a9871bd", "comment": "Malware payload (Mirai)", "value": "3130fb91361382555834e1e4906d8c013931dd96515dfb5650f5fa31847e7736", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240680, "uuid": "a07c554c-b109-4fde-85ac-899c330c483d", "comment": "Malware payload (Mirai)", "value": "f5d53bb12b0c019099909c2c7476b815144c5a4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240680, "uuid": "496f6aa3-94eb-4d7f-873a-922d3f5c2580", "comment": "Malware payload (Mirai)", "value": "ee1fb8d4a94b65e9aff208abcd14011cb268a1b506414e349b20fe12f205b37197972b4feb50fd4e915c5c0aa4bf8102", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240680, "uuid": "3f5d774f-361d-4b5f-a1bf-810cccd967e4", "value": "T14A436BC4F643D8F5EC8715702077FB379B72E1E622A8D643D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240680, "uuid": "adcd53d2-e79a-4c7d-b734-dfb924c7e25b", "value": "1536:JeESt/basV2rcZhG6ySN7naxtad1zWOIaEjrqM4s:JeESt/basVTgS7naxQdttXESP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240680, "uuid": "12671563-5b80-4925-a991-88fa7e77cc5e", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240680, "uuid": "4c65453d-d070-437a-b24a-f30b2d52802a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240680, "uuid": "b18ec39c-ce85-48e0-b5f9-6b5951ef1082", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2043b52d-c64a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679225718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225718, "uuid": "75afdfda-56f5-4508-b84f-85e93c3bfef5", "comment": "Malware payload (Mirai)", "value": "adc0f5aeab9a2cfc33c4754ba09dea2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225718, "uuid": "5a5e19ee-3812-486d-afd9-bfba462ff6d2", "comment": "Malware payload (Mirai)", "value": "32891b4f268efb1ec74f3952ec3341245f720562c722a8ec4f72cdaa3896149e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225718, "uuid": "865a49fd-bdf9-4d40-9de8-a4d87115c797", "comment": "Malware payload (Mirai)", "value": "a830234357049149f07fa438a286d429a8e1407e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225718, "uuid": "c55ae638-d49c-459b-88aa-fb095f3cc730", "comment": "Malware payload (Mirai)", "value": "0626ec0e999d5498177fd8900e85c1feff489b0f8f8a82fc6ff2d5e778a86eb5709a31517f1728b0cce51370bcd1e462", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225718, "uuid": "9f673b50-8a5e-4313-929c-b18c0e418c71", "value": "T14C533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F513BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225718, "uuid": "dc3325f7-bcb3-4a83-8191-20fe8b3038a4", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONycgGhd2G4NMiplImpcvwJZY10UoZvBqJ:0aHuAzgjjfUKU0NONycgG+7XtJa10fB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225718, "uuid": "0506cd5a-a2c1-417d-a335-ed8b12153720", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225718, "uuid": "a97492b3-88bc-4a33-800b-d7f30dc6a47b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225718, "uuid": "b9a14494-4546-425b-b47f-21bc802ef783", "value": "adc0f5aeab9a2cfc33c4754ba09dea2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4513201-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211364, "uuid": "73f9eaec-1741-4b87-baaa-9edd01304804", "comment": "Malware payload (RedLineStealer)", "value": "1cd131ce1041ab6030469d39b4a65faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211364, "uuid": "41d737f8-5d31-46b7-a393-501abc13111b", "comment": "Malware payload (RedLineStealer)", "value": "333e71d789cbba65c990d461a93d96b81d6272b39b97d7c8a6d1b0c52884ae1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211364, "uuid": "b4b27e56-edcc-4766-9695-6deab9f840b2", "comment": "Malware payload (RedLineStealer)", "value": "1c3f1a552a07ef47dbc102f8cb46cb68dd79b6aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211364, "uuid": "b55763b4-ee29-4bbd-95c3-39224d38669f", "comment": "Malware payload (RedLineStealer)", "value": "a66c8a5818767d043a423e999a1e2a4cc598698265e31b0554658a80e968b4fdd5f63cbb68f90e64fadf5a11245286d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211364, "uuid": "142eed17-64a8-4d6e-9008-07abfac80441", "value": "T10B45F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211364, "uuid": "0ef678b5-ee98-49f9-b8ab-8c0a6c44ed89", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211364, "uuid": "25d5dccb-c5ac-48e3-97da-b1c5fd683e71", "value": "24576:u1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:u1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211364, "uuid": "a6c13919-fb89-488e-98e4-e5dafb77800d", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211364, "uuid": "adfe4537-4f99-4d5c-96dd-8c8d08da353e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211364, "uuid": "c464ed51-a8c3-4c4d-a51b-ecc1db37aecd", "value": "1cd131ce1041ab6030469d39b4a65faa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6b7804-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226596, "uuid": "f8bc3f10-0b95-4149-aaf2-8e1a8df7e280", "comment": "Malware payload (Mirai)", "value": "343d65dfa874b8370a7bcfb885705544", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226596, "uuid": "83014139-17bf-4ffc-9fcc-6d16f24bb751", "comment": "Malware payload (Mirai)", "value": "33c5e6d10503199323d7d0a1564c49e4edf999644398e94c0b8bf134f50de866", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226596, "uuid": "6db68903-f498-4abb-b73c-8325d0c43d06", "comment": "Malware payload (Mirai)", "value": "3e989e1aa9dc30c597fcc22fbdfa04bcbe56ebc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226596, "uuid": "7b709255-fedf-4089-b824-e25c658189a9", "comment": "Malware payload (Mirai)", "value": "4b554de72151a2be09bf610fb56f4194b640d1a4d5b22afec3d9dcdcf4891f697ce0c3dcdbfa59a6950c42a2cb27d098", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226596, "uuid": "1e7a5290-5d72-4821-ba37-6dff162c6a90", "value": "T127C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226596, "uuid": "96e116da-e84c-4cd6-8cdb-3384db142da0", "value": "3072:4jDy/+mh1vtbPIKa6bpcUPium7/L7QsvmGfIiNb:mOJ1vxfa6bywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226596, "uuid": "fc4e40b9-9437-498c-a193-69b01564a849", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226596, "uuid": "9e96dd28-d6f3-4454-af93-d3f404459d76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226596, "uuid": "a5b46c0d-eed4-4556-855d-760af46dbd13", "value": "343d65dfa874b8370a7bcfb885705544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c28160-c690-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679256006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256006, "uuid": "bb5168ed-1cad-4c82-94f8-d84d32be288a", "comment": "Malware payload (Mirai)", "value": "4524268c2e5183a1df10fae842415722", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256006, "uuid": "e9d273bd-882c-4c60-a283-b57319872ef7", "comment": "Malware payload (Mirai)", "value": "33eac9f19726281db8d780de380b4e9a286ca60625a0d6f99d48e90561a79aba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256006, "uuid": "74b05673-0b77-4595-88ed-e13c7fa8a27f", "comment": "Malware payload (Mirai)", "value": "792afba5b43a1faafc5ce45fa954fb8c14f23cb6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256006, "uuid": "81dafde0-413a-404e-aef6-d089dd97c5cb", "comment": "Malware payload (Mirai)", "value": "f8fb50a0e6f6edb797d5e4c30202ff9ef20d7421d369ed3d469e4b8abf0685a68e9a544d2197bf87d033d77d9d0fafcc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256006, "uuid": "5ddbad50-9ae5-4dee-8963-f90891facd54", "value": "T1E8430170665892F9C7B56CEEC1F687A2ECFF913A6CA474A69684184C6421300DCF5BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256006, "uuid": "9940ca17-7bd8-4fcd-a0c5-d1528be14564", "value": "1536:CFBn23bd9cLu2BNrimUSWi0LV7F91agc5N:KI38lzypLV7Frab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679256006, "uuid": "2bdb4f4a-7205-41ef-ad8e-12a8371b42cc", "value": 56024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679256006, "uuid": "5fa613a1-f0c2-4a83-bb1d-19893cba701e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256006, "uuid": "9d93986c-c6dd-4133-bb97-b5a590c5a20d", "value": "z0r0.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dd590e-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212595, "uuid": "13f8806e-0b12-46d6-b5e8-2ffeb8c52e9a", "comment": "Malware payload (RedLineStealer)", "value": "c5bed922ada9b25e7959a4d08034f79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212595, "uuid": "27ae7224-8892-4af4-aae0-804d1997ed05", "comment": "Malware payload (RedLineStealer)", "value": "3458d9b74be0510d6a0223d03efb5622fda5bc9f25b380bcf3256bdc176c92a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212595, "uuid": "3c04b329-91ea-4069-b9bc-13b9f5ab7f29", "comment": "Malware payload (RedLineStealer)", "value": "3367094536807b42a3f46327d592bf52eb5d8b3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212595, "uuid": "28eb916c-123a-4940-a985-5a0b6f7382c1", "comment": "Malware payload (RedLineStealer)", "value": "b017cff7e28a73c442b3439c413a0b5b6c95eb6f6e99c3b0849a5b78489a4fcd70d4abc97bc33b5a16bb70f12c6f4024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212595, "uuid": "51f8cb78-bf99-4d4e-b79d-700eb5df61b3", "value": "T12D45F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212595, "uuid": "754208b8-1fcf-47cb-91a0-aba729e3acd2", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212595, "uuid": "85b3b9e8-8701-4f84-98af-32d60b31c0cb", "value": "24576:0LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:eko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212595, "uuid": "d6b06435-8a6b-4526-9699-73c480a70473", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212595, "uuid": "f5749973-a5b5-406b-ba42-f85ae1885569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212595, "uuid": "2e7e5ddf-510a-4776-84e1-c685d8f43654", "value": "c5bed922ada9b25e7959a4d08034f79e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec875531-c699-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679259991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259991, "uuid": "d07427c5-8745-4b80-b31e-4377631a9378", "comment": "Malware payload", "value": "1a734753f7d86583ead3dd3c3ec6ee1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259991, "uuid": "98e4a469-c91c-4ae7-8438-53daf79c3ed7", "comment": "Malware payload", "value": "345af30747e6bc29131d37896094eee96e0255ad157d0a1d688f732bb3d60303", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259991, "uuid": "b87f9867-934a-40c5-8f04-fc0cb9ce0a21", "comment": "Malware payload", "value": "157dd487f87ddf8583b15216691bed6e383a11d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259991, "uuid": "d54b4f64-7c4f-4061-bbaa-78b1de898bab", "comment": "Malware payload", "value": "48943f3a15d9805d95477e42720e9fbf1d17debd7c3499d477d5f53e1937643700f6cd937aad8e41c43cb43c4ae2cdea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259991, "uuid": "0be4d959-6b18-4ed2-a090-2c590ccdc8f6", "value": "T1A5B3A42A3A22AFFFE16C86310BF35F7097D5219226A19385F26CD7581F6128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259991, "uuid": "a01d7722-d188-4c18-9648-c449013858d1", "value": "1536:27j+1Tohq+XZ6NDmGf/Yo7exVXMIMNeUdPIUmkiIF8iCKrmne:hK4f/YrcIMrPIUmkiIF8iPrmne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679259991, "uuid": "4a3f88e4-9f80-43bd-9872-9974ad9691cd", "value": 108974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679259991, "uuid": "82b34a58-8aa0-4514-b15d-1c66cd722cf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259991, "uuid": "ff930af9-fe5b-4464-9266-78751dc181ab", "value": "1a734753f7d86583ead3dd3c3ec6ee1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29da28a-c66b-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679240111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240111, "uuid": "80d3e0dc-ffb0-4465-a053-3d0036e050c7", "comment": "Malware payload (LaplasClipper)", "value": "99f16ab6ab670935b5aa5c84b1b5f6bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240111, "uuid": "2ae7182f-64c2-420e-8881-2b31a16411e1", "comment": "Malware payload (LaplasClipper)", "value": "348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240111, "uuid": "63800473-5fc8-4dfc-98f3-20c4616c19eb", "comment": "Malware payload (LaplasClipper)", "value": "59f375481cdfe246d1ddcaada9941e16dcfda297", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240111, "uuid": "eb6a6096-c5a6-452d-90a4-13cc13746e60", "comment": "Malware payload (LaplasClipper)", "value": "1046174f1157c542f1e505b312a5b5997182ff21b3fb237780414d6783eccaea29de8f74d20b4cb17e40c9b11d95f669", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240111, "uuid": "90baa3b8-9823-419c-b423-e65449165d5f", "value": "T176763377222A0084C5E38D314A37FDF8F1F242AE8B819CF4659A5EC57D236E5A793943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240111, "uuid": "66d91f96-4414-48bb-97e3-f92f9ceaf9de", "value": "8aa23bea230ae1c890d1bde72074903b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240111, "uuid": "704f541c-6b5d-4654-ae99-58a81b7e8604", "value": "196608:Ltu5ODXM16mjmKSRFWuxx6ruj3nK/x9jWuy:L05ODcgR6mix1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240111, "uuid": "bc77350f-acfc-47ea-8e6a-734ed5f056ae", "value": 7635968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240111, "uuid": "f01b9796-266c-4e78-be8f-a71d1bf92736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240111, "uuid": "eda31b6c-224d-4672-bafd-83b5a15404b4", "value": "99f16ab6ab670935b5aa5c84b1b5f6bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff021a5-c658-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231704, "uuid": "3dd49f59-bfcc-4923-a965-be20c25d6d23", "comment": "Malware payload (Rhadamanthys)", "value": "6ab4b0382cc6cc5b1b5d82607d0d0ac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231704, "uuid": "fa70f862-6c15-4cb7-8ce7-97d926eba777", "comment": "Malware payload (Rhadamanthys)", "value": "35431fb330379416d98334ec09b6a319b9bd0671c925c1ac38df203409188a10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231704, "uuid": "dd61fa58-6899-499e-b471-b2e915034181", "comment": "Malware payload (Rhadamanthys)", "value": "2da1b66588f02da02cc3ca388d4936a061e8c999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231704, "uuid": "c35968ee-379f-4a67-9740-9ef56a95da1b", "comment": "Malware payload (Rhadamanthys)", "value": "eceadcf8be8ffc3366b08eb9a0d25cf82ee972b04cac1f7d636ff9a3586d21bb56795f469a6c2d4277ed8ae3a23f7eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231704, "uuid": "cc63cee0-1f8c-4443-a1c4-7cb591662285", "value": "T1AE743A0382A17D48E9264F739E1EC2E8B71EF271DE697F6972189B1F04B1172C163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231704, "uuid": "a6895909-7ec7-4dc9-897e-f07342a42bca", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231704, "uuid": "4d3247e4-35ca-4874-b1e5-b81fdeb852c7", "value": "6144:zu/LWFKsytsqO6iYkcOC1sLFUuldtKWoU7OqQDYCrE:zu/mBytvO6lkcJTWTyrkCrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231704, "uuid": "860ee78f-3c1e-4444-8860-0c3eda51b182", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231704, "uuid": "f1dd1a75-d690-49d7-9e48-7686ba26383f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231704, "uuid": "62a22c72-ac29-4172-9943-adc4800021db", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e8a017-c690-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679256004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256004, "uuid": "b033f0f7-870e-478e-9ae9-17c381c3063d", "comment": "Malware payload (Mirai)", "value": "40219fd9e43c12966f3b843c13a17375", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256004, "uuid": "8a778781-2ff0-4bf1-aba2-6cd9045479ac", "comment": "Malware payload (Mirai)", "value": "35e74622b20afd09a0e31dc7a139ffcb881d5a141e0862ca3fce955df50fdc36", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256004, "uuid": "c5624527-628e-4f7b-b299-586b04805ef4", "comment": "Malware payload (Mirai)", "value": "bdb369ba81ddb794742babbc96cb4123412a7470", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256004, "uuid": "e4e1ea3f-2cd8-4f27-b198-d48ff32a1287", "comment": "Malware payload (Mirai)", "value": "041497fa2574dc91cf035e9325c722aab69b8fdf8a3621681ad742b18bdaf71a7102f73eb88e5c774629cef445f6e818", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256004, "uuid": "4e2fe00f-3a44-40b8-9116-ef03ac8211d6", "value": "T140E2F1B7465F090BEE89F2F3A48C71A10CF26DA033BF8FA20D18496171171D85296AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256004, "uuid": "be3200cb-4c60-4fe0-bbc9-b6dc7a4eef8d", "value": "768:Aq3yhi2rg98FdmvPyQw7NABkcEfpVyVVtXJPYumcScSQ1KK7:LiFdmvPgACcEfpVOZascY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679256004, "uuid": "a91140c5-eb2b-44ac-8139-4f0525bdb980", "value": 31328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679256004, "uuid": "73bacb19-65a2-49f8-9a88-b9741223a53f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256004, "uuid": "d002d740-2277-419b-920f-bc8776440267", "value": "z0r0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe925f3-c655-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679230677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230677, "uuid": "424117da-663a-4915-9599-16fabc1683c6", "comment": "Malware payload (Stop)", "value": "80a0b9ba48cc1821415a5f6199d8848c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230677, "uuid": "e717994a-7505-4306-b768-d0f567691514", "comment": "Malware payload (Stop)", "value": "360006e9a559eb1322117c356b79852e642479ec9a729e01bf25505310dd2e94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230677, "uuid": "06306cfe-be72-4198-b33d-e07b852bd6aa", "comment": "Malware payload (Stop)", "value": "a3dc3be24a69358faadecb9c3784e6029d0f241d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230677, "uuid": "34052d97-7f1f-4f1b-b4bd-82ab39a1ff05", "comment": "Malware payload (Stop)", "value": "3b98b4c695a34a6bbabae5a1f784b552e8b2a753d718f6fa32b18d2fed0ea706a9419e78985fa59d74a8aa1470f449ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230677, "uuid": "ec0883c8-433e-418c-a60a-9919b38c3efc", "value": "T13F05DF0392F17D48E5264B739E1EC2E8F71EF670EF897B6532089A1B04B0676D163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230677, "uuid": "c9f1fdbe-2094-4c1b-948d-bac5e3895da6", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230677, "uuid": "d5f53c27-d2aa-4eca-983d-7373ec955113", "value": "24576:FFIU21ySO22wWtDw5CzRY0GRN+lts/rZ+kNnVu:FS1LCdGCduNctsdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230677, "uuid": "237c9d76-7f0a-40f3-9f17-5244740c6898", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230677, "uuid": "be3ffab4-8fb4-41d0-a170-34352bc897bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230677, "uuid": "053d3092-42ed-44ae-8528-0055affbb15c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2ed362-c624-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1679209557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209557, "uuid": "4e3bb300-d0dd-4a5f-8da6-d280d18bd8b0", "comment": "Malware payload (AuroraStealer)", "value": "d7c5cd06143cd8e4aadf95c82935fd7e", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209557, "uuid": "db6d2e70-e27c-4ca2-8e85-98b1603c3e9c", "comment": "Malware payload (AuroraStealer)", "value": "361dda6d1052d40b13116e82e39e6e572bf6f10e838809053409e4f2c7adc779", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209557, "uuid": "23639b31-975e-41f3-8231-c134dcb64959", "comment": "Malware payload (AuroraStealer)", "value": "849944420ea326c6a6408d28cd7abbf2235df00e", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209557, "uuid": "cfca9ae4-e2a9-4807-9a60-43764ea100c5", "comment": "Malware payload (AuroraStealer)", "value": "e20cf853c2e79e3a1895d132635484388f46a318138198c1c17c064fdfb4c904e93662e934cfc6f907207b403914805a", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209557, "uuid": "4627d273-806a-44e5-a99d-a3c82979c2f7", "value": "T1E835221BA7ED80A3E87967B068F603D31436BDA1577496AF175C7CBB18321A0A43137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209557, "uuid": "bf6449db-bdc5-4a0e-a790-5f209d572c54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209557, "uuid": "37a863da-c404-48e0-85f2-7df0ab58d3fa", "value": "12288:CMrAy90zDuRyulLJ1Cx5nRDGwGTyUg5IstMm+Tg5EDdU2stNXH62IxZ+513l6I7z:Oy0MyulTi5i2UzkER7uXa1ZQP2cR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209557, "uuid": "731763fd-c3db-4cb3-b72b-0fafbc5de65f", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209557, "uuid": "ea7c9d6a-9ab6-4d98-a37a-25b8b845fbc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209557, "uuid": "04884394-7432-424c-aab5-c492b23e89a3", "value": "d7c5cd06143cd8e4aadf95c82935fd7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539d9bcd-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212920, "uuid": "71309bc7-be40-4c40-96ae-c43e3ff73a58", "comment": "Malware payload (RedLineStealer)", "value": "fe645527145e6975c72508b633cfd199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212920, "uuid": "502c7a25-584c-4865-ba1f-7b59e096b5c9", "comment": "Malware payload (RedLineStealer)", "value": "36895cd17f04e74090e3baf79475b1f52dcbcc8e6555aae09f1af0bb4fc19167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212920, "uuid": "2dfab7c7-e242-4e87-9f38-8c8311da62eb", "comment": "Malware payload (RedLineStealer)", "value": "b550bd71432e2e904f83f6c432ba116ec9ec5e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212920, "uuid": "e8d65743-8ef7-41a9-a33d-edd42c7b6646", "comment": "Malware payload (RedLineStealer)", "value": "6fd8befeeeedde05934ff61e0fa62efb5ace661a5ac4a3a2665524ce91e0998deacafcf0c4b31db5e33b32ea967b7f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212920, "uuid": "370b57a8-599b-4ead-9374-07eed22e2110", "value": "T1ED45F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212920, "uuid": "620b2259-575d-4e29-81f8-4565a8e93e16", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212920, "uuid": "40bc42bb-2ba2-454e-9134-bcdf493ce87e", "value": "24576:XhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:XHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212920, "uuid": "1fd8c4f8-eb56-401d-9451-07da29bce37b", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212920, "uuid": "293b86bc-94dd-4ddd-923a-698cab12aa81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212920, "uuid": "d30260ae-90b7-45ac-8e2f-17a83b3908ec", "value": "fe645527145e6975c72508b633cfd199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772f3ce8-c624-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679209543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209543, "uuid": "f347284c-eb41-455c-85e8-35741036ad3f", "comment": "Malware payload (RedLineStealer)", "value": "acfbda11a6d006e031052b54d302677a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209543, "uuid": "d609441f-b9b1-4e10-8d86-f4645d722d1a", "comment": "Malware payload (RedLineStealer)", "value": "373399366099cab3394aaac612ddf7797240dfcb42e41ab19b505c9a20e3c845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209543, "uuid": "e76c18b8-94ca-48b5-8cc5-be6ce925885c", "comment": "Malware payload (RedLineStealer)", "value": "d490fbcdf2f708159470cd01c6d120dab8bc5227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209543, "uuid": "262b5491-c477-4d77-ae6b-888c7809485f", "comment": "Malware payload (RedLineStealer)", "value": "225e4861cfcf24da7a078fee9fe88f007cab540e0f9815d1baf7a96e0eb22732947bbaf6017e62a24538ee15bf298a1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209543, "uuid": "a55d01f1-6062-4df6-aef6-43ec762b0a12", "value": "T14D45F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209543, "uuid": "15afcdb0-aed6-484c-b919-7aa13cec9f25", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209543, "uuid": "2f41775b-cbc2-4772-9ff8-f7d3d4a1e31b", "value": "24576:RhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:RHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209543, "uuid": "c1736fae-b32c-415a-81a4-a59f81d2c0fe", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209543, "uuid": "cf48548a-a84b-4ffc-96c3-06f426809637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209543, "uuid": "9dd97840-3f0b-4d67-a756-2a27240fcee0", "value": "acfbda11a6d006e031052b54d302677a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd30378a-c699-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679259966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259966, "uuid": "6b2dc947-bc9f-4e19-9ccd-ba7e82142eb4", "comment": "Malware payload", "value": "0a8f33e0e6fbf0506cb92428c9519776", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259966, "uuid": "3a525c58-8dc7-47e8-9636-26a1450d64f7", "comment": "Malware payload", "value": "37548de3570ab3ba13c64a568a8c58f5e177efa9a6991aef15da103be86aa2ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259966, "uuid": "2e9aeb15-2fdd-47c9-bf2d-d681f5a60674", "comment": "Malware payload", "value": "acc85c1c06bb1fa80863929368517eae25f0a3f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259966, "uuid": "c8921044-7c27-4bbe-9356-6f7bcf9ea1ce", "comment": "Malware payload", "value": "0f94a9ac632bf3096c8293011d2109970069fb6340f243da70f19c8f7e1c7e1b90a6b4acba5a9e122a07683d927834de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259966, "uuid": "cffa1cbd-6cdf-452d-9c7a-ab55efb9ed22", "value": "T129832903771D0B43C0AB6EF029FB27F1876AF96116A36180B10EFED45772AB42512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259966, "uuid": "6f8de015-fbe8-4e04-a6f9-557a22d9fd4f", "value": "1536:lQ2P4MoLMZ1wl85JuGp7kchcSj3Sv/Rz8sCjGhBEmQ7Vh2jqnaz7e:ldzoLMZ1wltGl/cSj3UF/hBEmQ7Vh2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679259966, "uuid": "161bbac6-c18c-4d88-8dec-9c38073600e1", "value": 81327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679259966, "uuid": "78461e14-0849-49ca-a2ca-74dcd3f08261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259966, "uuid": "d52e4afc-5292-4f3f-b641-a23004a7d3eb", "value": "0a8f33e0e6fbf0506cb92428c9519776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0171ce82-c658-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679231680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231680, "uuid": "563d06f3-1eec-4f2a-870e-516ce1a1bd9a", "comment": "Malware payload (AgentTesla)", "value": "11aa003966247771c12825963bea52dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231680, "uuid": "f0b57d9c-93bd-45aa-afff-a06ca7b197e8", "comment": "Malware payload (AgentTesla)", "value": "387899fad2b9f561cc6b2023765354a3b385c5b515b361c3b019ff180d82d550", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231680, "uuid": "21c6a90b-29e1-45cc-b5ca-7b6e17317fb0", "comment": "Malware payload (AgentTesla)", "value": "9664921caacdd9efece3e476fed9e9bb9ef1b6d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231680, "uuid": "c81b711e-fbe2-417b-bbfe-c3eb77752207", "comment": "Malware payload (AgentTesla)", "value": "f74c86c45385dbcff40e6965031f2227d4afb504bffb5ce6b67d06e5cd4060cb0154a4669979b6a6dda2833c266c010b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231680, "uuid": "80eabc64-34e5-4b4d-bb12-61fc7607ab48", "value": "T10C050259B32AEB21C63E47FE6075342193F3A40F9235F3485DCEA4EA2A23F915605D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231680, "uuid": "c884c5e3-d337-477a-83f3-55252d507a25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231680, "uuid": "1a428bd8-eaf7-4a0f-8bb5-07e170326e06", "value": "12288:TzCiEpjkjXyuaq8H7406ylH5UVqzemL07hkvY99Ha0eqpDLd4MDsCoMT:T0jkj+h406GaoBL0Sw97eqpDLdCCoMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231680, "uuid": "9f0e5f3b-670d-46e4-ae66-b008deedc02a", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231680, "uuid": "c994fe5e-e062-4224-9d44-1af5874909b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231680, "uuid": "f25bc7f6-47f6-4b9d-9dda-35301d4a2cf7", "value": "Enercov PO 202246755181.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38aeb8cd-c671-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679242510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679242510, "uuid": "570cd304-9cdd-4a17-9333-821287325852", "comment": "Malware payload (Mirai)", "value": "b77f7822738e426b94053766033ac2dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679242510, "uuid": "59c380e4-3e70-47f3-b52c-acb71dad4009", "comment": "Malware payload (Mirai)", "value": "38ab346ab3335f15d5adffb01705a50a9dde7922bc5f90435ea3c2f12787b7f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679242510, "uuid": "6f64ba1b-449c-4a8c-9a08-010ccabf728b", "comment": "Malware payload (Mirai)", "value": "eff66cb23b4ed838a8a4369077cb1415c4ff485a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679242510, "uuid": "a9ac4fcb-4ac3-42ea-96c0-cdd99e8f6b54", "comment": "Malware payload (Mirai)", "value": "196a84c379e4418daba05a968e559355c85951ee73593e7f033364958b153fd6374b4be261c024115c3e031ba7836a45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679242510, "uuid": "bb0eff10-713e-431c-a198-550fad18aab2", "value": "T1DD534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979996B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679242510, "uuid": "57cda1b2-4c84-4bde-80c7-fefc284ee7f6", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG9UmtTy5EMcb/J9iSzEv2xRgN0L6FV+tg6wWE:+5HAdOmGyZtTAdUiSgOxRgN+e+aTWtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679242510, "uuid": "855b708e-ca30-4aec-ba8e-1d814cc331ae", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679242510, "uuid": "3d59fd6e-5737-46e5-8d29-f5d65aae966b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679242510, "uuid": "fb08eb63-0a2c-4159-9807-232a79404ee2", "value": "b77f7822738e426b94053766033ac2dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cd4ead-c65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackCat)", "timestamp": 1679234851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234851, "uuid": "21f97f83-8318-482c-b4a2-577d0f8feba8", "comment": "Malware payload (BlackCat)", "value": "5ec0db562fbf982be4d10db97aef0c81", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234851, "uuid": "ab0e0a65-f47d-47d6-b070-9c16e6ffd6d3", "comment": "Malware payload (BlackCat)", "value": "38d5f4f37686dab8b082b591224e272883644caab6a814e7751981da00523c51", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234851, "uuid": "98e297a9-27f8-40bf-b6ed-a27088ac97dd", "comment": "Malware payload (BlackCat)", "value": "6d4f370387b328408b711d754ceba0b0b5944952", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234851, "uuid": "f4767c0d-79b4-47ea-9d0f-e1da3c7fd346", "comment": "Malware payload (BlackCat)", "value": "fb5a83f15432be5bcb7ec72d1c0c6f982fdf6052f7ba0244d64bca37f1f993621bd7536437a33a2466954c78b697dec8", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234851, "uuid": "a097f2e9-a2b5-48c9-acd3-99431511af28", "value": "T1D3B67C59F84BE8ADFA7E7474607EF332AAA40819A0075C37CA46CD71B59E7613C4C21E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234851, "uuid": "fdfad1f3-65bd-4dbd-8a52-3e2cad5f22aa", "value": "ab97bbb6bef78acbb059fb53a0eeaa65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234851, "uuid": "1dc31a16-42b6-46c3-8c43-3e3f27cb32d6", "value": "196608:nsu/7r2bQLLI37MRXIQUxboNzPZj6xS13oy2AZpVT1xX/Z550:nl7r2bQLLI37MRTfbNzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679234851, "uuid": "1a9ad743-34a5-47a8-8874-b943f20ce6ce", "value": 11045376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679234851, "uuid": "fe383824-3351-47ad-805a-46e82a8c733d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234851, "uuid": "dcf1b1c9-8687-400c-83fd-ddf530b9cebe", "value": "38d5f4f37686dab8b082b591224e272883644caab6a814e7751981da00523c51.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d679b4-c655-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679230452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230452, "uuid": "a3b1aa83-2216-4683-baac-9e9895053288", "comment": "Malware payload (Smoke Loader)", "value": "a83431ffd687b1c4ed328441110eece7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230452, "uuid": "c33345a0-2a8c-4081-aac6-8c28c05ceb2d", "comment": "Malware payload (Smoke Loader)", "value": "39b955d9fd149c4b9ac962bb5b7e82852dd12de97b73f38f302b984f2ed19acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230452, "uuid": "bb009611-fae6-49b5-8661-8c30165b70e6", "comment": "Malware payload (Smoke Loader)", "value": "dcd1260a32d140d6a29bd914c90b36dcd544a1d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230452, "uuid": "04a18705-12f9-473e-9d11-728a2a20ad56", "comment": "Malware payload (Smoke Loader)", "value": "69f3dd7499187dd7ee8460b486ab0061e74acb517584378e840d71d8fbc4b8b632e4b1dc4261b155ef175e525c21940f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230452, "uuid": "beee4d32-c291-4266-9362-0943ad08eec3", "value": "T18C54F81393E13D48E9268B739E2FC2E8B71DF571DF89776932189A6B04B0172C163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230452, "uuid": "0b23131e-8fbb-4c47-9a9b-e3fedd1a866f", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230452, "uuid": "c58b2e15-86d4-4bc6-bda4-55a3901f2451", "value": "3072:aDNuXhLCXoR/wSIzXYIiT91GiKxLv5RLnZtN/FE:vXhLC4u5zII4GhjjBFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230452, "uuid": "3a2c8bda-8c8f-4432-bf2b-ccda4edb661b", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230452, "uuid": "3713e200-301d-42a0-8ffd-916e5f4af1c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230452, "uuid": "d6f21f7f-153d-475c-ab08-a55f9985eca1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3027341-c692-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679256969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256969, "uuid": "3170aab6-89a3-4b89-aa6b-9ea59f86831a", "comment": "Malware payload (RedLineStealer)", "value": "4ed9d1a08c5a71b70b80b9ba31a41c6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256969, "uuid": "6d79f292-4dce-4be0-9375-47a876e9f46d", "comment": "Malware payload (RedLineStealer)", "value": "39e1f937f5bba44e91e2a3864ec395c65bed5e98dd0b6e9c00ac25d4d6e673c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256969, "uuid": "77bf23e5-8f19-4944-9e35-ecf34b30d07c", "comment": "Malware payload (RedLineStealer)", "value": "d45dabea5c4b71fcba521827f6df39966e487f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256969, "uuid": "0383c6cb-6487-4110-a8c6-c1b641a63e5a", "comment": "Malware payload (RedLineStealer)", "value": "11f8fc6231c9baa44e6655bffb924ff3ba368756a020b385ca666feeef445ca3a75d4918338f26c9798bb94d10fb9518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256969, "uuid": "f5b00ba4-e572-48bd-9a6c-278ec37c4375", "value": "T17545E143F3F17C44E525CB729E2EC6E8771DF5605E59BB6D221CAA3B04701B2C2A361A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256969, "uuid": "6964fa44-bfa0-4757-831a-a30451eb008e", "value": "c901cf1b33a79cac7fcfec57ffb66976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256969, "uuid": "fb304134-aaeb-4e13-af24-eb5c684e7da0", "value": "24576:e4ordwXnXmk8pYvPxQPDvJ7F1d5MwrIuGd6PsRu2dQQ580hh:errdUnXOYvPaPjLmwUugu2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679256969, "uuid": "d55e17a6-c9fb-4f6d-aa51-862b6bc9c73f", "value": 1222144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679256969, "uuid": "6c213f04-a673-4b04-8f88-a321a526ee18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256969, "uuid": "4ed64e0d-8074-49b2-a243-313350e02cd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf97f8ef-c667-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679238441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679238441, "uuid": "5f1c38b7-2307-4e40-b6f6-331a247782b3", "comment": "Malware payload (njrat)", "value": "4c5c88969f4e671c80cc7fd337cbb969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679238441, "uuid": "9561cfbf-bb7e-4227-b347-c1c13f8270e2", "comment": "Malware payload (njrat)", "value": "3a07daefd68fc95fa0ab44882ea966fb45969015e49914a5e3ca4abce43aff54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679238441, "uuid": "8aa3962d-086a-4f07-87ab-eb18fd7f7581", "comment": "Malware payload (njrat)", "value": "604bc24156ab1292b8f3f39def64b35e559e3e0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679238441, "uuid": "9821f180-e513-40ae-b6ee-6bbe5529b38a", "comment": "Malware payload (njrat)", "value": "7c5aadb495b8ed818b4e7ccd9d6eea7a832770ea238243e791c0696ae6bbedb148f273fe341bea7692f8b16138cd61a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679238441, "uuid": "969f7740-a799-46ca-8f77-51bf73051199", "value": "T198E208067BE94215D6BC1AF88CB313214772E3838532EB6F9CDC98CA4B676D04255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679238441, "uuid": "d99376fa-aa5a-4329-a885-2a313953d11e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679238441, "uuid": "1bdcb722-1e3b-4cf3-af4a-6b42176fb778", "value": "384:y0bUe5XB4e0XFOZzw0Q0mS03AWTxtTUFQqzFAObbV:rT9BucC55dWbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679238441, "uuid": "80203fa4-2c1e-4bed-99e2-35d7bc4827ae", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679238441, "uuid": "92a5fb6c-bae9-4276-83bf-d04eef9278dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679238441, "uuid": "669c4ee1-3cb3-41f2-85b7-ca43176fb9e9", "value": "bKBx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a77a56-c689-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679253046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679253046, "uuid": "f19f9033-e1dd-4af9-bffb-e873a83e28a0", "comment": "Malware payload", "value": "eb8d50fd5a3afa04fe7fb476f2df9e99", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679253046, "uuid": "df19c117-7b30-42d0-b319-a8ad0a4dad2c", "comment": "Malware payload", "value": "3a60658cdbf960c135f07bd06d36124b5926b85c59a9c01948976b199e3959f8", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679253046, "uuid": "8ba27d63-a047-4cc3-bd76-4f8226ce6a41", "comment": "Malware payload", "value": "4c3efe832bd66a6998484638ee4e864d67b2f709", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679253046, "uuid": "00a1ff3d-8f48-4239-b35c-e7c245646800", "comment": "Malware payload", "value": "c3eaaeb961b9820a970b61773e05d85428f2ee3a2ff3649fd7c6a40e21dca4e436faad3e81ca3ef53efdf6f9e93d454c", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679253046, "uuid": "1438a9cc-decc-4f32-8651-f7d8fc9e436f", "value": "T12A247D15139B55F8D6B2BEF44DD69E06FB369A23522CC78E8F71AEAD0C50120DCA460F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679253046, "uuid": "6bf3703b-00fa-4040-97c8-8afeed87f4fa", "value": "3072:HaA0YRw9/WITtTWR7IbNzvL1awhuWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCCC6:na9xytedL1jp4iERBRCjTgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679253046, "uuid": "ec4d6f45-711a-43af-85f4-3943a879c4e1", "value": 218256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679253046, "uuid": "92553e13-c15d-4860-9364-e33775e9fddc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679253046, "uuid": "175626e9-50be-4aad-bc78-4fcac4dc3749", "value": "Inv_02_02_#2.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac25c21-c633-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679215965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215965, "uuid": "21b2beb1-71a1-446b-9876-8dc403c725de", "comment": "Malware payload", "value": "56c535484e526eeb01052e241a5abd0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215965, "uuid": "fb839446-f2d9-48ae-b528-adced4a560ee", "comment": "Malware payload", "value": "3a96a1ec1ba21c56b239fc2dbcd4b054e00dfbe8c04de3e80ff92306a9f3a2bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215965, "uuid": "f99ece30-621b-46dd-b3e6-5c1e577fb752", "comment": "Malware payload", "value": "79d69413698a01738c83e10ea3129e47bb86931c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215965, "uuid": "48dafe52-1f67-4c6f-92ad-ca4a4f15f2a9", "comment": "Malware payload", "value": "722072a714ada2b8485b2a60f86985bf3faa58369f97a3be8381757d57dffe2109d9c8486d5855d5ad3c807a471d23af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215965, "uuid": "d890af83-66ce-4d70-b100-93dc56f57cfb", "value": "T14FB48E028588C1D5DBCBC6F2C55FD2C5656F2C46E47A26788AF73F5D84BA842F8482F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215965, "uuid": "d8d667d4-a054-49b4-89ee-1125050e1c7a", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215965, "uuid": "903197ca-f53c-46e1-954c-7e3f514a178c", "value": "3072:eouzvch1aTJHBOAZSYGxkczkaodv07nb9yShzcKVlyWYWq:ehch1ysNxkqkaoZenb9yShzxnyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679215965, "uuid": "5e812bec-a58c-460c-87db-6d7ba4a36fd1", "value": 493768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679215965, "uuid": "ad173f98-194b-4481-8ad9-bd1c5b49cffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215965, "uuid": "3bc30a87-78b9-4767-9360-f7ffcd2d586e", "value": "VimeWorld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8a18cb-c65a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679232616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679232616, "uuid": "06458e85-1012-445f-9864-f355de469d40", "comment": "Malware payload (njrat)", "value": "24710356d2b88a67d0107cddc467cdc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679232616, "uuid": "48537209-df5a-4aed-800b-ab9050190c7e", "comment": "Malware payload (njrat)", "value": "3ad32746894dc3406c5a2b9bd3627c75e56887d2b92f0100e883d1cadbdad57b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679232616, "uuid": "f0ec7c9d-57dd-4ee5-aaec-d3830beb0b05", "comment": "Malware payload (njrat)", "value": "4e6f3384adfccf76198d00a03987781e3524105b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679232616, "uuid": "4a4fab8a-f507-4a98-8418-f3ec571a6e6b", "comment": "Malware payload (njrat)", "value": "9f175972946b5497c937123994b5efd2fa571fc2732c2c1d02815305aeabec69e21f3875f00ef47141b9c7f45b7c822e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679232616, "uuid": "c342ae6f-323e-4519-9756-bb1d29c64d02", "value": "T113C2096D37F5C3B1C1EE067E9922DA6142B1E04BE222FB1E0CD964DD4B5B7870A85ED0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679232616, "uuid": "445a406b-af96-4290-9c92-6bdebab5feca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679232616, "uuid": "e765893e-ef73-4785-86b1-5705b2b9a263", "value": "384:r1LaRuc+oYiKJ0pjRB7Puth5M6ve1jCKsuatydbZN8Cr9131ctP1um7M84Sr6es8:rV+4foR6W1AJtIb4iEPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679232616, "uuid": "1620c121-bff9-470b-b24a-d4437b3e1035", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679232616, "uuid": "a1be81d1-6344-45fb-af6e-6a58f5a0e956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679232616, "uuid": "80b96ddd-e59c-45aa-a01b-94f72e724e84", "value": "24710356d2b88a67d0107cddc467cdc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e205f44-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679218091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218091, "uuid": "115a3e0c-f892-4ece-b87e-5b3e867721e7", "comment": "Malware payload", "value": "9c99d0425639d24e74b919d798c63bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218091, "uuid": "69a2a23a-c419-4ccd-ba8c-8500fd61cc45", "comment": "Malware payload", "value": "3b5d4715330e499e2027c411b580cd469da164afdaa5803906de35a91b7c71d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218091, "uuid": "eb1f6ac4-bbfd-4cb8-962f-f033a3465faf", "comment": "Malware payload", "value": "e72f18b1c9b006cd9d9366e16b0d289674027676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218091, "uuid": "a4eb199a-4793-4e46-8ba9-f919404679f5", "comment": "Malware payload", "value": "1b5f84c34a1e9fbfa21edb34fd317457f3788c3f53235c30aa2141f3ed8b0e0dbaa9efa9b993738eed9d35725b3cbe24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218091, "uuid": "0d20ff1a-c080-4802-a1cb-d90472fe815e", "value": "T1D7E3F923B6D17176F27B5238CC91E520E76071196337876B8DAED33B13A3042B968E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218091, "uuid": "2a9d6f75-31ff-4360-aa1e-21c9b6444a93", "value": "feec3aaac725f71fdcd7d2601852d1fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218091, "uuid": "4ce78890-0808-4bfb-a1c3-961fffe7508c", "value": "3072:Ch69w7BupQRXHcmWy+p6DOWXbwsKkpQHj/oNw7u1LDZvmmwY3JyuDzlcJxjj8uqZ:CcMApQRXHFWt5H4LUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218091, "uuid": "88b1c85c-8e37-4182-aa3f-bea323add4c4", "value": 143440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218091, "uuid": "bc93e269-24c6-426f-bb17-02f5402e142f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218091, "uuid": "f9749318-1f99-4193-ad59-43744c0efb0c", "value": "JavaAccessBridge-64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434df82f-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224918, "uuid": "1ddd8d9f-f52a-4525-a20b-e63ddf856c3e", "comment": "Malware payload (RedLineStealer)", "value": "6f15d6c2019de7c319f2d91b6d805f9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224918, "uuid": "a39ed62b-9103-4a59-80da-ee178fb26a73", "comment": "Malware payload (RedLineStealer)", "value": "3c9a1f5318a1b8f830386ec3aa8d6eb1891db798d6dd5490e6dec9e3a2589540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224918, "uuid": "eb96775e-a282-4a56-991d-6043037eb66b", "comment": "Malware payload (RedLineStealer)", "value": "6ade95c55a9f6dd3537f5f4e6f7910bf3661f461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224918, "uuid": "40ab75a2-c53e-4dc2-873b-433bc90d67fd", "comment": "Malware payload (RedLineStealer)", "value": "329894de5105d6476f70a09883329927c26e03ec32767f84df1f428742877ad84fd0e5f33827b93cba76f6d2445fadb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224918, "uuid": "83c92de5-3a1e-4e23-8901-71712d50fa3e", "value": "T15505120BB7ED8422D5B547B04EF647D32B327E501A38835B274AAD9F0D72960A37076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224918, "uuid": "14561e2f-ffc3-4fbe-a46a-29b382061f82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224918, "uuid": "5c2c3dd4-7540-457a-900b-1d3765fe5aeb", "value": "24576:VySQM2zsyAF2ahics3NyT0H56VUQE5nI9yd:wSNEALzs3NhHEVUeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224918, "uuid": "0847d8f2-c94c-4a82-8b2e-bbd5bad71b09", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224918, "uuid": "c0a7aa74-1615-489c-833e-7de8c4705e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224918, "uuid": "dee7e1ce-2f36-49d2-bbbc-d0ccff9f1a9a", "value": "6f15d6c2019de7c319f2d91b6d805f9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d99743f-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679241203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241203, "uuid": "7a134270-c4c2-48a4-8377-ac155e915ad4", "comment": "Malware payload (AgentTesla)", "value": "fab20054dd4ad0b51fa6b8a81b04f5ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241203, "uuid": "0ce1a85c-8267-4f0b-a283-062756d92242", "comment": "Malware payload (AgentTesla)", "value": "3d0c15fd0414979de2879493ef9b16fe7aa864f8e23ebe75b919ae04cd7928cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241203, "uuid": "abf177a4-b9a9-41dc-a790-4e55f9b95d6a", "comment": "Malware payload (AgentTesla)", "value": "13424ed4be870854d55d0d6a901bdab83d96febe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241203, "uuid": "5a72e762-21a6-4bdf-81a1-417121b69880", "comment": "Malware payload (AgentTesla)", "value": "118c5d1de0b6108d098c2aac2513b67bfa382b2e52484e5c296e4e3764abe3549057abc532d46050e20854109805c8a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241203, "uuid": "718d3776-00d0-445b-8736-28a059aaaf3f", "value": "T1B115F158BAA5DB15C53E0BFAD03160F043736C66D522E35BAE8C7CEA3E327854A05B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241203, "uuid": "2235f2ea-bce4-4aaf-a47b-c9f1501066d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241203, "uuid": "ee0b2cc1-9a9a-485b-b9c8-952689fbe306", "value": "24576:Sl+yynEmDGxDedkMTqJ9eTGampEIYd+eLLQ01Ny7DdwGlZ+Po:SnYrkil95IUs0zyfKGlgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241203, "uuid": "caa21911-9a13-4cb7-b5f9-bfa19425f45c", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241203, "uuid": "ab753c6b-ec5a-4e31-8451-c83588250737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241203, "uuid": "8b909e8b-deef-450c-b772-6a626b53f713", "value": "DHL AWB copy & draft COO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953599c8-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212600, "uuid": "be73f118-c811-46b8-beb6-bfc600bdf40f", "comment": "Malware payload (RedLineStealer)", "value": "cedee705c202e23808dba37a8694c7e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212600, "uuid": "8933cb8f-df9c-4370-9e33-afbdb7ac8339", "comment": "Malware payload (RedLineStealer)", "value": "3d1317cf34b3ad99c4529ebde0bc281a669edec5e62840c66289cd380d9dc1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212600, "uuid": "b3aa9c4c-1bf4-4948-978a-6fbc833ed19a", "comment": "Malware payload (RedLineStealer)", "value": "cff9da4dbb33842ed00188da843c7891087b5bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212600, "uuid": "354f4bad-d533-48a9-abd3-ed18b8a2d268", "comment": "Malware payload (RedLineStealer)", "value": "71f7cc07645108e6b4dedd463ec2b6ca163a835d1156fca654df06eb56a6c5c7a2527ca4289df21a5f305c0868e37b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212600, "uuid": "fe32a785-3059-441f-bec3-05ce1f04806a", "value": "T11645F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212600, "uuid": "33e3e199-a5ea-4175-8999-6490151406a2", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212600, "uuid": "1971343a-b81c-4718-95a3-449643040bd1", "value": "24576:6hVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:6Hb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212600, "uuid": "11bf31c4-37f4-4a67-80a4-7869e17f90d3", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212600, "uuid": "56386c02-696e-4bc2-b931-a2890edcf74d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212600, "uuid": "7bf12e05-2801-4762-b675-90c07f9a0e15", "value": "cedee705c202e23808dba37a8694c7e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d5a42c-c66f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679241564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241564, "uuid": "c1bcd9cb-6f59-442a-8283-bab630732727", "comment": "Malware payload (Smoke Loader)", "value": "b57ebfe79d0d226ccc1961db4d90dea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241564, "uuid": "6523f0e4-a058-4eae-b6a4-561caec0ec79", "comment": "Malware payload (Smoke Loader)", "value": "3d4b51afefb80ed6ef1dea05d417da49acfdf2cab7dabcd25038d77891eb0e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241564, "uuid": "b8a824aa-275d-4b44-ab34-d352aa2d0034", "comment": "Malware payload (Smoke Loader)", "value": "5a44539618d935eeb19548d6d95342152ba32e22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241564, "uuid": "ac0469e9-e104-40d2-a9ab-5b62ba6e7382", "comment": "Malware payload (Smoke Loader)", "value": "dcc23f2ece7058c571d22e51a7650a3ea46880aa4cc90943523b746055a49218c369973d78786425552eaf99c8d8535e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241564, "uuid": "6cf6989f-6625-472f-ade6-0fa21c16cd44", "value": "T1E354094393E17C88E9268B739F1EC2E8B75DF670DF897B6532189A1B04B0172C167B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241564, "uuid": "3b96ca49-ae11-4ac5-a7d6-f73df8f3b4f8", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241564, "uuid": "01def859-755b-4814-865b-4f953d82910f", "value": "3072:ShtnpL8aFpG7Q4D5ivdyh8bIhuu4GywNbLLUC5RTctdgzgE:CnpL82G7Qy4IQiiGykPrTlUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241564, "uuid": "a540c704-7a07-47e9-b627-dc7f296b1383", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241564, "uuid": "79202503-a871-4078-a5e0-4a64ec775e6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241564, "uuid": "675c0d8d-8997-46b2-ba1e-1afb92a00e35", "value": "b57ebfe79d0d226ccc1961db4d90dea3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f52f9da-c642-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679222415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222415, "uuid": "733ab1e5-d7bd-4290-b153-9ceede6624c6", "comment": "Malware payload (Gafgyt)", "value": "ca1523632189b9282f08a0e364343734", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222415, "uuid": "562d952d-0c0f-4e9c-bd6f-ecd63d849df7", "comment": "Malware payload (Gafgyt)", "value": "3d60eb35183de55efd312b2a311ddee279b9e6e27107a66485223244cad28997", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222415, "uuid": "7b837bac-2e97-43b2-8155-b7532da01158", "comment": "Malware payload (Gafgyt)", "value": "7312ef9591c820d1109cf8bd4541a217b7763876", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222415, "uuid": "ef4ab8c9-f88e-4382-a2b2-629540957459", "comment": "Malware payload (Gafgyt)", "value": "47ba397284cb1c6821cc1a3889584157ba54a9163aa865fe62e2f4e709ae90cc0b7c77a15883a1028b68aa40b99335ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222415, "uuid": "e53d845e-d7c7-4a9c-9208-fea7afdbaa7f", "value": "T16A933A07B71C4F43C1DB59F029BB2BF15765B9E112A36181B91BAED04B33AB82523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222415, "uuid": "517d78db-855b-49d5-ae8a-878154700611", "value": "1536:v3oCHK7pwmQVTXUvbwPzLDOHMyILsiO6aRv/lz5n5hPJ+8OFO6V6qDjjofSee:v4L7NQVTXUm/gvILsi2/T5hPI8OFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679222415, "uuid": "9bc7370b-2f0a-4cc0-b3fb-170a4cb40669", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679222415, "uuid": "9a403247-0b88-4a8e-b1f1-73ba8fec0d54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222415, "uuid": "3590dd81-7f00-4e85-963b-87a226a1a2e6", "value": "ca1523632189b9282f08a0e364343734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c53386-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214104, "uuid": "d9094928-f8bb-4815-b653-cb69b2d814e6", "comment": "Malware payload (Mirai)", "value": "37fa287ac9759b466b4bab5f3ab916ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214104, "uuid": "f013cc84-fcd9-4cb8-9150-33ec07414f59", "comment": "Malware payload (Mirai)", "value": "3e24882a811361115ec7429c9325526b6b7545adbd9abfc8e32c913a4b00457e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214104, "uuid": "53ec60b2-5ec3-4c7b-9f97-6e13ab91698b", "comment": "Malware payload (Mirai)", "value": "938e0d56ffe5edf69bddf6f6436511da1cfc8c63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214104, "uuid": "0382856e-5fa6-480f-abd4-1deed00d120f", "comment": "Malware payload (Mirai)", "value": "7d851bfbf61af49e93abcaea5bef8d0135b20bb348b94075a8e508a4fe78bf5e187a5782884f0e9e4c3abbbd6ee9f215", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214104, "uuid": "d5f5847f-74ce-4f18-b230-d18bb6e80bcb", "value": "T101C33B46FA418B03C4D61B75BA9F824533239B54E3EB3306592CAFB43F86B9E4E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214104, "uuid": "ab9a3671-66d7-4273-9f1c-5c6a9faf48da", "value": "3072:osLh9Ok/PvvYKc/OGcP4ipNjY1qDdPWubs8NM/9Qmm4r:osLh9OacLcP4ipNjsqJWublNM/9C4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214104, "uuid": "f4f76c74-926b-4134-ab77-748fbeb1cbad", "value": 123279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214104, "uuid": "84951cb4-ae12-4835-b8a6-e0959c5b889f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214104, "uuid": "69f8df4d-660b-479a-9cb7-6c09ba8a0724", "value": "37fa287ac9759b466b4bab5f3ab916ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b449a0-c656-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231234, "uuid": "0ed782d3-ea9d-47dc-ad64-6e60c0618630", "comment": "Malware payload (Rhadamanthys)", "value": "449ff3d6ab93c3d937ac29952a59a463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231234, "uuid": "22522433-2ce3-4fdd-a917-a1eab59e4a8c", "comment": "Malware payload (Rhadamanthys)", "value": "3e5717c918b21e2d105b23fa8fed2528541435a24462beb8eb6fca4bd2ad8027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231234, "uuid": "a88403ec-0865-4e14-98d1-005dc6efda92", "comment": "Malware payload (Rhadamanthys)", "value": "9794a5731721075fd64feea9d10984fc7ea5e620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231234, "uuid": "a528a028-8f3c-4ea1-b5aa-3bf324cd7383", "comment": "Malware payload (Rhadamanthys)", "value": "60fe8599c04112506bd0030bdc5041c66fb86843ee8327247dc2842bcbe3ab94281448c65790e638b1e9eedfe2670825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231234, "uuid": "beb140f6-7f6f-4487-b69d-cc7c5bee7a27", "value": "T14A744B0393E13D49E9268B739F1FD2E8B70EF670DE89776936189A1B04B1172C163B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231234, "uuid": "a62443b1-78f7-4b21-a4a9-579f3a690ebb", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231234, "uuid": "20f00c87-98b4-447b-ae47-62534c25ecd8", "value": "6144:8ukL9ECGLe4j6Rd/zXDHR3M99JRRuNlQxBkzWdWn4ICYTxh/:8ukWJLe4UVc99JDXfdW4Olh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231234, "uuid": "873d97d8-f2cf-4e17-94f3-887d111f71f3", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231234, "uuid": "0f6d6d73-96b5-49fc-bded-664e0fd6892d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231234, "uuid": "b543a9f5-0e40-4e11-93e5-e802abe3e9cb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddebc2cd-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1679241499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241499, "uuid": "d9c9c112-7c7d-42a9-9f14-e95758ba47ff", "comment": "Malware payload (Vidar)", "value": "8339a07c7c59540a7a18bd08ceaaf697", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241499, "uuid": "9eca189a-feae-46da-ae83-4c9c05250319", "comment": "Malware payload (Vidar)", "value": "3ea8f457387940d5a64458d38284ed785a9e04e245cf28e03bfc38d5e9188599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241499, "uuid": "b91a60a7-caab-4f8d-8c71-dffc423f7300", "comment": "Malware payload (Vidar)", "value": "3f7a7604b7e0fee6f9394fde0f04d7a71ba900dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241499, "uuid": "30717454-a4a0-456d-acc3-1f530600f21d", "comment": "Malware payload (Vidar)", "value": "2d9b296fa752debcf7ce81f95bd96585b3f1c91c8210050531c565f4b3265c99e5aeca6d34d8f70046f045787ff4f857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241499, "uuid": "a628c6c1-7f0a-4429-ad1e-fee0d738324b", "value": "T1F654E883F2E17D55E926CB729F2EC2E8771DF5509E49BB6D122CAA2B04B00F2C163715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241499, "uuid": "c4d1e588-c9d2-4c21-b923-00e19e2ec7a6", "value": "cf9749211bb5c4a3fd321170f5076a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241499, "uuid": "c3a9ef58-7277-4685-84bb-c1d850049962", "value": "6144:6nrLKPF1a0wVT62bLyEwFj9BXgX87zvGhwE:6nr+dIf6urknXgXKjGhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241499, "uuid": "c63b970c-6fab-4169-b548-b75d744c527b", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241499, "uuid": "97b4ec2c-c4e7-40ef-a995-af10aecebd0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241499, "uuid": "abac7132-e107-4e4d-b7fe-7af6b86c4c26", "value": "8339a07c7c59540a7a18bd08ceaaf697.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7ef774-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223375, "uuid": "4c44b9c4-5b35-41b0-92d2-4a5a60e1b64d", "comment": "Malware payload (Mirai)", "value": "43f9532c6fafc49ff68cb8efdd837a81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223375, "uuid": "c921c415-0182-49b4-84e3-264ed5821d31", "comment": "Malware payload (Mirai)", "value": "3f70c90fd84ff5cea900b24fa9990857543d84df048639c86711863552fb7ac6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223375, "uuid": "3dfab243-9a03-46cd-ac9b-d4023339c9db", "comment": "Malware payload (Mirai)", "value": "5fc932c72730e31f162cc6f2871e82029487215c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223375, "uuid": "cbdfa3a1-4841-4d3b-9f07-af4e67015956", "comment": "Malware payload (Mirai)", "value": "763068c829394bd9907f7776620640e1665d09b974036781f93b861023cafe5186c6293f73910837b56d3a8c398885c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223375, "uuid": "3940efab-d6eb-4332-8b3a-345538c1b682", "value": "T144138E76C86D9DD4C2448678A935CE781F63F104C2671EFA1E9A85A68043DFCFA093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223375, "uuid": "504ff974-3aab-4654-90ab-6ca5bf4ef003", "value": "768:CaY0wtw7XWrp61eFIeyi2r2kn4YkkcNU1gVCvolpICn:Cazwtwj5MIFR444y4PPICn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223375, "uuid": "304d28f9-a39a-421a-9370-507a1938b7c4", "value": 42672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223375, "uuid": "24c6f2c5-9cad-4360-a9b9-35bbdbeaa03b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223375, "uuid": "2143743f-d1b3-402b-94ea-6736f1c0f0e6", "value": "43f9532c6fafc49ff68cb8efdd837a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c80117-c65c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679233650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233650, "uuid": "9cf2a15f-46da-4741-b290-de21d4b40b5c", "comment": "Malware payload (Rhadamanthys)", "value": "efc45cecb573305aa1e8987b2e7b3b25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233650, "uuid": "dcc8f641-6767-46c8-b7f0-0d40d5cf1d8b", "comment": "Malware payload (Rhadamanthys)", "value": "4048995d56f0be4873d9308e666a05c41587047c53fb9de02b3e6942a8af81fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233650, "uuid": "75de85ce-2168-4135-902a-504fb37eaa41", "comment": "Malware payload (Rhadamanthys)", "value": "fcf3877d33974ba41d2065df90f7e73abddc95ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233650, "uuid": "e03e931e-5bdf-4b81-b39a-01f38a469c07", "comment": "Malware payload (Rhadamanthys)", "value": "0fe9781439eecd287ad6c3fd8392a8477d5293d50deefc4be4f7422dea7fc6b7a849f43702d00903468c7e4175d8ae0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233650, "uuid": "81512dbf-2391-4799-b8ff-9693d0bcb938", "value": "T1D2854CF21193FEC4973F1D44C10439809C00186B57BC969CFECA6A9797E99A4EF9DAB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233650, "uuid": "4b4e5d5a-8819-4b27-8b23-5f4c68ae1f44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233650, "uuid": "3e6452a8-ea1a-47b2-800e-7967d655e300", "value": "24576:cl7JT3YKh9Ot09OX7l348A5NylY4G47HRWFYbK1dV48pRAaQDFJ+TA/nEdslVtfE:I3YdoY2Ooz2DYVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233650, "uuid": "a9487430-fced-4160-a7f6-cb9ebd8e53f5", "value": 1870336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233650, "uuid": "bd464414-c37a-4887-83fb-e073f146cc32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233650, "uuid": "fe77d741-020c-4046-94d8-bd616cf604f9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5026edd-c637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217808, "uuid": "53e387de-8ae8-4241-91c1-d395658effd2", "comment": "Malware payload", "value": "d2b52fc989d7db31f22ab8eeea8f8ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217808, "uuid": "01b1c16c-53de-4205-8e27-47e2ff57fbf5", "comment": "Malware payload", "value": "40a00f094e302447bcd18944764c08e9a0ef512663e789de9a08424212e91194", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217808, "uuid": "d46c0a96-2e70-40ed-8ac4-d3c7ca5bdf60", "comment": "Malware payload", "value": "8c6600e4d888d70e5ced9ff5acfafca5e0f5d6ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217808, "uuid": "92dae2c0-cd8f-45a7-b564-f8cc4b0bbf30", "comment": "Malware payload", "value": "36046c7b615ac7de5a73da397e7ce6bec81304cb6b48b78010cfa19751733381d42ddef85a33e01a57654e17ac1461de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217808, "uuid": "506d6de8-a0d3-45da-b090-b44dd756ed64", "value": "T13376E16A924893A4C56EC5B0812BD685B57A3C0EC3B952EBB7E77F801BB70C0F935750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217808, "uuid": "ac44a6b4-f50f-47fe-ac57-b055c450ea16", "value": "28a65ca7a8a025de42a9352377e1793f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217808, "uuid": "8b62a316-18ff-4f9b-9c0b-2b4195b8e51c", "value": "196608:iaU7/Kre8wAkrmqHIblhq60Pi8g3Ho+Vkgj:dreeVFbLqLw4+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217808, "uuid": "eac48bad-15b3-43de-ba12-02ef8e1ffcf4", "value": 7257144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217808, "uuid": "08530a8b-b337-458a-b85f-78f60dfe1584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217808, "uuid": "fb374200-f4e2-46af-a4d8-92487a6f7143", "value": "VimeWorld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c31b5c5-c66f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241657, "uuid": "88c18fb1-5931-4d71-bd25-afd579db8110", "comment": "Malware payload", "value": "6c258b647e3141ee8f8114d78eaaf66c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241657, "uuid": "ddd5f818-0aa1-48c7-a024-55dbf46373ef", "comment": "Malware payload", "value": "413cf56bc1d240b039de2a931d4db40f06380c195bc204344f2768751e44119e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241657, "uuid": "1bd7d986-b914-40cc-9c92-e0bcb623a7a6", "comment": "Malware payload", "value": "41635158d933a8ef6cf0d0f459c513e723df0519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241657, "uuid": "a54b3d76-e6e3-4bf6-88d8-320a4969603c", "comment": "Malware payload", "value": "9a1e22b0dc5666246a3000f9493af2b68d0af753e97ba51152e244990c19df2d569342273f9f02e696e907bddff47450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241657, "uuid": "b046af08-d596-42f6-9f1d-be8851bbad89", "value": "T181D5AEB10A93FE87E76F2EB5D02024C0DC69842B97AD6758F8C1295347D9758CE8E1F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241657, "uuid": "5452b026-7734-4ab6-80eb-f0ca35737f96", "value": "24576:oafQKgqtAyrUFdRZTbwcXE1Rw2qs9kpu2ny/v/LtGZsYjot0+iEzyLU/E5h8bV2X:oNwcXFoaU/E5h8bKlsyKqiB8tFgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241657, "uuid": "b21c81f7-02a7-448c-a35b-f754b195b752", "value": 2806479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241657, "uuid": "dd86f833-66ba-4526-b370-6edd22c8c1cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241657, "uuid": "8277e3ad-6703-403b-b662-915e519b80d2", "value": "6c258b647e3141ee8f8114d78eaaf66c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ee80d5-c65c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679233459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233459, "uuid": "91f23c79-fa1f-4011-8109-ebd29897a007", "comment": "Malware payload (Rhadamanthys)", "value": "029df110444ab7746911e96d1febee72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233459, "uuid": "256dc58e-444d-48f4-b082-eaf19f55682a", "comment": "Malware payload (Rhadamanthys)", "value": "4248d58d86cfd2a671e4323f57993f95e193c94d8c33ccb7219800bacefa95a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233459, "uuid": "aa9812b6-e60d-4f30-bc00-888a7940b442", "comment": "Malware payload (Rhadamanthys)", "value": "26e77a415e8daea0008f8fc48de5591ed69e5a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233459, "uuid": "6f3e271b-1a58-457e-95fd-9b2a90eafca0", "comment": "Malware payload (Rhadamanthys)", "value": "f60ba206a4f1bed378b4e96a5c74fa201ad7a9a6ffaa41315a326698be099efcd9802b6ff652220ec81fbc0feb4fa787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233459, "uuid": "ff814f02-edfc-4030-ab5f-841c20e680c4", "value": "T1BD74394392E17D48E9268B739E1FC2E8B71DF670DE897B653218DA2F04B1172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233459, "uuid": "3d5c266d-558d-4fde-b637-a3de720e4263", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233459, "uuid": "2f9af161-a961-45ee-affc-0a6f0697914f", "value": "6144:Bu3LdQxK9Gf0mKGFIZzL/v2XxmXtYXOy5yeirYI/E:Bu3WaM0mJSYz5jYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233459, "uuid": "7deacfe5-1df6-4593-914b-83af007d7141", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233459, "uuid": "2ff1cc85-10fe-48ae-b0cf-ef39c10cae24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233459, "uuid": "ec4ca692-5148-4ffc-9514-d151eb1064b0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c368e3c-c66f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1679241603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241603, "uuid": "5ed44d86-fcca-4679-bda1-4190344393be", "comment": "Malware payload (DanaBot)", "value": "a4c7bb8d408dca0a8d76ecb9db984ef8", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241603, "uuid": "36dd818f-ca3b-431a-9f84-8452d3d0ed32", "comment": "Malware payload (DanaBot)", "value": "432138d2f965f6903a141b81fba6c20d46489bda12a2699199d17134aa0ae1f2", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241603, "uuid": "c58ab8ac-ef36-4037-883e-b0a486e9c6ef", "comment": "Malware payload (DanaBot)", "value": "29b850d80545b94ba43ae45c412460176a9b1b43", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241603, "uuid": "37e229f6-d5cf-406d-931e-14d280a59cff", "comment": "Malware payload (DanaBot)", "value": "84b47440a06aef3bc51905d22502f6daf06144ef4945ab6ee56f5aa6a078f7de4ec19ecdee7f1d980f0c0cf7e4c40b61", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241603, "uuid": "5f15ebf4-6fb5-4c96-a1c9-38d4dde7474f", "value": "T1FDD5121383903C48E5668B739F1FC2E8B71DF272EE5ABB6533199E5B04B1176C253A90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241603, "uuid": "9bf50bbd-cf58-4a6d-ac40-439bfce31cef", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241603, "uuid": "0dae9add-6547-4dc4-9ada-f63f76d3adf0", "value": "49152:96onJnCE/jGO8wc+xILRSSJA/iEKjZGPo82uW6ioVnZH32bwMc47HjOA3Og:9RnJn58D+xIlSSJgiBtzQDUJc47f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241603, "uuid": "10bc55da-af74-48ff-a38b-e77b8c3c8c19", "value": 2783232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241603, "uuid": "bbf5aab0-336b-4c33-874f-ff286d97b688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241603, "uuid": "3493f3ee-e165-491e-babb-c03d5ca7bbd1", "value": "a4c7bb8d408dca0a8d76ecb9db984ef8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b8ed5e-c65b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679233276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233276, "uuid": "c92b8c67-c980-42ba-9826-b0edd99729ca", "comment": "Malware payload (Rhadamanthys)", "value": "eed47d292238f663ba7f60d55116cb2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233276, "uuid": "b14e6a29-bd64-4941-905c-26855cddec7d", "comment": "Malware payload (Rhadamanthys)", "value": "432449641afbbe54aaafe6e0efe3e9360106d1a71448f5d85a3be2ab38ff1e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233276, "uuid": "2a505ba5-bdd8-41f4-9e6b-3efca11556a3", "comment": "Malware payload (Rhadamanthys)", "value": "f3e654ebe80dc0de1c2062a3a5c182500dbe2986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233276, "uuid": "d8c3c010-2cd8-4b14-9ef7-7e6a83965532", "comment": "Malware payload (Rhadamanthys)", "value": "07447b88eadd11cd68c227f7a8ce5ddb7ca94f5e308a62a3d08292a4f433bfb6e382243053c4464a6f4fb05c6e73cf58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233276, "uuid": "2869792d-37e5-4b4a-9ee7-891a663cf1a8", "value": "T17A744C0393E17D48E5268B739E1FD2E8B71DF271DE49BB6936188A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233276, "uuid": "34b442a8-c378-4dae-ac51-58ff5c484fa7", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233276, "uuid": "f869f5d7-7f3b-475e-94f2-1c11c61a5376", "value": "3072:ae1uTdL+7jwvcRYrLGnlvT/FVOoFbWuxth2Wi1lykMJQ9XAYbq5l4et7jE:fuRL+7jwcnzbJDw1lyk3Af4yjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233276, "uuid": "21b7da23-7310-4efb-82c7-56b31acb962f", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233276, "uuid": "7267d21b-cd39-468d-a43c-aa50990867f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233276, "uuid": "f9d6b29a-aaa3-4a07-8374-ea8dec9e2c8e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b79bc8e-c63c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679219805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219805, "uuid": "ed91fc1a-8970-4bf6-91d5-bc727eac805b", "comment": "Malware payload (Mirai)", "value": "dd63b88f2db9cb0c9d223b7d2d9224eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219805, "uuid": "e382de55-1671-4c37-8515-17d9d4108f69", "comment": "Malware payload (Mirai)", "value": "4385bd79c30d38b495e606f866438efea6a811fc07804359430081a9977726be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219805, "uuid": "83291989-ad39-40b8-9bb4-229b79f038a0", "comment": "Malware payload (Mirai)", "value": "3e4e95d190337a6bdaf286a97625e865c190eeeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219805, "uuid": "86f90401-64c3-478d-b4cb-4f0735e46a65", "comment": "Malware payload (Mirai)", "value": "55b3b7c9a0badc8d7521e47da5a8842e7f7cb20e7b423bd29c207c6d93a2e8d5f3a3bf8506c261798852ca71a1b884bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219805, "uuid": "0c01f581-4e5d-4b9d-b8f4-ef1fe90b4275", "value": "T1FD634A01775C4E43D1A61EF8293F27E093EEEE9021F4F5846A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219805, "uuid": "551379b4-c8c0-46db-8725-db653fbba231", "value": "1536:ZjVO2KsrO4zb5BdLWBpTaQnQSe1ECj5ds:CPsTHdL0NQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679219805, "uuid": "19be99f5-2a2d-4563-b1f7-8b7bcf947f37", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679219805, "uuid": "ea1695b2-4db0-4c83-9dbe-21d8389020b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219805, "uuid": "f419ae98-aa2d-4527-8790-abb46a2eeb13", "value": "dd63b88f2db9cb0c9d223b7d2d9224eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fdc141-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226647, "uuid": "6c3a0c0b-b280-4e5f-ae39-6a70073aa9a7", "comment": "Malware payload (Mirai)", "value": "2b5360af6ec9603a7d72ac1c5c264551", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226647, "uuid": "72d3daab-d109-4a04-856e-8125b3bbaa7e", "comment": "Malware payload (Mirai)", "value": "440d42d1b5261793b95f9c1b19d9754eb51c28ab184585721507f32d6778be81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226647, "uuid": "d3b13f2e-b69a-4cb7-9735-0542e18e8b13", "comment": "Malware payload (Mirai)", "value": "2c116bf874d8299d600df6781742457f10a5fd13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226647, "uuid": "78a18155-6e46-4114-9cb0-5bfba3e87c2f", "comment": "Malware payload (Mirai)", "value": "106ce1fe36cf7e5e2d5fab6cb44a84f91c46830a79924d22e18fe1142a8f939ebc406dd69076c301a9df47e487a44c16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226647, "uuid": "4994ded5-431c-4844-a339-716116f21c3c", "value": "T1FFE38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226647, "uuid": "3e346ce8-bb1d-4cfd-93ca-f69b1028820b", "value": "3072:dgZc9h1jlnLA2PiXYeyCc2VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ2VWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226647, "uuid": "30f55819-3620-45e0-a72b-5c0c879d6daa", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226647, "uuid": "96530c76-74f0-4932-82d7-43e87b0fa8da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226647, "uuid": "02228f9c-8d22-4bd3-9323-e03cdca4917a", "value": "2b5360af6ec9603a7d72ac1c5c264551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64531ac1-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211659, "uuid": "d776e961-e4ec-4b60-981c-ad90c4933669", "comment": "Malware payload (Amadey)", "value": "3e21843a1fd4356dabe1855d96cb6067", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211659, "uuid": "02cdad0f-b69b-4fda-a5e2-fad9ba389ff4", "comment": "Malware payload (Amadey)", "value": "44a6d083bc5896412c23f6ad195ffd5beb68f6c1177f40058877d54b720a42d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211659, "uuid": "ec4464c7-a995-441f-8492-25f356b7bafc", "comment": "Malware payload (Amadey)", "value": "17405c7879184cfe330cf416eb8151329a785221", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211659, "uuid": "c4f5b0bf-4663-4c1a-ad48-b6d125672851", "comment": "Malware payload (Amadey)", "value": "d168ebfcc93fcaac01cd0d177945f3e8ea52225366531fec346fe363592b1c30f66d365d6701bc3c4b74905fef3d6796", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211659, "uuid": "7ec884a0-1526-4cbc-8a79-0118ccb21f5c", "value": "T10245F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211659, "uuid": "db6a7fc7-c943-48d7-b12e-c8f8fdfeeefe", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211659, "uuid": "e1d4d7d2-2680-45ea-9671-0147fd216dbf", "value": "24576:OhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:OHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211659, "uuid": "bfd6ae86-4b53-4f0e-98bb-97a4529d3d64", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211659, "uuid": "8a84004c-12c8-4086-ae9d-6c1f23d75f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211659, "uuid": "0fb35a6b-f2e5-4f8f-9376-a9219904dd51", "value": "3e21843a1fd4356dabe1855d96cb6067.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5da813f-c63d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679220466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220466, "uuid": "f01ff00e-7842-4303-9a5d-d12dc2b4ac2d", "comment": "Malware payload (Mirai)", "value": "b7b4c0bacb61934bd021fe66d2f9f654", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220466, "uuid": "792c92a1-1863-47ab-9edb-d18cab5e623f", "comment": "Malware payload (Mirai)", "value": "459f10b4b3d3d548b7136e2ca8af9a0d5e0439bb57c39c38ee32edf5ec567ba1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220466, "uuid": "133186b5-5e20-4cb4-a738-0e2ab9f01a82", "comment": "Malware payload (Mirai)", "value": "5a43c27e5388be92e45cf974c2634205c00c33b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220466, "uuid": "417df17a-2126-444a-91a8-69dade96fb17", "comment": "Malware payload (Mirai)", "value": "5bfa9460f6a99b2f4c7e20195d7f6a4d636d1cd47d59736c457eea6070e1e321fbbea2b90fcbcafeb469255c351d2c07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220466, "uuid": "514ba8b5-8387-4f8a-9e8d-fb6289f01a61", "value": "T191636B21B8391E27C0E4957A22F7872AB2F9534E24E4862E3E750F8EFF5558076472F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220466, "uuid": "eb11f2c1-871f-45dd-980c-f273c397c29f", "value": "768:IcowEe26GLAhfg+MhN2K1sv11FN1nD3Id1pvSnh3Ei3BaJbyqCDSgPoGO+75ZLo0:IcIMlhfgNhNvRSnoVypX75mUotQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679220466, "uuid": "b36a33ac-426b-4a12-8057-f34d1ed27044", "value": 72660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679220466, "uuid": "7f7be26b-2eaa-44f1-838c-2f0f004bcd5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220466, "uuid": "1a0d92ad-855c-47cc-b0a1-b681b333056a", "value": "b7b4c0bacb61934bd021fe66d2f9f654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d68ab9-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211372, "uuid": "b516cebc-37c0-4aa5-a57d-7c802ddfe2ed", "comment": "Malware payload (RedLineStealer)", "value": "28702d3d6fe38d8d8b840ac9d69da896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211372, "uuid": "a73f91ab-3a12-486a-9068-edf86318fd99", "comment": "Malware payload (RedLineStealer)", "value": "46337652ea1ab21e0b93eccd989fb0f5afdd0523a4803eecc47752ec882bfdf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211372, "uuid": "c85ac9a8-dc4e-497f-a0ab-17b965b6005e", "comment": "Malware payload (RedLineStealer)", "value": "3ad238b5b202e8bb9a4500082af40625c75d4cce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211372, "uuid": "381cbf52-c7a7-405a-aaeb-9c17f39442fc", "comment": "Malware payload (RedLineStealer)", "value": "250590e76c2a3da000cf91a5947eea87275ce54a29de35abfb5bbeaa0ecf73b976da4d56cf0e093013d9d2fac45c9f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211372, "uuid": "e505d1a8-4df4-413d-884f-691f730feb35", "value": "T1A845F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211372, "uuid": "129a87c1-71f0-4aad-b7eb-c38ef831fef2", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211372, "uuid": "f164e7eb-1df6-42a0-b329-e42377db20f9", "value": "24576:XDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:X3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211372, "uuid": "b2cc1823-d8d9-4f1a-bf7f-c320533c96e9", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211372, "uuid": "008f56c0-8f3c-4c8e-ad1c-8e5cba9921bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211372, "uuid": "a5f0fd11-b7e5-47fc-8651-f65cb4ea955c", "value": "28702d3d6fe38d8d8b840ac9d69da896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03354fd-c66d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1679240965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240965, "uuid": "56475930-1df7-404d-815e-37eb59ce2425", "comment": "Malware payload (Vidar)", "value": "c310d4e479589d94b6f948a43624d3e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240965, "uuid": "cd8231ae-70fa-472e-9120-00a5c39655ab", "comment": "Malware payload (Vidar)", "value": "4720007dc50c1eda6f4aaf5ba8eeebb276ecde68bbf1a146fce899aa2b0c0c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240965, "uuid": "a54b967e-e067-4f4c-a401-bc88156de3d8", "comment": "Malware payload (Vidar)", "value": "46110b16dfea473ed09db50c9688b47020bc39b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240965, "uuid": "90338c17-5361-4318-b370-a0a6b0b472e1", "comment": "Malware payload (Vidar)", "value": "2313a0423c1451d720260e39a5227d2b2f61bda04c0a3f8bb36f3e191775838838e574d5a39f3886d9e43d0919d60a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240965, "uuid": "fd170805-2f3e-4a42-a18f-ee2b4050952c", "value": "T13394121D52ED0F76C1EE81B9A6C264418338C92F4A47E30FA5C817BD5A273EE4461E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240965, "uuid": "30b7d9af-80f5-4d4d-86f6-67e50508f767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240965, "uuid": "c53dbdd0-cf98-4ffd-99bf-2b3e156adfe6", "value": "6144:SXa7AHRZ/jjmEhQjolEQZu7k0U4ETThwMdCl24c8rufdhzSxucWJBM:ia7WRxjjmEl0k0wThwMsM7rmIckq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240965, "uuid": "685b059b-b402-4d9c-aa41-a5ff5416d66e", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240965, "uuid": "19ac80ec-f3e6-43d6-b22d-744b3fb46eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240965, "uuid": "315a121b-4af0-4d11-9d69-f4af528d7d1f", "value": "c310d4e479589d94b6f948a43624d3e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72edeeb-c65b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679233327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233327, "uuid": "988a151a-cdf1-44be-9bb4-4fa8501c140a", "comment": "Malware payload (Smoke Loader)", "value": "482370bdb5d8d4f02a8cbf7ea6d2f921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233327, "uuid": "9ace2923-84e3-4c8b-8c7c-b532353bbce3", "comment": "Malware payload (Smoke Loader)", "value": "48386627bb56557498183b4a2ebe0ead01561f426cf8672499b8578e3e3a6b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233327, "uuid": "6b8f9dff-8c50-4d3f-bd71-ba51e7ffc6be", "comment": "Malware payload (Smoke Loader)", "value": "bc510810fb16d3edfb4e1385fb1de7efee25bd1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233327, "uuid": "749988b1-7107-425d-99e4-fc05422561ba", "comment": "Malware payload (Smoke Loader)", "value": "fe7ad7ba673fba9a8e56f3deb6f869f129bbd0d40f696da13f2c22a969df83f27261ff84e67de061a5c15c927b450f9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233327, "uuid": "d5d0dc75-9b4d-4b78-8b1e-005ff52ee599", "value": "T145740813D2A17D58E9264B779E1EC2E8B70DF271DF49776632189A2F04B01B2C263F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233327, "uuid": "2c36340c-a2a1-42b6-b8da-d24ea4679b9c", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233327, "uuid": "bb9c8b4a-ccbf-4a7e-8d3a-05e5d4e562eb", "value": "3072:CmYli8H1CLQF3upMfss0/cmIESLLFnGVzO6yhpWToU6xRV/t95OMfH:/YrH1CL03u9s05WGJYhsToUWvgMfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233327, "uuid": "f66698ad-ea2b-49e7-ae52-16693e7a4222", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233327, "uuid": "6a76f30b-df09-492a-b81d-be2c15814ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233327, "uuid": "1be0463c-9fb4-41e3-9409-73b3fe223e87", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2fb10f-c652-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679229203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229203, "uuid": "e412dbb1-3691-4859-bdaf-e8ff453f1adf", "comment": "Malware payload (Stop)", "value": "2e2a08c305b428488f5cd359c1f884db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229203, "uuid": "349eca5d-3648-4587-b1b3-ffec7b19e8d5", "comment": "Malware payload (Stop)", "value": "484c5744d61f823650e0e4d8c6f4b0c7235a3ebab72af70ecaa8f15f11f4e0d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229203, "uuid": "e9aca4b0-5a62-48c7-ab6d-f5e679701010", "comment": "Malware payload (Stop)", "value": "0fc40a59ce115b42a8dec19665c8e204bc7068b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229203, "uuid": "e4334e10-a642-4d3c-ac74-6b3b4f6a97b0", "comment": "Malware payload (Stop)", "value": "77429c0d9c7121270fa1c2a0a6b9b0e7a9aabffdf219d9a35a4280a472055bcb7cfd0eae973ed89e151c000e6ed73b6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229203, "uuid": "7a21c520-b76d-4261-8a30-1610cb560958", "value": "T1AE05D01383A17D59E9268B739F1EC2E8B71DF670DF8A7B6536199A1B00B0172C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229203, "uuid": "b449b997-4e76-4b84-a8ea-a167b21f3566", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229203, "uuid": "f76de1e9-b527-4b05-b01e-d1258f7dadc0", "value": "24576:53zOng5MQOW48jn+bgvLhRlyxKoivc4vZ:5jnCQOW4VkLZyxKXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679229203, "uuid": "b91905db-db2e-4dca-945d-01e05102687b", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679229203, "uuid": "8f7a8636-f150-4410-b082-9b273a99e394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229203, "uuid": "80c957ce-8ba0-49e0-8cd7-96fcd14af41c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0e7b88-c624-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679209555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209555, "uuid": "723ed835-c785-4ae1-8c36-df93e07a1430", "comment": "Malware payload (Amadey)", "value": "c8a322ac95b060daf0fae693b4144e56", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209555, "uuid": "718ca1ac-60a3-4341-8800-2cfa248eeecd", "comment": "Malware payload (Amadey)", "value": "488da1dfd6b0dfb01c593568f2dfe3dd211e93a052ef2c9f408be1b82f2ff8f4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209555, "uuid": "a7dcb849-96ea-40e5-a550-1e36e59cdd15", "comment": "Malware payload (Amadey)", "value": "64031da794882eb58abc8936c15fabed3b56d41e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209555, "uuid": "a7e9ba04-a2a6-4d53-a540-5e86aa2931c5", "comment": "Malware payload (Amadey)", "value": "37c416192968b48da7fd83d65b6d0c79b3cd81882e860d2489afefcb0557c4376db31597a76c4b9d9082221c20e9ab21", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209555, "uuid": "e3deed5c-373d-4e81-b63a-901384519249", "value": "T1CA45F11387E13D48E9668B739F2EC2E8BA0EF670DE49776532188B1B04B1176D163F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209555, "uuid": "6d4f970b-ddcf-45ba-8113-6690fbe1f18f", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209555, "uuid": "2e541395-056f-49ca-902f-9cb7437902ef", "value": "24576:xiB6d7tVCYW2LVKiSPoFbZFCU7joh4H2glJNtiLNsHu0xvO:xigtVCYWKHJdHPlvtICO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209555, "uuid": "988259f3-e775-4fd2-a164-6bf219afed79", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209555, "uuid": "e09b5af6-a431-4f0a-9e37-96ea48e6fa9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209555, "uuid": "64eb6489-0b96-476d-b44b-c9640782c88f", "value": "c8a322ac95b060daf0fae693b4144e56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ea1c78-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212893, "uuid": "2487992b-a694-44eb-93e5-7b5b57d689c4", "comment": "Malware payload (RedLineStealer)", "value": "e74f2ed351d601969bf6eb7c109765f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212893, "uuid": "f63f8db3-75a6-4744-a1ef-d86583f1f4b8", "comment": "Malware payload (RedLineStealer)", "value": "4a6122d78de096756652bcb98635aec7a293e4e5fbbb5d1a1dadcd927b8a7ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212893, "uuid": "7806c612-5ddf-49d1-a898-13c820b2e521", "comment": "Malware payload (RedLineStealer)", "value": "7ddef6a592d170ec56b65c9b7d8ba47ae215df97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212893, "uuid": "1d790c25-fb3e-4e4b-b268-dd2427bd0d3c", "comment": "Malware payload (RedLineStealer)", "value": "f26c5c4feaa5ce8a42e95c967dc9e3930a8aba240b8669aaf800035d6a25373743f6a29228b83044bfbee0be5eea1fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212893, "uuid": "dea07263-dc77-4c41-8ed9-2ef9a5a9a746", "value": "T1C945F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212893, "uuid": "a1e18afe-2af6-48a5-b86f-8b340c18d97d", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212893, "uuid": "2ef65cb7-dae0-4414-9b4d-eda55ecded85", "value": "24576:m1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:m1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212893, "uuid": "eb96b055-f14b-4e02-91d3-dad60de933fa", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212893, "uuid": "201cdec3-e549-4426-9d5f-e6e3435d0629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212893, "uuid": "a945db92-c18a-41c4-a0e9-11e6460fd974", "value": "e74f2ed351d601969bf6eb7c109765f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0742727-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211357, "uuid": "fd61d6dc-0a3d-4639-9d2d-fc6128cf3cd3", "comment": "Malware payload (Amadey)", "value": "0d5d1d85ec88446f5c4f620151b160a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211357, "uuid": "21661e2f-f7ae-4549-b837-0d3c6d991804", "comment": "Malware payload (Amadey)", "value": "4b16cd48ff49c9b437e7fffa13764ff72419563af018a99d00b8efae6d709270", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211357, "uuid": "1dc5aa78-402e-43f3-a770-08488eef57c3", "comment": "Malware payload (Amadey)", "value": "1eac00d72361038bd93ade95753ad4d6c46fc03b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211357, "uuid": "7945fdf3-9ebc-4de6-ba61-cb77ad4c7033", "comment": "Malware payload (Amadey)", "value": "4bf51e98734428fba62b66563e9049c72f20310cd736f2cc5462778b05f9e566340f661922019cac5391d623f5082235", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211357, "uuid": "ecb0adeb-42e4-49a8-a3e7-5bc6f6d29eb5", "value": "T11445F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211357, "uuid": "e7ae1a91-f267-41b9-8ddb-f80d2bb75784", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211357, "uuid": "e5f5deb9-d368-4917-8b95-5bdb99478caf", "value": "24576:AhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:AHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211357, "uuid": "7e9dee33-a57e-44ff-bae1-b07a83e6b974", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211357, "uuid": "b5b97e46-0e8d-4ce0-903a-bbc0e0882c77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211357, "uuid": "87ce0e4d-a7e9-4653-aa0f-aeba0c39e12c", "value": "0d5d1d85ec88446f5c4f620151b160a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1c23d8-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226626, "uuid": "2eee1cb3-6f01-48ae-910b-da569113ed14", "comment": "Malware payload (Mirai)", "value": "f1616e4c12ee02075a930d2f29f9577e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226626, "uuid": "bae17c5b-210f-44b0-862e-25f289edf05d", "comment": "Malware payload (Mirai)", "value": "4b3a91527d1094d0448f88b370121e35f6bec1203cd9e5ebc6e30c7343a084d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226626, "uuid": "f3487f40-2dd7-4e82-8ccb-637fd9be2256", "comment": "Malware payload (Mirai)", "value": "1f968ed4958deb906de0ddefc13b93d5cfceef2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226626, "uuid": "e259d3c8-99e9-498e-bfe8-3a8716b8e48f", "comment": "Malware payload (Mirai)", "value": "06036ca2aa92d7f575c9d5f5e6d43ba0c667822b1cbe7ef66d300b5a9cf23325f259d98f6a94346230f5e2127eaad72a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226626, "uuid": "67a7ca95-91a2-424c-b371-338970662bf5", "value": "T1BCC3F731E8044B1BC2C223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226626, "uuid": "2f0dca62-36f8-4d24-86a5-3f033d0ddf40", "value": "3072:6jVlyaL5JCrIpv04scbttiEiTmP46aQyfPlfKsNb:yoCJCN4scbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226626, "uuid": "fd8646f9-b2ec-4667-87c3-0d8f0a2c11c3", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226626, "uuid": "ff0a90ac-11cd-4c83-bd4c-5ac84361da17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226626, "uuid": "cc7f6888-0c85-4ec9-9b79-713216808edf", "value": "f1616e4c12ee02075a930d2f29f9577e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ec40d4-c664-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679237022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237022, "uuid": "dc6392e8-91d8-48e3-839a-9d5a319867b6", "comment": "Malware payload", "value": "5930b4200f1e488b703d6ea67b870dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237022, "uuid": "0180c345-5dc9-41de-938c-72e98b6b5d99", "comment": "Malware payload", "value": "4cda5887c2269f045be440464eb183ffa9cca234e5c9fa3ebc2722bb197452e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237022, "uuid": "01d133bb-3a02-4435-8b2d-70c4f578f7a9", "comment": "Malware payload", "value": "760b24a4ad3938fa455599c2fc703a45bbbb950b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237022, "uuid": "a8e95a92-6279-4bdd-8bc2-7c34beb211fb", "comment": "Malware payload", "value": "99ac363402e97140897e098fc4b1d53bab316ad38b06fdf6198f3ab3f3ff5da287682b30f68395ccbab5ff884b1094d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237022, "uuid": "57813e18-c996-440d-b770-d6bfe54d3a63", "value": "T141853947BC8105B9D8AED271896542927B307C941F3063D77A64F2B82F77BE4EA3A314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237022, "uuid": "7714a632-2ff9-48b3-b5d3-5aa49aca09e8", "value": "6684e8fdc7ec7e3f06df06f78226a007", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237022, "uuid": "36c469db-d221-4729-81ce-50549585c674", "value": "49152:Z/g2mOQ8ZcO3s73ZWYrb/TTvO90d7HjmAFd4A64nsfJGHJrND1jCVoYgVzqau:ba3Zpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679237022, "uuid": "c0f216ef-6165-439e-bf2b-403a6db38d21", "value": 1720832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679237022, "uuid": "0d61d4ce-bf4e-4e01-b775-3c11cb475593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237022, "uuid": "bedcb9b0-49e9-474a-93a7-9f32e6b5dad1", "value": "760b24a4ad3938fa455599c2fc703a45bbbb950b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6236ca-c65d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679234032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234032, "uuid": "073872e1-a842-4a34-bd96-29dc740dd8e8", "comment": "Malware payload (Smoke Loader)", "value": "f6a6060a62c5dbe26ab63df30b06ed5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234032, "uuid": "db72711f-ed8e-492b-ac59-0789df6c54a3", "comment": "Malware payload (Smoke Loader)", "value": "4e0bfb1af51cb518a3a3055070b65bae14dc0c4f9bf065261706dfdad5924ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234032, "uuid": "972fc0c2-0be8-464a-a0db-9ee515639de3", "comment": "Malware payload (Smoke Loader)", "value": "ef84556fae9deb7eb845688f29d60c943728b394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234032, "uuid": "e6a8c1f7-bf2f-4ba7-a3ad-26124de9bd3f", "comment": "Malware payload (Smoke Loader)", "value": "864f425c58274d02ec15aa180f2c358b458fb428b92c3085650cb119c642a95e6c26a6ce3bf046adeed1b39361d94c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234032, "uuid": "a5d710ba-222d-4bae-8b62-1dd3e0c29e55", "value": "T17A54F953F2A17C85E916CB728E2EC2E8775DF6509F49BB6D221CAE3B04B10B2C163715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234032, "uuid": "c8f13a1a-72b4-4b52-a09a-55cee2ff8317", "value": "41f83c8707be0871bf2bea8f993f5e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234032, "uuid": "2b4053e0-df91-4381-962f-76eefef4e22c", "value": "3072:PePnMLKE/jTe1Ya+2m2ywKdQMNCL3q7Ho2MLI5RfGJhvqP:qnMLK4el+2mk8fCbqTo2Mwfohg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679234032, "uuid": "611ca148-1abf-4e40-85ef-3fa21ba5f14b", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679234032, "uuid": "a91ddc12-9397-491b-bb33-4e80363a884a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234032, "uuid": "8b712480-3903-48fc-bb5d-fb43f749c7b9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c21eac1-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226678, "uuid": "334f6c51-5847-4c35-aa2a-ca396b93304a", "comment": "Malware payload (Mirai)", "value": "c4eb01a5c571c834de83c359d4c16d36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226678, "uuid": "da8b07c8-e565-4e12-9c44-790c83d5243b", "comment": "Malware payload (Mirai)", "value": "4e6aac2e57593b8d6b5af3a8cb8e23b528b6655b8bbf87faf41fac20850f8d6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226678, "uuid": "5686b61c-0bf4-41c0-b0d9-242e248a407f", "comment": "Malware payload (Mirai)", "value": "bf4e2266b5056f14ee4eb347cbd2e4731fe1de9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226678, "uuid": "20f1be00-712b-47a2-aa61-4861483598a5", "comment": "Malware payload (Mirai)", "value": "1dcccffcdbf8482abaa512e7358fa3e701bfc004a61380310a1c8e0976cb6aa4543f3919ea958afb24a577c975d01a6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226678, "uuid": "0c06c50d-cbb8-4e3f-8bbe-76bbdae9875c", "value": "T19FE32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226678, "uuid": "d0eb612f-a358-4172-8a80-f6198e165469", "value": "3072:Cv/WwsLgaq353qHiCOvhOpAqkDQHbeskmhxQwoVSUNu:KPLaq351hOpAqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226678, "uuid": "b9e7f610-de26-4e37-9224-89d8fe5d6d8f", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226678, "uuid": "e2a9de5d-6f41-40d1-a4c0-3b8fd1c54717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226678, "uuid": "9c7969d9-11dd-4ef8-b255-9631f7dbf0e1", "value": "c4eb01a5c571c834de83c359d4c16d36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab10308-c656-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679230836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230836, "uuid": "66666d33-1c08-461e-a903-0bd6d4af0408", "comment": "Malware payload (Rhadamanthys)", "value": "a066e3ec415d829fdb9cafe585ddafd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230836, "uuid": "80286495-6882-45ba-9acc-7579f0822dc5", "comment": "Malware payload (Rhadamanthys)", "value": "4f8035db83d6bb34bf4d2027f64c7995376a63c6353e2f46f67fd1b2875792b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230836, "uuid": "5ff5b4c5-b389-4069-890b-8c53005d07d4", "comment": "Malware payload (Rhadamanthys)", "value": "d20bbd0a85d830258c6f49415b6aa047e154490c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230836, "uuid": "2fa024f2-c0f8-4bbd-865c-dbeceec4bbc2", "comment": "Malware payload (Rhadamanthys)", "value": "4e796a3cf1ed4a9589a527f1dfb7894a996926377997dcb3e7c68298cb427d594ba654dbf11cc11dd6be34e1d19d8cb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230836, "uuid": "b4480c83-f244-439b-a140-2fd02d24ab2d", "value": "T16C743B03F2E17D49E926CB739E1FD2E8761DF1609E49BB6D221CAA2F04B01B2D163715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230836, "uuid": "40e3a672-dd96-4240-a976-e43ecbafaf94", "value": "cf9749211bb5c4a3fd321170f5076a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230836, "uuid": "ab9a620c-a90d-4ce3-9120-442e13a7b634", "value": "6144:NwuDLPVICRlbKDfo8C3EXCVG+lDrwu1A7t0UOh:+uD5NlbKDfNC3ESskPbAJXOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230836, "uuid": "670b19d9-3951-47d4-9efc-fa17e5e03400", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230836, "uuid": "578df870-e8fb-4e20-a32b-33509eeec0be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230836, "uuid": "523ef4c0-1956-4b12-aee2-e2a199f254aa", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f346c8-c663-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679236517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236517, "uuid": "c1b250a4-2cbe-4a9d-b0b8-aa1ccce2367d", "comment": "Malware payload (TeamBot)", "value": "d358804cfcd29ed97fc6fc1eba64f86a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236517, "uuid": "2b059b35-3105-4030-becb-aa4800ecacff", "comment": "Malware payload (TeamBot)", "value": "4fb64a8e694b7128eebe821aa5e89c1b6071177f72a60a58fa8e01de0e5448c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236517, "uuid": "3b048712-ae15-4239-bc23-c55291c82f3a", "comment": "Malware payload (TeamBot)", "value": "2ae1d7201cfd4d4a337c04bc3c7ff7d9661ac837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236517, "uuid": "3b5a5aa9-03c2-489b-8142-910c341718c6", "comment": "Malware payload (TeamBot)", "value": "5a1010b5964521a7116aff57ba881976fcbeaeea7c0968f86dfd5d3c4171e7348f96070744b166f64bda7fefc276720d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236517, "uuid": "c9680cce-a74b-47da-bc72-a4849fe3867b", "value": "T15B540A83F2E17D45E926CB72AE2FC2E8771DF5509E497B6D221CAA3B04B0172C163716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236517, "uuid": "3c6f1584-a103-41b8-878a-20c1749c3a61", "value": "cf9749211bb5c4a3fd321170f5076a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236517, "uuid": "441e4450-f557-448a-b9fc-d36a7da56e5e", "value": "3072:T9DNtlXXLYeoAlLZ/RT4ygvfzJ6XUNXVNzWhPE4+5Ib7xJhxk:TbzXXLYRiLZayozNXVNAHfrhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679236517, "uuid": "72080633-a3d1-4626-8d58-d3dbb6c988bd", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679236517, "uuid": "2b0db69e-501b-42ab-896e-dc7580ba2898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236517, "uuid": "20e4a0e4-bc28-4b87-b2c0-065dbf6ce8e4", "value": "d358804cfcd29ed97fc6fc1eba64f86a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524e9b54-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679212918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212918, "uuid": "3fe51e04-6237-4eed-a78b-da1d311f2377", "comment": "Malware payload (Amadey)", "value": "fed76a41f5da2bef3ab048a43b714b10", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212918, "uuid": "0024f36d-6675-4545-9802-40b06404efbc", "comment": "Malware payload (Amadey)", "value": "50d5b6d5815956074f18810a50ac1de0df5dbb3040489275801459fdc8b9609f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212918, "uuid": "5a83b2ca-9bc2-4adc-8461-e0349580c37b", "comment": "Malware payload (Amadey)", "value": "5b9645a0a6413bc4371ccafa4a1555a851a84352", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212918, "uuid": "33839443-8d4c-4de9-8a6a-e04440fa1323", "comment": "Malware payload (Amadey)", "value": "ba69937f5f6da8d398200caca540b85df0fa603eab20d6be378f765cff0872f520cb8f9fd38b4d19bc145966c314f2c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212918, "uuid": "218aeec9-2836-4d76-b86c-12d1daace006", "value": "T1DF45F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212918, "uuid": "10373a88-1291-4b98-b9d7-92caf430b301", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212918, "uuid": "0ed05645-745a-4342-85ea-177b10eeb6b0", "value": "24576:YDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:Y3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212918, "uuid": "9e07f316-6e0b-4ad7-9f2c-397db3aaeafb", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212918, "uuid": "8d6dc302-27c0-4386-a8f0-602429f81ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212918, "uuid": "3b5c3287-1e7a-4991-b2bf-dbd056528650", "value": "fed76a41f5da2bef3ab048a43b714b10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19acf6b-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679218312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218312, "uuid": "03fb6a6f-57f5-4658-b4c9-6de8a8bc47d6", "comment": "Malware payload (RedLineStealer)", "value": "3aad8ffff71d839067849d72d77a5648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218312, "uuid": "9401e7cf-aaa6-4d07-bb29-a8b89f7d9d3f", "comment": "Malware payload (RedLineStealer)", "value": "52682cb2b7f11cff4905c76d589e8de592e1678d271e369ee11aff15a2c74ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218312, "uuid": "42d3f904-a8eb-4102-b1ee-1d0cb10480b3", "comment": "Malware payload (RedLineStealer)", "value": "6da38370e1c9c9d3cd9bd1626cd3bb960247714e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218312, "uuid": "da00a754-973b-4ad4-8236-c8e6da2910f2", "comment": "Malware payload (RedLineStealer)", "value": "567378225c71b69278498030392138dbf6ed552aafa51067c98cd6e41ff8fbc74a693e980e024f79df2b6ee48dee76d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218312, "uuid": "8e67e5ab-1744-41ef-b066-02bb14bfe512", "value": "T10845F10393E17D48E5268B739E2EC2E8BB0DF170EF8977653218DA5B05B1172E163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218312, "uuid": "f1edc88e-9cc1-4003-9508-b369c4a8142a", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218312, "uuid": "b18b180f-50e9-433c-8800-0761379357c9", "value": "24576:2WksAUpYGbPrZhqNdhHkLPSPiBKo7LZvLtPY8GOCGRAR:2WkUYiPrXodq6qBLBJAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218312, "uuid": "f1c42d9e-163c-4af7-976c-a0c3b896e751", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218312, "uuid": "f21c1e17-4717-4885-ae1f-b017bb7acb67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218312, "uuid": "cd142c2b-cfae-4e08-81b8-5cc036ae4e99", "value": "3aad8ffff71d839067849d72d77a5648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eae842f-c62d-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679213287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213287, "uuid": "d51f1e7b-1ff3-4fb5-a2f5-66c30548a41d", "comment": "Malware payload (CryptBot)", "value": "d32cd492ab44503128b89ba0ae6778cb", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "d32cd492ab44503128b89ba0ae6778cb", "colour": "#107679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213287, "uuid": "5d4967c9-fbf9-4dec-a9e2-8232115e49cf", "comment": "Malware payload (CryptBot)", "value": "52a70a809294561f69bb7016818e295779d8e00c797097cf77d534ed3a07dd2c", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "d32cd492ab44503128b89ba0ae6778cb", "colour": "#107679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213287, "uuid": "af8b2aaa-8dfe-4690-8ede-bd0ea32d595b", "comment": "Malware payload (CryptBot)", "value": "78c4d59a96f7e025fa7ebe80030fd9bb4547d21a", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "d32cd492ab44503128b89ba0ae6778cb", "colour": "#107679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213287, "uuid": "134e10e4-044c-472c-8519-43da3db8cfd9", "comment": "Malware payload (CryptBot)", "value": "3bdba8e9acd9b7e6e803f3c50538450e4286ff53a6343391c219167a8a971fa5fc36e191fcf2cbb5eabc3042290c2f02", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "d32cd492ab44503128b89ba0ae6778cb", "colour": "#107679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213287, "uuid": "b8a71a08-f553-47de-8f6e-c700a8dc8aa4", "value": "T14E862333B2668489E6A5CC350627FDA471F31E2A4B05E8B931E77FC516F2AB0E507913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213287, "uuid": "0a048493-09c6-48ea-89e6-af13b9bce97a", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213287, "uuid": "6a8c6b87-b11a-4b26-a425-1cb006a4d5f7", "value": "196608:utjk/L5eZGBmm5t+fYOBaBMVrLWD+o88Vl:qxGBpIf9jVWD+o8sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679213287, "uuid": "367f59d4-aa18-44e2-b746-5eed56b8a79e", "value": 7896064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679213287, "uuid": "71d79329-f1e1-4a50-bd56-791d86a614a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213287, "uuid": "62778a45-510d-4f6f-b313-a1825d4147e7", "value": "d32cd492ab44503128b89ba0ae6778cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ce6f4f-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212922, "uuid": "0c87b705-ceb8-4c1c-a6b8-eca84258e0a6", "comment": "Malware payload (RedLineStealer)", "value": "f6c34f365bcfee9eb5c0ce5d6df102d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212922, "uuid": "6bb09f5d-e4c3-42de-9745-0b1f2044648e", "comment": "Malware payload (RedLineStealer)", "value": "52cb743c91509d8b5e31408c11823e5240782fb66f1dabb9fa55883a31bfe36a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212922, "uuid": "77888663-d32e-4641-bc62-7a2538315b90", "comment": "Malware payload (RedLineStealer)", "value": "e6e788008d2a376f9459e0ad1a8c54912f5b0c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212922, "uuid": "8511e1d4-8c25-408d-be58-7202d12ad8e9", "comment": "Malware payload (RedLineStealer)", "value": "bdce22eb971c402a6f170e4545b8b717a216175939f8a636b2c846bf0c2dbe6655b1d5c667da85c92a3d68f0c65d80dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212922, "uuid": "523a2f20-68de-4ff8-8fe9-9b5330fce039", "value": "T18245F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212922, "uuid": "dae66db7-c5b6-4350-a559-b901248999e5", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212922, "uuid": "1cd0018c-78bf-40be-977f-3378f5db553d", "value": "24576:6hVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:6Hb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212922, "uuid": "d8495b61-fca7-4476-8c58-52a0788d98ab", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212922, "uuid": "c76800e3-6914-42dd-b610-a5e87b8b258c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212922, "uuid": "e9bdc038-1c8c-4fc1-8db6-9435b5dbb22d", "value": "f6c34f365bcfee9eb5c0ce5d6df102d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae363e38-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211354, "uuid": "191bc5f1-25db-4931-83b5-64da11175fb3", "comment": "Malware payload (RedLineStealer)", "value": "08b9e2204fa803d6c13c95ac7cd8467e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211354, "uuid": "be4b6b28-1f48-440c-b5c5-e15665e3c9cb", "comment": "Malware payload (RedLineStealer)", "value": "52cc07ed0a0d86dc04baa07251c557c36d361191466a92e9f58eb09fe1977de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211354, "uuid": "a01da60d-5370-44de-a32a-05e9b450b3d8", "comment": "Malware payload (RedLineStealer)", "value": "34a2cfa9af378a41dcdc4ecaf97b8a18def6eb58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211354, "uuid": "d3863302-23cb-47e8-b210-06939a644949", "comment": "Malware payload (RedLineStealer)", "value": "b26543ea6c4613bad82ba5fee8ecd93a412ac3ccdb28ed169d1e7bcca0451266793d48cf20ac6ad5a7ea8d09806caa1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211354, "uuid": "0b5dd904-129a-426b-b0dd-1d17072b9a33", "value": "T16745F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211354, "uuid": "75cfebda-bb8f-434f-92b7-1df4b76dc4d7", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211354, "uuid": "f8085116-ee79-42f2-a2db-aca93de52dae", "value": "24576:/hVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:/Hb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211354, "uuid": "04ae0ffc-840c-41f2-982f-0625f42981cc", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211354, "uuid": "a55b879c-d265-43d8-9ef8-f6f5c43533b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211354, "uuid": "69af771e-8935-4eae-bf34-5bbfa837c86a", "value": "08b9e2204fa803d6c13c95ac7cd8467e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b69bf2d-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211671, "uuid": "09745385-4de3-4ae9-b20f-a14bbc7c419e", "comment": "Malware payload (RedLineStealer)", "value": "38c5cbdba8468f6e015ec711a2d4626a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211671, "uuid": "e52b873f-b3eb-49b4-b22e-0630d24d0599", "comment": "Malware payload (RedLineStealer)", "value": "5423b97ed1cc230f88edfdfe45f77161d19cdd5f4f372d807d0581d904cc1b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211671, "uuid": "9561e7a6-79d9-4f22-98fc-c702a41e497d", "comment": "Malware payload (RedLineStealer)", "value": "48bce207bf9d119dbc223fb93c956ae27cbb3480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211671, "uuid": "f2a2e867-272c-4f87-86bc-b5d79099ea45", "comment": "Malware payload (RedLineStealer)", "value": "b671401f95c89e19fb8f994fc244c630b1a6f79318e2bfefe7ad2814ee6de5e4f8dce7db4368990dfad90adaf4eb167f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211671, "uuid": "5d3cb3c4-3b8a-4378-935a-3f2c8f712b28", "value": "T11745F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211671, "uuid": "50b0bf5b-a568-4129-aa4b-6682001614dd", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211671, "uuid": "6fe16295-b442-48a7-93df-397df2b3f13b", "value": "24576:61F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:61FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211671, "uuid": "59b5272f-0a7c-4371-9d48-b71cf33292f0", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211671, "uuid": "6c54d175-156f-4e0e-906d-f5d77b4eb42b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211671, "uuid": "98950db1-1f05-4ca0-9a1a-14dc3fd28f0e", "value": "38c5cbdba8468f6e015ec711a2d4626a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddef1d0c-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223460, "uuid": "4f123da9-0060-4039-b5ec-128356116d96", "comment": "Malware payload (Mirai)", "value": "f1e2b61db654cc7fa016262a3b399486", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223460, "uuid": "da0abcb7-cadc-449b-b268-97fffd942a2d", "comment": "Malware payload (Mirai)", "value": "5443c0ccec4bdd20f4657e6b4dcc32807f6dfcd8d00f796b226ff0ab6e939c0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223460, "uuid": "caba8523-7203-476e-ae26-3b784f6269bf", "comment": "Malware payload (Mirai)", "value": "6b4f79f495ba2d0348fe3131dd40229aff6fc08c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223460, "uuid": "5be46a87-56f6-416d-b6e8-dd30d7b4dc97", "comment": "Malware payload (Mirai)", "value": "a795928f621fb1913fc1aa3c8832328e6ca55e0d10d6e73c82990d453dec9d6c6f0e00ef24caf49f5cf8ea2291f8fe28", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223460, "uuid": "a3229d31-db45-4623-bba3-15c61c8a212b", "value": "T145A2D1BFE49A4997DDA9A13B010C04D6147B5C5413B783D22F6575B389B78E8FC36680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223460, "uuid": "b8521b91-8191-4ac9-9863-d099e40d06a2", "value": "384:MzcDqRfKUWFH39z+/49EThvIruI8qB+eANnlBQpMr/QDNflW+v1RpG:OMkKJFH39CBhgy7qsZoMTqpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223460, "uuid": "4fb311b4-dbf0-4168-8fee-1f7d41a433c2", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223460, "uuid": "6e67e8ba-f51e-4dbc-adab-30a25e964c2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223460, "uuid": "af7f603a-64ce-470b-8c4c-c0a5f904370c", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af58309d-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211356, "uuid": "62bdeae1-308c-4028-8948-40508f8518ef", "comment": "Malware payload (RedLineStealer)", "value": "14c3f9963f18f0bb4d9984a4251cbe3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211356, "uuid": "c07d6d73-3699-4513-a94c-2f23d9a5ef29", "comment": "Malware payload (RedLineStealer)", "value": "5462c13c2322ebf7139af776a14e3dc11456dacbfc890cef9f2d9166489c1cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211356, "uuid": "4a8080da-39de-46a7-a915-a439b6dd9c3c", "comment": "Malware payload (RedLineStealer)", "value": "6c774ab8bad680cc08884631c451b835de6be464", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211356, "uuid": "f0d14056-ccc9-4316-9392-55c107df1336", "comment": "Malware payload (RedLineStealer)", "value": "990f8a6bcbe8c417be20df6c0f1f01fb0fabdbfe45afddc66c711371de9a6aba4ffe811cbc30c1d578af293937befa2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211356, "uuid": "17122071-4431-4019-a45d-254a57e5e493", "value": "T18B45F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211356, "uuid": "122390a6-28eb-4460-a951-efebc05b0566", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211356, "uuid": "b6ccd51a-ba55-44fc-adcb-654f1e4d6975", "value": "24576:2LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:sko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211356, "uuid": "0266fbe4-dff8-4c93-ad1b-2ceb3f010dde", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211356, "uuid": "12af4f76-d455-4177-bb8a-f225c090db86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211356, "uuid": "8d80afcd-e360-4802-a321-9e3ec9181925", "value": "14c3f9963f18f0bb4d9984a4251cbe3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd0eda8-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1679241260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241260, "uuid": "0333e696-6c88-4a0d-8f4c-7ed65610fb46", "comment": "Malware payload (DanaBot)", "value": "7311953bcc80a0a4f90f9ff15e3aad8e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241260, "uuid": "6e1b35a6-e8fc-445c-a8b1-ed7b395a79ca", "comment": "Malware payload (DanaBot)", "value": "54bfd26d068d0e2a1e654e99098d3c369ce1411825d4f4d6669bc637c2fcdbe5", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241260, "uuid": "1b984e46-e560-4131-aee4-670fa1be8d27", "comment": "Malware payload (DanaBot)", "value": "1fbf35f4e6b765a50e3d77fc390f2e80b5d1a445", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241260, "uuid": "c72a6b01-915e-4575-85fe-a4f7b3abace2", "comment": "Malware payload (DanaBot)", "value": "ae46cd2f53b506e13b70f53f3c34cea03d24ab978158dbad388ad9b3ab62e883f5bfc44a4844ab4ec7348085acbc0a61", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241260, "uuid": "f17e924e-af00-455a-81ce-7efae54bb8a0", "value": "T1C2D5234393E13D48F5568B77AF1EC6E8B70EF670EE89736572289A2B0470176D1A3B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241260, "uuid": "6a2c815c-3cd7-4c8a-8c43-b7b32b880398", "value": "8b512f0a0b2cd54ff600ee8ace8b2bd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241260, "uuid": "da3182c0-e005-4b2c-902a-e838efd7fb93", "value": "49152:havkHJT6FkelBo2pmbxV7htH9FWZ9K9Ndc+kNjavMlEYKkAQTgC7k5E2:hxnelBYDP9rYexq7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241260, "uuid": "f8620e6e-9989-487e-b265-a68bf86ad887", "value": 2783232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241260, "uuid": "03379bc8-f1e1-4eb4-bc35-294611907a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241260, "uuid": "7e4a0391-d871-4b3e-98cc-e79da3d7219a", "value": "7311953bcc80a0a4f90f9ff15e3aad8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8d2301-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212591, "uuid": "261cd195-5498-47a9-971f-4df292e48084", "comment": "Malware payload (RedLineStealer)", "value": "bffd1107c35e57d7f59e415351facba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212591, "uuid": "3b950f93-2d40-48ba-a736-cba3e3e255d3", "comment": "Malware payload (RedLineStealer)", "value": "55c340d2c5baa3d963477d18cabcdebd4b880607c17eb364881f545fe5b132c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212591, "uuid": "1ff6d935-f870-44b2-855f-ace0e2b40966", "comment": "Malware payload (RedLineStealer)", "value": "9c241bc00dcf1df8906a21b324c1e2c82f771fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212591, "uuid": "efbc8b68-0ee7-46fa-946b-f5fea71245a7", "comment": "Malware payload (RedLineStealer)", "value": "ac157fb7d6c972e835d670c2ba9947e382215f277b8ba61f1c71200f541b683b2e714ea5a44be6e6e9e48acf107cb02e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212591, "uuid": "3fbc5dfb-2648-480e-9d8d-cf8bf6bb1133", "value": "T14745F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212591, "uuid": "c68ff67e-69e3-445d-ae25-6651ff1267b0", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212591, "uuid": "03646cb6-23e4-42bb-80a8-df94281862be", "value": "12288:kxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:qbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212591, "uuid": "b3aaa0b6-7ecf-4074-b082-698cb39a79c1", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212591, "uuid": "c8c6468e-d3dc-46aa-9cbd-a0c2785e2ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212591, "uuid": "9eb72744-e2c9-45eb-b3f8-3a279138afdc", "value": "bffd1107c35e57d7f59e415351facba4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2e7ed0-c66a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679239726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679239726, "uuid": "3a2c01fd-b312-4208-b55e-7fb29cb5e93d", "comment": "Malware payload (AsyncRAT)", "value": "88a5b7da5503d2726c991aae27e9d8ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679239726, "uuid": "05702835-4a44-48c3-9060-830f87ac576e", "comment": "Malware payload (AsyncRAT)", "value": "55eb509b981d5340bc517e3dc260faf7716615dd464a1d6424afbdc4e7145c4c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679239726, "uuid": "495cc0f0-1e6e-4b47-8cc7-523cc7379db8", "comment": "Malware payload (AsyncRAT)", "value": "f74d9515ab2b62b7b25d666a0d2a6e884312b6fd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679239726, "uuid": "6f98ce1d-6aa4-4cf4-966d-bf3ff39330a3", "comment": "Malware payload (AsyncRAT)", "value": "56e00c985ace01b4d56d87f09c7be2969ea20e3ba53f1459accb9632e70f6bcbb3f204553e0509789e132b95994e360c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679239726, "uuid": "6d223512-dca8-453e-8a71-08668e1ed9bd", "value": "T1A0E3170426948126D26D46B3E8B2DE348277FD561932C2152CDF3DAFFA12BC659324EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679239726, "uuid": "952748c1-6363-436a-981c-da04bd8d7f15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679239726, "uuid": "b941c051-34c5-4755-8b70-8c3dce31e483", "value": "768:4OEuILWCKi+DiP9/ah+diRi++98YbngeuTS3psvEgK/JHosI/F+gUK8qL43dUgd1:4OtmxqXx+9zbg/W3mnkJ0qvmUu/VclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679239726, "uuid": "16235ca6-56a7-4b3a-8caf-09f8954e0af7", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679239726, "uuid": "684d76a7-e989-42ea-a067-43f587ecd244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679239726, "uuid": "f446d2f6-477f-43f5-88ef-06f001e67d97", "value": "ipvanish-crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9896a0fe-c652-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679229356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229356, "uuid": "86d81add-bc16-45d6-a591-8ffcfb28cf6e", "comment": "Malware payload (Stop)", "value": "7e79fbc05e59e5b7e91ebd0c5a2efe78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229356, "uuid": "6175d34d-274a-498f-8c59-4e1b57fc1035", "comment": "Malware payload (Stop)", "value": "56221b7ad16a9c49d02a3916fba76504b9e4d66d9150b7e882f9a0747208ec80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229356, "uuid": "2f9c8c38-c7f7-454e-99f4-2d3cc37f864f", "comment": "Malware payload (Stop)", "value": "8d0c7ca5e6e97cdf369238f2d2f40182793810ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229356, "uuid": "4ae7fad2-d660-4a73-af2e-eb70b7155a7c", "comment": "Malware payload (Stop)", "value": "7c71178d88a7e1619743cc43d8cc3097e2fe34a0753f63aa8b81b098c64d3d8867e9551f816f1659ef842400353a1c70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229356, "uuid": "42099e5b-1646-4876-98ee-89b4d6be3e0a", "value": "T10105C01393E13D49E9268B739E1EC2E8B70EF171FE49BF6532189A1B04711B6D163B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229356, "uuid": "1c37609e-b28b-4fdf-979a-163b113602e1", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229356, "uuid": "16b379e1-fb53-47e1-a9aa-1a402d84e05b", "value": "12288:lPHvMxVzZz++6riV2ClysEhnUJ89QM52bpFhRJqLVfsZLKnXDqEq79fVKQ2/E:FEfZz++f87Q812bHzACZLKzq/79j2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679229356, "uuid": "f4ad259e-6d2b-4719-bfee-6c9066286fc2", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679229356, "uuid": "eac57139-8d77-46c7-86be-1d3c8bbabbd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229356, "uuid": "d9cc3e55-7fbc-488a-9675-9c5e78896769", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4621f8e7-c663-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679236519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236519, "uuid": "fa6865d0-9711-466b-be09-32c77c62b199", "comment": "Malware payload (RecordBreaker)", "value": "fc17fe82f6d34fb0a65984351f48333a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236519, "uuid": "f9a96b74-5b91-4ac1-869b-73ca45be4a33", "comment": "Malware payload (RecordBreaker)", "value": "579ce02143116d53c1cd6eaf9bed90f16a830f6f7651ef56fc8aa03a29533be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236519, "uuid": "f7d2a8d2-437a-4fce-b9e2-a218a96351b9", "comment": "Malware payload (RecordBreaker)", "value": "158ae49f4dcc55958f3ca7528fa28b0476916a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236519, "uuid": "fe435a55-56a8-4e5d-8d37-f80dff7b9517", "comment": "Malware payload (RecordBreaker)", "value": "f8a44097872a9d0d1c52d0ca330a662e506a0ef614a732fd13699a97cc655d300c4c69de30d1d2637fd4bb4836739135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236519, "uuid": "4032f318-2e87-4395-a9b5-457fcabadc54", "value": "T14854D61392F17D48E9368B739E1EC6E8B71DB6B1DE8DB7653218CA1B04B0172C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236519, "uuid": "0945a5c9-38fd-4ea2-a9fc-0df923fac874", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236519, "uuid": "abf4836c-0df3-4b09-b551-d8f8d4fa113c", "value": "3072:dDltXZL98y+1VEKoNYpzS91+OEpKj85ZLn0tVjQ0Ih/:ZXZL9QMKoNYpAUjw+h/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679236519, "uuid": "510e2b99-14ab-4fab-be79-367a270ca287", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679236519, "uuid": "4ccee832-3551-4fcf-9790-a3975bec9fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236519, "uuid": "f3c167bd-a29a-40c7-8e07-210a56ba4313", "value": "579ce02143116d53c1cd6eaf9bed90f16a830f6f7651e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1152ebc3-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217962, "uuid": "609db6f1-a628-4d36-b361-1dfabced0144", "comment": "Malware payload", "value": "5744d267b585b93e5d36df52e1f17fb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217962, "uuid": "e9b2b738-6eff-4dc1-a7ca-bb08a187ec04", "comment": "Malware payload", "value": "588841559c6ee193fc73713618cbe35687e21daf63d29f1dbcd884be7d130d08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217962, "uuid": "b1f80fc6-041d-4625-9105-40d1acba1f1e", "comment": "Malware payload", "value": "de62daf889e85a6cc95551fe63a74c1c12dbd787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217962, "uuid": "1b7248c5-924d-4e1c-b300-7b6ab1574e0f", "comment": "Malware payload", "value": "5754514243bcf412ea32561376a9b95e0415ebae2ce03658659be6e94891607ac49e9ed45b056bdc62916a6556407e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217962, "uuid": "68b8c35b-3e98-4401-a305-6a6d3a96c244", "value": "T1C2059D9536A907F6D137D23DC996D606E2B2741517315BEB01A04BAF2F23BE09A3F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217962, "uuid": "469de51a-cc32-481f-8345-b5ea2e70d764", "value": "1208bcdc77cffee6a6813646321cfc79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217962, "uuid": "b0fd1415-36c0-4b90-befe-2a1e56d14657", "value": "12288:+gzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKveHQGokoR:pzJetPMw9HfBCrMb2Kc6dmyyKvewGzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217962, "uuid": "7314c993-8317-46b7-8009-0545e708abf9", "value": 830544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217962, "uuid": "ff09a897-32e3-45f2-ba20-523b479c4997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217962, "uuid": "87da8abb-0068-49b2-b151-8a782b34c8c0", "value": "msvcr100.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1dbfad-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211352, "uuid": "57d74429-e378-4b5c-97f2-a2088fbf8ed5", "comment": "Malware payload (RedLineStealer)", "value": "0934b86104ae8d86a55b085b7facdcb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211352, "uuid": "6df0f322-a2bf-4315-ab68-1f2700524302", "comment": "Malware payload (RedLineStealer)", "value": "5888c7642f4a6c2bb91aa49c0d9a4dd98004d242ff4c12db6a8be439d8387bb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211352, "uuid": "d6fd5510-bb70-478b-96b8-0f53664e6b5b", "comment": "Malware payload (RedLineStealer)", "value": "d58c02606e4587663549f4105cfe21f0917bef69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211352, "uuid": "cfbf960b-6d27-4e2f-a47b-ffebb8ea59be", "comment": "Malware payload (RedLineStealer)", "value": "bde4137ff521e7ef6114ee9c431db06ee1f9e1df9006be1f9121cc0b4d29cd7b752c9a7f3d3a9c9f187fc6c7f60639c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211352, "uuid": "7ebd32b7-eb4e-44bc-acb5-c96df385ddc3", "value": "T18E45F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211352, "uuid": "8f4b6660-bb2f-4a43-a4a4-b06f1ea2ba64", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211352, "uuid": "a4bfbe87-050f-4a19-9547-f094cb36b7d6", "value": "24576:21F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:21FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211352, "uuid": "febe4203-f7b2-4f6f-a313-bd3060cbebec", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211352, "uuid": "7d83d2ba-a13e-4401-a2ba-168ed4d8eee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211352, "uuid": "0515d394-9b59-4ce3-a17a-224c32549b93", "value": "0934b86104ae8d86a55b085b7facdcb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227f03cf-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211978, "uuid": "da5cbe8e-72fb-4588-9545-8e25ae24ee29", "comment": "Malware payload (RedLineStealer)", "value": "756dac6b103f823ca3f6a18e8342b721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211978, "uuid": "2b67d1b3-e383-4c74-b522-73b4ab6573a7", "comment": "Malware payload (RedLineStealer)", "value": "589bc16bf3330640e7b811faaa4adc6cc05158891b8d4b4ca3128926253907c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211978, "uuid": "18969820-66fa-4a66-ab98-dcf6c4dbe4fe", "comment": "Malware payload (RedLineStealer)", "value": "5c010f8393349d68b6e021a05d83fb4a4ed587c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211978, "uuid": "b2df067c-d270-40a3-8a37-a77bd3613b5a", "comment": "Malware payload (RedLineStealer)", "value": "9bab4d0c5bc5c19ee5692e4e86d632072342cc5d2eb9c8cb79ff24a0bd727ee25ae9fcbe181b86e22c06be01e06c61ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211978, "uuid": "6e0ef5f0-ed1f-4056-81f3-72ea9fc893ce", "value": "T1A845F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211978, "uuid": "3079248d-ebd6-4541-9e8b-60c573a09afd", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211978, "uuid": "505d0da5-c490-493c-b34c-b9266561c293", "value": "24576:vhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:vHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211978, "uuid": "84b42b92-3892-44c8-9242-c68a0a0666fc", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211978, "uuid": "1f5a4d2e-d02e-4583-bbf7-e9527e5082ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211978, "uuid": "87f7798d-24bb-413b-a3bc-b05ba2fa7b93", "value": "756dac6b103f823ca3f6a18e8342b721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68772a0-c66b-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679240144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240144, "uuid": "92aa2c4a-cb5a-448a-b2a5-d0caa6276349", "comment": "Malware payload (LaplasClipper)", "value": "fc6d40512829e36687854cb0118a5a1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240144, "uuid": "9ff687d9-7ed9-4621-96f8-392de86ff7f9", "comment": "Malware payload (LaplasClipper)", "value": "58c0d2f945207a56f5baefbb320d7ddbd01089205025de05133db173281e65e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240144, "uuid": "ddc0140c-3f98-422f-836a-98f0379fe393", "comment": "Malware payload (LaplasClipper)", "value": "cf801f9dad93b5ebbcef79b093b034b45aa75a1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240144, "uuid": "2c8c64bc-2887-4e5d-b4d6-cf5521026529", "comment": "Malware payload (LaplasClipper)", "value": "3ec8000c2ac3ca511ed1a076c464e14a07843df26213dd7d621f102d33ac2d661eb9272a0bf423e4c6bfd6a7f05ed56f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240144, "uuid": "53d1a361-0552-4ecf-806e-cf3bd50ff413", "value": "T1DBC5335EC54B572AE8D4BEB55ACC0CAF7531040F29E70A73946837A2131A0FE7CF65A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240144, "uuid": "465f7bf1-b120-4921-97a8-2b9ff940c888", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240144, "uuid": "7468c0db-4c93-4054-952e-22e19b526cf1", "value": "49152:6EE4S6KbgMczZ3kXz64kU4r6mN2udLglBA9iHZN9OXOMbK:VEV6Kbmhkj14rzUMnibX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240144, "uuid": "847ec653-016f-4d49-b997-8ee62c9d7284", "value": 2718208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240144, "uuid": "a35ae4c1-6d0a-46f9-b3bd-794a0c993e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240144, "uuid": "a95d0a9e-7f55-48f2-895c-6d24c9cef106", "value": "fc6d40512829e36687854cb0118a5a1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a18e2c0-c64a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679225681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225681, "uuid": "708a7b74-8dea-4463-9895-810558a43676", "comment": "Malware payload (Mirai)", "value": "f00a76d811175143bc3a11595bc71b99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225681, "uuid": "b7a99a65-7d49-479c-a2ce-880e65705e53", "comment": "Malware payload (Mirai)", "value": "58cddbee408c1195c3050bb5b3066a4baeafbf3372e42d2cfb477764ebbf44f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225681, "uuid": "4c555e89-a8e9-4762-83d4-2468de6933c2", "comment": "Malware payload (Mirai)", "value": "c93e00177172462e7dfbdd537890f0184859a350", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225681, "uuid": "57a8f4b5-a141-478e-9322-26a217d68eb1", "comment": "Malware payload (Mirai)", "value": "2e53852d3a55f97000d56a9c3ab4edeb74c5d72fffea7343985064c993fdab67c72c02ffb05b90f686abf6e61298d215", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225681, "uuid": "9680072f-c708-4984-8f6c-065255528197", "value": "T12F432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225681, "uuid": "1b7110d8-0827-41b3-9aee-d6e4bd02e652", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwj:RqtmZPuutfbltZFBSJsBcfDSTFI+BEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225681, "uuid": "571d4ad1-ea11-4b67-9ea6-34a6064461b7", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225681, "uuid": "95b1b4a4-e7ae-4ef2-8170-00e60bbc6830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225681, "uuid": "baf9e77e-0c81-4f06-9343-49aac54a6375", "value": "f00a76d811175143bc3a11595bc71b99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bae80cf-c624-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679209551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209551, "uuid": "d5ccc3c9-4cbd-4d11-938d-f80da38e2ca1", "comment": "Malware payload (RedLineStealer)", "value": "23549018ff606cef6861f1408b450f8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209551, "uuid": "96ef7512-7509-4728-a973-65e57408466d", "comment": "Malware payload (RedLineStealer)", "value": "595828d15dcdbc852e32486b78048bef6ba0fd65bd20326f4a391f4f78d4f281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209551, "uuid": "88c3398f-5b23-43e0-8cf4-ffa170900b07", "comment": "Malware payload (RedLineStealer)", "value": "e2182b16a9dacf3bd56d05905e1ba3f584e327d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209551, "uuid": "2e647c9b-caf3-4c81-a941-ce6a7e63a7b9", "comment": "Malware payload (RedLineStealer)", "value": "eb05a22aa7915969cf3a1b4dd4d1414cf3e591cf30e9c1a817db8b128e2d070b2ac915c6f5405b224b7f37546c270c94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209551, "uuid": "cc815e63-38e3-4eb1-bc59-943ac9bf72e6", "value": "T11145F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209551, "uuid": "e6d0f669-f03b-4fc9-96a4-d416a8686308", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209551, "uuid": "b23a48c0-8622-4b33-8b18-b79a3999ce21", "value": "24576:8LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:mko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209551, "uuid": "220be830-89de-40c2-8279-573e39b4b98b", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209551, "uuid": "ff69c2e4-6831-4527-92ca-1232476202a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209551, "uuid": "a9110cfd-6e58-48c4-ac63-ec89eef5405f", "value": "23549018ff606cef6861f1408b450f8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41eed21-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212276, "uuid": "cf78f403-d8cb-405e-a6f1-b878878ae36a", "comment": "Malware payload (RedLineStealer)", "value": "9f599ef2a8eacf024c118cd20e7282c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212276, "uuid": "198fd76f-7f60-44c0-b760-3dc24ded5f37", "comment": "Malware payload (RedLineStealer)", "value": "59ab8b3a54d198e0e9b3dfd72a23159e9c2ced61b712edbd1b64b66c31992287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212276, "uuid": "c1ba5ced-1dd8-4cda-82c0-01cba86c23f4", "comment": "Malware payload (RedLineStealer)", "value": "512513ff7c8be1d7cc81269bdfeb880fc8dcac7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212276, "uuid": "d29030ea-c1e8-4411-888b-4eaecc58719d", "comment": "Malware payload (RedLineStealer)", "value": "1e3105fd481ee3903fb6fcdd1d2b987fa671c736382741426a1b50444f041dbb5b309415a41585ee297482924ec42f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212276, "uuid": "d94049eb-f15a-4ddc-89d5-dd6d0d315850", "value": "T169151307E3E84032DCA133B055F302D306367C555A7893AB2B5EAC9E1DB26A0B675776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212276, "uuid": "e62e5f46-701f-4bb8-bd2e-2bb8483af246", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212276, "uuid": "1ebea1a1-2920-43fd-8b19-a17c5e67601b", "value": "12288:/MrHy90GJB790LqQxMD91XA5fwu/q1SD2aQkYKc5INdKMot62bhs+X1D3ixhCvYv:EydPhxzAfmSD2r8rNdY8Us63CM15ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212276, "uuid": "68df72f7-918a-426d-bb11-1e000a4334e0", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212276, "uuid": "6bdb8734-cd22-40c9-a9d2-afcee751a321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212276, "uuid": "cd19112d-0a11-459c-ad93-068501c76a2b", "value": "9f599ef2a8eacf024c118cd20e7282c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca78337-c66c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679240691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240691, "uuid": "50b204c7-1d9f-421d-b7fa-6db1e0d49da4", "comment": "Malware payload (Mirai)", "value": "32f726fae409091b679bca15de0d81df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240691, "uuid": "36b13a01-6cad-4f32-8105-acb891f8307e", "comment": "Malware payload (Mirai)", "value": "59e0c6a560b8c063fb66cbfa080b838b61cfceb274d628916444de1e40656ac2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240691, "uuid": "897f3ae5-5335-414f-b81a-2a3dc35c63f3", "comment": "Malware payload (Mirai)", "value": "81ed0a039da397a772000473a2bd4c6da5acc0d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240691, "uuid": "438b957e-e5dd-4236-9495-ed86a7f3174b", "comment": "Malware payload (Mirai)", "value": "f668bdcacce5459d44c75450170049fd8fc4db4d94a1bcff02e55f5e4168a69a27ff614d6a559cfacacb9616a3e1e96b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240691, "uuid": "e8b5119e-8490-4541-9f21-6057669575ed", "value": "T11BE33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240691, "uuid": "45b33c82-0178-4faa-a6d5-2ebf35a38270", "value": "3072:yJTc2PBSpm87Oabvzj4dlRsh8ZQIlddMXkkTM/9zY:yJTcGwOabvzj4dLsh8/dMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240691, "uuid": "4bc101ed-914e-4f24-850c-397663906b73", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240691, "uuid": "4bf29552-c8c2-4768-a549-9d90f02c8767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240691, "uuid": "f9a6f79c-3edd-4f4b-90d9-6eafbec61692", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e8458b-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679241515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241515, "uuid": "df5e4155-7379-443e-b530-2688a874a1d4", "comment": "Malware payload (DCRat)", "value": "76f2d6d5f4a0697dac00d84f55f6d90f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241515, "uuid": "b368cd5e-875e-4ace-ac4d-69b75a2ae1b6", "comment": "Malware payload (DCRat)", "value": "59e478ee01656fef4ad1d331fd2f5c793a8e9b0052eb8251b551956a6ac85096", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241515, "uuid": "15014345-a2a8-448b-b76b-3305db80a589", "comment": "Malware payload (DCRat)", "value": "eb3ed24c6c842bba1fda27c57493039621c1021c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241515, "uuid": "5307eb10-3e7c-45ba-912f-05ebad1c7ba9", "comment": "Malware payload (DCRat)", "value": "ddb2314bb54a7a9c9dac5390dba945436378249b693943c5ae6343bc44401557bef80fa64947eed62f654267ab52b3d4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241515, "uuid": "ffe5d9b2-34a8-43c9-abd5-a67ff5194573", "value": "T1C185AD017F44DA21F0091633C2FF494847B0AD11AAA6E72B7EB9376D55223A77C4DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241515, "uuid": "0a93a31d-aba0-4841-9be1-842f0d80f8d1", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241515, "uuid": "c88d1c3c-6e8a-42db-b259-b8db165e003c", "value": "49152:ubA3j3+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6D:ubdTHUxUoh1IF9glZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241515, "uuid": "07bc8ca2-0e81-4f30-baa4-c1f7703f93ca", "value": 1870281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241515, "uuid": "5f70bf56-0c55-4a19-8155-9af310b49528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241515, "uuid": "b5e4c2e0-c8b4-4881-b2a0-1b3944f221bc", "value": "76f2d6d5f4a0697dac00d84f55f6d90f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50ce890-c66c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679240678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240678, "uuid": "717508ea-43d0-433c-8864-cc4ef1d97857", "comment": "Malware payload (Mirai)", "value": "88bce03e77c14646ff92f51acdd374f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240678, "uuid": "09fdb4be-c4c3-4e12-8e3c-8e146e3ce9a9", "comment": "Malware payload (Mirai)", "value": "5a3a3eae493580349307d3cf5662f8a55c8745d482b3a49cad859f70829a538e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240678, "uuid": "5b9d6629-abea-4d15-836b-2c9fac716023", "comment": "Malware payload (Mirai)", "value": "012bab56982124f4133db66bf08686e774c17b99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240678, "uuid": "be991ed0-d56e-4633-b314-a165a411cda7", "comment": "Malware payload (Mirai)", "value": "e6697d78a1888e521beeb117d52676c6db698e255c478a3fe0eed7c6e7a9b06d3cee3b077617e3a84f44bc0f037975c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240678, "uuid": "d7463a7c-7779-486e-9e8a-e16a8bbc545e", "value": "T168534B17B58280FDC49AC1744B2BBA3AD93775FD0378B2A677D0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240678, "uuid": "ffbfa571-2f63-41ca-b0c4-2f3a7b6471c7", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQILiKimfFoktCe3fYRMV:WShU3q7cEDlCK/0DQ9i8Fok06fYR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240678, "uuid": "51dec0c8-6064-4771-9265-09bc7462a6dc", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240678, "uuid": "3ecd4a1c-d8de-4c2f-87ca-02172d6409fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240678, "uuid": "7e3487e6-d6d1-465a-841f-0e05a6d3eb3c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed19a0a-c655-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679230628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230628, "uuid": "0631f912-5b07-4b0d-9238-54290daa87f0", "comment": "Malware payload (Stop)", "value": "f8c1de4cd908de5e8f23c93ad885013b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230628, "uuid": "b9778530-df9d-4665-bc0d-02519ca41595", "comment": "Malware payload (Stop)", "value": "5a80e93abdc99d52b8cca61a20ff4ec4d1ab62206417e5d87f0fa9cbce436890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230628, "uuid": "a03b9a71-cab2-4270-beeb-42a499a419c7", "comment": "Malware payload (Stop)", "value": "d84e715e0250946fa3a23072c6dbe505ab016e14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230628, "uuid": "e09cc67f-758e-4daf-84a9-02f39b5e5c23", "comment": "Malware payload (Stop)", "value": "26277ba16cc8e3e1ee636ccb3e43e4b6c8f9b131fa267034a0b0580781ecb81451d6ee8421e0ddeff8522e6e993f2fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230628, "uuid": "8386f282-e801-4203-8b4f-3349c2e6e02c", "value": "T19105CF4392A1BD48E9268B739F1FC2E8B70DF671DF597B6532189A2F40B1172C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230628, "uuid": "163c25f8-6111-447a-b2bb-e483507e235e", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230628, "uuid": "f42feb1d-c7d5-4d78-898f-ba5332ae6617", "value": "12288:nuYOYzjJ5ix2rNwbzIC8mN8dw/HSNuRubElalHK8PkFn35Zwsr:xXO+wfV0w2qElHKNppZws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230628, "uuid": "f53e2207-e666-420d-a724-3dbef8bd134f", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230628, "uuid": "99ad300f-02cd-42ec-8ba3-0e61c4c1f08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230628, "uuid": "c6c30cc3-60cf-4033-9408-06c0f8226db1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf67b80-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223458, "uuid": "ba436ab8-8c73-499c-a74d-f8c1b2bf096e", "comment": "Malware payload (Mirai)", "value": "22bb17294511d8b17cb5efdfb752164b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223458, "uuid": "2328cb74-3401-499a-bce8-8dee88b9ba78", "comment": "Malware payload (Mirai)", "value": "5a8499214d6881637611d7295aa5b8d77bbf2f055c4d0508ebbbed00ef1875aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223458, "uuid": "0a51024b-5344-4dae-8c58-a0870b4f91ad", "comment": "Malware payload (Mirai)", "value": "75799992a838b3bb80429433db2a3ff8a0f5de85", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223458, "uuid": "1c445bec-d4c0-4bbe-ada4-1875e83067ca", "comment": "Malware payload (Mirai)", "value": "74a19b9eaefb54af1289c09cf1298014cc95f3e1ca08769fc84e28d6f813022f441bb9d923707a76f52ad49ceedc01ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223458, "uuid": "56cb8462-e7e8-4db9-a4b1-d9b50e0c5731", "value": "T1C1A2E17DF724C1CCE445847E15572A7B4A6FF8A247D8820E9E15E4C702C39CEA49EEB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223458, "uuid": "98df6a69-29de-44da-a3c1-0e5647db9824", "value": "384:UDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chJTNifHhBJhpExUC03uhHB3QJmRxp2:UDZ5Dw7RjFjcU+O24sDSNifHhrhpEguU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223458, "uuid": "b355d150-e519-4b13-aa4e-c59a41bba303", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223458, "uuid": "6aea7559-47a8-49b3-b7d1-59b6972bfa03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223458, "uuid": "1cb0995e-289d-402e-b09b-7296bdc5e7fb", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29616c12-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211990, "uuid": "3fcf26ce-0f61-40c7-bf58-0f74b99c2849", "comment": "Malware payload (RedLineStealer)", "value": "850d9a9623f93e6db33732876f508db0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211990, "uuid": "8254cb16-fc7c-420c-b2f8-4589829690b6", "comment": "Malware payload (RedLineStealer)", "value": "5b1b3e04d5d4ff6a9b11311b94416c19f46c8fbb2c38302bee2ad09277c14437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211990, "uuid": "6e36f5e9-d4c0-4d5b-8224-38b8829f2b51", "comment": "Malware payload (RedLineStealer)", "value": "d0d4fd16eff876549309c6eb13123688b80cda9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211990, "uuid": "1f695330-3aba-45a9-826e-2e3fcd3d3c65", "comment": "Malware payload (RedLineStealer)", "value": "8f0184fb269c7355e29fd5b156a282b22af2ab02440288a333e48ae7d2cd163f3dbd8e82201e6dd6bfe830f4442b200b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211990, "uuid": "d12d88f2-029f-41ca-af03-e8fbdf80324a", "value": "T16F45F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211990, "uuid": "991a759e-3377-41a8-8277-eacae091148f", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211990, "uuid": "855e8f59-8296-40f6-8adf-888199a35a4f", "value": "24576:qhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:qHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211990, "uuid": "7634451d-c65a-4812-ba7b-fc6f5b599217", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211990, "uuid": "ea3a014b-6739-4ca5-a052-0e80d8093a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211990, "uuid": "ad8a28b0-0663-4c83-9d13-28a2a6d4646c", "value": "850d9a9623f93e6db33732876f508db0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0752828-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679218310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218310, "uuid": "fc581539-9515-4091-af86-833ce5d7fe70", "comment": "Malware payload (RedLineStealer)", "value": "562645a653a983239afbd128dbee05c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218310, "uuid": "910849a6-1309-4334-918a-8fea05896c2d", "comment": "Malware payload (RedLineStealer)", "value": "5d276ec8415933f4a88bfcf54cba14b9352c09f7343d8149d70f1a0fad784962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218310, "uuid": "c5b23a4e-c5ec-49b2-96b8-65dfbe1a238a", "comment": "Malware payload (RedLineStealer)", "value": "06f97884c9edf9e0ea8b6b0cf530d6cb01cb422c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218310, "uuid": "3f6ed111-8f17-467b-9e15-69345d8138c9", "comment": "Malware payload (RedLineStealer)", "value": "a7c1bc13f3912241988d6dd41f8524972915062ae4d667876f9c734fb55314345db35c2a729d66e50584743aad752ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218310, "uuid": "5a1ec6f8-993d-414c-9fc3-136914b02339", "value": "T15445F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218310, "uuid": "7a87c0c3-7cf3-4d47-a240-0b1e412ffb6d", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218310, "uuid": "8fc39869-6dde-46b1-873a-6ac4dbd91dde", "value": "12288:zxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:9bXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218310, "uuid": "d7146fb2-077d-4710-93cc-4e2f0bdbb384", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218310, "uuid": "142aa9cd-334e-4cab-b613-bd8e31150219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218310, "uuid": "ab397a67-f623-4dac-9b87-6350049c7689", "value": "562645a653a983239afbd128dbee05c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c59df8-c639-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679218612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218612, "uuid": "27501fde-2539-4a09-85e8-73deda796042", "comment": "Malware payload (Amadey)", "value": "1e7ead502239d7c1bb5e33d827bf3498", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218612, "uuid": "8142aa14-7dd9-465b-9617-265952719201", "comment": "Malware payload (Amadey)", "value": "5dcc9c00be0e6904b8584546f6675b667d88b95e1ba18ab78c5ab589f2beb2c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218612, "uuid": "50e137e9-0335-4c1d-96e2-32d7ed518d1c", "comment": "Malware payload (Amadey)", "value": "f50809fee5f1656beba3c9a1793773476a7582bb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218612, "uuid": "d03645d9-dabd-4c44-8f6e-531cc3cce791", "comment": "Malware payload (Amadey)", "value": "931d1c742fe7db6550a4d96aed55b7d74dc89bbe4364d98d7a11524e25446b9b4994ecb6dccb96ef556c6975bff1080d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218612, "uuid": "31934baa-3e04-4178-ad84-3a2d1451b5d6", "value": "T19545F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218612, "uuid": "7e2ff9e4-5224-4d72-9df7-dc06403fd709", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218612, "uuid": "45f87908-039b-440c-a908-b4ec554e973e", "value": "12288:sxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:SbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218612, "uuid": "a02233cc-fc32-48b0-9823-4dbb0f1798d3", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218612, "uuid": "752b5d35-f735-4adc-83a7-065dd232654e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218612, "uuid": "83d064b2-f7b2-4b5f-a5f8-1a403cc4198f", "value": "1e7ead502239d7c1bb5e33d827bf3498.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9fb462-c64d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679227380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227380, "uuid": "48f170ca-c561-413f-a4ab-2d2b1104b8cb", "comment": "Malware payload (Mirai)", "value": "6c3d923d3463f58d030c197137e409a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227380, "uuid": "a29b7eef-8c97-4e7c-9480-dde337f92b6d", "comment": "Malware payload (Mirai)", "value": "5de53c8a16ff982fcd74f469724303008f0b99245442887e0015f82a35098390", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227380, "uuid": "12864b0e-5b04-46be-a125-ddae5aa11fab", "comment": "Malware payload (Mirai)", "value": "76fc72b7dbee26496fe59c89308e64fef1340dd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227380, "uuid": "2686d50d-819e-4ffe-abae-bf9fe2887bba", "comment": "Malware payload (Mirai)", "value": "3259ee496f12e333fb8dbc6e00a3c8945f752157fa1fa21133f153269eba2fb206ea366e5b1013d08bbeea834aca984e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227380, "uuid": "d309031f-7cef-415e-95a4-be3590b10e93", "value": "T126A2D025D345AEF4DFAF9C9493C1C2C276E547C7268AC8E340FEBF016606006BB88D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227380, "uuid": "b172222e-38a8-4b45-a4a9-6fb26dc63e95", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5uM4uVcqgw05VxJS:MRxsSVsMD6xiJJE5zRWNn4uVcqgw09E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679227380, "uuid": "df6818f7-9b5f-4ddb-aa4e-a72d426a7c44", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679227380, "uuid": "17ebdf84-1225-425a-8653-d6eb758c2059", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227380, "uuid": "26368d70-3e11-496e-bab3-5fc42338c740", "value": "6c3d923d3463f58d030c197137e409a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e296e5b6-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223467, "uuid": "7d83fdaf-1c78-4bcd-b048-9bcb3e03e409", "comment": "Malware payload (Mirai)", "value": "21aea3b7ce1bc36e6dd6aaae27aeb33b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223467, "uuid": "067fee16-db8c-434e-b3bc-793570997a34", "comment": "Malware payload (Mirai)", "value": "5e4e5d0a948d28029c4e4fb5b270afbbb4b1e4e39e5187152473a7f663b60a26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223467, "uuid": "cc0c323a-69c2-4fbe-a396-bbd2c5a6d4de", "comment": "Malware payload (Mirai)", "value": "a6fcf072e9e867c34e1fc18d7088b616112b6185", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223467, "uuid": "e026826f-fa82-40db-9aa5-58ce8b68734f", "comment": "Malware payload (Mirai)", "value": "54d9cc72eaceecca2ce74a0df6687da50a8cad048c494fac1b0eecdff23fd5e10bdf447822e9990c313dfb135623c751", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223467, "uuid": "b7166c63-8cbf-48dd-9a03-c0181547ec48", "value": "T1972308417881AA13C6E4237BF96E01CE332563A8E1DF72178D226F5477C682F0DAB756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223467, "uuid": "d07bca2b-4ca1-4ec0-ab25-7f925bf541af", "value": "768:roa3QpWd1+GjoqXQm+EcRUvDzOyEW+WnIpoXbAv8FMhwFfXI6K7Frw3JtPN+kaTN:X3AWd8UoUzOLW+ZpoXbAvcQ6KoJOwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223467, "uuid": "305d7c46-1fd7-419a-8257-4cd7bac192ac", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223467, "uuid": "7ae29490-280f-400f-ba5c-f3bf557f7697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223467, "uuid": "1d475940-382b-4481-8515-bb3c024733b5", "value": "21aea3b7ce1bc36e6dd6aaae27aeb33b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ddb358-c68e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679255261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255261, "uuid": "5e0695ee-2778-4b3f-a3a9-8e02e1e6f287", "comment": "Malware payload", "value": "5f319cf8df14bcc88f5079d3abe42710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255261, "uuid": "0e47baf2-7aa7-4594-9a79-6cd1aff3927b", "comment": "Malware payload", "value": "5e4e7755785621a1aa805c06ff9a4c48ea595421fbb3dd40232ee8487d104024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255261, "uuid": "a94d39b8-8f53-4c7d-b0a9-802eabaf0360", "comment": "Malware payload", "value": "f8b6393d8af11d6ca19a5fb209a720d9b573eefc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255261, "uuid": "24ae8c2d-613d-4f97-978a-f3858f0d4ddf", "comment": "Malware payload", "value": "147d0351246cc077bf94c6f29808a66b700a49bf04409dc0ab0f63baf297569dff41468e9c0cd256adbf1fd07e6629e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255261, "uuid": "3dbb7842-d7e7-49ae-92ce-659ed8f8e050", "value": "T1BC158E26B2D19537D1721A3C8C5BA3A5582EBF512E38794E3BF82E4C4F3A78138552D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255261, "uuid": "5d11cc43-88ba-46e0-b51a-1c285ccb86cc", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255261, "uuid": "6d97356f-497d-4229-89f6-ee0c132b91dc", "value": "12288:0MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9VO25nQopS:0nsJ39LyjbJkQFMhmC+6GD9t1pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679255261, "uuid": "d3edeaab-6013-418d-b033-b28819da433c", "value": 881840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679255261, "uuid": "5f2e0d86-fd64-4647-82ac-c71a714ef895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255261, "uuid": "b26df2fd-483f-4037-a385-35ddbb1be349", "value": "5f319cf8df14bcc88f5079d3abe42710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5170a8e-c651-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679229028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229028, "uuid": "fee36e29-3d12-48db-88ae-5b5f165ad5d1", "comment": "Malware payload (Stop)", "value": "b55b98a5254e4fe18c00aa3571dae6e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229028, "uuid": "f3695bf6-f8b0-41ca-81ae-03732cb19644", "comment": "Malware payload (Stop)", "value": "5f32994ba18ea60037aaaaa54590f5f05168f8aca109b3d2d43b072e1195f3d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229028, "uuid": "ea919cd1-02b3-4979-ad65-0b971a172856", "comment": "Malware payload (Stop)", "value": "b447f5947ebe40c72b22c26b145c890d4cf54244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229028, "uuid": "6f85d128-1978-4ecb-82d5-938db4b009e1", "comment": "Malware payload (Stop)", "value": "a45b17867ab6f5ffa855197fb064e03b605b07f2133a7db0c404b2cbb4d41f50e156a3862cca7917ea81b7bdc35dff59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229028, "uuid": "b1f9043b-c6c1-4c03-b359-8bcd9752a04c", "value": "T17305D01793E17D59F9268B739E2FC7E8B70DB271DE497B6532188A2B04B0172C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229028, "uuid": "d3048fa8-f836-4cef-b9b9-d936dc207a2a", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229028, "uuid": "dba7581c-183d-43c1-a88e-b4ab62bc6332", "value": "12288:dP3Mh7sg8wUQxrTwm0nufAPYQY3266/YgEmTP24T+FJrpkEHGnumL:N1pQbUPY326mTP24IpLGnum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679229028, "uuid": "e32d3f27-d4a5-40aa-85c1-3003132f2d2f", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679229028, "uuid": "af18a5c2-b3b7-4f81-8006-9a2ab21c04c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229028, "uuid": "14109a6e-f8b8-4048-84d3-edd8ab646bcf", "value": "cracksetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a96bd1d-c624-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679209549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209549, "uuid": "ae8160e0-74c1-47fe-8d94-930855d034a2", "comment": "Malware payload (RedLineStealer)", "value": "a09f4ad2e1dc82ff6f5192b1ff4ce337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209549, "uuid": "04e69fa9-17bf-4ff1-a5f6-3ab07321c1fb", "comment": "Malware payload (RedLineStealer)", "value": "5f89afc750f6cb3bc7db7560a6bae618d29e56307b64755cbae69eac5deb3d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209549, "uuid": "a20f9ea3-2a25-4a6a-bc0f-096af135a933", "comment": "Malware payload (RedLineStealer)", "value": "0e4eb2263d5f621fc70f7bba79f41a57b6e58dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209549, "uuid": "d09c1cc5-a376-48ee-9cec-25294c2033bc", "comment": "Malware payload (RedLineStealer)", "value": "2db975cbb230adf8cc74e2aa21870c08cc7986049ad13d323ce9a2be7792f15f29ed1c839ec57aa3fcbbae4665e1882d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209549, "uuid": "7b633896-32af-4afa-b86c-ceaec7e0b301", "value": "T1F445F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209549, "uuid": "98c5c9a0-16e9-42ff-80e3-78e461dbbfa4", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209549, "uuid": "ba4f009a-1cc2-41dc-a920-c644f4672ac1", "value": "24576:8LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:mko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209549, "uuid": "fe3bcf6a-98d5-4916-b551-9c9509a78172", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209549, "uuid": "6779c6cd-3bba-4e1d-96fb-87d7895d4dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209549, "uuid": "908677e5-9b46-46aa-ac01-f089e63aea96", "value": "a09f4ad2e1dc82ff6f5192b1ff4ce337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2fcfa2-c61a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205151, "uuid": "96433233-f6a5-459a-88d2-d25802dabe3e", "comment": "Malware payload (Mirai)", "value": "1876b01b0dcd2d7b11c5a0223d7094df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205151, "uuid": "8007bd27-3f59-4626-8e0e-3378afc85851", "comment": "Malware payload (Mirai)", "value": "5fa60fb3d1ffb1e52033c6fe40836a1aae2990873cc6d527d4c7b539f393e770", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205151, "uuid": "58ddd69f-5886-47d5-919d-4c5da15ee6d2", "comment": "Malware payload (Mirai)", "value": "8b9ca3e1a7ea12d9e42c832d49951ad8dbc07679", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205151, "uuid": "e8263b96-5310-4193-8244-2c9f279a5d63", "comment": "Malware payload (Mirai)", "value": "83b64465a897189436aa3e5b1bb2cf11c21b760e376e1bf1e05a666ad44d4bc0ea21ed30163b50da031975fc44c1566d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205151, "uuid": "d1501146-fd09-436b-8c97-5d05e73b8f10", "value": "T1ABD2E12CD95D7D05CAAD3E7D64CE56B5298C70C0935DE6CE17268448BB17B8BEC070B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205151, "uuid": "90123074-5b5a-4224-97c9-3536a6a70f1d", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNi2JbUWUP:kbDs06t4BEub4sU/MbUi2YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205151, "uuid": "32bc25b1-2e5f-4919-9006-ada686ad07f3", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205151, "uuid": "48e2b972-0ce9-4e58-831f-3e7fb30b0708", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205151, "uuid": "9c96fdfd-4429-448a-b0cb-53f892200bca", "value": "1876b01b0dcd2d7b11c5a0223d7094df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a04e24-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212890, "uuid": "641a63a1-8596-4da0-a5f2-d488c924a6d1", "comment": "Malware payload (RedLineStealer)", "value": "e9509c91ee0b5228cfa62693d5700aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212890, "uuid": "913e294b-d224-40fd-99de-6038012fb789", "comment": "Malware payload (RedLineStealer)", "value": "605929e3e236a5c98e9474e0adb78dd7cb0e04ede63c14479db9e5e8c597b5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212890, "uuid": "3a295490-ee80-4a96-bdd9-cdedd70ab086", "comment": "Malware payload (RedLineStealer)", "value": "74fe58c2072553d7a09f69859b120846ece43341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212890, "uuid": "f7713c88-6f1b-47b8-ad88-94d3de975565", "comment": "Malware payload (RedLineStealer)", "value": "5d97b23da0bc7309c21f954aae3d71530899893000869d458fc6b75b44be2a549dbbd41dce2c0f8e6caeeba713930d6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212890, "uuid": "34032016-2625-4a9e-83ea-f72bd4c3c0de", "value": "T153352317AADC8232EC7127B458FF02D319327E617B7997E6221AAC87193306075763E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212890, "uuid": "330420f8-f977-4c00-8fb0-dcfd694d7697", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212890, "uuid": "4baac971-9b57-4f24-8ff2-a1561c9c7216", "value": "24576:LyiLVGy0P+fRSMiLfExGCo/cZOgNyOs2z2sjRE:+iLQpekMiDqhUfgjz9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212890, "uuid": "d8763c75-58e4-4b7e-88c0-db1314d6dffa", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212890, "uuid": "e5843340-25e5-44f2-a3f8-0463f1051c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212890, "uuid": "0331a58d-d7f0-4dc3-95ef-249d5adbb43f", "value": "e9509c91ee0b5228cfa62693d5700aaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7befcf45-c65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackCat)", "timestamp": 1679234892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234892, "uuid": "ffb4a4ab-7348-4cbd-b8be-677ed99ed3fa", "comment": "Malware payload (BlackCat)", "value": "b67ffe5e49ada7628ae9c32eaa3b4ce3", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234892, "uuid": "1700ed32-f04b-440e-a016-4389d004b11d", "comment": "Malware payload (BlackCat)", "value": "62ae5ad22213d2adaf0e7cf1ce23ff47b996f60065244b63f361a22daed2bdda", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234892, "uuid": "6a5959a2-2ff1-4004-9a0b-ae1517507def", "comment": "Malware payload (BlackCat)", "value": "ddd203bae26ac216e0fa0548c2cbb02891edb12c", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234892, "uuid": "a27f6bf8-bab7-421a-8f68-5cb1afd94e13", "comment": "Malware payload (BlackCat)", "value": "2eecc9d388276d349f92354e97215a37e61bfa0f0b179a7c349e5fabf933cb13ef1c22566a705f4aba96ee3482c1cafe", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234892, "uuid": "8c269f00-e10c-41fa-a244-0f45e0178275", "value": "T149B67C59F84BE8ADFA7E7474607EF332AAA40819A0075C37CA46CD71B59E7613C4C21E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234892, "uuid": "9a6f79cd-7dde-419b-9b73-5ef7114099dd", "value": "ab97bbb6bef78acbb059fb53a0eeaa65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234892, "uuid": "22dcf2a8-9874-4a3f-acf0-9352b9d4609b", "value": "196608:nsu/7r2bQLLI37MRXIQUxboNzPZj6xS13oy2AZpVT1xX/Z550:nl7r2bQLLI37MRTfbNzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679234892, "uuid": "292c1dd9-35c6-428d-9734-939ae5d16518", "value": 11046912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679234892, "uuid": "7042d019-60c7-4b0a-83a8-ee2f26e9974f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234892, "uuid": "d0499f95-98e4-457f-bb25-3968816d1a17", "value": "62ae5ad22213d2adaf0e7cf1ce23ff47b996f60065244b63f361a22daed2bdda.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c7c1e5-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679223451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223451, "uuid": "1be95a75-3079-4efb-812e-b3c40994ad4d", "comment": "Malware payload (Gafgyt)", "value": "085ebc0534498321a78acb7225caec59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223451, "uuid": "50c87e0a-1151-474d-8b03-3c569daaf2d4", "comment": "Malware payload (Gafgyt)", "value": "640220f5f049253fcb7e0074f31baeda10ff490e5dfe62f55f13f9bc7969814a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223451, "uuid": "3a04bb52-4b71-4a9f-9ff6-6627084e2a8e", "comment": "Malware payload (Gafgyt)", "value": "9c83ca2306470a719e0ab8831d37c66afd84622d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223451, "uuid": "f2f1199d-3a89-41af-9396-2ece0e224a5f", "comment": "Malware payload (Gafgyt)", "value": "0933643602e9f2b5c6353f4b2769b08b93ed7e08cfdf7f4c1b14c02ae707aa880f050b20921703fa32d5723b8d97039c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223451, "uuid": "a127f295-00bf-47c0-9462-601fe22b69e9", "value": "T1B2933C06F8419753C1C327B6B7CF47493B3267B957EB330266386FB02BC67991A25A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223451, "uuid": "b1ff7135-3bd0-4f3f-8856-f266aec3b4ec", "value": "1536:J3k+bhVMXuRGQx7CcHxtOByWh5hrajKDxBSn5QyMjvVqQEqn/lJXCPe:xhMQ3HC5hryKlBSnMjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223451, "uuid": "0b3eaa6b-13a3-4098-b6dd-1e4a106ea360", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223451, "uuid": "38a99c8c-f42b-4d40-aad2-0d6dd6407bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223451, "uuid": "3b4484a9-5254-4ca9-a402-73adca9f720b", "value": "085ebc0534498321a78acb7225caec59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7ef4e6-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1679241229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241229, "uuid": "e1092f2a-028a-4361-896d-d25f3af0b72d", "comment": "Malware payload (STRRAT)", "value": "1ab2e5692258d40a9fa81cf465595e1a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241229, "uuid": "d90c54fd-0a91-412c-b475-b13598ae746b", "comment": "Malware payload (STRRAT)", "value": "645d88e82d8b0e75ccf0f38443029249598da6729c8eb4beaef021dce5860a7f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241229, "uuid": "4be297ae-d5ae-40d4-90fb-70b526fcb550", "comment": "Malware payload (STRRAT)", "value": "8904eb1d116713835ee50f44d36849d4b70617fe", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241229, "uuid": "f92d728a-0d64-44aa-8005-5f1c055b6756", "comment": "Malware payload (STRRAT)", "value": "d83f1259ad5eb25379db9fece9695b305bf535e629c60a9b1677dbf99f04b776b9c1dccc4274bcff8202502d0d9994b8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241229, "uuid": "1f71d6f4-3f1b-492f-9c34-3443d2e0144a", "value": "T1E92402CBBD5992F4C44FA1F679068133D26D02EAC211916F24FD09506C78EBA2B275DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241229, "uuid": "9dd9a969-8179-495d-8f7e-7afb61e82e7a", "value": "6144:Pdr9tGNDLN9y6/plymNG9D064w4VE2TP0qdBrK0:PLtGdLT/zPw2fDVE2nBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241229, "uuid": "bb36432c-ef70-4251-90fd-dcfa964a0d24", "value": 225733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241229, "uuid": "96084d61-f4b2-4871-93a9-f47d6f7c7022", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241229, "uuid": "db406f0d-d0ab-46a3-a510-252d98b1e513", "value": "List of Products Order.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb9d4ef-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679223461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223461, "uuid": "fef0ed0b-529b-4bb3-aee7-a5a852b6cea3", "comment": "Malware payload (Gafgyt)", "value": "80f5d6d2be5d2c66e9f5afe62f10fc6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223461, "uuid": "dace831b-9a84-4f5b-be89-40b74d96f03a", "comment": "Malware payload (Gafgyt)", "value": "651687311afa49341915aa7fa92c8a64078a3a22cf7648547725486b6cc455c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223461, "uuid": "dfe692dd-90b3-4cd5-9213-f383c2a20f13", "comment": "Malware payload (Gafgyt)", "value": "6f121738f98a4361ca8a4365c52c19654b84363a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223461, "uuid": "c0631565-6250-4f3b-a22f-44d709229cf2", "comment": "Malware payload (Gafgyt)", "value": "8a1068ef7570eba13adef7e78c879f06e9e12dfbce0a92e18f8aa362fe2fe7973f77fcdf97105b2e5143fac21c76521c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223461, "uuid": "dc86effd-201a-4ed3-b1ca-687db7259517", "value": "T10CA32905F8118757C1D327B6F78F47493B3267B997DB33026A347EB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223461, "uuid": "00660708-5412-4e4a-ab41-9881318f4651", "value": "3072:cA5hJoRw5hbRRK63a2bxj0+rQ0Knm4XATe:N5kRw5hVRKDqj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223461, "uuid": "1342d19c-cd2a-492c-9644-360e66eef3b6", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223461, "uuid": "2c888163-7001-480f-a76e-9eac3b1a5589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223461, "uuid": "8d2acd67-8218-42c3-8770-696d90a4d071", "value": "80f5d6d2be5d2c66e9f5afe62f10fc6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a4ab98-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241320, "uuid": "80f6da6b-2cdd-4c5e-9693-d4b652f68ca3", "comment": "Malware payload", "value": "a53b0206ddea7bb080a79bd398afbd1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241320, "uuid": "e2d55d06-b406-4fc0-8218-8d0321fe979d", "comment": "Malware payload", "value": "6546ac0ca25d857a0de503c42aaed734e3196452d1ee39fba27c2650e7dc57d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241320, "uuid": "4ee98ca2-635d-4c15-8ff7-661f5ae44505", "comment": "Malware payload", "value": "2526993880cbdf3c9e74f5286fbe2d370e1c9af2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241320, "uuid": "e3001c12-c30a-46ef-bc78-f9956e19b1b6", "comment": "Malware payload", "value": "a128ca007a1c3bd71a1500032fdf682305608f7ddee407bec9adad38165a92176774a8782d734071b9e812d67e2e9b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241320, "uuid": "5e693d8e-171e-4941-9dee-86cb624afad8", "value": "T13E75336EE657C0E829687D7B53002DFB726AB078D4C5BC2567B83F39143A6B4A12C347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241320, "uuid": "dc80538d-4293-4253-b495-2de102852d58", "value": "49152:PIYOehoPDsucOgn+Dyrt82oZ081rddG5/Zl43SXQkcUr29uD:P1h3ucOg+2rajZV1rrcl8SgvUIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241320, "uuid": "35524ff1-040c-4b2a-a700-907f563407d7", "value": 1653295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241320, "uuid": "5b3f3f22-5a87-4e74-86b2-fea87ef8c163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241320, "uuid": "118a1873-290a-4b5e-a9a5-a0702581762b", "value": "a53b0206ddea7bb080a79bd398afbd1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72671aff-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211683, "uuid": "85b531bf-5ba5-4487-af0c-745ff16d4791", "comment": "Malware payload (Amadey)", "value": "4eb0fb8d652bf9be568553f31aee715e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211683, "uuid": "338fca5e-f1a4-4746-9466-ac43c856baf4", "comment": "Malware payload (Amadey)", "value": "654e2807b930add66ab7842d7501b432b1fb56c793e7a63acd38af3af36d79b0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211683, "uuid": "824d8ca4-2ee7-448b-b3fc-438072420b23", "comment": "Malware payload (Amadey)", "value": "d3546333d4ff3cc02ba15fb19bd75e31640db618", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211683, "uuid": "96f6fd17-603d-4eb8-8583-7a1d79451d13", "comment": "Malware payload (Amadey)", "value": "43dd6e0431e5a833f5366886ec85af2eafbd345d7f7a6b2ef495e2abec4cdf8ae171d8dbc727e1e4411061732f612f97", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211683, "uuid": "1613d60f-ff25-43ab-aca8-29fab81fc348", "value": "T13845F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211683, "uuid": "bc252761-d254-4877-aa9d-67fd7f7b01b5", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211683, "uuid": "a9b0b302-1a84-4bf2-ab6c-c6d5fccd2d7b", "value": "24576:wDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:w3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211683, "uuid": "5b714ef8-8804-47af-8962-be055f75a725", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211683, "uuid": "b380f912-41fd-40d0-acfc-39dc843866ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211683, "uuid": "fbd7c155-fdd1-4839-8bd0-265e04b644da", "value": "4eb0fb8d652bf9be568553f31aee715e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e01501-c66d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241034, "uuid": "09014be5-e926-4b42-b991-0fd05a62de5e", "comment": "Malware payload", "value": "a77d77c5f0bd291c9ad31bd4e109dc59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241034, "uuid": "f6d17f20-36aa-40ba-997f-bf2b74c873b8", "comment": "Malware payload", "value": "655ef6af1b7978feb6a9704f8b2c83bfb0c75ee434f706bb5d6e71b4f953c046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241034, "uuid": "c036c946-326c-4e56-b83b-fe7a83a6d4c1", "comment": "Malware payload", "value": "5c5c4a7dc696152bb50d43e09f06b309a1a119b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241034, "uuid": "37c9904c-c7f1-471d-8cbd-9a42e843cfcc", "comment": "Malware payload", "value": "180431cb022608b3893fdcdf15dfc7d7bea7c3291522aa5722d65669df5949a9acc0df004cb399c3878f6eda0157e3d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241034, "uuid": "f286e40a-f330-48be-ac3f-271c4d600c6b", "value": "T14593AE317BA0C472C4836470442996A26F7D653223B8C9CB2BA45B75AF307D2A77B35F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241034, "uuid": "24e7c585-3057-44cb-8532-28552a49c9b6", "value": "1536:6GUHXYlIMYZAYEemwuRlKFLyGJWttHSrFUqSJi2JFMsx5yXK:6BIlIx1EmLXQLqGiu1x54K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241034, "uuid": "c86ccac7-6291-4355-adca-e770493476af", "value": 93166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241034, "uuid": "b8545e43-b757-4b14-84ac-ec1ef04af22a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241034, "uuid": "89d648e7-a678-4de3-9298-a4d1dac4db8c", "value": "a77d77c5f0bd291c9ad31bd4e109dc59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2968c2-c625-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679209845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209845, "uuid": "3f22b82a-0d1e-4ba2-886a-39ba5ced6985", "comment": "Malware payload (Amadey)", "value": "884c029d788e3c044875e340f905edc0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209845, "uuid": "a3c45dda-6eb5-4e4a-97f3-887ddbde8561", "comment": "Malware payload (Amadey)", "value": "658d6fad555cd998d36d7ee933bbf40e6120df77ce4b917a357372a562d70de8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209845, "uuid": "eb4f9f4e-1523-40fb-9e56-a2b243656959", "comment": "Malware payload (Amadey)", "value": "73a596ad7f7895c716e0a598148fd73c45f74a09", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209845, "uuid": "2c24fa46-221b-441d-a09f-ca0176868481", "comment": "Malware payload (Amadey)", "value": "96e78aa51021be0847bd5869871b09e5a4b013210bf25a6c0e4a16a6e89b693338a50748ab9fc53e7767c82f38abdd9f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209845, "uuid": "46f5424c-9c34-4a66-b11f-c971e934203d", "value": "T11545F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209845, "uuid": "e9b09b65-8b1a-428e-92b9-ecddff7c2fdc", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209845, "uuid": "66d0b772-5991-4049-a314-07e65bc865fa", "value": "24576:OhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:OHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209845, "uuid": "603e9cc3-aca0-4685-a0f9-a249f49d70c8", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209845, "uuid": "53bed47a-9c50-4dc8-a3b6-33c3e2f11e87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209845, "uuid": "cf30b030-aa74-4bd0-a82f-ffbd3b0fdb90", "value": "884c029d788e3c044875e340f905edc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9298d5a-c654-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679230270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230270, "uuid": "116da9c6-1c06-4e9b-ba3a-56bb28b902ff", "comment": "Malware payload (Stop)", "value": "ee5dd6b86512c217b8d6617cf7598336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230270, "uuid": "e909c626-4209-4169-870b-fb74b18576f6", "comment": "Malware payload (Stop)", "value": "65c744cad3b2160efd1f3d31c4bd86fe102437bf335c77f5a439d9b9661e1d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230270, "uuid": "62721852-a043-4919-9c5f-1e59a8d6013f", "comment": "Malware payload (Stop)", "value": "4d137fff19009de865a3929e7741ce1ec64b2bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230270, "uuid": "1a8516b0-a61e-4ee9-92f0-6eb1c77d6392", "comment": "Malware payload (Stop)", "value": "50fa86f4e610b1aa9171926accfae953ef7e1a3ce293ad7870e904f097d4af62c95146038d072d1a0132313ede2f5b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230270, "uuid": "0c3a3919-e778-493c-9776-9c32c2e4a929", "value": "T10805D01397E13D4AE9264B739F2FC6E8B71DF271EE497B6532188A1F04B0172D163A90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230270, "uuid": "50b6e390-9c2f-4d07-a4cf-a68ff478475e", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230270, "uuid": "ff3afe95-fa3d-4a4e-bbc2-8c9f40589905", "value": "12288:HPDrJtoSkJsorvNfaNUeY/+iiqjHDWRo0BKsGF/BbDkmmrDPMEAE:vptoSkKorlfaNkiqHWXLGv4MEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230270, "uuid": "4d73d4be-af62-4678-b72a-7f0a8eb8bc1e", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230270, "uuid": "5fc87aa5-e345-49f7-8043-9a5c47448b43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230270, "uuid": "45124d69-4b7e-41ae-96d3-725e586ca28e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cbae8d-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679218314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218314, "uuid": "c5761d2c-1c30-495e-a04a-0cf33d5af695", "comment": "Malware payload (RedLineStealer)", "value": "432c71c7860fff67660ce43aeee49ede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218314, "uuid": "0e3dfe9e-f21f-46fb-8cb1-36e276dff33d", "comment": "Malware payload (RedLineStealer)", "value": "65f921dcb0f51c99f5f03f935a54639fe8b0cff899bd9b804b13c0fd966dc293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218314, "uuid": "bedb1a13-a387-44e5-9f91-bc6cee8e57f2", "comment": "Malware payload (RedLineStealer)", "value": "5143ed66343d6de536432841f86df8b8bdc593c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218314, "uuid": "d3588d93-a1e9-4e4f-bc3b-e6f18e7cb41c", "comment": "Malware payload (RedLineStealer)", "value": "fa246dd503ea92e7f1491f63131fdf8a93bc95ec4469ba6955c69bd3fae6c55f60fe908f041862f063e9fa1a521ad689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218314, "uuid": "fb491d05-0808-4870-9b14-07e0158e875a", "value": "T1A245F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218314, "uuid": "6a65db7c-ac67-4413-a1cf-72ac5741640d", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218314, "uuid": "42b93ba2-0866-4fb2-8fc2-bb1383ba76e7", "value": "12288:uxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:wbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218314, "uuid": "be0b9459-f14b-4856-93d9-c3c4c3800de1", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218314, "uuid": "2a0cd27e-470d-41d4-95c7-c4c2ddf1db69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218314, "uuid": "f6612401-399a-4ba7-b3fe-487594c2f48d", "value": "432c71c7860fff67660ce43aeee49ede.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e001d3-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211665, "uuid": "0fe18010-b611-4140-bc08-6d8e1ba33ef9", "comment": "Malware payload (RedLineStealer)", "value": "37e2709a2075bf479484154aa9272a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211665, "uuid": "4be1853b-0b50-4e8c-9f1c-0f488ccede17", "comment": "Malware payload (RedLineStealer)", "value": "6685facf49c4504a9c6c97a672bd192bb4c4990486081a4907be53511481bfaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211665, "uuid": "faad3a15-c8e0-424a-9893-265710b197cd", "comment": "Malware payload (RedLineStealer)", "value": "9f52b833ff1cd4092e6d82922ea44063f97524ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211665, "uuid": "c1e705fa-5c1a-4297-8cb3-e4a8310c2693", "comment": "Malware payload (RedLineStealer)", "value": "bb817bed3536a0b4da45731bddf38a786eaaf45b89cd8f85ab29261ec6b86abf49c3ef87202e8d77357778bc9b339fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211665, "uuid": "0c8962a0-71a9-42b1-8923-acb133d00e1f", "value": "T15C45F10392A17C49E9664B739E1EC2E8B71DF2F1DF5D7B653218DA2B04B11B2C163B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211665, "uuid": "88a63857-99ff-42a2-9212-fef9a58cc7fa", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211665, "uuid": "5aa7f51d-f3e4-4e75-a094-ffeb3a6c1fb8", "value": "24576:8drxnnySqJxCY2MNaboMVEQxSrvmK9ch0dzt6Jub86X9mkR:8PnnoqdlbVvivmK9che6J48q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211665, "uuid": "854dd5b8-3212-480c-8819-4797503fa726", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211665, "uuid": "9400039f-d9cb-46fa-9871-4145f9e88758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211665, "uuid": "bd64f2d1-5b96-41b7-8d97-c0f3e234468e", "value": "37e2709a2075bf479484154aa9272a9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52136a6-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679218318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218318, "uuid": "4ba91672-748c-404b-b96e-de1724b7d6ca", "comment": "Malware payload (RedLineStealer)", "value": "b0d53e3b3fc3c819526ce722c39f3aa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218318, "uuid": "a7988be1-7495-4822-82a1-08e819183c85", "comment": "Malware payload (RedLineStealer)", "value": "6723661567d73dc077107296353ea2b334ef5b5ec86448d51e69e2fa1340bf1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218318, "uuid": "ce4d61db-086c-44a5-ac38-1918c121130d", "comment": "Malware payload (RedLineStealer)", "value": "713336642a368f60327da90d5892ef8ed98f48d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218318, "uuid": "6fdce887-e8b9-40ed-8001-ab66a21c0b15", "comment": "Malware payload (RedLineStealer)", "value": "a3de7b46831b8cdfc2c267198392905a8efbfff034aab716d2e3b8d04253de1b45ee1a0801dff73c52e7d53042bfb31e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218318, "uuid": "83ffccd4-3d21-4779-855c-1570d414c006", "value": "T1B845F10393E17D48E5268B739E2EC2E8BB0DF170EF8977653218DA5B05B1172E163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218318, "uuid": "7559ba27-fdd6-42ed-85f1-d2668ec99d40", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218318, "uuid": "eefdf39a-f37e-420c-9af3-e99faf20df7a", "value": "24576:vWksAUpYGbPrZhqNdhHkLPSPiBKo7LZvLtPY8GOCGRAR:vWkUYiPrXodq6qBLBJAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218318, "uuid": "d4505667-d231-49b1-9259-d891b1f8729b", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218318, "uuid": "2ad2cc54-8358-4f02-b002-5c884c32a7cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218318, "uuid": "dc7da18b-f025-4cb6-b9b9-31e656126843", "value": "b0d53e3b3fc3c819526ce722c39f3aa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e42f55-c65c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679233702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233702, "uuid": "aa41d56b-3ea1-4703-a5fa-797e444bfacf", "comment": "Malware payload (RedLineStealer)", "value": "16660f033fcaebf744365ec2f9fe79b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233702, "uuid": "c17e5c6b-f591-4eea-b9bb-880ac9e12052", "comment": "Malware payload (RedLineStealer)", "value": "67628faef9a814ab02d6284eef3ec4faf472a0e7535cc7c20c8e106dd2acd067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233702, "uuid": "490b747d-9edf-4831-8003-55a306916d35", "comment": "Malware payload (RedLineStealer)", "value": "33ce6f5891fd258b82336c9a08e71ac77559cb1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233702, "uuid": "bd18b08d-3ef9-478e-aef0-0198735d78a5", "comment": "Malware payload (RedLineStealer)", "value": "c582d98b53ea685270b1fc313e08d8931b1485689a454e00b7b786642bd767f67179fe482a00f3f820195ff7a9dc6513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233702, "uuid": "a888dfa0-66d4-4d26-9229-7eccce4d38ff", "value": "T1DE352207A6F89072D9F957B00CFA02D31A767D606B34979B338B7C6609762E0717272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233702, "uuid": "f1e593f5-a427-4997-aff0-bdfcbf620279", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233702, "uuid": "a0278863-691b-4afd-8501-dc0941b31136", "value": "24576:ry7e8MO34FjHHKCrnTLHFIfqHkd6cDKRidC3MkiIXzIoT:e7e8dMHH7nTxICa6cDUP3nZXEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233702, "uuid": "e1595d67-5d6e-4e5a-8636-d5a58a51d375", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233702, "uuid": "4ae588e5-d300-41aa-a446-557f68a82254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233702, "uuid": "3fb3af90-1b24-4705-bd99-3b604b8407c4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8367fd0e-c61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205698, "uuid": "a448239d-b60d-4763-b981-bed4695571a6", "comment": "Malware payload (Mirai)", "value": "fbfb63e73b6926906a4ece96a489a743", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205698, "uuid": "b66cc400-c05e-4cc1-ab5d-02e9e6ee594d", "comment": "Malware payload (Mirai)", "value": "677e1176f6faeb48b6b0d57ae4ff2f6fb569200d903c19ef0ae54b56355d49f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205698, "uuid": "efa676f6-6c33-4fd0-bb71-9d8dc8650084", "comment": "Malware payload (Mirai)", "value": "db5ce55c6ca380c3aa450e25f92a8c1595102d9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205698, "uuid": "979ee3d5-2b60-49d3-81e6-01e04e4959b8", "comment": "Malware payload (Mirai)", "value": "c79c734a934a2604f2c13c5d9bdf65e03d6ef8beb44cf6e2749d251b597bc7c7d4a6f60fb458f95372f6338fc54e91d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205698, "uuid": "1b6b7c7a-bdbf-488f-91fe-703679e05d1a", "value": "T1F6C2D044F081CA05CFEA28F43D40DBCABBE06F5BAA628E9176E153D25E5C2774201DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205698, "uuid": "b5abec5d-a753-4efe-864e-1a23fb4b7b8c", "value": "768:wVdafO76jpmNJJKehmA7trpfIX9KeA7PV9v4uVcqgw09L:Aam+AnKehPRa9aN9v4u+qgw09L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205698, "uuid": "2a0b8a36-e108-477b-bb15-afa5606b0bab", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205698, "uuid": "fcf4574a-89cd-4b5b-8b60-822fb2ed1505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205698, "uuid": "f1867d47-6e6b-4cdf-a6fd-367c011cfff3", "value": "fbfb63e73b6926906a4ece96a489a743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7011937f-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211679, "uuid": "f829e39f-06ae-4eb2-a336-618eb38c33a6", "comment": "Malware payload (Amadey)", "value": "49d4524087135cd13d853fd53fc98a63", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211679, "uuid": "68a0dd46-86f3-4c4f-8306-49381f8a2cfd", "comment": "Malware payload (Amadey)", "value": "685ec681d7c5e451278aa95c50bc19aa5c0a1b43a4835255d02e111672e1e731", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211679, "uuid": "c12fd705-3e88-4070-810e-37e1a77dd1ea", "comment": "Malware payload (Amadey)", "value": "c799b5e3e5ee02f834feb4ecee55c6ffe2182440", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211679, "uuid": "07a8809b-c063-47c2-89b3-699de7a076b7", "comment": "Malware payload (Amadey)", "value": "2ae8ca611a67654e2a8756c844ff78f0ba860e87a2a9a154b4187de803cfd212ae1eff92e8af75f5d0b19fe241524a83", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211679, "uuid": "06df41b0-26c1-435b-a1e5-b4bb116efe65", "value": "T14D45F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211679, "uuid": "f0d4c388-a4d6-4b33-84fe-6b323cc25539", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211679, "uuid": "3cf3e1f0-1c49-42c9-9f0a-7bd8a7489626", "value": "24576:xhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:xHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211679, "uuid": "eb2a466e-9a41-47bc-b9ce-58375d8c934a", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211679, "uuid": "eb50f7e6-70ce-49e6-87d3-50647e62d590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211679, "uuid": "4d7bf151-70a6-402e-a32b-f07f4b819ab5", "value": "49d4524087135cd13d853fd53fc98a63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271321e6-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211986, "uuid": "27a814b6-4882-4c6b-85d6-7d53d08a0ca7", "comment": "Malware payload (RedLineStealer)", "value": "73f23ffe3fa39ab967e371834c2aeb83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211986, "uuid": "c2929005-3091-4013-a577-a9fdba16c606", "comment": "Malware payload (RedLineStealer)", "value": "693c37a1a0442fb8d8141d447a92da619f077ecb4d6bbf14d0697bca2f17a9c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211986, "uuid": "d80b9226-a3e8-48f1-9469-32508daed2ac", "comment": "Malware payload (RedLineStealer)", "value": "ffac069edf9a2986dea5109c1f544f792d025d81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211986, "uuid": "3475cb8b-ba20-4fb4-9871-d6cdd8bc5c6e", "comment": "Malware payload (RedLineStealer)", "value": "329f2650553cd4a6d717b64f2cf08ab7084e981d78311c5bf27b4ec132f48a3bc629539146075010ff12b8f223109b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211986, "uuid": "39143fc3-ce08-42bc-b535-665641c478a9", "value": "T10945F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211986, "uuid": "09bde283-06c4-4a03-8ebd-2bfbcf4e18fa", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211986, "uuid": "f6da06e0-a3de-4f0e-ae8b-36b180c988cc", "value": "24576:bhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:bHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211986, "uuid": "82c387ad-85f5-4473-9aa5-deea924f1e82", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211986, "uuid": "f0974881-0ad3-4e2c-b036-6a701fab79b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211986, "uuid": "ba295e33-8de3-472b-81e3-b8b167cb3d64", "value": "73f23ffe3fa39ab967e371834c2aeb83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1410d736-c643-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679222692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222692, "uuid": "34c5fdea-d3f0-493b-82e7-3eb112794f4b", "comment": "Malware payload (Mirai)", "value": "4cfa5fe2441996843f41fd538eddc232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222692, "uuid": "ad7d01ad-78d8-41c2-a3af-df51f3472721", "comment": "Malware payload (Mirai)", "value": "69b7dad7707100859c2e9bfaa7e3b520a937d627b2b1869baf81af5b83ce4c6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222692, "uuid": "0ee5a84e-9511-4821-942a-6b24d36c55b4", "comment": "Malware payload (Mirai)", "value": "d24c8b6a6aa9acd9aaa88617c91674a87d76c581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222692, "uuid": "e644df0c-4bcb-4e64-827e-9afbbbed4972", "comment": "Malware payload (Mirai)", "value": "e3f4545dab21d4a4c4cf7e1d46c21368837e0d5fde89a04ee6461605ae38c1eb8ad9fe527a11691474760b45edff804f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222692, "uuid": "80886a84-6047-4338-b0ea-969280e460c5", "value": "T164434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222692, "uuid": "b120f126-c204-4fec-9d7e-25abae83cb7b", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmc+Dj5gk9vWnTI4eBH+4sToQLDKFv:Yn/EsW5qhSh6am3lWnU4GH+dNLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679222692, "uuid": "555e969d-868f-4f24-bf7b-adf2c45f5c21", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679222692, "uuid": "8a37a360-6af0-4ade-bcab-96f456b0c8e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222692, "uuid": "57defdcb-5b76-4e5b-9125-163b7e3d50ce", "value": "RpcSecurity.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196123ae-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211963, "uuid": "09d8bd98-92b9-4996-9523-08fe8110bb4b", "comment": "Malware payload (RedLineStealer)", "value": "49eee162365e0e4b8b3ab64362bf1aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211963, "uuid": "39cacd8f-b0c1-4f40-8be8-2f62d8bfb2f8", "comment": "Malware payload (RedLineStealer)", "value": "69f805c4217fd4a252b1291aa0c2327faf3ce036017b43deb2a10ea6fc8d1b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211963, "uuid": "e423ac03-fceb-4fa7-982b-f22ed2a13a3b", "comment": "Malware payload (RedLineStealer)", "value": "3da60ca062c924ede57527320010bb530ee398bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211963, "uuid": "7e841883-ed3e-44a3-af9e-62ba5692dee3", "comment": "Malware payload (RedLineStealer)", "value": "a935c8d088842272af25e05c1cf9167e7048a375c97751e4a4605813b37f3c8b410600d6de7007db198f972e26c4caed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211963, "uuid": "b9074e8b-18c3-4ee4-a82a-ff88fd433329", "value": "T10C45F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211963, "uuid": "df435573-7d4a-4581-a4f5-eb1ff5047eac", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211963, "uuid": "14fbd804-dd3e-438f-9261-1356f2b2f753", "value": "24576:ODJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:O3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211963, "uuid": "07be2978-ac30-4133-8405-ddfca2e32596", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211963, "uuid": "8f8e616d-0c1c-41be-b03b-6de709422a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211963, "uuid": "909445ba-40b0-4fef-9569-6af7a854d90a", "value": "49eee162365e0e4b8b3ab64362bf1aa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be25068a-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223406, "uuid": "746593c1-433b-4d21-bff8-f5afe3934bca", "comment": "Malware payload (Mirai)", "value": "d70f8dee151f2fc526361ececf812320", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223406, "uuid": "cb2a4892-8ef4-41be-9dfb-19527230f109", "comment": "Malware payload (Mirai)", "value": "6a500acfe1312bae177086ba0d2189b2a6bd3437b72578a42e114721de34ad1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223406, "uuid": "c3f6d642-fac3-4bd6-804e-372eb0768b1c", "comment": "Malware payload (Mirai)", "value": "21d2402df227bb31d1a382434776b0246b8a4ffd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223406, "uuid": "40880a7b-f595-4bf6-8a79-98b5c04c3710", "comment": "Malware payload (Mirai)", "value": "cd5e92c0ae917a068a1ef76a4ea7d16887089f089cee16ee2d33c2b72a001f774e27765ff1c4b4ec2134fd661c4de28f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223406, "uuid": "7c291942-9690-46ad-ba1f-effdfbfd910d", "value": "T192732A86B8819A21C6C516B7FE2F104E330297A8E2DE7353CD145F6477CB85F0E2B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223406, "uuid": "9f6704d7-7ba1-4494-a547-508615f168dd", "value": "1536:C9nQlxuJzfBcgq+FZY0JrcdkSv4d+TfJvWa5dCAnhYXoHuzVL+13Ljn/LdCIhidb:jrKflLYgcSSv4d+TfJvWa5dCAnhtOhLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223406, "uuid": "f87c81c5-4fbb-4f83-a49e-b70541279efc", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223406, "uuid": "c84aeaaa-8dca-4edb-9f82-18ecc7f8d048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223406, "uuid": "269001c4-4a7a-47c8-a5ae-b472215f3981", "value": "d70f8dee151f2fc526361ececf812320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54484d7-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212278, "uuid": "da597f31-f340-47e1-af50-ade0feed02f4", "comment": "Malware payload (RedLineStealer)", "value": "9f2a2fc1dda81f7747cf49a1999b87e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212278, "uuid": "0f05f0f6-4d3b-41d5-8afa-d453ed650540", "comment": "Malware payload (RedLineStealer)", "value": "6abbeec35a40919325f069ec47dccfc1b6d4132ef0f9114acc19778f1cfd21ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212278, "uuid": "60b56346-3dad-44e9-935b-49fd6662f80b", "comment": "Malware payload (RedLineStealer)", "value": "5abdc7ab4c726665bccb0f1557faa860455852ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212278, "uuid": "736771c6-eeda-4ec6-ba57-5453dd1cd925", "comment": "Malware payload (RedLineStealer)", "value": "b749f02480e56c7a5a47c07ef7345910dd3e770734ae66523aae440039f778ed138ef525a2a13d178040532c8183d037", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212278, "uuid": "c283cc9b-8652-4f62-b221-5416a2457c4e", "value": "T19F151217F2ECC022EC756B701AF603C70A36BD601A7457A7274A7C9E1CB25A0E572767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212278, "uuid": "d119c7e6-9a68-48c6-9b30-87c6686f4dc2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212278, "uuid": "ffb4659d-1370-4109-81ab-8052e58bf5ac", "value": "12288:xMrBy90He3BbmlZh5uxsbqVTb149z0Tf3R0f8332Jtzs6j/cRJp/Y+62uSD+R1Mb:4yo4FWLWV1+z0Tq0nEtzvcRJmCDlmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212278, "uuid": "c77744ce-0b77-412e-aa3e-c2633e9abc19", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212278, "uuid": "2a2ea3a3-1905-46dc-8529-c1808aab1ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212278, "uuid": "c5d05501-d11e-434e-8bf3-5e7e0b190e3a", "value": "9f2a2fc1dda81f7747cf49a1999b87e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd2b83a-c665-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679237475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237475, "uuid": "bb6d724e-1f05-480d-a2a6-e7637948d5c4", "comment": "Malware payload (RecordBreaker)", "value": "5da5ec943227fc949d4815d01b840322", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237475, "uuid": "923759fe-6b63-4bfe-9819-ab64a0d35292", "comment": "Malware payload (RecordBreaker)", "value": "6ad7834b4af4629c257d41d87c44f0301f514e3228b1b42ca0590c72929e9f93", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237475, "uuid": "d805cee4-ad2b-4896-b1fd-de1048624502", "comment": "Malware payload (RecordBreaker)", "value": "b52930524c8f6807fed9e1b85e83e31c0e382748", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237475, "uuid": "f7ae560e-14ae-4c57-8cd7-fff94c561acc", "comment": "Malware payload (RecordBreaker)", "value": "9910fd8c1e574e53264253ff1325f839b7e7a86a47c6a4c447d5d7b3ea7f5267fd736e881c9082acb0f028bbc8331e80", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237475, "uuid": "dabb123d-f1ee-4201-81e1-c48cf11e6b6f", "value": "T16F54F913F3E17C55E926CB729E2EC2E8771DF5509F49BF6D261CAA2B04B00B2C263615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237475, "uuid": "b4bf473c-7b48-445b-87c4-c77d1a77f057", "value": "cf9749211bb5c4a3fd321170f5076a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237475, "uuid": "c454cd07-1f5e-4406-9853-40f953e43ad3", "value": "3072:GDo+XbLzrgfLAHRu6MKpVu0TDKH1LRA5Ib7SJhRrb:6XbLz8fsHR9MOr+HRfch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679237475, "uuid": "f3de1e0e-3cd0-4966-bb24-f50af93dcd31", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679237475, "uuid": "ab15aa83-6326-4d01-a914-7b59a48bef34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237475, "uuid": "168a27ff-cf9e-4606-bf58-1936071d30ba", "value": "5da5ec943227fc949d4815d01b840322.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90aa7deb-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212593, "uuid": "ec5f64ad-d52d-4dbf-9803-fe714ff6f546", "comment": "Malware payload (RedLineStealer)", "value": "a9d580dec2864ff9a3bfbb13e2239a22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212593, "uuid": "7afa3674-54c0-4845-aaf9-05013fab77a7", "comment": "Malware payload (RedLineStealer)", "value": "6b08ad364f89d30a3e16e99d5fad7ef75f75423fd581d3d5bc71cc84751fd8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212593, "uuid": "b2b8d55f-07be-4b0d-a4bc-04de7d9ac4cf", "comment": "Malware payload (RedLineStealer)", "value": "05d3a276049e14693c39a0c1852ab15d8bab1f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212593, "uuid": "661013fc-07a3-46c9-a3e3-00a7097a30cb", "comment": "Malware payload (RedLineStealer)", "value": "52df181ba48ee1e3e74354f1739b90b37acba86b9f9d639b27ebca303b50ab169c0ca2b521d252565628ed284fe93000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212593, "uuid": "945ddb15-323f-4015-a8fc-c4441d2504b5", "value": "T1BB45F11387E13D48E9668B739F2EC2E8BA0EF670DE49776532188B1B04B1176D163F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212593, "uuid": "adfe4b7d-f488-4701-bca7-4c35af33c2bc", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212593, "uuid": "fee2d435-c938-44e1-96a3-ddd8ce84420a", "value": "24576:0iB6d7tVCYW2LVKiSPoFbZFCU7joh4H2glJNtiLNsHu0xvO:0igtVCYWKHJdHPlvtICO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212593, "uuid": "043ef846-b1f9-4703-a906-0849bd25314b", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212593, "uuid": "4502cd5b-7817-4a7e-87dc-28513e470507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212593, "uuid": "01909c29-368f-4d01-9369-766d8dd24105", "value": "a9d580dec2864ff9a3bfbb13e2239a22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5120fe7e-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212916, "uuid": "7bfbedce-a943-4a02-88d3-a528f6a9ed70", "comment": "Malware payload (RedLineStealer)", "value": "f5dc535ddf269381fb1a4de4d6488ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212916, "uuid": "0df6e9c8-e1ee-4bce-843a-36c3b6d0b25e", "comment": "Malware payload (RedLineStealer)", "value": "6bcd8ab382d0c1bf14ad5325ee258b3969544f3eee60bd9ae0a980127eab2de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212916, "uuid": "c3d91803-d209-47ba-b5cb-c2a69687dcac", "comment": "Malware payload (RedLineStealer)", "value": "140bff0b3ddf3616685063fdd6328376b517d8e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212916, "uuid": "2f41bf48-6cb4-48aa-96e0-ada18c8c6941", "comment": "Malware payload (RedLineStealer)", "value": "bd6aed7950890a63e4025f2528bdcfe21d4c614034ce0660cfdc50a0e0ad43f89fb3e5e4fdc26088a2e604c443d41513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212916, "uuid": "a86fb5bf-1a1f-4dd7-89c3-12dc0ccbe437", "value": "T1A9052212A7DD5463CC715B7418FF03830B367CA65EB857AB2354688B1CB2AC1A47673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212916, "uuid": "5f1f10c4-0330-44c8-9a58-ff6952c44474", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212916, "uuid": "12dd810c-1c21-4378-a535-ce17b1255751", "value": "12288:vMryy905/132Y0NMfAq6pZPHcxsgq2xiU+Ox3ft8+S4o6Mpnmc:Zy41mY0lqomiUnL8A8mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212916, "uuid": "f7cea200-320b-495d-81f2-6f1d38b97556", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212916, "uuid": "15929e65-a300-4539-91ac-bd3e3cecd038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212916, "uuid": "8eb773fb-086a-4bd3-8638-de222df73823", "value": "f5dc535ddf269381fb1a4de4d6488ead.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a6fbc0-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679224924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224924, "uuid": "37c4ed92-1faa-42fc-852c-915ea375ca0a", "comment": "Malware payload (Amadey)", "value": "2f4d2c7eef97aad39db9e0102806d8b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224924, "uuid": "5e40f0ad-549f-491a-8864-2fa4791ef077", "comment": "Malware payload (Amadey)", "value": "6c7458cada703034c5c9f706c73624f0a20ebd47b4479280d0bb7fddf196b061", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224924, "uuid": "fc4de1b9-cefb-414e-880d-1ca397082eba", "comment": "Malware payload (Amadey)", "value": "fce4da4d1cb2aaba8554ff14669fc299869f64a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224924, "uuid": "09918715-5c01-4f2f-b749-8917ba222acb", "comment": "Malware payload (Amadey)", "value": "ddc8e5bdb4699cb0a41226b6b1350c808b195cd0668f32992a542ce62bd45108e5a754a2061bd2cac58535d0cba3b1eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224924, "uuid": "6e441f27-2d1d-4a68-b147-ce763e3fca9b", "value": "T14945F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224924, "uuid": "a95e2fad-d403-41b8-927a-e12d04540d0f", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224924, "uuid": "75ddfc27-d05e-481e-a052-59ebf6dd6cf4", "value": "24576:J9h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:J/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224924, "uuid": "d346a68a-44d1-4a46-b66f-f7a3f2b0a1f1", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224924, "uuid": "b447af03-8114-475b-9338-fb26a3583fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224924, "uuid": "9311ba41-72cc-41c1-bccc-bd88a81f278c", "value": "2f4d2c7eef97aad39db9e0102806d8b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc131607-c637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217873, "uuid": "ac451f05-068f-4508-b216-659db1a1f9c8", "comment": "Malware payload", "value": "19252e23b6573c3b30acdc6c44e10192", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217873, "uuid": "89d6063d-91d3-4a2e-9367-4bd412794188", "comment": "Malware payload", "value": "6ce37274b502ee01e02dab5c5378e8a2ec50b6e1431b303e5ccaa3334140ba00", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217873, "uuid": "3b96b74c-4ced-4bfe-b156-8da2195bfc8d", "comment": "Malware payload", "value": "8634b24a560f9c5aba2e9d6d70003766a8a46e8c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217873, "uuid": "dd4eaa0b-a22f-4b7d-a980-8249e430ff56", "comment": "Malware payload", "value": "3ad588f8a9c2743a4aa1a2fd3a9f3a5870a275af8c02dccf14ee90f841d4506c6e07c954ac69deff3a816b9a174274bd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217873, "uuid": "cd2b9088-bedf-4c76-a100-47b8456e8dec", "value": "T1F986F119BEFB9964E20F84B910617083E41B4F79B908F0AF567454B42DADCA4470BEFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217873, "uuid": "76366bcb-2c48-4945-a19c-2edf496853ad", "value": "98304:xmsezfi5NSVnZlbMNjeZtsX5pgFe/CbtLa+4mXsR+Xyc43eV+0rO74EK8PhQarZK:UsYQybMNjeZts0FxJ9Ub3esP4EK8nrZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217873, "uuid": "5bfdf6b5-3bbf-4d55-aeac-9e59c02cd407", "value": 8575126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217873, "uuid": "2a63fbd8-ed93-4979-939c-ab37cf255eba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217873, "uuid": "d739e97d-252d-4432-9068-be680125ae0d", "value": "game.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243260b5-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214129, "uuid": "3229dfff-8e4f-4819-a122-450a463a091c", "comment": "Malware payload (Mirai)", "value": "34d53d26978e5ff4d45143eef3382a9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214129, "uuid": "da8e3599-320a-4749-b6ec-c32988d0bba5", "comment": "Malware payload (Mirai)", "value": "6d29bb8dd75e1b0d47e54b04802aa958a4f78be0eee3c28e655e585a0788f7c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214129, "uuid": "32c5c034-9b5f-4ca3-be81-2437a05e80f3", "comment": "Malware payload (Mirai)", "value": "3ddb90ed16ef3a46dbc649a06726db0f5b8a1984", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214129, "uuid": "febeacfd-743e-468a-82d3-9052e94b9e65", "comment": "Malware payload (Mirai)", "value": "33f0babae492066a9dc950493969ce4741a96ed6c877bb967d6e3dc266b8652f66be2f0c85a0f81b49b0b81d88ae422b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214129, "uuid": "b3cfede0-bee4-44a8-b367-98a3ae0423a1", "value": "T128230781BD41C906C5D46273BB0E56CC371A03A8E2EA3307AE2A5F607B8ED6F0E37555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214129, "uuid": "68829f2c-f0da-4c69-8ae0-16a140c28cbf", "value": "768:+OQ1+0kshXUwycrFPMgSnT3VZrlhlWlDwBcHi7N38SdPdiI/hdNnouVNASZ7jJY6:+1BVhXUwyy9ATlZX0XqN38S1diI5dNn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214129, "uuid": "fb5cdbc7-87f7-4bb4-a7d6-7b62de892a65", "value": 47120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214129, "uuid": "0508f07e-1863-465b-9fdc-9c09a8d0f80a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214129, "uuid": "c8a08767-756e-4f63-b7f0-29bff89ac197", "value": "34d53d26978e5ff4d45143eef3382a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b01a9ba-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217979, "uuid": "23350f48-4674-434b-a331-e1525c5dbfc5", "comment": "Malware payload", "value": "c0da8de0b264a296fd58f006fd09189e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217979, "uuid": "b36a22ef-85a1-4726-9def-e76d0b17048e", "comment": "Malware payload", "value": "6d7f7a044f39276e8692b04704d077ca7939b542ece9665987b8492ba683a772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217979, "uuid": "72ce2812-fefb-4b57-9c2b-f64079f20f25", "comment": "Malware payload", "value": "ddc0240999d5eeb9a07e793e87f4b266fff1a80a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217979, "uuid": "eb928894-6fa3-443a-a5ec-fe5d5a6d1530", "comment": "Malware payload", "value": "e4f5e534abd2d4c6ed268d1c48117372c6286bcbda1a630b32c69f006c6d00c12edc2da2cede1c5d9448e7303bf73c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217979, "uuid": "b3290fb1-f22c-45c2-8c65-8b83be2f036a", "value": "T1D3F3288AA2564CA2FCA275BC70565003E3B77998013CC27B47E1CB1E5BBF7627997381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217979, "uuid": "b022acb9-a544-415b-af7e-626d6d345bd9", "value": "61d17acee0f8170d6733555fc8f9cf93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217979, "uuid": "e63f8241-5e10-442c-97bc-310c7a515139", "value": "3072:KoJHehqkq7/e4LkOM2p27+Pn8pInVmUVgVXQ5:Tkqq41zpHyYmRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217979, "uuid": "e4a86b93-d379-48fd-b5de-971f71b949b2", "value": 161360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217979, "uuid": "ab7af854-721b-49e0-99c8-933dcd70e543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217979, "uuid": "6809f544-80eb-48c2-a440-edd909e777c4", "value": "java.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5a4d7b-c68e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679255241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255241, "uuid": "5eb86b9c-aeac-4209-bfdc-3af89410db97", "comment": "Malware payload", "value": "b9f26ca857e3ded6ad5f628a1fd18e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255241, "uuid": "d9d2591c-2c46-431b-8e27-33d321447308", "comment": "Malware payload", "value": "6ee047cd2309e4f3432c8d401928dee739060fa80830331d3c50830fe2653d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255241, "uuid": "54f32c28-c975-4502-a2c7-77d34f20ae36", "comment": "Malware payload", "value": "0da9313fff5183c4dc4e322348fa3bdab4ae5dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255241, "uuid": "a4eed2f0-f690-4dd4-bc9d-9a6447672696", "comment": "Malware payload", "value": "06795c9d48823ba028d9ce40f4aa479e36e5f2e5598d345e8a28d74a7ead61cc848121892e96a40bc215c2b7e5022838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255241, "uuid": "2ec5825f-1bf9-433c-85aa-52d05b247aaa", "value": "T1CA658B0491D030BECEC4DAF746F6AF4B757630731B419A1FD08EF299892AAF4AC47964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255241, "uuid": "5be9a171-45f9-4041-8403-6fed4673a70a", "value": "24576:Q0aEYGGuskUeZjhxp8E8dmBHMQSWr7ozlXaJVJog3B:Q0vYGL/PdGnWYzlXaDSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679255241, "uuid": "34e5a8fa-8b6a-45f1-abe7-a617363728cd", "value": 1428068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679255241, "uuid": "a664a6c5-850a-4a94-b242-2bdfeb421491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255241, "uuid": "3530fe6f-4835-4029-b6a8-864b56898e86", "value": "b9f26ca857e3ded6ad5f628a1fd18e9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8d6754-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214119, "uuid": "9e0148fd-4884-41e7-94dc-7191f5c75eb0", "comment": "Malware payload (Mirai)", "value": "6ccaa759cd5bd89480f0beab89ed307c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214119, "uuid": "908fb09a-ea77-4497-bf18-65e7b5b8bbfc", "comment": "Malware payload (Mirai)", "value": "6f1a96b3d2dcaff3488ba8c738395bb2014669a672d079201fe8a0d3dc6586b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214119, "uuid": "ada29b7c-7e34-4012-8116-6e4e3e248e42", "comment": "Malware payload (Mirai)", "value": "f5a0dc177fbfb82bcbcb126f321122ff8fbe9511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214119, "uuid": "8d9aa6ce-de1e-41e8-a397-80ecb9e0a930", "comment": "Malware payload (Mirai)", "value": "ceef06fe7affdd01a3cadcff704a160699126de02ac99917371488a1e7a65f473e641a84b780d17acd7898589f253253", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214119, "uuid": "980a9273-4a16-4e4b-b889-930c7d5f6f48", "value": "T16CB30805FC004B23C6D26BBBF79E42DD773666596BD73301A6296EF02BC17982E39250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214119, "uuid": "c5a02f09-0207-4140-bbd9-0df547df4363", "value": "3072:ahDQ1qlYQInoRy6kE57Sqa6ZJN5h1mb77BEX7HoDQHDVpZAlvm:Qt7Sv6PN5h1mbW7HoDQHDVpZAlvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214119, "uuid": "c7e917f7-e585-45bb-887c-e3d078952fde", "value": 109187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214119, "uuid": "4260403a-8aa0-46e1-a9cd-7e770a12a3bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214119, "uuid": "fb072a64-79bf-422a-a476-c0f04a096d95", "value": "6ccaa759cd5bd89480f0beab89ed307c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cdb928-c64e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679227399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227399, "uuid": "a1acec4c-4e67-4579-b6be-f1b9ea6f12ea", "comment": "Malware payload (Mirai)", "value": "04cdca38c24036d68b9f20336c49fe74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227399, "uuid": "dd4e1b87-f844-40e7-ab78-3950324def55", "comment": "Malware payload (Mirai)", "value": "6fa9bacad58cc2e3a76d51087ad461543923f7f91e6c30742cd7dc6f6960d041", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227399, "uuid": "7a677d1b-cc8b-4fb9-a310-f63c673f628a", "comment": "Malware payload (Mirai)", "value": "b6e7e419b3cf4669adf9059eeeba4ac5c9457552", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227399, "uuid": "9871077b-8ac9-48d3-923e-ba567c8edf8a", "comment": "Malware payload (Mirai)", "value": "fcc9e863e397d93d53020b31cb82c6e68c3acca1f793fa04e5fff3241e97992cec41fb4c66f5ff27ed191fcd37f3d597", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227399, "uuid": "2065c57b-5b58-4959-9733-3c995d128b9b", "value": "T1ED534B32FA762A27C0E5A47A21F78B15B5E117DE21A4C65E3DB30E4BFF606406502EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227399, "uuid": "7c9c75a5-2e74-42d1-8f7b-1cc67dc52134", "value": "1536:wwkfZJxFtojQlvnrj/Byzn7dke4tuItYZ6w8+BwQkz0XYIfiV0u:BkfZJxFtojQlvnrj/a4LYZ7LYN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679227399, "uuid": "0e04608e-0979-4daf-b311-f732c1e0f666", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679227399, "uuid": "1cb96eb8-4604-4139-a2b5-b38832edf599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227399, "uuid": "1c16609e-b381-444a-bbbe-4cff87de0217", "value": "04cdca38c24036d68b9f20336c49fe74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1405203-c672-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679243115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243115, "uuid": "9b3fe7b9-6f6a-4e33-9ba8-5482ea8be58b", "comment": "Malware payload (DCRat)", "value": "2462e26144fa12fd2ca9dce4d2c13420", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243115, "uuid": "189f0d64-da61-4e0d-b1ef-1786ad3c09b4", "comment": "Malware payload (DCRat)", "value": "6fe3e7b8886862e6c2e9ea8684396da80e57ca2c1f85026e7edc0ae6cef80c35", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243115, "uuid": "a774eb40-cd57-4184-ad1f-304c0c15da7e", "comment": "Malware payload (DCRat)", "value": "39151c10b343122006aaa172f1f1554a38137528", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243115, "uuid": "6d1ce4c4-3bcf-4a23-ba31-2d9a2dd1bffd", "comment": "Malware payload (DCRat)", "value": "303f96ca1bfa6f0a2ac107b1dd86411cd9a908d4974fa659113c8a86db96ccd3c52e2154bc87f850f734ee6d7938b458", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243115, "uuid": "50e11f25-e34f-4a1d-a33d-be544d8a2307", "value": "T1FE2517017E44CA12F01C1233C2EF454847B0A9516AE6E36B7DBA376E59163A73E2D9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243115, "uuid": "83a30cb6-3367-4c0d-a43a-687ce3299edf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243115, "uuid": "71824ce9-5511-443d-820d-a8c2cd1cfce8", "value": "24576:IxBKgJkikTpvNX6Uc3GawHa/Z2twSbIAflddj6T:IiXLv8UAw6/oPEudj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679243115, "uuid": "601c3039-ced6-472c-bd74-167f396ee73a", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679243115, "uuid": "b827513d-e436-4947-ae3f-1653daff710b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243115, "uuid": "5e1f1bb3-8b93-44d6-8e9c-0723575c4d3f", "value": "2462e26144fa12fd2ca9dce4d2c13420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0159c61-c60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679200163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200163, "uuid": "c2189e34-8b5a-44f5-a5cd-dd13c50f3abf", "comment": "Malware payload (Mirai)", "value": "e6c90856ee5533471bb6bd5b2d28da4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200163, "uuid": "74ba4fd4-d6f6-42ee-9b78-479e74fd582b", "comment": "Malware payload (Mirai)", "value": "700eb0d884c38d590043c81155405a6bad74dc00cce2b6324e847d2e6fd2a904", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200163, "uuid": "bd41329f-6078-4000-a533-a6c548525bed", "comment": "Malware payload (Mirai)", "value": "ed4b511e1720d48c7b8a57485e6daa4df125726c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200163, "uuid": "3a88dade-0ef0-4b9f-9524-bc6efc72b74b", "comment": "Malware payload (Mirai)", "value": "ee8de7c9cb975364142d73340e398f4ac3feb8f2c54d59a7705d08ef72413e518213c35fd95a04b78f120b978b2e9d88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200163, "uuid": "29b4390f-ff69-4d0c-921a-46376d1fa5df", "value": "T1A063961A3E219FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200163, "uuid": "58c9d219-051a-4ac9-a0b1-81bb91352aa3", "value": "1536:AHNFnXDuPq/SyZBp9tFI0v6bqfg/Kkz73o2x8SW:gNFXDKGrnI0SWYz73o2OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679200163, "uuid": "f1eb3763-8270-4bed-9cf7-3dae69dfb6ab", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679200163, "uuid": "44ab757a-e61e-455d-8436-e4021d0a27bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200163, "uuid": "bd7b76f4-ac69-4def-8dae-15aeb0b8331c", "value": "e6c90856ee5533471bb6bd5b2d28da4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7499f5e-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1679241434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241434, "uuid": "410469ba-d309-42fd-8742-61968eb1cf16", "comment": "Malware payload (DanaBot)", "value": "3beb6d11a20600d7bff257f040dbef43", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241434, "uuid": "b00002fd-e44a-4229-bfd6-0aa20f4134e7", "comment": "Malware payload (DanaBot)", "value": "7068bfa614a42e4aebe522e4b7f28c77ee75e139e5ae37fbf48b90a754cf9cc7", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241434, "uuid": "398c6f7b-049c-4202-8d8b-fdbc0b5a450b", "comment": "Malware payload (DanaBot)", "value": "f711f0d949086e0f26102d00eddf8c7efb572be6", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241434, "uuid": "112fa0d5-1939-4fdc-a49a-b5fe205616c2", "comment": "Malware payload (DanaBot)", "value": "e379e4203fab76fb47d599eaad23da4a31ea02530fb0f8532e6a20cbbfa2fcf55c437847f6e3f793d86baed86dc4bb12", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241434, "uuid": "fca92e56-4da8-4323-96ec-0d440f9f1410", "value": "T1E4D5121397E17D88E5258B739E1FC2ECB74DF271EE597B6832188A1B05B01B2D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241434, "uuid": "e33b4807-ca25-4503-8cad-a6daf4701319", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241434, "uuid": "569bcd28-8279-4afa-9de3-033f131822ca", "value": "49152:reB+TnU4J1/KRZJad7WaH143FjtUo232v69/r9Bmq2hj:rAQnU4XCRZJad6a23FjKZmyhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241434, "uuid": "6d3a4850-28bc-46e5-bcc9-b3a8197060ec", "value": 2783232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241434, "uuid": "be9a6867-e5ff-4895-81da-b5923d453c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241434, "uuid": "75c17ac9-ab1b-4bb1-936f-bff5edcfddb3", "value": "3beb6d11a20600d7bff257f040dbef43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1549ec29-c66f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241591, "uuid": "5f0adc7a-f16b-451f-8ece-db3dee25d639", "comment": "Malware payload", "value": "d3eb8ce3b0edc1462c57986cb1756921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241591, "uuid": "f6ec5667-ee2d-4775-ba93-c7935cab8a0d", "comment": "Malware payload", "value": "712c87a3fe55b170358252e7e5db424a5c683e66130bec2a86af16006b58cafe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241591, "uuid": "316eeaf6-8ae1-484c-8fcc-4e1ce883adce", "comment": "Malware payload", "value": "65dc1d0466109f9c81f74f60378d77f38c16cb78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241591, "uuid": "1df2bd3c-c396-484b-a292-8888d905b52b", "comment": "Malware payload", "value": "7742ad6ba9ee2377d351d2b62df2c551899458acb4f039385927bd1b3ad5058fc2daa6a663c0f93bc2596111176f7324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241591, "uuid": "c2bd4d19-47f2-499e-9f74-8bad3bac504d", "value": "T1FE34223A20DF41D7DD04A2BAFE85C66471B5B033EF9E6F31F765B972124126A8E0B460", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241591, "uuid": "27490341-5548-4d0e-bc19-8e05c268f647", "value": "7fbb89c5ace3a586a0c16f198ccfd95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241591, "uuid": "90dbe808-be06-4512-94bf-3166809fd09f", "value": "3072:0eSJSvFVJZxiGarNck+gLp082uSTl8vNLjPo6j6jZQwrcy5531Jr4CP3gnkIP:0UFfZxZarNckZVqPuPjjwZRFXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241591, "uuid": "4ec0c68a-9200-4915-8e16-aed98ca40441", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241591, "uuid": "91fdd2f9-466a-443a-a46b-8191ddf1773a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241591, "uuid": "a8b6eec0-1bc4-46e3-8beb-cdfee99ca19c", "value": "d3eb8ce3b0edc1462c57986cb1756921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140ea535-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679214102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214102, "uuid": "13b113a5-3063-4d15-a1f7-bd2bc78740da", "comment": "Malware payload (RedLineStealer)", "value": "1f661307a0654310cec833d4dda7b0bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214102, "uuid": "b9d7b41e-daca-4631-bc1b-649f647eb23f", "comment": "Malware payload (RedLineStealer)", "value": "713f372204058a02f75119d87df085c1a3b60932686486b71201f8385c03422e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214102, "uuid": "60dc368b-72f7-41ac-bc68-84f3da601c39", "comment": "Malware payload (RedLineStealer)", "value": "8081a0df255a880896ea2f7e745a3bcd09315d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214102, "uuid": "c262d7bf-dbc6-45de-a747-093fc78aa804", "comment": "Malware payload (RedLineStealer)", "value": "81139504c9c0a6f1f167e91759c0b20000bb6d0b937e39bb7589434b10315213e4f9a164fb3ebd3a0a4ed7f7c44980fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214102, "uuid": "f06e1751-cc10-42be-a44b-d66f751303f3", "value": "T1AC45F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214102, "uuid": "a401ae27-e6ec-4dd3-a6b8-8d6092a7c5f2", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214102, "uuid": "93a0a721-b3b0-4561-8d27-f672663e6a0f", "value": "12288:kxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:qbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214102, "uuid": "fa7ba67b-8b04-4cd4-bc1d-b8c76e958af4", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214102, "uuid": "1fa4b5db-fef5-4586-a4d6-cd0c4462f894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214102, "uuid": "e2b791cc-6e75-48ef-9ee1-4019c4d57fc8", "value": "1f661307a0654310cec833d4dda7b0bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8938eff5-c61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205708, "uuid": "2085309d-a6db-413c-87d7-5aea4d69d9fc", "comment": "Malware payload (Mirai)", "value": "7acbeb44b71b48e5e5216131b59b5a4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205708, "uuid": "31c2efe5-ae28-4750-a9c7-d7c36ea08fb4", "comment": "Malware payload (Mirai)", "value": "7297bade4d01030a3fab500bed2a0d0783e3ee0a83813e8f4d2e55b234e0071f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205708, "uuid": "ff85579d-6e0d-4daf-985d-c589a75d088a", "comment": "Malware payload (Mirai)", "value": "4c6878370abb9311640a5fef9b35fc316c221852", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205708, "uuid": "8bc831b8-ca55-448c-950d-9398e2b8c85d", "comment": "Malware payload (Mirai)", "value": "5237061cc8eb4caee4a68baa285697142baa542bb9ce662b376e987ebd016f1ca9527a63e2c0dfa33021d8e260d8a853", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205708, "uuid": "ccb0e029-e6a9-4556-8060-b584d622cd0b", "value": "T137E2F157C3729422DD786BB2F96D85CB2BBD4BBCC57B30A31A0556182E670435B7C443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205708, "uuid": "4f706d39-bac6-4229-9a1e-e55b332821ba", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9Xyc9q3UEL5Iy:1orm1vpALgUJylLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205708, "uuid": "98935b9f-ed53-431a-8b73-2dc23d3baa29", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205708, "uuid": "c13ddff8-f404-4002-8209-a53385d5e8c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205708, "uuid": "3ddaffaf-ea27-4e6e-87b6-f11bb58e33ab", "value": "7acbeb44b71b48e5e5216131b59b5a4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dad8c11-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224909, "uuid": "6d813e52-0622-46a4-977f-73f295dff0ab", "comment": "Malware payload (RedLineStealer)", "value": "3135d7ceb954fc4ad21b07a65779cbf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224909, "uuid": "ee60875f-43e2-46ae-8d27-d73c0c834bbe", "comment": "Malware payload (RedLineStealer)", "value": "72e3b77278add41f8f57543e2b22239016eaa7e2d3261d2eff70f59586d2abbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224909, "uuid": "ec6222bb-bf9b-4286-8f8d-4bbf241f6d8d", "comment": "Malware payload (RedLineStealer)", "value": "9b136a7cb4c411a7e64af4f75bf54ad4e4d38829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224909, "uuid": "019a26c7-c02a-44be-9955-cd0ca17d2f80", "comment": "Malware payload (RedLineStealer)", "value": "8fe4c9c87d59a8fa5c1afe58d87f095a02979bba600065aced87866e3ba856f4312faefad7263251ee552300e45a0f7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224909, "uuid": "da09ddb9-2dc1-460b-b388-fb397a1e4b00", "value": "T10645F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224909, "uuid": "ed15690b-0ea6-45b3-be6b-ec887820bcf0", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224909, "uuid": "4a469766-9072-48b3-992d-578ee9447a41", "value": "24576:e9h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:e/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224909, "uuid": "256407bf-92f9-4e65-b8a8-775e25e3d418", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224909, "uuid": "d6a7fe27-3f62-4c13-a16f-7ffd3e96334f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224909, "uuid": "a7991e8c-c7cd-4aeb-979b-0817be25ef29", "value": "3135d7ceb954fc4ad21b07a65779cbf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b55940-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214160, "uuid": "b2b5266d-4925-4036-8aa2-e57e13e539df", "comment": "Malware payload (Mirai)", "value": "d3276cd1129708e068558a36729e3c9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214160, "uuid": "aa3dbbb1-704a-4828-883c-6fe141ee5b13", "comment": "Malware payload (Mirai)", "value": "7414148e6b31d307ba05ffec5d97493771469329b604c93ff127c5af9b399d4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214160, "uuid": "08dd2e6a-977c-4db0-8224-b1cac651d013", "comment": "Malware payload (Mirai)", "value": "4c7f34e2bf36e77ff590fcbe81882aef6cb3f4c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214160, "uuid": "64997d56-e876-4d65-8478-acb4f6c45fc0", "comment": "Malware payload (Mirai)", "value": "df45205d58a5695d750b912c5423ef6bb2da423eaf5b241d38cfaf89b9b26196275054c354adc4fea23ac6734864f250", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214160, "uuid": "9bbc1138-2aed-4ff7-a282-f8f892f75a74", "value": "T162D31805D9508B23C6D22B7AF7AF528E77232BA897CB331156287EB42FC179D1E39510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214160, "uuid": "0aada71e-c414-4cc0-93e6-91cf41d5e2ee", "value": "3072:1gfuySdhp0eQTrDUE8GDoeFafhxsWC0LlYKVh45hx7q5VFSLMmy/QsYJ0Yj/:wUE8GDDFafhxs4Va5hx7qPmy/QsYJ0Yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214160, "uuid": "0835186d-8388-41a6-b4a4-b214e3200f3b", "value": 130431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214160, "uuid": "b6268ffa-100c-486d-846e-8953b303ddc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214160, "uuid": "9224751f-52bf-4424-9fb9-83d08b6307bb", "value": "d3276cd1129708e068558a36729e3c9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab96580c-c657-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231536, "uuid": "5c9c7742-1b2d-4ee9-9b76-74f458014ca5", "comment": "Malware payload (Rhadamanthys)", "value": "96a1826acb653006f7528f77dc88a8f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231536, "uuid": "11743cfc-847a-43ce-83b4-0befd1a56cfe", "comment": "Malware payload (Rhadamanthys)", "value": "74bb06f6276fec8207c129228abb064fc1dc1b3d499f258c5630d3069b032d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231536, "uuid": "4835cbe7-d428-4678-8488-fa2a6e6cee65", "comment": "Malware payload (Rhadamanthys)", "value": "f2d8b92a9a2c9cb043606a24697c28b01136ae2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231536, "uuid": "ace17c8c-9394-41f2-962c-1b7230618160", "comment": "Malware payload (Rhadamanthys)", "value": "e542bee348570dd68ddbf9aeade8664775cae75cfe2b4c50acbd54e68cb9ad1546611664bd9aa304b5e0d96dcf7b4f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231536, "uuid": "4f643a02-792b-44b2-983b-7557b132af8b", "value": "T10B744B0383E17D5AE92A8B739F1EC2E8B71DF670DE497B6532189A1F04B0172D163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231536, "uuid": "d578a77a-2149-4d6d-874c-36ac9f37544a", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231536, "uuid": "c02ff601-b081-4599-910a-a295ababce28", "value": "3072:z+KyujiLWtrDAHE+ahbS6H9MnVXplXYRCl6IPp/f0TUWe7865vo0aUVX5sYctaJK:zAu2LWtrkHE+gSq9w12Zup/JJVaYnyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231536, "uuid": "94c36a9a-3c2a-4356-ba66-1ca59bb56f9e", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231536, "uuid": "a37931f3-05e7-48d9-993b-e3bcf6b47187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231536, "uuid": "d79797be-1e1c-48e7-933a-5f3881765022", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5dee77-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211379, "uuid": "ff2d9fa7-5e51-4019-a2eb-ce84268ccb30", "comment": "Malware payload (RedLineStealer)", "value": "26519979287331d917a21d284502d100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211379, "uuid": "ffc2544f-e913-4ba2-bd65-efbfc42afae0", "comment": "Malware payload (RedLineStealer)", "value": "74f864f9703e66e0b2bbcc67e6ce41af1f8a9b663040c83c6150f71243d46e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211379, "uuid": "becc555a-eab3-4f5a-9124-523027476164", "comment": "Malware payload (RedLineStealer)", "value": "be94c7e334447eda947a5b7d3aaea0c1df608be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211379, "uuid": "5ce14fe2-2883-4410-a52e-62ae2e937631", "comment": "Malware payload (RedLineStealer)", "value": "fc6055f567b672a9073010623d8b327b90d68c4cb5e1de405147d142b5fec27f29f2c9b15139bc2999af6325633880dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211379, "uuid": "decd5092-630e-4a5b-bd66-2397d494ddcf", "value": "T1B345F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211379, "uuid": "15334d34-e935-44f2-a018-a331e36764c6", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211379, "uuid": "4431e76e-bacd-4dd1-a7a3-12c17a4ca127", "value": "24576:8LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:mko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211379, "uuid": "2e8e2de2-7c12-4f6b-8e98-1be3c60f5956", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211379, "uuid": "0bcc33d4-fa45-474e-bc18-55e817d66364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211379, "uuid": "d9dd7bd3-cd6a-4d5b-89c2-3f7e3b253417", "value": "26519979287331d917a21d284502d100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8b7a85-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212910, "uuid": "21e1671b-c66d-4076-8785-944f7a75f490", "comment": "Malware payload (RedLineStealer)", "value": "f7aebdb2411fc0070d8a73923d05f3ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212910, "uuid": "fb8a978f-81bf-47b2-89ae-cd2cb5548825", "comment": "Malware payload (RedLineStealer)", "value": "75104b4568580aae1459638e12c6eaf7c2b0c59848768354ee3f803c716a1eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212910, "uuid": "7df0c28a-e44c-4224-9703-22155e74f21a", "comment": "Malware payload (RedLineStealer)", "value": "a7024d3f1d322fa8c6cf06cde601110a71a1747c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212910, "uuid": "e60f2ebc-13fe-4a09-8c44-e5d467449775", "comment": "Malware payload (RedLineStealer)", "value": "d8d8e05bfd478b509e184ae538d2afcaf2b13989ee0509cab05d43ec4c05d3cf669292f0e83af2de29c8ce5d1c9e9faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212910, "uuid": "1f8bfc5b-6770-4820-a876-f3fdcd0adc72", "value": "T12A45F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212910, "uuid": "e426e829-6e9d-451f-ae8d-35c46322a0f9", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212910, "uuid": "0d9bc143-888e-49f0-b977-e7b2ab992455", "value": "24576:0LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:eko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212910, "uuid": "d2010758-c6bf-4087-97f2-ce8b1b726194", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212910, "uuid": "ca5f0de0-a1fd-4035-a9ff-bcdc9643fa02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212910, "uuid": "3dc22086-aa18-469f-a65b-d3bda41c17d8", "value": "f7aebdb2411fc0070d8a73923d05f3ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac171d7-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224931, "uuid": "641b0c43-6d49-49f7-83ee-2cbebf171232", "comment": "Malware payload (RedLineStealer)", "value": "8f0526aa8ac6d0e5fb4d562edd3080df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224931, "uuid": "1388ae04-5a26-4a07-b88b-6f9ca9c77a03", "comment": "Malware payload (RedLineStealer)", "value": "7535facf775c8360420f0765f3b985b676fdd67e8eef847494409bfaa3c3ba09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224931, "uuid": "c44abe20-75b1-4d6a-bde1-351f97c368d3", "comment": "Malware payload (RedLineStealer)", "value": "ddba89c5b4a0344c6ee516eaf86f0f18abecf2c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224931, "uuid": "fc35734f-c980-4e51-8e38-1e7eee8bfb4a", "comment": "Malware payload (RedLineStealer)", "value": "9be084a0324361ef3ef98583f80aa830bedf053e404467f2084a73c2a0c2d0f75a098c9159e040ec750f3e1d25d1e59f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224931, "uuid": "b15ec9d4-6b86-4ebc-9ea0-d65ca93e69c2", "value": "T16F45F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224931, "uuid": "49a0104d-5337-4e0b-9994-d6cfadee9dad", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224931, "uuid": "61f3f5ee-eeb2-40f9-b968-37abf6b91735", "value": "24576:x9h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:x/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224931, "uuid": "a3bdc16b-de5a-402c-8227-84b0df8747d6", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224931, "uuid": "e08b8d81-f4d2-417b-acf0-19fb72888346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224931, "uuid": "faa5fe75-5aab-4b31-9723-682c45134cbd", "value": "8f0526aa8ac6d0e5fb4d562edd3080df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2f6c31-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217956, "uuid": "a8b09c60-3849-44d2-9971-02076e7a031f", "comment": "Malware payload", "value": "1dc74c81ab9a8030f529b256911a9c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217956, "uuid": "5e5b3baa-9dc1-4297-8084-bc8fdf6dfb5e", "comment": "Malware payload", "value": "7549366fec62485f6f6c8bdc98a1095b8aaf768d0b75d8225bde344d8c24b231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217956, "uuid": "51833767-b1ee-4b0e-b04d-3aee491d6ebb", "comment": "Malware payload", "value": "ca169a8b64be1c8d75d2003d859eb92c1ce288b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217956, "uuid": "84c8ec26-ae3f-4f93-a392-d0772eb1cb44", "comment": "Malware payload", "value": "97fe6c314c96a97fdd4702a15c7429fd646930067ef3361497e751629d95683d9370f678f048620924ba4f135ed6d043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217956, "uuid": "377aa9c8-d9d3-4fd8-8218-97d311d18ea5", "value": "T1C02739AA5ABC80A8D176C13C8EC68297E6F238211B7057CF3266561E2F73DE5057DE31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217956, "uuid": "78897f24-7272-43f9-9eb3-6b42c23f79d6", "value": "f00bdc24abc5fd9887445a6106ce22b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217956, "uuid": "3016e9a4-99fb-47ee-b7ce-c1cdd6b1d16e", "value": "393216:U+wwp+sy8PRXwoA41qtePIJ7TsBCTDUzOLhh1M11wZJkq0Tl7:UTWay7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217956, "uuid": "d77cfd14-897f-44eb-b947-226e13107bce", "value": 20756048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217956, "uuid": "8b072992-95b1-4f11-8126-73ac9bcb301a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217956, "uuid": "b512534d-ea60-4207-9257-0bc2fb9b6167", "value": "jfxwebkit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb24e29-c612-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679202015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679202015, "uuid": "35d4ad88-b059-41af-a013-bcff882b7847", "comment": "Malware payload (Mirai)", "value": "f17680b158ffc45267524332ec05f9bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679202015, "uuid": "10dba5b4-268e-40e2-9e16-f532161a6fa5", "comment": "Malware payload (Mirai)", "value": "762b73bd42d73c47163f3057faa4670e3c1f150198689c155055bbf2a514de1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679202015, "uuid": "585f92f3-a52b-4a90-999a-ab29d6181c24", "comment": "Malware payload (Mirai)", "value": "2175d44fd230f45db3823567fbc845d7c0e63147", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679202015, "uuid": "2cb5410f-bc2c-4deb-93a7-0d05653b33b6", "comment": "Malware payload (Mirai)", "value": "53d43186d21c018cd66bef65985edd3afc479abbf8f3c8617942e3d49d62e2d73a7bd503b1325892cbb4e98c707b263d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679202015, "uuid": "d06b0ebe-6610-4376-999d-15d71dc8bc63", "value": "T1D1C2E170A2AD1CB1CA500636E7BC56C5BB430F7DFAFE3890114047BA394195639DE9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679202015, "uuid": "dd6e4e2f-9072-46cc-8316-e629bc5567eb", "value": "384:ESt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE+KJ21hymdGUop5h0:ESsoTAZ3alkXLvFh8nNEX21s3UozO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679202015, "uuid": "207676e9-cc87-44e5-95fe-ff63e9d4ba3b", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679202015, "uuid": "25057a3c-ab6f-4593-9541-e80ba23553dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679202015, "uuid": "7c3e9658-8189-43c6-89a2-a99fd3ca4e5b", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec53d28-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212912, "uuid": "b87a1740-61bd-4cb8-ada3-1885e4c15cdd", "comment": "Malware payload (RedLineStealer)", "value": "fcbace11bb0e009bb5394c714d6c35ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212912, "uuid": "51464241-65c3-49a0-b1ba-d7689b271452", "comment": "Malware payload (RedLineStealer)", "value": "766693c14a4e7c264d423c218528420b2cea8581cf90706bddc4563122564490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212912, "uuid": "3af9e454-e092-47f1-9277-21e9100a0f08", "comment": "Malware payload (RedLineStealer)", "value": "a8077f14d3cf29687bec13428964eb26569ef38f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212912, "uuid": "2b2b12cd-ce81-405e-a007-d7021228a36e", "comment": "Malware payload (RedLineStealer)", "value": "bb5bd843d45cf9821f7c2f08fb1c60af9db03dc62b8411252df43ba56a485ac9ff8ae332be172f56df52d290a359bed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212912, "uuid": "4f37f37e-e0c0-4bff-9351-77e7a7d911ea", "value": "T120352307A7E95023D9A013B019FA03C30B767D1286395297279FBC5E2973A74B93637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212912, "uuid": "04a5be80-f7fb-4224-8f15-d4e9759def9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212912, "uuid": "21d839f7-a344-4b77-83a7-1dba443f3430", "value": "24576:yyXVdttrR41yoQWIQZ1nzvSNZmcz3dKTh6vueJy:ZX7thReRZZ7S3VQC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212912, "uuid": "c14ffb2a-0bf8-4e33-aece-814b4f0f4692", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212912, "uuid": "b9ac06b1-e824-4cfe-a9bf-d236d5b45f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212912, "uuid": "6512f4b3-bd09-494b-a0b2-d0a41382215c", "value": "fcbace11bb0e009bb5394c714d6c35ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a302603-c651-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679228715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228715, "uuid": "5674f885-5c85-472f-90f2-bd19e9596a36", "comment": "Malware payload (Stop)", "value": "69bb15beaafd45e58f18a4729c7b6188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228715, "uuid": "1905da02-c047-4c0e-b601-e07c3efee71e", "comment": "Malware payload (Stop)", "value": "7674b4a32413dc10eeb3419038d0282b60e2ad0b8a0b450ae0e02a95c606873e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228715, "uuid": "90126828-c9ef-4ed9-8ada-acf44459863d", "comment": "Malware payload (Stop)", "value": "db38fc83bda2cd035c1a2a64d7ccfe6048cb10c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228715, "uuid": "9e2f1084-3ce2-4243-aa0d-1c077113f321", "comment": "Malware payload (Stop)", "value": "b91f5386797f9d947e0ed54277e87e9ba15f75a302cc722a939ac9b4d20b04f404c933f191097245b48659bdb60ea5f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228715, "uuid": "f80d3c0a-127d-4afe-a9f7-7819e5520972", "value": "T19405DF43F2E17D44E556CB329E2EC2E8760DF6509E49BF6D221CAA7B00F11B2C163796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228715, "uuid": "00ec7f04-c20e-458f-994f-7a0385e505f2", "value": "41f83c8707be0871bf2bea8f993f5e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228715, "uuid": "4f76508c-67c5-429b-91af-8d76d78b22dc", "value": "24576:UfGOISehkk++KJTuUAhYS8235KT7kkmhS:UfwSfdSoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679228715, "uuid": "1b7500c2-6cee-4bb6-8b12-3aeeb2f0bdb1", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679228715, "uuid": "074968c9-2d19-414e-b474-ec1df48a7b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228715, "uuid": "f9bc4e95-5ec0-4a98-8d9c-6b8048ae61aa", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39419d5-c637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217832, "uuid": "2e92ea93-86e7-4098-b5cd-b3434748e684", "comment": "Malware payload", "value": "384a539e89858fb8d88efa90a7d880e8", "object_relation": "md5", "Tag": [ { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217832, "uuid": "d3b8c807-46c4-4f59-a080-b650eb188810", "comment": "Malware payload", "value": "773e6e9035f2c02a760e7cc61d6473f7bedf62c6848bb6b719a065db9c1f7760", "object_relation": "sha256", "Tag": [ { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217832, "uuid": "f3e417ff-a707-472f-b27a-396379ab5827", "comment": "Malware payload", "value": "311c2fd361d0c7dc4bfef958a827dbc7e0de3f90", "object_relation": "sha1", "Tag": [ { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217832, "uuid": "28297ee7-2a12-43f6-a36a-8d5a155d928c", "comment": "Malware payload", "value": "90a07562fca170193c9fc67332a034588724f1faa721008294dd13b9949938f02ec027c5bc0b9eb55f928cf2c34c34bb", "object_relation": "sha3-384", "Tag": [ { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217832, "uuid": "93a10449-ebe9-46c3-ac61-95d8a786710f", "value": "T1E1229F304423BED8BFBBC5ACEC1206F5DD64F6B1AC44E418722A95FB186905549D2C6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217832, "uuid": "76caf053-1ad6-47bb-b839-4969f4618e0b", "value": "192:ZSYNJHKY8zRbwQga86L4sSYNJHKY8zRbwQga86L4E:ZSWZUlw96L4sSWZUlw96L4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217832, "uuid": "6d9365a1-8763-412a-ac7b-8525c96c1472", "value": 10113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217832, "uuid": "f5635687-e632-4ecc-b6b0-f1f9431f82b9", "value": "image/x-pcx", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217832, "uuid": "46ee20d9-7242-44d8-8b5c-ad78e1f263d4", "value": "servers.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b335a8fe-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211362, "uuid": "ed66c8c7-1987-4e1a-b22e-722547a30525", "comment": "Malware payload (RedLineStealer)", "value": "1e0c9a83ec9d41536483f6fc4d34f5b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211362, "uuid": "610b7e43-3bdb-4092-8645-78f3eb8019ff", "comment": "Malware payload (RedLineStealer)", "value": "779d4a715ac6bf4ff7cae5537d392d90c5e487816610a8d266fb9ee5611d8c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211362, "uuid": "216db69d-1245-4a54-aa2a-1b5fe0fb7237", "comment": "Malware payload (RedLineStealer)", "value": "fff2b585a17d2f27430030afa103599535985fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211362, "uuid": "85624d82-9d98-4505-b00e-6c9846905c6b", "comment": "Malware payload (RedLineStealer)", "value": "7b682b494cf23c57199b5c75bbcc0ece064e5a1e169503c716db87425fb65bc25d73ed583beebc9fee0515fa7d1afb01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211362, "uuid": "6051da9b-bae8-4b57-9dde-5885f6dad70c", "value": "T12E45F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211362, "uuid": "89164b38-2e52-4022-a0f4-f5736d452a92", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211362, "uuid": "8f242b39-7c5e-405d-b4d7-5f6b0309bf6d", "value": "24576:0LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:eko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211362, "uuid": "6582757b-c895-4c7a-a976-00a546ae5496", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211362, "uuid": "64f04967-ab7b-4a12-a659-2c86d6a6f0dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211362, "uuid": "2f485106-b5d2-4d9e-906b-2615ddc2e88f", "value": "1e0c9a83ec9d41536483f6fc4d34f5b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab733b4-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226702, "uuid": "c79170be-7da9-4975-a475-2b6285414092", "comment": "Malware payload (Mirai)", "value": "3ffb50d501e3b42ad89032e13358cfd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226702, "uuid": "0587fc4b-312d-4f86-915f-9e3a4894d78a", "comment": "Malware payload (Mirai)", "value": "780d9de131d531d3b4a16e10a44eb7405409e95ec5a357ed4610bb5696ddec23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226702, "uuid": "2a714c12-7ba2-4fa3-b417-2ee84e79e3a0", "comment": "Malware payload (Mirai)", "value": "63840fcb8f17841d5edc8a32bc4d5df6e1d03908", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226702, "uuid": "27c4d34b-c9fb-4307-9677-9cd520b392a1", "comment": "Malware payload (Mirai)", "value": "c569b2a10bd94f7511f65945f4a75c43578b00fdc71ea838fb07d171fc21691b2bee7b227e4723baf3050e1ed76c4b9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226702, "uuid": "504d430d-3b32-47bd-8b4e-ea6a395e792c", "value": "T10F330A9EB8029D3CF90BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226702, "uuid": "ee4326fb-d041-401c-b8e7-c33f697201a9", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGX:r/hqaJMeteqK806MHdkfQX6HuCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226702, "uuid": "2b0bb764-4313-4352-aed4-b09b236e0e8d", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226702, "uuid": "58d1bc12-5233-4892-8f6b-cf3623742c9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226702, "uuid": "93f0940b-9b64-4378-bad5-fa2ef5df6d71", "value": "3ffb50d501e3b42ad89032e13358cfd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81be0e40-c68d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679254658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254658, "uuid": "497d074a-902e-4679-98b2-46affa27bad9", "comment": "Malware payload (RedLineStealer)", "value": "32da8a1854dd954cf6e8538d78ca6af2", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254658, "uuid": "bb44eb7f-fbce-4aac-b8aa-f1de921587e9", "comment": "Malware payload (RedLineStealer)", "value": "787aab7bd295293c85adfd76fdccfa3748ae513bfcba3fbe3eb0b59a2b521324", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254658, "uuid": "03a5d19a-9b18-4da7-95fe-92828ee4aef7", "comment": "Malware payload (RedLineStealer)", "value": "0786b876a15d8669fed2daa323b774abc64d6cfb", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254658, "uuid": "c021a4b6-9cf2-44b7-ac5c-654df518fce4", "comment": "Malware payload (RedLineStealer)", "value": "19cbaa2e7be77065f81f4f5a256b5d896e3dd17fd31053b466db91969cb64290efa8eaf768a7a883d5e8b3ad686b88cd", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254658, "uuid": "6b19d07b-dd28-44f2-8a71-5f9ab79e3a0f", "value": "T13F35E01175E2C472C472113209F0DAB55E3EBC614A669EBFA7E41F7E4F302C0DB26A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254658, "uuid": "51544cf1-2c99-4e9b-a5d0-e1d0aad53e15", "value": "eb71d3b9da7039bab34fc17867ea0e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254658, "uuid": "08c61ab7-1ff4-44a2-b514-f2f0a33468a9", "value": "6144:bPs0lKPrhQ5iJjS9SmL2jEAOaeJczm067rg7qtwSHOv1sdzsopny7rC:jyT/J7DEAeSr6PTtwSudsdoKy7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679254658, "uuid": "fd1cd28a-4dc3-41cb-afa3-ae638cae3da1", "value": 1128960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679254658, "uuid": "3cee9935-a79d-4dbf-9295-a81b936b5075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254658, "uuid": "5b6de2c5-d6b5-4dab-aa44-17de95244f8e", "value": "32da8a1854dd954cf6e8538d78ca6af2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15b02f2-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223439, "uuid": "cf5ecc3c-0420-4fe5-83f3-46abfbbe2de0", "comment": "Malware payload (Mirai)", "value": "44c5de61ee1d3f79d9e5c0de2ca45a69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223439, "uuid": "38cb461b-2b79-4ee7-bf5b-76a4758806f8", "comment": "Malware payload (Mirai)", "value": "78da0e8c7c7c7afd5a3686a1112d1916bf3ac827cca24f9ae29bec20b88037ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223439, "uuid": "913fe32a-9bfc-4d9b-8280-ea92c1523c92", "comment": "Malware payload (Mirai)", "value": "8e07e2ca8b2b3b2083609607b3b4c07e590acb3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223439, "uuid": "191c271e-f29d-4cc6-b3a0-f3e0d7211fef", "comment": "Malware payload (Mirai)", "value": "84be7ac5febc02f59451bf91c0b751450a04d920e3867a23264b6ddadfaf16a9cff39648ff61e1f67e52c6e0b7758c54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223439, "uuid": "700cd6d7-b167-4835-a001-6648e11508fb", "value": "T180131B42312C0E1BD6B25AB0293F16E083FFE9A024F4B589655F9B568A75E3710C6FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223439, "uuid": "be64b67f-088d-4d22-a9bf-133cde0e92a2", "value": "768:OrtEHoi4TJ1+UhCIRHOPAFRs5SRJ8wGwjlmH90trtk8ZbwPpA2qB3u:OMb4l1+G7tOWcSIwHmH9s6BARo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223439, "uuid": "34a127aa-5219-47db-bda8-c1d2cad563ad", "value": 45004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223439, "uuid": "b73b9d82-c508-4813-a327-5a67cbc27c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223439, "uuid": "535e40ed-0b6e-40c6-8105-e6e48a5214e0", "value": "44c5de61ee1d3f79d9e5c0de2ca45a69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c476ca1-c651-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679228772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228772, "uuid": "5a4b558f-a9b7-4785-b98e-28154829ccb4", "comment": "Malware payload (Stop)", "value": "8b238d58934cdf1a5a398de288961bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228772, "uuid": "65a19384-1e93-485e-83d9-02176667fe39", "comment": "Malware payload (Stop)", "value": "7a8136a8c2e253ad3dc26e50726efed2689833b1f70cf0161a1d88ba350d1c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228772, "uuid": "4711c30a-43be-4e8f-b68a-3c06c2481793", "comment": "Malware payload (Stop)", "value": "dc52cc6539ed4d7c61f5f7bf558d6b4ce7c68a8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228772, "uuid": "a921b125-1da3-4051-a5fd-f12c9279ca8b", "comment": "Malware payload (Stop)", "value": "388b63b515bef1ee636887175c3868e6c2b700f629837ae0fc0e0f3f98e727c49498378411fd17c428c72114a84a7ab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228772, "uuid": "473949d7-7d51-46c5-9120-f4add38e659a", "value": "T1CE05CF5382E17C4DF526CB739E2ED2E9B72EF671DE497B6532189A1B00710B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228772, "uuid": "2cb06437-6e1c-467f-bbe8-fbf51ac3c5f1", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228772, "uuid": "a4ffcb72-e2e7-4323-ac62-73ce92602455", "value": "12288:LPfwF5zDI6nrwsXkfo9tYW0xZhs0yG38s1G/J4sKJxLfD+gIi0oxKSgh:zQsAkw0W0xZi0vM0G+7JxDKgEoYSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679228772, "uuid": "c016f7c9-93fb-4a58-9149-ad0b60281e01", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679228772, "uuid": "58793ec0-1d4e-4147-b91f-2d4f2c4b5ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228772, "uuid": "a15cce1c-c3d7-45ee-af93-f55f10a602e3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c151d489-c636-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679217399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217399, "uuid": "26d1972e-2b6a-4d82-98e2-5b812a6e1d5f", "comment": "Malware payload (Mirai)", "value": "3ef643fcceb6891c58d1dd6e3124c037", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217399, "uuid": "fc6852f3-9cef-42c2-871a-e74aabbdc666", "comment": "Malware payload (Mirai)", "value": "7c1aaad576c3bd99ddaf93944649cf0bc7ec5252b5d636b62a21ac8da18ee5e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217399, "uuid": "348ba713-64a6-44d3-9f8a-8dca844a6bc4", "comment": "Malware payload (Mirai)", "value": "0fe415030138b8a246f0ae87a468ee08bd979976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217399, "uuid": "15b236e3-f7e5-4e90-8059-befe4d6e704f", "comment": "Malware payload (Mirai)", "value": "97ad2490dc0999f3aace669a6bfe273294c2b6d84d14bd844cc23c65af3334c4648ec3c61571c41cccc50322a7cd4a66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217399, "uuid": "3b3fdcb4-9024-48c4-aee5-8fedc4b43def", "value": "T10C536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11602D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217399, "uuid": "73f34a68-db5c-4965-a98f-4e302345e850", "value": "1536:Z7qARubgzY/bEJyxRcpW80LDHhklv4JQC9DSW:NP+eY/bEJXWXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217399, "uuid": "b188fe25-1c68-4dd6-891e-e0e6b0517feb", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217399, "uuid": "4401fb03-272e-4144-9e4c-3b32f0b80492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217399, "uuid": "24aabe55-e02b-4b8a-aeb4-e6e1cea474e2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d6e19e-c64a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679225667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225667, "uuid": "d446c8f7-d40c-4a08-9b1c-0fae49d2a8df", "comment": "Malware payload (Mirai)", "value": "743ba5057addcac61a95fbf5491ca9ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225667, "uuid": "a769683d-ed09-486d-8d4b-40b4874b149b", "comment": "Malware payload (Mirai)", "value": "7cc619e1d88e8a2b382e3ec1a293460f208cbd4341863f1155f5ac4354a4573e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225667, "uuid": "fdb9a1f3-79d8-4df6-b260-96af2f4ea7f6", "comment": "Malware payload (Mirai)", "value": "9ad9a5517a45ca344f7a2455f2e8a21db5bf4c8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225667, "uuid": "a21ca99a-3781-46b7-a4a0-81c57aaeb4c7", "comment": "Malware payload (Mirai)", "value": "223b626576d8675949aef737a9716d5ad3959a8d2bd1d66b214e5b4d4a94055b2d0acc8f720e1959f696465b2a261a1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225667, "uuid": "701cb288-8a38-4ff3-ac1c-0fd003f91c4c", "value": "T1EEC3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225667, "uuid": "a1a3d9fc-0705-463a-8216-a4b181681aa2", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPrL7ymm/QMurB1nKGNb:SMQplVramm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225667, "uuid": "b1bdae92-b74b-4654-b112-d26f0b89f8ab", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225667, "uuid": "36641737-a5e3-4719-98ba-c670b2a792fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225667, "uuid": "7ee76be9-0aaa-4b2d-945a-31b11d097b32", "value": "743ba5057addcac61a95fbf5491ca9ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c326d4-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212891, "uuid": "aa15aee7-5505-423c-95fe-59bd312ed20b", "comment": "Malware payload (RedLineStealer)", "value": "dc751767733b955ae44a27f7e6af32b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212891, "uuid": "3e59ff17-1ae9-488a-ac85-767b2808cbb1", "comment": "Malware payload (RedLineStealer)", "value": "7cca602c9575d26d4a09920d1589c05c0152e124197d3f7574b0469e92b1bbdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212891, "uuid": "b1576bc0-9fa7-4f22-8439-655490d976a1", "comment": "Malware payload (RedLineStealer)", "value": "eba1c1378ddce6de2f85c722a71be4aefc71a0a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212891, "uuid": "3d15e636-0b15-41de-8984-e23c2e9d4b65", "comment": "Malware payload (RedLineStealer)", "value": "1b5a05f3a9ba3473259de5873cd340e10031f68444bd9f8dba569066161b510d9b93a69cc9ac8fdca7dd1ad44c331364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212891, "uuid": "32075b57-e670-429a-b40b-37b4fbc7f09c", "value": "T10245F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212891, "uuid": "6052fa2d-8d36-47cb-b8dc-75c902bbf11f", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212891, "uuid": "97b57537-9c19-4fae-a2e0-a2858a713829", "value": "24576:YLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Kko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212891, "uuid": "b7bccb0e-dce5-4602-b5e7-d7f64d5e0bc1", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212891, "uuid": "dc48a9e5-c0b5-47c6-b63e-048d8203e23a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212891, "uuid": "c6c7b52f-3b8a-4405-91ad-3ba2d498b392", "value": "dc751767733b955ae44a27f7e6af32b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a3ee22-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679241235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241235, "uuid": "52ef07bb-1b28-4b65-a59b-7ef8d7fe6b47", "comment": "Malware payload (AsyncRAT)", "value": "4a80f9fca7467788469bc14355c82a6e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241235, "uuid": "a4d4f253-28fb-4314-aa96-9cc4ba5b0e24", "comment": "Malware payload (AsyncRAT)", "value": "7d2ee960d7637469e889562dd15bcdac342ae364ffecfff27113cc2113b0809a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241235, "uuid": "5596abf1-bb52-4442-9ad3-3e784eb19864", "comment": "Malware payload (AsyncRAT)", "value": "23f7ec3120eab1d79f593d4b267e85a627af1b44", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241235, "uuid": "5847254e-685a-464a-a36a-a0412693b9f3", "comment": "Malware payload (AsyncRAT)", "value": "9bad4b352c3315c64109ca99246b8e715be28344efe615667d1ac9851c54273e40a0dd93c6859d96ee21f62e80b200e2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241235, "uuid": "f2930988-5ba9-4919-8351-b7ad1195de28", "value": "T1BD32E797ADDB7E529D5B4902AF230070C87B343C1461907E8DAA936A7FD1ADC1DC4CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241235, "uuid": "2f99769b-7cf1-4638-bede-bebf3df3ac43", "value": "48:RvFLuCWFFFqioDYsuX2VL8suXtR8oM7PMM:L6CaLqioDEmVL44P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241235, "uuid": "27959910-478a-403c-9e95-7a87de423551", "value": 10929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241235, "uuid": "fa65ea10-df9a-4910-9bd5-0605e39cd433", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241235, "uuid": "b6223e99-2030-47f2-990a-85f431bdf392", "value": "Statment 1863607932.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e77a3e-c6a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679264602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679264602, "uuid": "e77d8bb6-62bb-4de5-9d9e-732fd2bcf81b", "comment": "Malware payload (Mirai)", "value": "a9779c28bc155a631d8f66571bad46c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679264602, "uuid": "0eb4edac-fad8-4dc8-b729-cce9045a9742", "comment": "Malware payload (Mirai)", "value": "7d45bb9948f8b27fc4899c5481a36de87c7e8d98eb6f6774ce2867c77e475510", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679264602, "uuid": "009b12f0-961a-4508-8e45-b581c5e05fa3", "comment": "Malware payload (Mirai)", "value": "ea43922794475ac573f49b286e7543779d404ebd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679264602, "uuid": "1b7ed9c3-2fbe-4fab-bceb-60103146b706", "comment": "Malware payload (Mirai)", "value": "6a16ee93980f31987be7709f0871256b03a5a01e5e6770faf861c870e52bb2cea5da6ab528fcc61eed1e731e3fd7a4f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679264602, "uuid": "d23c3a26-74e8-443d-9463-60bf10e0ea93", "value": "T13B63029EA6A1805EEAD20DB5D2FE204382103DE932ABB7A127150F6564C25CE74DF1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679264602, "uuid": "c7ffea1e-67d8-43dd-8331-20b844cf044a", "value": "1536:Ua5kAvzERkSQqC4je1yNtOO3jA7nKFJhWZ1YdziWlisk0H:UESQqBjeUzOSj3FJADSlYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679264602, "uuid": "1c4a4d52-35a8-4122-aa2a-65b1ac5a21dd", "value": 69204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679264602, "uuid": "1bff6660-5bd8-488b-8500-32a275f29199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679264602, "uuid": "bd3a0ce7-2558-4e50-9e1e-ba1e3e71cbeb", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56f7327-c6a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679263818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679263818, "uuid": "54818a99-632e-4025-86c3-d6789a225a77", "comment": "Malware payload (CoinMiner)", "value": "39dac645fb473abe88ebf3bb28e360b0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679263818, "uuid": "a5b67a5e-0642-4ff1-b03a-8281dbad542a", "comment": "Malware payload (CoinMiner)", "value": "7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679263818, "uuid": "524d2e69-7977-40a7-9009-e2319a4b98e3", "comment": "Malware payload (CoinMiner)", "value": "e2b8488b672d5765b404dc44f1ee6e0e005a2932", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679263818, "uuid": "a93f78c3-7e10-49fb-be77-c5b769955b29", "comment": "Malware payload (CoinMiner)", "value": "78739d4bda88a0a8d9a7b247b03344fa320d0d60fece7bb4370c77216f2c16eeba4a01f6f231aae71f041e54d1aca9b8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679263818, "uuid": "49907014-14af-4e46-a0eb-23209e860d90", "value": "T1C09575342EEA5019F1B3BF7C9AF435959A6FBEA37B27854D0061028A0733A41DDD173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679263818, "uuid": "1e38b694-d1cd-4b2c-9fa7-e7c0c10b36db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679263818, "uuid": "f3cd4f43-e2c9-41e8-bee4-c58c2aef8ed7", "value": "24576:dCNqlizzN4yGwrXLoamoWvXa7IwfvoMODACOfCW2lPy1A9Qsy2lPy1A9QnG:UwgKyGwHthIwf7gOqW2wKQsy2wKQnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679263818, "uuid": "ce2b9f19-0c29-4ba4-b0b5-b4d0b5dabeb4", "value": 2043392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679263818, "uuid": "b24436be-9ed7-4321-b662-82b82a42b562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679263818, "uuid": "743a382a-8506-477d-bf01-49ff78c9ebd5", "value": "39dac645fb473abe88ebf3bb28e360b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb079f8-c655-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679230788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230788, "uuid": "fcd35ae0-5c74-4b9b-b9e7-2bf06300663a", "comment": "Malware payload (Rhadamanthys)", "value": "3114407632abe938973c4751307ba80d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230788, "uuid": "02a9b1d1-926c-4d6f-b13f-ddb5a2ed0ee7", "comment": "Malware payload (Rhadamanthys)", "value": "7e7d63e3a65bdc7258d659d77b1e66ce07c834ba2897886682e383babfc68da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230788, "uuid": "32c033cd-2a3c-4250-b7b8-90efd2103d33", "comment": "Malware payload (Rhadamanthys)", "value": "af4d96dc213ad326e5e077075af7b0edaf86d0e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230788, "uuid": "ab2a4125-d1aa-400b-96fe-9361f34bb545", "comment": "Malware payload (Rhadamanthys)", "value": "32ff36887c42d94bbc54561c57f78d970e9d352e25cd4bc03829acfce201669bf074174592ebd0d735cf424bea7706d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230788, "uuid": "d44f4872-b120-4492-a604-c6f60e33e44d", "value": "T14A743A03F2E17C55E926CB738E2EC6E8775DF5509E49BF6D221CAA2B04B10B2C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230788, "uuid": "78a658f9-f573-4d60-94f4-d57a61caffbb", "value": "cf9749211bb5c4a3fd321170f5076a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230788, "uuid": "f71e2fd6-525f-41b3-929a-1d8442bf5105", "value": "6144:5GbujL/Rx7ewK3fFUgpuQnezB+Qxd+ykY7kUoh:obujdIpCgYQABnx/kYjoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230788, "uuid": "37aa9b58-534a-410a-a2c1-55c8db14428b", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230788, "uuid": "8234c36a-0dd3-4d4c-8534-f54394b916cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230788, "uuid": "1f549590-51ed-4fa0-98db-5adb7bfe4e6d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c6b6fd-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241510, "uuid": "a8fdfbb1-c6db-49d2-8d6d-a94ce98309d1", "comment": "Malware payload", "value": "6986f1d3d40626f825b3ebf0415fc54c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241510, "uuid": "3cc29d64-96c1-4a7d-8b83-b90878ee38a7", "comment": "Malware payload", "value": "7e84d74990b3b4a9807b3072a2637c0c7035b2e9bc4f6e603b9f1766172fbf3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241510, "uuid": "09e0a775-8ae4-4896-b76f-2c94b6145702", "comment": "Malware payload", "value": "4e498030af12be1c971aa8b06178c24266d39197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241510, "uuid": "a00eef48-2bc4-49f2-9c95-9ba62f04a6dc", "comment": "Malware payload", "value": "c1640aa45cbc1f9f40c07ab48a3e3cffa1bf572829d01647315fda0886dac4bc4ec596a426dccaff7d5ac158323f2e2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241510, "uuid": "c828c2d2-51e4-4daa-88ca-3076b5c31305", "value": "T13333A54632FA5F1EF53987F902580808FBB0772A7A15FB8E5ED220DE6869F404B51B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241510, "uuid": "caa03e24-c723-4add-af3d-e23ce7821136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241510, "uuid": "ffed84bf-4370-457f-ba43-fcad31685f5c", "value": "768:ero4Jbpck6DKrC58V5GmKOb02HI2thwykpTz1:qbRpckGSPGib7dLRQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241510, "uuid": "2f97bcde-cb2d-468b-9c17-3b4d6fe20add", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241510, "uuid": "e9dd82e0-7d5e-4945-aafe-82f4fbc4f5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241510, "uuid": "2bc3a7fd-a7e1-4abe-af84-cf75b2e74f7c", "value": "6986f1d3d40626f825b3ebf0415fc54c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b0d1da-c65c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679233755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233755, "uuid": "c235bcb1-a583-4f9d-9d4b-3f64cb2bc3e4", "comment": "Malware payload (Rhadamanthys)", "value": "8ad47f6bd62975254ede9b4737429715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233755, "uuid": "390861cc-822f-4004-ba8f-4a7ff331e90d", "comment": "Malware payload (Rhadamanthys)", "value": "7f5a1d9a81c8e16ed8e5fff72f8685f529235753bd3ebfabeb947c589774179d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233755, "uuid": "efed93d5-3d5b-4ffb-a045-2091f9b39df8", "comment": "Malware payload (Rhadamanthys)", "value": "f772c8b56828c4c5dffb1c87ac3116de3c8bbc29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233755, "uuid": "b31cc1d0-491b-4947-b789-b665d0930ae9", "comment": "Malware payload (Rhadamanthys)", "value": "c052195a6877d5ed4899413f516f677d4bbac5b03b09d986a5a0f8b300ac7e0f5f147b308c34966654ec4e30302722e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233755, "uuid": "7953a97b-577e-4f6c-abcd-82cc0c515164", "value": "T15D743B4393A13D58E9268B739E1FC6E8B70DF671DE8977657218DA1F04B0172C2A3B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233755, "uuid": "7a813072-7060-4af4-98df-0fc0389dced5", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233755, "uuid": "14e29d4a-c5be-4974-a0c2-56a938a32fe7", "value": "6144:Qu/LWXRHS7Rz4ghTG1zqmBpYcdnHx4ub5PsuBYQE:Qu/UN29ZYzqRcdxb5PslQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233755, "uuid": "af15d4e1-b90f-4bcd-bac8-f1d29466d078", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233755, "uuid": "e30d6414-dc30-449b-8298-2acb1b0b4651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233755, "uuid": "6e261d44-7d0a-4ae6-a3b9-c62237748f89", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60920b5-c651-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679228949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228949, "uuid": "289bfd46-8aad-45b8-8129-df9bd8d4c786", "comment": "Malware payload (Smoke Loader)", "value": "257f2d3abf1ba4145d02cbdaa3827938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228949, "uuid": "1b0fb571-78ab-4076-b62c-3fa90d328ef9", "comment": "Malware payload (Smoke Loader)", "value": "7f910d62e8f625e12ac492aa6435d7502f24ec40f584b3d82d2c8b085c2abf48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228949, "uuid": "3010d14f-c74a-4621-bcde-18f73f1a640a", "comment": "Malware payload (Smoke Loader)", "value": "30d5ae7912b8a2f1ccd7c2fc0fd93e11acf344bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228949, "uuid": "495fbcec-b9ba-453f-be14-7ff7058aa2bc", "comment": "Malware payload (Smoke Loader)", "value": "437969466f06316ab0b5ad3f925e95cbc52d9cf5cf7a34ed0537e073fdae97bba04ecf63016160e6befea36767432909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228949, "uuid": "da1877f0-3859-4ef3-bd66-8838059da2d7", "value": "T1EE54F81382E17D48E9268B739E1EC2E8B71DF671DF497B7532189A2B04B1172C173BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228949, "uuid": "d6796103-6d75-46e3-881c-7649f5ad712c", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228949, "uuid": "a9cdc4e9-d648-4fda-894f-ac42ff2e4da4", "value": "3072:KDo6XZLVeLVrgrECJmTvaMFPmlq8pGG+Cnhs8Ha5RLnutn6MZ1L:sXZLVgWrECJmuIOfGJQhvajS1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679228949, "uuid": "25d0d8cf-abe6-4c21-930a-cf562804f346", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679228949, "uuid": "be375456-898a-4d68-a5ba-0fcd08295cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228949, "uuid": "e35d12d9-0e4a-48ff-bf1f-cb53267a26da", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1d6d07-c663-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679236477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236477, "uuid": "71ec077d-242f-4f49-9a5f-529a65ee4e25", "comment": "Malware payload (CryptBot)", "value": "b9d635f3b9813943221249aa312ec50d", "object_relation": "md5", "Tag": [ { "name": "b9d635f3b9813943221249aa312ec50d", "colour": "#D9CAAF", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236477, "uuid": "570cdac6-8906-49c5-9c4f-0b28499f3fb8", "comment": "Malware payload (CryptBot)", "value": "7fcd90faf86392f69e354b1d557f531c467636d995be118cc1b9dd20acd66848", "object_relation": "sha256", "Tag": [ { "name": "b9d635f3b9813943221249aa312ec50d", "colour": "#D9CAAF", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236477, "uuid": "a609ba86-5713-4b8f-bc45-28d68430bbe7", "comment": "Malware payload (CryptBot)", "value": "27774bbdb9cc9d2f026533c3c36eee06d4d7908e", "object_relation": "sha1", "Tag": [ { "name": "b9d635f3b9813943221249aa312ec50d", "colour": "#D9CAAF", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679236477, "uuid": "a1fddb83-63ea-430d-b856-38dc94680764", "comment": "Malware payload (CryptBot)", "value": "5d0b1132e282ac5981b1cc3d0fc4b325fbeca45286a30872bbc8f81790451ce763226f4fd3c4c702c7808c33980a6f19", "object_relation": "sha3-384", "Tag": [ { "name": "b9d635f3b9813943221249aa312ec50d", "colour": "#D9CAAF", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236477, "uuid": "b92120ce-d94f-453f-b8ee-ef24fab87391", "value": "T1CC6623B3722D8149E4E48D399913BD9530F61F968B81EC7970E7BBC91B32CA4A513983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236477, "uuid": "f99c5d2d-245b-41ad-8d0e-84b4ca6a66a7", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236477, "uuid": "75800a51-dd0a-466f-bdb0-e6d32222e3a5", "value": "196608:sxeUbegYe8hMuBHvNoLlG3g/5v1w+P6X+:seUbe5hVvyLHhv36X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679236477, "uuid": "7cb8a938-562e-41c4-888a-c96a19ecc81a", "value": 6619136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679236477, "uuid": "dabcf3f7-b3a0-4da3-8559-89b98eb9575d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679236477, "uuid": "1afc1abb-62f2-4ecb-855b-850b5c090179", "value": "b9d635f3b9813943221249aa312ec50d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631d4ece-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226690, "uuid": "f128b586-7a2a-485e-b6ef-fa8edc5df40a", "comment": "Malware payload (Mirai)", "value": "87a2428a7d7214f2d1f9ddc707353712", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226690, "uuid": "7d0ac8b2-fc50-4fbe-8bbb-9853b5222321", "comment": "Malware payload (Mirai)", "value": "7fe4155f48f1879d1db64684567144b02b82129bc0a647d640a9977e74806423", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226690, "uuid": "d2ca7f8d-ce32-4918-9662-c972c39ae2db", "comment": "Malware payload (Mirai)", "value": "baafab6a5dde0f5cab1e71a3ef6abd6335aae7ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226690, "uuid": "73bfb4be-5945-4fc9-9ed0-eade27f5eeac", "comment": "Malware payload (Mirai)", "value": "05b2768b401acc3c24466622b9d53372d5f1bac1600d4d57131ee219cdad88411c7246bf460b94c5ecd01220667e6265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226690, "uuid": "382c96ef-592c-40df-83d6-e9f0c0913491", "value": "T158A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226690, "uuid": "7c7666a7-e935-4d1d-89e1-da616fbd525b", "value": "3072:wW8FUmgujld6Mkxm6AJ+4f+HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f+HmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226690, "uuid": "1e04b25e-370a-49ff-be70-68916020b1d3", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226690, "uuid": "2fb9902b-5b12-4b2b-9470-3fc35b03f44a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226690, "uuid": "926981ea-22b2-4046-8780-6bed64f5b5ab", "value": "87a2428a7d7214f2d1f9ddc707353712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8142d91b-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223304, "uuid": "6dfc3658-de56-47c8-95ae-3433c155e0c6", "comment": "Malware payload (Mirai)", "value": "fe7757273f95d0f54949a4808d1a04c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223304, "uuid": "0e68f7fc-47ed-404b-9d03-d6ebeae923a2", "comment": "Malware payload (Mirai)", "value": "8026dc50932d4fc4b1dd50e6cb3a218fd8c220d004980ae0ed8535efed0a9898", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223304, "uuid": "fb2a4047-9102-4b2a-8e92-20bad83dafb0", "comment": "Malware payload (Mirai)", "value": "270ce649b2f85c977eee89755b812ce207b96555", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223304, "uuid": "bb9c58bc-892d-48a9-8035-f135d33bd25d", "comment": "Malware payload (Mirai)", "value": "05b761cbc9f08b823678f7d9141c7c2af3955ffcb4f8e6ebb99245c6bf3c274520498067cc22feec58893a7334e86b50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223304, "uuid": "b3c69a31-5635-45bd-ac85-7aea85281495", "value": "T1CB332A21793A2F17C0D4A47A62F74758B2F11A5E66E8CA5EBC730E4FFF60940A4136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223304, "uuid": "47d28bf5-709a-4631-9d5e-ee1ff5c1f86f", "value": "768:Ncu2oSxq9wiNZmPScYRXdgPIrBzUT82EtO+vDIi:eu2FxSwiNZmPSnRXdgQrn2Edr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223304, "uuid": "f7eb9436-413f-4258-bd06-bdc561399582", "value": 51124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223304, "uuid": "9f18ef2d-32ec-4a02-80f2-5ac552326b9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223304, "uuid": "8928638c-5c43-4d28-8850-5e6bb4eba53a", "value": "fe7757273f95d0f54949a4808d1a04c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1cd318-c657-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231350, "uuid": "e14cf541-fbee-4ce6-8b0a-af5a8cf6e6cf", "comment": "Malware payload (Rhadamanthys)", "value": "d051550b7085a8ec636c860dbe364757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231350, "uuid": "a0109401-ffcb-421a-872c-999b92468827", "comment": "Malware payload (Rhadamanthys)", "value": "8059a627641eb1c31eb14ef8a90a71e482c3fe71df249f17046bf8923dbc1b19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231350, "uuid": "64a56d45-efce-43ca-a91d-189376a6edd3", "comment": "Malware payload (Rhadamanthys)", "value": "e2ba16cc065e52545fe67e27abb799fc188c0e7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231350, "uuid": "905f3bb2-e406-45c1-90d9-cc5a81efc7e9", "comment": "Malware payload (Rhadamanthys)", "value": "c96a823212aa58fafc1f4315752bccec8c6e4b43f0a8efe0b91a1e48287126cb6c6802edcad331cd585633a14523b0a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231350, "uuid": "33cdef85-bbd9-4850-b4e1-abe7dc7c814d", "value": "T19D744B4383E17C48E9268B739F1EE2E8B71EF671DE597B6532189A1F04B1172C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231350, "uuid": "1e4438ea-fedb-4a98-935f-669fadbcd0de", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231350, "uuid": "f06171a1-133e-4422-b827-5595cd4dcd34", "value": "6144:sugLVu0QJ1KD4u6w0EDEbCiYyqsE4jbyhC:sugYH1YH0EDUz5Nbjeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231350, "uuid": "ecd05229-8d95-42ad-b2b0-b7c5ae847dfb", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231350, "uuid": "bf529a87-014e-42ad-b044-215e1638e5e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231350, "uuid": "b4fe8e4d-ca5b-46a4-9b9a-cc36413e49e8", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975c14b5-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212604, "uuid": "2fdc23ce-1365-4c49-a5e5-b49fea85e9df", "comment": "Malware payload (RedLineStealer)", "value": "d16e87bd29ec89a18d8a477ad08b6f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212604, "uuid": "30279926-1738-4dbe-88a2-f20f9df78845", "comment": "Malware payload (RedLineStealer)", "value": "809d5bdb8703636ee347d5faf1c775ce89240c394bb1078a84d890265548b4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212604, "uuid": "ff484446-c5cc-46f5-b8c8-102f82c2b558", "comment": "Malware payload (RedLineStealer)", "value": "75b0733ff874d497b7943278c7f4f1759998621d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212604, "uuid": "80c9fa3a-b46f-4f63-b43e-9ab50c5ae0fd", "comment": "Malware payload (RedLineStealer)", "value": "0249d6842840af0f649b82f70345a1a743fa6695ac1cf30de078ea31d45faf76bf9d095c28efe1595173997ef941f16b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212604, "uuid": "e0492980-9ffe-453f-9b36-41508d74cb62", "value": "T17C352217E3E58432D8B49BB018F602D30B36BE619B6947FB365AAD550D339A43932337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212604, "uuid": "f290d5e5-57e3-4746-b779-7e86fa83cc6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212604, "uuid": "1f1f452a-37c5-44d7-b0e9-6166a485552f", "value": "24576:DyHKquVOwyzGjwAMjin3iKeEaGMcZZtzHemXKkeJGbQsp:WtuQwyz9AMjin3W7bcz5L2JG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212604, "uuid": "5c21d583-351c-4685-9ef7-c7a6fb79efde", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212604, "uuid": "7d261adb-2492-4bf7-8972-2334b65aa4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212604, "uuid": "b14b4fec-cc9c-457e-b174-a0494c57fe4b", "value": "d16e87bd29ec89a18d8a477ad08b6f0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee05d08-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224911, "uuid": "8f0c457b-772e-4c84-b6b1-7826fd908898", "comment": "Malware payload (RedLineStealer)", "value": "0ccee05e17fd806acca4e78b4f88b5f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224911, "uuid": "7fe80bab-0cf4-41ab-80df-3368c1911abe", "comment": "Malware payload (RedLineStealer)", "value": "80d1afa5fe1e29051205da3ef021f96feae023d7b780cea8c8dd6ad8ce9ac010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224911, "uuid": "dbba3aa4-0322-490c-a0d3-74860bd1f375", "comment": "Malware payload (RedLineStealer)", "value": "b8bb534337d4d1c0a0b8d24e543d36cf1ffe4824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224911, "uuid": "58bb6f45-8437-428d-a7ad-e6d9b5756f2d", "comment": "Malware payload (RedLineStealer)", "value": "c738ca5211572cfc5cc27f7a7590379bfcdf72d42d9c68fea0eeab464ac0e628e5a3cd895557cacf8d20055f73a59bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224911, "uuid": "576c88aa-55a7-46a5-899b-c57e258434a9", "value": "T1A945F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224911, "uuid": "91f6034c-73c0-47cf-bb0b-062b40d20cd0", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224911, "uuid": "100adeb9-12cb-4f43-9307-a4f79face308", "value": "24576:19h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:1/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224911, "uuid": "7046f798-faeb-4d9a-8bd7-59214ae9d810", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224911, "uuid": "2f715332-4683-4b48-98cc-ca099a622f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224911, "uuid": "17542b29-b575-42dc-bc77-10e345e0d187", "value": "0ccee05e17fd806acca4e78b4f88b5f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987d09e5-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212606, "uuid": "e9886d47-c63a-4895-b1fb-e89df78de7fd", "comment": "Malware payload (RedLineStealer)", "value": "dd17f8bea3eecbd956cfa713d6f11912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212606, "uuid": "1ede0a31-178e-4462-8839-01dfa549c637", "comment": "Malware payload (RedLineStealer)", "value": "8203ad807cfc09a5bf30d04c473e7a0505c7597bd98df49bff18faaa9ca8baac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212606, "uuid": "1e5a9583-652a-4b6e-977d-26f15578eed5", "comment": "Malware payload (RedLineStealer)", "value": "22f2ec9aa81028da80938ffc1f0df580f56cdea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212606, "uuid": "0373f915-6d72-4c69-8a5e-f671859491b4", "comment": "Malware payload (RedLineStealer)", "value": "6e04f77a5243fe1dffc18f0ec539267ad2484f41b50d84611edc126dcda4bf7d654d3e4774cf207808724fef96e65b6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212606, "uuid": "72b57c9c-ad7f-4744-a9bb-df42b11a8f0d", "value": "T12645F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212606, "uuid": "d16148a5-f66d-4bf5-9e80-152c40184a90", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212606, "uuid": "0cb09bf7-cc62-439f-942a-d73ab7125e38", "value": "24576:0LdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:eko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212606, "uuid": "f48f6196-daa5-4a9c-a22a-96abc32e764a", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212606, "uuid": "b9821e18-99c0-4823-874b-9350d3e83ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212606, "uuid": "d55d2f25-ad84-4c20-8614-fea697d6e2bf", "value": "dd17f8bea3eecbd956cfa713d6f11912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3aaa72-c636-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679217180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217180, "uuid": "ef69aa0b-deff-4927-a0d6-864ff0053d76", "comment": "Malware payload (Mirai)", "value": "b09a9634932e49aa352ed3a939afdda5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217180, "uuid": "1c90fcb2-cafc-4a6c-ab0a-387a4cb7661d", "comment": "Malware payload (Mirai)", "value": "82232144cf1ce795307236ecbc02a45d052667a2cde4990d1125b9b9471e0851", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217180, "uuid": "a95fcb29-7acc-4c02-93b5-29f6821746fa", "comment": "Malware payload (Mirai)", "value": "9a409656e4e661bd1f7ff0dffde4553544839fb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217180, "uuid": "185d5c62-9957-4341-aa7a-20ade21c252a", "comment": "Malware payload (Mirai)", "value": "c37cae613f13bb7a1529fa19645ff2e405222b4b2ac58b98ce32082d8358d605306397e7b78eb563a901632966e69eae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217180, "uuid": "ed2834ab-0643-4ab6-9e56-24695257b0a6", "value": "T16FC32A46FA418B03C0D61775BA9F424533239755E3EB3306992CAFB43F86BAE4E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217180, "uuid": "c156da06-d159-4e3f-a563-b861b90fee25", "value": "3072:U2lNh9O5cJzJtfveV0DP4ipNdITqpreuhyAM/9ur:U2lNh9O5eFDP4ipNd+qwuhlM/9ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217180, "uuid": "1ac02afe-bcaa-4031-b15b-c8f477ec83c0", "value": 123295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217180, "uuid": "eb0de2c9-e6f1-471a-886f-b095cc8dd62a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217180, "uuid": "2c15f743-6f14-496c-b57d-88ca6c1feab9", "value": "b09a9634932e49aa352ed3a939afdda5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a80b9b-c63c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679220030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220030, "uuid": "f9aec2fd-a83d-4ee6-bc13-40e5f01828f9", "comment": "Malware payload (Mirai)", "value": "71236366f282589b77518ad44bacb8f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220030, "uuid": "8001b0e7-8d83-410b-acc4-a6a2d1a439db", "comment": "Malware payload (Mirai)", "value": "826684411fda457fa56876d8448b0d348007f98b1d156ec65f04dece2dc69403", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220030, "uuid": "1deec2c0-9e09-461e-8db2-e57f35285b7f", "comment": "Malware payload (Mirai)", "value": "98db6b562a1a37001c961f4a467192a9e5b6ba23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220030, "uuid": "4d9deff9-5b2f-4ba1-a776-d2ad6ccaec8c", "comment": "Malware payload (Mirai)", "value": "dd2cad8b6694e5518dddd7a07a22b7cf18222c817b23f17b5ab718eec7b62b1f40683b56e57792428c2bd06684c48e37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220030, "uuid": "ff84c0dc-3f03-4731-be4a-e7e0590273f2", "value": "T163134BC8A943DDF5EC1102702136EB36BB77F43B212DE997C75AD523A892A01D50729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220030, "uuid": "e8fdab76-0301-4489-9426-bcc5dd1d22a0", "value": "768:Wn6rgUc06KEpQhnqCgKrkIh+z6mbZ4JI3/W0H8mE3MCFQFOFXXUIvu8jV+f5E8ff:Wn6rgUD6KEpQhnqhKrkIh+zpbZ4JI3/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679220030, "uuid": "23d619dc-2836-4650-9e2f-6ce70571c06e", "value": 42588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679220030, "uuid": "85ff8932-923b-4d2e-a272-3b8b39a61789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220030, "uuid": "1010f88a-5a09-4d28-b477-c1a8ccb999a6", "value": "TRC.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe37c7df-c66c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679240694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240694, "uuid": "20652c4d-163b-43c8-96cf-f199c792a0e7", "comment": "Malware payload (Mirai)", "value": "c99ad3306b48372b95cc6f4ebd1ca72a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240694, "uuid": "d380dda9-f431-4bda-b62f-eaed4e5f0f51", "comment": "Malware payload (Mirai)", "value": "826ff6907778a47aad222b4525687adc3fdfb99e9cd4bbac8a65254be47e69f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240694, "uuid": "2e5b220c-0f65-4d0d-911f-5fc231dee4f0", "comment": "Malware payload (Mirai)", "value": "e351f2d3cfa03e185bae4a7c39b16f4ba395f0ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240694, "uuid": "5979c15c-37b3-4056-a105-82d03520a348", "comment": "Malware payload (Mirai)", "value": "6fb45499d3e955f9ae47a98a45424eda2f18c169c824b119c67e77aec18dbec7a220c5cf129d4f5776e3214b02c7be9d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240694, "uuid": "51a4f209-23a6-4726-b192-264323edbae3", "value": "T1D003F751BC829A77C2E1137AB6AE4A8D332163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240694, "uuid": "eee02e87-daf6-41e4-a944-47e7ed0494a3", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTo8/NYwWS:svbUG5fPlUlDf4Sycv+PUX8jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240694, "uuid": "ff9c76a4-9aa5-4906-bb49-655b5c5bd7c0", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240694, "uuid": "ec13547b-b798-4716-a461-d554d92f780d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240694, "uuid": "58a5bdf6-94df-4a2a-bd4d-a66f1bc21c96", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66653fd-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679213193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213193, "uuid": "dca42ec7-b791-4b98-8f0d-8104de61add2", "comment": "Malware payload (RedLineStealer)", "value": "2705b75eb50bd57448c5350c3ff99607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213193, "uuid": "4a79d646-9dd5-43ce-8147-6cc322535c5c", "comment": "Malware payload (RedLineStealer)", "value": "82b5d704e8b04dd5b632f7d268200c325dcd8747ac9706e0c3fb41d03bd94190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213193, "uuid": "5000daa4-03c3-4be2-9fc6-2f4ce910232a", "comment": "Malware payload (RedLineStealer)", "value": "38201cb5840184b2aaec2da98abdc4f58ff55324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213193, "uuid": "246aae1d-3b04-4495-8804-beec49b7e45d", "comment": "Malware payload (RedLineStealer)", "value": "b0421507e7b01c8ecfb48a758e7ef04a9f724b35a803f23ca05417ea3972feae3e777ace5b5ae74c365ec84ff7a624bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213193, "uuid": "98bd1fe9-c372-4b6f-aa07-675d000392c3", "value": "T1AF45F11387E13D48E9668B739F2EC2E8BA0EF670DE49776532188B1B04B1176D163F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213193, "uuid": "a27b9432-ae6f-4be5-969a-d9b59f417f47", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213193, "uuid": "6bcafc5a-3da8-4d76-8d21-63a474a7c157", "value": "24576:miB6d7tVCYW2LVKiSPoFbZFCU7joh4H2glJNtiLNsHu0xvO:migtVCYWKHJdHPlvtICO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679213193, "uuid": "602cfa35-dae9-4f8e-9464-a49b642fa56e", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679213193, "uuid": "37de2b18-024d-47bb-8d2f-3265dbd141ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213193, "uuid": "17cef371-b89c-4208-b317-c11d705edb1b", "value": "2705b75eb50bd57448c5350c3ff99607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62a5493-c65d-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679234130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234130, "uuid": "1c5860b1-56af-468e-aed0-6b35c026be66", "comment": "Malware payload (CoinMiner)", "value": "ca341777340c9f6a7ba878b3e37fcf9c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234130, "uuid": "0513bdc9-3d7b-4840-98fe-57de3be9c167", "comment": "Malware payload (CoinMiner)", "value": "8591b86016fee0267755649d008dfb73d0d7ac44ff4bb27f94585477b2eb5924", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234130, "uuid": "8485de98-b0a8-4d83-91cd-1287e53f4ffb", "comment": "Malware payload (CoinMiner)", "value": "07a04b16322d7b7ffb20d06da3f8b0b8d6758d3a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679234130, "uuid": "5b750f5f-c549-49c7-b8d4-398fc6aca9e5", "comment": "Malware payload (CoinMiner)", "value": "103944e3b4974d96759cd06eba4ca5faef5697d42e4cb745c1e215ba8e673cf70bc9e04ef801a70bfaf75aa222818c4d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234130, "uuid": "64646bed-eef0-4f62-9e06-9ae6f926e496", "value": "T1DE24CF0338508431CC7BE57859FCB7CBA36958761BB5C70B672A39DBEE05761227822E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234130, "uuid": "5d9eddd1-7060-42c5-998a-5c89497dc611", "value": "eb34989b8fe3c43ef88d833129f3453a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234130, "uuid": "73f419fa-1dea-414b-9815-4fd508487115", "value": "3072:ess1fPMY0xyVpX5sLRRQRo0PnPdvAP2JyCiNZOQGWpOeXNzxc2NA1YSlajLgYBRH:efPVvX5G8nFmnvOZWB6MAkgLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679234130, "uuid": "23dedeee-e695-405c-91a7-312a3ccbcc6b", "value": 222200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679234130, "uuid": "a7528061-f1eb-41a5-a0e6-ae1a4e74506a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679234130, "uuid": "f2cce06f-9fa2-41b4-9733-4282b49df37f", "value": "bgfbv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0243166-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679241422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241422, "uuid": "9be5ca26-a7a8-43c9-9469-392916ebe222", "comment": "Malware payload (Rhadamanthys)", "value": "4028b97982c562e94cf503226858f6fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241422, "uuid": "3929046f-4dc6-48e7-b288-dd37bbbc6977", "comment": "Malware payload (Rhadamanthys)", "value": "8661ed05a0580a8c9b06de1c6c9fccce98d910b17b95d66f1b3ff569831e3617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241422, "uuid": "345f83ea-9f63-4809-8dff-a44f54a0dcc0", "comment": "Malware payload (Rhadamanthys)", "value": "50a3991613ab7b99500124b1f22bff5d10a956ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241422, "uuid": "d1ad20fb-0228-465f-bf3d-c92a95385781", "comment": "Malware payload (Rhadamanthys)", "value": "803a6929953f5f006734467e9c1d0f6260ef987b5fd1e47a4f4ceb0db24d3356e8cca8cecde7038292b68b13c81b2872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241422, "uuid": "5eedbe0b-a7f4-4590-9e7f-b9dc3f46e1cc", "value": "T1C7743A4392E13D68F9264B739E1FC6E8B71DF2B1DE49776932189A1F04B01B2C163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241422, "uuid": "0d316d17-08ef-4449-8fb8-5682dd8f23ab", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241422, "uuid": "ad8a6d36-549f-4bb9-9350-6c85221b9cd1", "value": "6144:gJjPLyW6+9M0JcfrW0ZLkbLgoQ0oJKGmTTqkZAF/174Mr:gJTB6yMj9FkbUx50OyMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241422, "uuid": "0dee3186-0361-4f0e-a8e5-0a5c1f1a4636", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241422, "uuid": "b4d56009-8f0b-47e8-af84-3779467b9d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241422, "uuid": "3f2bc4a8-3422-47c9-8071-6a4f4b59b513", "value": "4028b97982c562e94cf503226858f6fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999ac624-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679212608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212608, "uuid": "89f0d5d0-32ba-4c2b-bc8f-766a49acb2f4", "comment": "Malware payload (Amadey)", "value": "dfef858408a6777e6daea3f5bdcaa4da", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212608, "uuid": "f5f1c8e6-452b-4b6b-9fcd-45298b3207e3", "comment": "Malware payload (Amadey)", "value": "8720d435ba4bd5f354e07488d2ef9c87b41d45987b38090a60a26ba53e5c290d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212608, "uuid": "b2e5d4ca-8c90-4199-89e9-ad5cc2cbfdcc", "comment": "Malware payload (Amadey)", "value": "76a03ebcdcab1543e0eba82cc5ce32a1e582a93e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212608, "uuid": "d34b222b-3d66-43ca-a073-3879def90b13", "comment": "Malware payload (Amadey)", "value": "909d36594066695a38c52e41540d8a0deb9c3cc8e9987455b02bbc3d5d55f23d8220ea2fbfc450e25e639c803fa8052d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212608, "uuid": "cbd585f7-3159-4201-9195-fd93e54d61a6", "value": "T1BA45F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212608, "uuid": "d82478f8-7ec9-4fcf-8559-4ca16424a1cd", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212608, "uuid": "a4a26b22-810b-4285-a05f-87dbf83ab77b", "value": "24576:i1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:i1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212608, "uuid": "e48e7542-8b67-4558-9525-d4f1be7ae225", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212608, "uuid": "66fcbedd-c72e-4cac-939d-eca29ff7ef82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212608, "uuid": "f3582e04-e865-4ed0-ae36-367a2aa718d3", "value": "dfef858408a6777e6daea3f5bdcaa4da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b767300-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679241360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241360, "uuid": "44cf71ea-506d-4821-b048-88947d182d4b", "comment": "Malware payload (Smoke Loader)", "value": "6f5bbd93caca10b8a869ba2793b4cce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241360, "uuid": "37104a63-48c9-46d8-bb5a-b9a92196803b", "comment": "Malware payload (Smoke Loader)", "value": "8807e165003544956853bd7362822a3d9fabe16c313d5c65ca2126ef73b89dc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241360, "uuid": "0a386a35-557f-4e5b-9797-4cfb3334d302", "comment": "Malware payload (Smoke Loader)", "value": "959ff4a441b9028dc55631a61e4ddfc0e15a277a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241360, "uuid": "a949fb55-6c93-4c98-933d-151c1cca447d", "comment": "Malware payload (Smoke Loader)", "value": "233f2c896832b071c1edcd45d5f955cafbf34db58364084bbdc611cc7232d7c890e9ea752d023c0a1f00ba7b46710c97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241360, "uuid": "3eded5ea-c502-4285-9bb1-3dd5452a56d5", "value": "T1B2D45A792EAC86E7F438E7B5AFE08133A2D397D7BF11CC5858D3066C4E0694268DA11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241360, "uuid": "ad7a1555-39b9-4321-a508-b1ff07179faa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241360, "uuid": "889469cd-f8a6-465e-85ea-95c8d0539de9", "value": "12288:jBdPtUoqcxtmABdVLhcA9D/4BjNmKoUoJcL649OHGm7+:jBd1BFdpkBRmbUoJV4OD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241360, "uuid": "b8de7ff0-9a80-46fd-8d08-be5f095a1c9f", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241360, "uuid": "a2540d5a-9a28-4116-91b4-631c53f207d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241360, "uuid": "729b1b40-48ab-42d2-ad4d-3678fcec6167", "value": "6f5bbd93caca10b8a869ba2793b4cce0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34b9b70-c672-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679243252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243252, "uuid": "50d78c85-8b33-40c9-952e-136342834097", "comment": "Malware payload (Mirai)", "value": "56f822048a4274c2bf37b905f7eaad36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243252, "uuid": "8c320325-b439-465c-a3bb-c5c68d9f9342", "comment": "Malware payload (Mirai)", "value": "88941f21c17bad363feeb37e47c46c3ffb90e4b6dc40c611d94ef6b2d0b7cd3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243252, "uuid": "4c4b328c-21b0-479b-be7e-50277c5fcaee", "comment": "Malware payload (Mirai)", "value": "57887f92405d1601fe490a04bfb285f437a1905c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243252, "uuid": "ce7c5d5b-ec47-4fb8-9aad-56cdeb52a1b8", "comment": "Malware payload (Mirai)", "value": "cc41233fb3c2804e8a7c3a14116f430820b0db4532ed84dfe11ff0fcaca8158cbb52c76f10cdb83fa9e83e31520bd304", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243252, "uuid": "9cb77a02-f093-4a2e-9c91-415d3905c836", "value": "T16A438D37E96E1E74C08641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243252, "uuid": "f7e630ac-f6bd-45d5-8a73-2be966a22e00", "value": "1536:Naa0brW/Od9hlCRbK6fuKwXQCcpvDCM12+Wq:Nv0brWGd9X96fBwapvDM+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679243252, "uuid": "f35b41e5-3e30-457c-b80f-ff4b29996960", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679243252, "uuid": "c0d8cd62-8bb9-4a04-ab2d-976b739fa425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243252, "uuid": "51847a1d-fc69-4eed-8d8c-ff4f8d831fd0", "value": "56f822048a4274c2bf37b905f7eaad36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f257fdd4-c607-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679197295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197295, "uuid": "3b2bf78b-ada5-4eea-ad5f-f1695edfad0c", "comment": "Malware payload (RedLineStealer)", "value": "8841d1b566b108abbb86aca882867ecd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197295, "uuid": "fdafa2c1-b3de-438a-b07f-0f63f2e3f76e", "comment": "Malware payload (RedLineStealer)", "value": "89bad8eeff38f1e5ea58348314ee05352b1eb22d3a4ee8c15be9d0098779487e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197295, "uuid": "5b7a1a3f-144d-4e9a-9433-f0dbca251f94", "comment": "Malware payload (RedLineStealer)", "value": "285ea38f2392feb7d0e7a966f31f7d86b79f8664", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197295, "uuid": "ee96e50a-3a60-4f18-ac27-7b63286a25bc", "comment": "Malware payload (RedLineStealer)", "value": "08456f141b02b2c20713a3ffd92f87dfe6ce6b5cd861cd16dbc193e50802ad6d43b166c59cc757a73dc356290bff4ba8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197295, "uuid": "d971a26b-24c2-419a-b111-f261638b9039", "value": "T152151203F3E89162D8B4577019FA03C30D36BE91867443AF3646986B1CB36B5B97636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197295, "uuid": "ed142926-5786-40e5-87a7-9c5edaf2605e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197295, "uuid": "6ec23d45-942b-4cd1-ae08-53eb6b96211a", "value": "12288:9Mray90T6WJPNyIt8mZYU5FOOjJcN9fqU0XxyJG/WT3+V1gKGuVHJQSmfkA:zyQJPoq8mZVnDoux0uo3DpuESC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679197295, "uuid": "e9f9ae68-7cdf-47e6-a55d-ed3b1a472e62", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679197295, "uuid": "3a3667d5-7bf8-40a5-ab4f-3748192604e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197295, "uuid": "f973a2e5-137a-4949-9e83-151d679de97a", "value": "8841d1b566b108abbb86aca882867ecd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab8f2a4-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212610, "uuid": "0f8ede60-0e86-4820-9925-e2392d5217e7", "comment": "Malware payload (RedLineStealer)", "value": "e800b57b0f74fe5e9fa850acca1879a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212610, "uuid": "c2040e33-2b54-49a5-8ec3-431ea18dce5b", "comment": "Malware payload (RedLineStealer)", "value": "89fe0865b1d06a7e22f6dbcc233300a019a76f7500226eac0d6090e7ff5c661b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212610, "uuid": "9ce61a4f-c461-40f5-90df-44bde752aac3", "comment": "Malware payload (RedLineStealer)", "value": "7003777eac4e7a24f9db918999f8aa862980e73f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212610, "uuid": "69bfdd38-4d40-420b-989b-2797cc9db82e", "comment": "Malware payload (RedLineStealer)", "value": "bcae813bfba4faa5268652e9aa441c219fa461ed1094e3fbb96ea536e0c9b83d7bf5ff272e2ccac65fcd1031b86f9a28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212610, "uuid": "df19ae2a-57c9-4757-b0fc-b6ec720a6ba9", "value": "T1F645F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212610, "uuid": "c4adb385-3d59-4292-8363-b6860aac0df4", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212610, "uuid": "8e555f78-17ea-4c8b-9e69-c24f407f741b", "value": "24576:wLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Cko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212610, "uuid": "cbd6e72b-6ca2-4506-879c-4c0e6ae3fe2a", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212610, "uuid": "5399a195-fe69-41e5-b8bb-b2191cc2ce25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212610, "uuid": "fe8fc0de-aa0d-46c5-827e-8fd2f9f8df34", "value": "e800b57b0f74fe5e9fa850acca1879a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4dfc42-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212587, "uuid": "75041967-bfd3-4551-9a90-eea8f0b8cae8", "comment": "Malware payload (RedLineStealer)", "value": "cab3ebb913c7494ad7526f752eda2971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212587, "uuid": "05dbd158-40b8-4e39-9b4d-7eebe50cf964", "comment": "Malware payload (RedLineStealer)", "value": "8aae268b49987e7855328c82f41e8b06fcf50b77692dd397f8f3f29d15748116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212587, "uuid": "5cd081ef-0eb0-496e-9d93-ef426ae701e5", "comment": "Malware payload (RedLineStealer)", "value": "b5597cb79ee7c25a8e7e36a7cdb0e9f62bc8bd51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212587, "uuid": "21b15d10-9511-4f0d-8568-af19bc378b9b", "comment": "Malware payload (RedLineStealer)", "value": "cded490a1a7d4c1641a47fbb7dc1f1ee4270942d4ca0bf313bed3859825f134c756c25b658e8dd1401608e5fc977959d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212587, "uuid": "3fb8b219-6363-4c73-9fa6-9a5de1a525ee", "value": "T16605220BF7E84632E5B4377018F217D306357FA24A38479B168EAD4F49B23A5A231767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212587, "uuid": "87a9a1fd-7a21-4794-944a-0552b49a700e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212587, "uuid": "cdc4697e-facb-4fd2-9b10-43d9e6fb20ec", "value": "24576:Xyzst7AIKU1UAtwmEypK8Q2MiMKY3vD5Zl70SDOu:iwBHKLoC8jHMB3vDvlYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212587, "uuid": "d842068f-e0cf-4035-b368-64c83ab034f3", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212587, "uuid": "048b3a5d-1e63-4d8f-bd9d-e1cc8357d174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212587, "uuid": "618a1def-ed4d-41cd-8e7c-7b892992a5a5", "value": "cab3ebb913c7494ad7526f752eda2971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c900f96-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211673, "uuid": "cfb61e32-bef9-4b32-afd2-cc3150a0f7d5", "comment": "Malware payload (RedLineStealer)", "value": "4133287e88218759e6d05de03a8e4875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211673, "uuid": "4c8960c5-3bfe-4166-b130-ae5bec64d81f", "comment": "Malware payload (RedLineStealer)", "value": "8ac14bb5fa772de2cde340e4a78904b12335e1246cef4508dfaec4ee27e10cca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211673, "uuid": "11763630-e7cb-42c9-9928-52fffafa8225", "comment": "Malware payload (RedLineStealer)", "value": "f5adf0778d9a8a811ae4ed07e0856fe4b3f1d812", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211673, "uuid": "73b36ba7-a7a4-48ef-98e6-50047bb0a0df", "comment": "Malware payload (RedLineStealer)", "value": "18bc7157938de50efd9a77fe506ad89ec68978f5f5ccde2b60618bae70650381ad1c418123736468d54c292aced4cfbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211673, "uuid": "834057f9-6cee-4cd0-8056-8c1ae9513a18", "value": "T14745F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211673, "uuid": "bdb9bf58-f502-4e62-9dc2-10e3ce76cb7f", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211673, "uuid": "742abdab-b37f-48cd-9140-03d5c83c27fb", "value": "24576:MLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Wko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211673, "uuid": "f3250432-67f3-4b10-b9e4-b47f26b5b357", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211673, "uuid": "d9bd227f-2a8a-4eb7-b188-52d1bc0a31f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211673, "uuid": "882405d8-2e86-449e-8cd9-d2ee538f90d3", "value": "4133287e88218759e6d05de03a8e4875.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19108e3-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211359, "uuid": "81cdc37e-18f0-4f29-990f-79dbee488617", "comment": "Malware payload (Amadey)", "value": "11ecb04d293bc6814cc7bd550164cf2f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211359, "uuid": "060d69ce-64c3-42b9-889c-f9c048f5ecc2", "comment": "Malware payload (Amadey)", "value": "8c6a0698e75ed567d22079534fd962c7b9f59ae5cdaf7c5dccc32c7797fe3e7a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211359, "uuid": "0efdbc09-4268-4cd6-be96-131f73838ade", "comment": "Malware payload (Amadey)", "value": "6f6941a9a7cd2787fc27c4e2d57343e840f10011", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211359, "uuid": "becc52fe-45b6-4a3e-8d6a-e6089e687e0a", "comment": "Malware payload (Amadey)", "value": "5963e63762477565010f47ebd61552197b60788ed8494beb0fc6e2cab1acf5ec6c1db8003640df59deac0355c8173fa7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211359, "uuid": "dd08c287-e681-4d82-beda-8ad4a61c6fb0", "value": "T1CA45F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211359, "uuid": "3a489a35-baa5-4dc8-8e4d-b88a49720a52", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211359, "uuid": "afe5a94b-1f76-41a5-9c12-3494c1e9059f", "value": "24576:cLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Gko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211359, "uuid": "0d224903-9c2f-4178-8807-36b7ba8419e4", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211359, "uuid": "bfef89ae-f8cb-4f24-b76e-597369ae8d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211359, "uuid": "4cb5252e-2b24-49b8-9227-8fc158645844", "value": "11ecb04d293bc6814cc7bd550164cf2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7390a47b-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211685, "uuid": "3e9304b5-de2b-41f7-b100-68f6206f6320", "comment": "Malware payload (RedLineStealer)", "value": "36d56d783d89fa962428e75d53fa1577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211685, "uuid": "7e8c475f-ca77-4de8-9000-f374033ff9f8", "comment": "Malware payload (RedLineStealer)", "value": "8d60d0f19ac81c852a30662032988c9d48fb3300ae03ca9744be2a030bddcede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211685, "uuid": "fbade9af-02c4-46ae-a29b-a3b6525a763e", "comment": "Malware payload (RedLineStealer)", "value": "0430b58b33993dd2738660d08fb68dd9d2e75ec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211685, "uuid": "adc0c26e-55b4-44c3-89f3-7a5f7952fa21", "comment": "Malware payload (RedLineStealer)", "value": "a9deca46ca892f6307ac7065615526d33c45d2a8a75d390b82cae1b992ede61008d642538d72a8daaec53a4343541633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211685, "uuid": "1c9c831c-a7ab-40fa-a1d8-c0c34cc31129", "value": "T16635220BE7ECC122E6B84B705AFB03C31A39BC618F7486DB135E589A1C725A47476367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211685, "uuid": "094e4613-d1fc-41a7-9255-9d108b4e385b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211685, "uuid": "318159eb-b7a2-4505-8d75-6b472189825b", "value": "24576:XyKSVEFsRyZSbuLEcoOHuIwGlbLAPW7W:iKS+FEdAEcohIZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211685, "uuid": "7608fd84-8925-4a19-93b6-ff3900689d16", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211685, "uuid": "50157fbd-9704-4dfb-84d5-ace8be8e9318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211685, "uuid": "3f739ae7-d9cf-44e8-b6ec-2aac9b9beb0f", "value": "36d56d783d89fa962428e75d53fa1577.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4b04ad-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679214412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214412, "uuid": "8e4291a1-fd43-4051-a485-21f5270db2f5", "comment": "Malware payload (Amadey)", "value": "db179ed370031cdc795bf6b03c352ec4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214412, "uuid": "a67656c2-bf7d-4405-99d6-b80cfbbca793", "comment": "Malware payload (Amadey)", "value": "8e1094e3e0a8db068f8f7257f7f6474f5a077ba1d599dbab5fcab3101b6bc3b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214412, "uuid": "c8bb2221-360d-400b-8af2-4ce9ade1930f", "comment": "Malware payload (Amadey)", "value": "add9b43cf0e8f196e7509c23f962d3f9ceb515ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214412, "uuid": "40fdfcb1-16a6-4b3b-b5f4-122c188cfca8", "comment": "Malware payload (Amadey)", "value": "00ff09c051d36d1a3e9b909a84599d05077742dd57f00ccfeaee0bd5645d527332c5a3a9d055d63a74b759125d3cf7f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214412, "uuid": "f990e3ea-22f6-44cf-8a5a-935253f62626", "value": "T15545F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214412, "uuid": "26b3e855-28a1-4949-94be-2e4a620236f6", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214412, "uuid": "835dd1bc-37ab-4805-8714-0572b4539fd5", "value": "12288:jxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:NbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214412, "uuid": "a6fb7071-15fb-424e-9475-66f9d8e6eb8d", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214412, "uuid": "b69af78b-a460-4723-966c-497d1bb19cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214412, "uuid": "71fbdd09-60af-471d-a137-1fea64363c2e", "value": "db179ed370031cdc795bf6b03c352ec4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3251107a-c694-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679257531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257531, "uuid": "9e72f719-4a9b-497f-a589-25a7d4a9bac9", "comment": "Malware payload (Mirai)", "value": "b076a235201f63d819787e560de4a7e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257531, "uuid": "18916a47-3d7e-40d1-b9be-292d39953563", "comment": "Malware payload (Mirai)", "value": "8e3891fd194084410a3c1cfb8831cbfd8ac93d60714053c1b333e66c2d2422dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257531, "uuid": "06b11db9-6305-4ee4-8218-f6a22afe5466", "comment": "Malware payload (Mirai)", "value": "d5cbb3f618ce16b17569d26351b74a25b5e9d98f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257531, "uuid": "4d0832fd-70bc-4ce2-aad2-05640caebdea", "comment": "Malware payload (Mirai)", "value": "0592fb642674f9be53fa14a239a892c81fdf77a139f04945fdff6732c37456e499ae03905493c8540546d46153f21b66", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257531, "uuid": "7c47c489-5903-4ed3-b5db-4eb45f503394", "value": "T1A703E1BEF9B478269CDC347EE5CE132E4BE57690379A474423A10C88DB7551E6A8F02C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257531, "uuid": "3b2f2386-099b-43e0-b92d-719f1b6d5762", "value": "768:tka69F6uQhGnAWnKqEKfktcaZjgsm9hFALTksBRWP:tkaSyhynwKGZk9leT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679257531, "uuid": "f64f594d-c865-4cdd-908c-7dfc46f1c410", "value": 38320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679257531, "uuid": "42d02d3c-fd52-4439-8099-c5489acce9a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257531, "uuid": "1b84fc6a-07a6-4233-828f-2bcf5630bcef", "value": "bok.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e196a545-c637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217882, "uuid": "b6a1b8a6-ce15-46e1-9d00-c91ebab3d116", "comment": "Malware payload", "value": "de9c8cfa46dc5299a27013d41a6a6f16", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217882, "uuid": "e280be32-72b1-44e0-a80d-5e47cbb5f741", "comment": "Malware payload", "value": "8e4089aca74c8531fd04476f585b6ffe645e5b41bc5f1a65406ceca86dc63df2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217882, "uuid": "0a8d5ba1-d3e8-43c9-9b7f-322461e56b93", "comment": "Malware payload", "value": "bd70eac4c3771c959318df77e73d5a76e86215da", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217882, "uuid": "0814f878-2cce-4a5e-9c92-54683a60a2c9", "comment": "Malware payload", "value": "ff927625dd113948248773286565dce3c82e08bb2d54b0ae267bac4e7a870bed94a36db6235d8399007b9623d632928c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217882, "uuid": "061ac0e7-7bd4-458c-a5c0-8b99a9e3cab1", "value": "T18EF6F11EBEDDE029E60B80F21041E153F42B4EF9E50AF15B11B815BB98A5C950B4BFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217882, "uuid": "252290cb-79fd-4ee3-8c7e-a51fbd0cb444", "value": "393216:VVmmrNNWdk4OlBY7HxBAQStutiPvW//Ow3+PgTWzjwJQqwLkZ:V4uNhBCRUAmK/OW+PgTrkwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217882, "uuid": "72f31aca-bc14-467d-8953-328669982a5c", "value": 16409916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217882, "uuid": "524f595e-6fcf-4485-a09e-8882c799e1a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217882, "uuid": "35428cad-c8e0-4981-986f-7fe5bf8cb2ec", "value": "libs.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242384b6-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226584, "uuid": "66163926-abdc-42d9-ad91-4c3f5c1ed30c", "comment": "Malware payload (Mirai)", "value": "3ec972eeecdeb196652d34ae52af510e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226584, "uuid": "a15d1c68-5833-4b49-ace9-44ae8d64670f", "comment": "Malware payload (Mirai)", "value": "8fdf3c5043ef7f6529e236baf80ade0d919506d57140c9329b81f9e6735cf0f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226584, "uuid": "38f24f29-c045-44f1-aacd-29f980cd7440", "comment": "Malware payload (Mirai)", "value": "45301b64d23fd1c500492c7e8d7316f5e1bf076c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226584, "uuid": "959e5435-f225-4299-bb55-7bbbe8581b7a", "comment": "Malware payload (Mirai)", "value": "224c67f290b43a3ff70956897174bde9b8ff1493b6f1384174f567c42b2ebd0466e30fcce0840d935dc1d72627093806", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226584, "uuid": "a6fece1e-bbba-484b-aa68-e212591bd32d", "value": "T142E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226584, "uuid": "f73d9b29-f623-4d67-8da3-7dfbc117cbfb", "value": "3072:JW6dm9tS1aRGQdK76t/zCzI5mrThPaLEnvPrNb:c6IG+LCUmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226584, "uuid": "e8cc2ce1-fc95-4572-9d54-040ea42c8639", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226584, "uuid": "7cd9af51-9d1c-4005-8e84-6149336c68c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226584, "uuid": "268f6141-8ab5-4a2a-9da6-efe2c7b50f83", "value": "3ec972eeecdeb196652d34ae52af510e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630e3795-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211657, "uuid": "ee918918-7bc7-47cb-93fb-8d2d9c5a65a8", "comment": "Malware payload (Amadey)", "value": "3d217ad4686b3f690419e37c912670a3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211657, "uuid": "fd422f4f-05d5-4cba-9367-352f63591e51", "comment": "Malware payload (Amadey)", "value": "906f56676155ab48905692d348cb89294d31fa0f9293e083eb87b54e25899ce4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211657, "uuid": "a244cfa1-8c10-4862-a932-57889b7472cc", "comment": "Malware payload (Amadey)", "value": "d6bfa99d88df1f5c344a4f87d1743def6cb8c397", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211657, "uuid": "f55d49fc-ff1c-4d8e-ba23-e87f5afd27e5", "comment": "Malware payload (Amadey)", "value": "5b0ae40d5e5a70de54e9461dc575a3abb292b45e682946b96179de36f2c2ad22966df1ffe3f5d2ba810b7f19c7ef5862", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211657, "uuid": "3344cd6a-ae6e-4dd3-869d-6461b2511393", "value": "T1E545F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211657, "uuid": "c1066fa8-2f42-4dd7-afed-f4ae8900c311", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211657, "uuid": "71c5ef06-83b3-48c0-b608-8574795db5ed", "value": "24576:+1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:+1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211657, "uuid": "0dc0f3a4-8bbd-4a1a-a018-c90c04eecdcc", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211657, "uuid": "b0ee6af8-eabb-434f-8a03-77e332746050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211657, "uuid": "0eab5071-f59d-43a6-98ac-e55e03ff2ed2", "value": "3d217ad4686b3f690419e37c912670a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bead542-c652-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679229255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229255, "uuid": "5cfc4d64-2312-449f-93ef-f54e04d6658d", "comment": "Malware payload (Stop)", "value": "8de62d2ae6917acafbfc286f75df2552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229255, "uuid": "5b983866-c7a6-405c-b09e-67540d67109e", "comment": "Malware payload (Stop)", "value": "90925440b152418f4955cb81fcf2ba978c73923eb9bfcc12627fa779bb82acc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229255, "uuid": "50620cf7-8a61-4739-a173-c9c0b39b488d", "comment": "Malware payload (Stop)", "value": "3e310844a668be95e133ff18b7886a3b0431cd60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229255, "uuid": "f56f3802-5795-4a29-9f7d-59082d56f14d", "comment": "Malware payload (Stop)", "value": "dd58a37d7cf22b3c17eea1fe9a48063ed777c3e23905fbf243409fe34a2d5838526bb42730d168acf02eb33b35af1413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229255, "uuid": "940ae190-35fe-4fe5-bcc6-160f526aecd0", "value": "T1AE05CF4382D17D49E5368B739F1EC2E8B70EF671DE896B6932188A1B04B11B3C563B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229255, "uuid": "ddace4de-ae68-4dd2-a0c4-87ae12ff481a", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229255, "uuid": "b7e6ed7e-3467-46d3-80e9-d1551c83d3f7", "value": "12288:NPjuS/psFJ3YLPTeD1XQEO4vyUuJn2SkTmEuNFXiLmPnfqCVNE:d/aE6pjvIV7kTR4MLmlVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679229255, "uuid": "f78dc794-a76d-41b5-805e-23162a74c563", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679229255, "uuid": "e3a33d01-db2a-4679-8112-d2b6b3e5822c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229255, "uuid": "fabb70d3-d52a-4a20-a62f-df684bc11c43", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf2fae0-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679241309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241309, "uuid": "f4edf5bd-f921-49af-8401-f6bc3c2937ee", "comment": "Malware payload (Rhadamanthys)", "value": "5b3b11362caf1ead03bb3a40c1187e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241309, "uuid": "002ad2f0-89cc-4f05-9af5-b359aaefd262", "comment": "Malware payload (Rhadamanthys)", "value": "915701f1afb2c06b564be989ba6f78997b34bbe5ddf85e9edfc617487870a0be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241309, "uuid": "b4f0480a-405b-4a6d-a6d4-7afdc88bd4cf", "comment": "Malware payload (Rhadamanthys)", "value": "6fa8308e677dc9513f1611ce69f6d2a4f9ede2ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241309, "uuid": "53f69bc6-1c57-4ef0-b1ed-3721c01b36f4", "comment": "Malware payload (Rhadamanthys)", "value": "a4dda2d919c1a2ca86c79de3bf7553d8668eb5af9c6d3adae65cb20d6f77b1292de2fb15c4ba6c0f7c987b8e02f7e912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241309, "uuid": "234172fd-d5f6-4ee9-bfad-45ec27a2362f", "value": "T132743B4392E13D48E9264B739F1FC2E8B71FB671DE497BA53218AA1F04B1172C163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241309, "uuid": "c4b8b099-d8c4-4283-a0f2-129b6bcc21a3", "value": "8b512f0a0b2cd54ff600ee8ace8b2bd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241309, "uuid": "7336b899-c227-4203-ba5e-0d6c4bc39c1b", "value": "3072:JvgJJMFLOuP929W2iJCEYg8KpByirihhWBXuhN/e+ybwcbHn1AFzNO75MRtCcyK:GJMFLOu129/WpB4DW+yn+jUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241309, "uuid": "a3b0fb8f-3783-4fb6-a2d6-fd739e973969", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241309, "uuid": "937cdc6f-559b-4673-b3be-a54b304e60e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241309, "uuid": "ae95dc4d-cb3d-4882-bc69-f56a8200f5a1", "value": "5b3b11362caf1ead03bb3a40c1187e12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bad5f3b-c63c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679219859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219859, "uuid": "dae3928f-925d-4051-bc6a-c1972aa65b66", "comment": "Malware payload (Mirai)", "value": "41a3a1e9c2a8c40012f256aabaaf8b2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219859, "uuid": "731d9bad-801b-4f27-960e-c393311f03e5", "comment": "Malware payload (Mirai)", "value": "92520480f0be792920c949218c60e5da725c82a2a5b2493a9f5c84783f1cb1d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219859, "uuid": "9bc1283f-16ad-4f9a-aee5-bafe1e5c037f", "comment": "Malware payload (Mirai)", "value": "bcf660a985f204e1c21175f98f91841b319f2a77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219859, "uuid": "d8fa6116-36eb-4873-9618-e5d9b7b4a28c", "comment": "Malware payload (Mirai)", "value": "a1e1d05b2838d40f21f2ec7a2ebb369e9ad0cc646076517990268e41cc0470c6a691416b0e4f3672908c48afaf7355b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219859, "uuid": "6285f69e-05ac-483a-9b7b-7210f4cb874b", "value": "T189831946BC819F01D5C912B6FE2E118E33131768E3DEB2239D149B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219859, "uuid": "22316724-ea20-4f78-8114-47d1e6c3ed18", "value": "1536:CxnTsKJgf2wC2ZTwbMT4IKsk5ba8wkbyMRiOcYc8QRQv5SYG:rKGs2+AKsYaycYc8QRQvMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679219859, "uuid": "077b083d-e00b-4249-b91a-e69843b979fd", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679219859, "uuid": "8cc563b3-ac49-4399-8e89-ec456bfbf5c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219859, "uuid": "ac9a1065-b0ed-4ead-86bd-7d48287e6db6", "value": "41a3a1e9c2a8c40012f256aabaaf8b2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0f4fb3-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679212805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212805, "uuid": "daacca37-de44-4bf6-8d53-b1bf61fd0954", "comment": "Malware payload (Mirai)", "value": "dbb2301b2bd90df50ef0600d01243d3f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212805, "uuid": "01f54c89-f7ee-4790-a50f-e0b699f460b7", "comment": "Malware payload (Mirai)", "value": "92b0350825e41d10d4bb3889946a61678e61324945e0eb0509f0c26c6c22ae24", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212805, "uuid": "7718780d-cb00-4dd0-9134-8f7b3ab6f54b", "comment": "Malware payload (Mirai)", "value": "fd9e63f45ac1ceb9e3fcca76b40f4e528afd1eff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212805, "uuid": "0dacad39-7c71-4c38-8bf3-716167c489c5", "comment": "Malware payload (Mirai)", "value": "76447e426dba20dde970d6aaf03bd6fb716d25531eb4a3d9180c123f90774932a995567ec7b829dd758be39f6155a0d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212805, "uuid": "96e4e150-4a37-41bd-94b7-32a5059046f2", "value": "T15F1349DAE287D8F5E81201B0247AEB735B76D27E2066A987D354ED32EC13542E24738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212805, "uuid": "62f62460-fc32-462b-87ec-90c59d542fb7", "value": "768:T/nHZQbnwwguWbmXMsgezJOLEObqVXrT4PRRf85Xo8iunOZ:T/nHs1SmXMsHFOYObqVXrTWrf85Xviu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212805, "uuid": "e47dda04-44e9-479c-b3f4-ca7521907e12", "value": 42640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212805, "uuid": "ff0a9851-098f-45f5-a756-72fc1badfa3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212805, "uuid": "6351e2c8-dcbb-46c6-99f8-ee00eaf2c3df", "value": "zed.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46c9e47-c65c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679233805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233805, "uuid": "3777f045-d223-41b2-ad74-93ed6ec9cb96", "comment": "Malware payload (RedLineStealer)", "value": "13d663251ecd6368c2ccfad1e19a2aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233805, "uuid": "ea971595-9876-4791-bc4c-483ca6d1a86d", "comment": "Malware payload (RedLineStealer)", "value": "934f9cf6bc79eb4e4a2e9b82df7f024294c88eba57f5a19d43d2a9c3bbd7dc92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233805, "uuid": "4164eaeb-59d4-4269-b21e-b051bdbdc790", "comment": "Malware payload (RedLineStealer)", "value": "dc11f14bf1af927275451db1b91a43bbc8a4c50a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233805, "uuid": "c82f2fc4-c023-4b98-aa51-0643266ddb5a", "comment": "Malware payload (RedLineStealer)", "value": "9994fa6e7cd2a1e08a57f0642adb6b24a90bcdbe7688ae3df1129e534fcff134e8d899665106581747701e52bc05afab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233805, "uuid": "e05f2f2c-80ae-4020-b096-9c5b2b73e418", "value": "T179352307F2E89162EC3A6B7044F702C30E3A7C90AEB557D7134A6DAA0C73525B57A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233805, "uuid": "9dae12e8-3ece-4a64-94ae-f766d5b4ca12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233805, "uuid": "271b7464-6585-406f-baa2-1673e7fb9fcb", "value": "24576:FyKTPtqPP92E7XFSavH9IrJJBDUSd+UzvhLp50:gK5qPP92IX9IpPHv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233805, "uuid": "bba99f98-a398-4610-89d5-f108d8b0edf4", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233805, "uuid": "553d8d98-b007-4e26-969a-a559845cc767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233805, "uuid": "027e5bf5-d9ac-43bc-a3be-7e5de85a59d3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfd6e50-c652-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679229419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229419, "uuid": "9eaf0195-797f-43d4-b517-cb8a65c0bc64", "comment": "Malware payload (Stop)", "value": "a993591258b7fe7c5fa4ee7aa4a27c54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229419, "uuid": "36cdc320-4e48-4e86-864c-1ab58759e11a", "comment": "Malware payload (Stop)", "value": "9397ff6e983a3a071173c76e020e464ee2df3def8925c373eafaf38eaa410bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229419, "uuid": "fae3074b-63cf-47cf-a2aa-ef9a2468efa7", "comment": "Malware payload (Stop)", "value": "9c0259cdd7c4d1774faf4e75c908a9181c50c2f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229419, "uuid": "5fe64758-f244-4880-842d-a93973e81f7d", "comment": "Malware payload (Stop)", "value": "0d9b7faa5a06e351a4d1109589f45e1fae14e3631e846e5fef7d5127cd1af7af00be6a0c810d8e0743d6387517dc7ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229419, "uuid": "6d1dbc20-c05c-4102-aa77-fbbe73f49064", "value": "T14605CF4393A13D58E9264B739F1ED2E8B70DB571DF9D7B6932188A2B00B11F2C163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229419, "uuid": "ac961195-7c7e-453c-b0cc-7369b4bc7811", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229419, "uuid": "9c5bcea2-fddb-489b-92de-753ec5355c49", "value": "12288:fPTIoIXI014mkOvMls/j6BzxRiTCtf6suT+RSLn8XfUsGBTWE:3QjPvM86hx4A9GnwcTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679229419, "uuid": "55523136-15cd-4c5e-a754-f818eac19012", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679229419, "uuid": "13f6f7c4-1772-46b8-9691-d7af0b8d2429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229419, "uuid": "5afc4eca-b197-4e3c-9e7e-21d26febe81e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a863fee-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211965, "uuid": "83e7e009-edd2-4f32-b573-d278994e4158", "comment": "Malware payload (RedLineStealer)", "value": "62002529a1f266228a4ca2ccd6f6a8e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211965, "uuid": "4e7e05bd-c424-4a87-88b9-4a91b17cfb16", "comment": "Malware payload (RedLineStealer)", "value": "971d332a2ae9b41b528e6a8319976aad8c26628a49cb1fe8791593658c4cab98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211965, "uuid": "6566af1c-f009-4779-bf66-39080ddacba4", "comment": "Malware payload (RedLineStealer)", "value": "a6eb44270b97770f1f711738ad7f496cebbc1fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211965, "uuid": "14aed677-c1bd-4408-a87b-e5619559fbc9", "comment": "Malware payload (RedLineStealer)", "value": "15443f0d44dc2635e95f86e3334dbcbd5589ebeb14eb8886ecbbd3be1de368190803fba2a958b41461875ff187720043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211965, "uuid": "5aded62d-cd38-4869-8969-5c4535fac589", "value": "T16B052243ABE44462D9F113B048FB42532F3AFCE15878861E2B66A95FDC732C5943236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211965, "uuid": "fd089fba-f6c2-4086-8ceb-1d8d6cff1d1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211965, "uuid": "ef9cdec6-0926-4f31-ba2f-f3bb2ad4ca80", "value": "12288:SMr1y90Y5VOTWWMHpCiNb+4v+EXgpqj+CvqTZ2AQvZukb1+TYC8DO4:fyjbWMHpCoqIL+NTMAQZhb1+EC94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211965, "uuid": "ea3d0b24-f3cf-46a5-8b41-3366fd6f38f0", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211965, "uuid": "fe5631f1-6078-4b05-956f-c75afa5eee1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211965, "uuid": "e0e1708e-f9b9-4383-a0ed-055b1d964fc1", "value": "62002529a1f266228a4ca2ccd6f6a8e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252bb009-c668-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679238612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679238612, "uuid": "9601b0b1-595b-492b-ac59-505a003a43f1", "comment": "Malware payload (RedLineStealer)", "value": "20b01b94fec9143a2adf624945aa41c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679238612, "uuid": "ec7787fe-a063-4b10-a956-19a71d51ee40", "comment": "Malware payload (RedLineStealer)", "value": "97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679238612, "uuid": "9bc9646b-f8f7-416f-b13a-eb3d7da6770a", "comment": "Malware payload (RedLineStealer)", "value": "3e3690bb58b1a42cea254a0eb039019c7ebbbf3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679238612, "uuid": "c6b23565-7d50-4abf-adf0-b7faa46f98b8", "comment": "Malware payload (RedLineStealer)", "value": "749c9182283a7784e517cdb86c08abed5dc1af872e3f5a5b5168755baa996a5a6cacb72e85692f07b5d946e577b6c264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679238612, "uuid": "4bbce422-604f-4ab8-8acf-8dc5632002e8", "value": "T1EB04D51437FCDD11D1BA5A3FA961A05086BF9802A842F75B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679238612, "uuid": "6e2409d7-10bd-46df-917e-6f522d45c51f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679238612, "uuid": "fbf35361-493a-490d-978e-845aae1ea123", "value": "3072:4xqZWVba1Qhu/q55e55FQhMvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+c3:mqZ9q52Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679238612, "uuid": "f2f8154c-1020-46a7-8975-006971ed5058", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679238612, "uuid": "65c0dc88-34e3-4627-aa97-fe785e09573b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679238612, "uuid": "e3ecd042-6ac1-40c0-bb34-2ebee5f36ece", "value": "97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb22946-c68d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679254514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254514, "uuid": "d1b9cd78-fdd2-4789-9411-2f901cb6253f", "comment": "Malware payload (RedLineStealer)", "value": "2dcb98fd5966936cc39cbf79a77cb10a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254514, "uuid": "0b5dab04-910a-42b9-9d13-3325b902ea9f", "comment": "Malware payload (RedLineStealer)", "value": "992800ef53c471350a0350954576bbfba075542b30adfe1af658c5efdb90bf2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254514, "uuid": "48d6efeb-c581-448f-b54a-7b783a6df184", "comment": "Malware payload (RedLineStealer)", "value": "e1c4dc9fb75d03649361919a2aae94b110799c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254514, "uuid": "ab5b0ba8-0d48-4ed4-aa43-514baa23543c", "comment": "Malware payload (RedLineStealer)", "value": "efb97c92478301148693feaafd168826d05db224de9ca82cdb3ffa619ede26424b3c07f68e5241c546ad2d07b81a97dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254514, "uuid": "d3aa0d23-83e2-4700-9a52-b84e80a8b051", "value": "T1FA748222A5D78392D2A7DEBD95E8021C4BC6CE842414A50DF95C5FC3B709EF0297F6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254514, "uuid": "8768e0b5-9281-4638-bed8-807187e50226", "value": "0a10feeab78e14d094cce830068ffca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254514, "uuid": "dba50f84-373f-459f-965c-6a9bad8ddc08", "value": "6144:U9Sq1oBFaCcpMQuyFAMcqzDMdtcoHCaVPM:U9zDdpMQuyFAMEtiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679254514, "uuid": "140bedbf-5362-4f3e-95ec-6d99ccb2177e", "value": 346520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679254514, "uuid": "64976c13-8852-4f22-878e-27d0412d0bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254514, "uuid": "80002ce2-13b1-4d25-bb10-c03b6e0c54ad", "value": "2dcb98fd5966936cc39cbf79a77cb10a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b22ff08-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223294, "uuid": "3f59a352-37c4-4998-b235-595231d4c855", "comment": "Malware payload (Mirai)", "value": "19460012eaa5e7086271b9a37739711d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223294, "uuid": "d4236ca2-cba2-435e-9dcf-cd602b1e79c1", "comment": "Malware payload (Mirai)", "value": "994887445a78d604c1bd5eb593053f8f88d8163a372e3a2cd73b395db6017cfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223294, "uuid": "46f02169-2377-47ad-841c-8087997fcb04", "comment": "Malware payload (Mirai)", "value": "4c9378cc1b575e078439d2ac2a6140264bf7bde6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223294, "uuid": "9aaed448-5357-4fff-97d7-091919ec16ca", "comment": "Malware payload (Mirai)", "value": "ce7dffe75c4243dee9e569a43ca2a2b6105bc7a334798bd83f55804c57e7d7e8f6bceaa6eca1ed4d4049ecd853a24631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223294, "uuid": "f109ac78-6226-43a2-b6d5-b6fd3d6327c7", "value": "T16153971E2E119FBCFB9C873547B74E21968C339626E2C645E15CEA012E7034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223294, "uuid": "101dc429-b923-40fb-a04b-0f4c7a2bd141", "value": "768:ruVBQl7KPLz+X/rZTnsrZThdUrcOZUehcjx9DIOVJlbplhy7dA+V/z7JcbiB0QRm:QQRKPLz+XdnMwrcOUjLbDI7pZ9RFW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223294, "uuid": "2a6a93d7-6ecd-43e5-a428-10186758a632", "value": 63364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223294, "uuid": "4994f022-a368-4786-95e7-0920a4d0cf16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223294, "uuid": "40b91998-e0c5-4a35-996e-d938ceb8f642", "value": "19460012eaa5e7086271b9a37739711d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da985d09-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223454, "uuid": "50baeabe-13a6-4a9b-9f1a-0b3673aba1f7", "comment": "Malware payload (Mirai)", "value": "7539300edc4f748e4e475679b3a494b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223454, "uuid": "0ea87735-0715-4e0d-9f11-402f7df15598", "comment": "Malware payload (Mirai)", "value": "99f79e1b11d5daf80c360007d63ed754c377aba1cd995dd196a0624906059f9d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223454, "uuid": "2454ae7c-47dc-4b32-87bb-7e3e007d3e72", "comment": "Malware payload (Mirai)", "value": "908b89ae3cb8d3a6e49431870b03db2060796185", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223454, "uuid": "26de5e9f-0917-4429-a2bd-fccb2c509acc", "comment": "Malware payload (Mirai)", "value": "dcba038e09c15418c5dc7db6e109d9118a55802a685969febb117f7f878fbc11129b462f86a713a84ca5168ba38c4df3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223454, "uuid": "9a47bfb0-38d3-49f9-a959-807def4daea7", "value": "T1A6A2E0257F1DE98FCD37B23883E9E5C693D07D24D2DCC6866741C11BABA36846834E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223454, "uuid": "8efcba33-9e61-4c0e-8b85-bf89ca0e11e4", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtslvSt:x98o08kxofBE+ZkXaT47C2Epit4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223454, "uuid": "2d5aaf7d-5c46-4e9d-966e-3a4dd7739593", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223454, "uuid": "97ad01c7-f9c8-4820-8512-07a0b115e1e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223454, "uuid": "d4390e57-618c-4df4-9766-db40c7234f34", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514cf977-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224942, "uuid": "c5a6cfa3-5900-4377-b613-4059cc78a9ed", "comment": "Malware payload (RedLineStealer)", "value": "b8f22c3b5365a9c54c30fdb580a1a57c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224942, "uuid": "759f6921-ec10-4015-9e94-0f823cc5509b", "comment": "Malware payload (RedLineStealer)", "value": "99fafef35020660488f3d881642ed20b48dca7d467bced357541ec1b750788f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224942, "uuid": "eec49d87-d7cd-4f1e-985d-243ec9eb827d", "comment": "Malware payload (RedLineStealer)", "value": "4bbfaffc4382b9b7601ed74c5c7695ab37acb413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224942, "uuid": "74090ec9-e780-4ce9-ab6f-114622c6208b", "comment": "Malware payload (RedLineStealer)", "value": "e0d9eb7195c8b7f81d8a26fe50c6e0f7f7f1a0384c8a14326992771ffe8cd6d8c74eaa38a5a4a1c4f374789107a3184f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224942, "uuid": "757d0afb-2604-463b-bec5-6872f0f23da8", "value": "T11645F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224942, "uuid": "cdc79b0e-aec4-40d7-a732-e10a66650866", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224942, "uuid": "f4c8f167-33f8-4382-9ef5-5a14cd165f08", "value": "24576:U9h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:U/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224942, "uuid": "96710bc0-4863-4e97-a923-91b7ad70eac2", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224942, "uuid": "f4bb2dd5-f5a7-43b8-85c7-a5953de8f0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224942, "uuid": "ba17ccd2-51e0-43e1-85c6-c4ff4799ed45", "value": "b8f22c3b5365a9c54c30fdb580a1a57c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ca1575-c69d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1679261460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679261460, "uuid": "3f23a8a7-3cc0-4264-ab46-d9009cfb0351", "comment": "Malware payload (Vidar)", "value": "24604438f2cb5fcbda87b9fe3f817bcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679261460, "uuid": "62e87285-2dc0-4670-8648-54974bd2db72", "comment": "Malware payload (Vidar)", "value": "9a61e776585dc88a15e548278caead09cdb871d4f4fac962cf14f0d43eca9c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679261460, "uuid": "d319d968-9807-4da8-a14f-009b9a97cf86", "comment": "Malware payload (Vidar)", "value": "fe61f3c2824ea356df33eba858d5abed8f46ef82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679261460, "uuid": "6f63e303-9569-497e-9d25-63f2b71eb6f1", "comment": "Malware payload (Vidar)", "value": "099f7f2611f780c07d31ff0e31d42480d115d7a5a18ca99b66cfc94207ad0c8dd6709f66db782499560dd613efc0e071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679261460, "uuid": "3fdbafc7-60b3-4c27-9285-5610dc40addc", "value": "T11894120A6FA291A8FABA20B56CB54D386533DC2DE2C49B4FE3C8F178D136B411532D5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679261460, "uuid": "1e204c2b-17b2-46af-921d-0b479c0119ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679261460, "uuid": "6571626f-9ca3-4358-90fd-3fc4235d7495", "value": "6144:YtojTSy7+iRLF+NkKloo39+Te9Oy4BXZ/lZX02oNawWk/mrFy27UoZkCDqUFh:bSAM/99+Te9nWzZXcp/GF7UyDqUFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679261460, "uuid": "60e1bb7b-3312-4332-86f1-6ff881f4f96a", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679261460, "uuid": "f4f873e1-b001-4cc7-80fb-d3e2079284dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679261460, "uuid": "6c52aba9-f516-4add-a612-2f0176c8d160", "value": "SecuriteInfo.com.Trojan-Spy.AgentTesla.30857.29403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b53407-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211980, "uuid": "496b7c7f-e90a-4856-801c-e955d56a3eb4", "comment": "Malware payload (RedLineStealer)", "value": "30d90115d275ef7583c5651439758b3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211980, "uuid": "9a6340a4-35ff-41b4-92b4-688c3d983781", "comment": "Malware payload (RedLineStealer)", "value": "9a6902207fc90231e32721f9638aaf06464ce2f627f1e334fd37346e94a11cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211980, "uuid": "3d021789-9d63-4be2-bf0b-b626c2b2e510", "comment": "Malware payload (RedLineStealer)", "value": "073b26bdcbbc994ced8d6c908096561433ed6478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211980, "uuid": "65590406-dcd1-4cd2-a548-e2d6ec68e946", "comment": "Malware payload (RedLineStealer)", "value": "44d2d79bc730c01f2e7660118eded6243ce48546b25500b800ac6eb52f932e942fcb0c0aa5fa7bbd4ae2c57d8b8e99af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211980, "uuid": "7f6e472a-f9ab-445a-8d9d-d52f14cb1d36", "value": "T11245F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211980, "uuid": "e87bc642-0fbb-420f-8e46-c11cb6537d5d", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211980, "uuid": "ea677214-add1-46f0-b6c6-71c481e1c21c", "value": "24576:NhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:NHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211980, "uuid": "2c6d6006-0974-4c1e-bf1e-ee030858bc14", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211980, "uuid": "0f056ad7-376d-4a48-888c-29729911426e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211980, "uuid": "2fe275ff-511b-40f3-85eb-7cf1a961d600", "value": "30d90115d275ef7583c5651439758b3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ca8b5b-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679214405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214405, "uuid": "28e1d739-0e2a-4d0a-83a6-587567b3ff3a", "comment": "Malware payload (RedLineStealer)", "value": "62008ab8d2d61523a0d2bbda022e94b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214405, "uuid": "8ec9cb1c-af42-4c7e-9509-36285dd45e3e", "comment": "Malware payload (RedLineStealer)", "value": "9b103927cc65d597799c102cf614f0abaede275d9ec39dd4d2aa341f8839a98e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214405, "uuid": "98ca44b0-2a8d-41a6-8356-8e9a1a3f2ad7", "comment": "Malware payload (RedLineStealer)", "value": "f31e736a6fb34640c04a7499078eecef4b85909b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214405, "uuid": "5f9b6f68-3a1a-4638-b01b-015c3fc867d2", "comment": "Malware payload (RedLineStealer)", "value": "d259f4829ddccb9c74497ac0a304215da105bc0f93f1688f013c86fd187833b7f6e1989ca9dc20ec93e7eb0a8a263b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214405, "uuid": "fd19d982-e0f5-4dec-bb1b-08130163c130", "value": "T12445F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214405, "uuid": "22882e39-2592-432d-93b2-3e73149df9ce", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214405, "uuid": "3e8cf933-c48c-4da2-b737-1d3fec5d9a36", "value": "12288:LxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:VbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214405, "uuid": "6e0cc07d-6250-4ef6-84b5-36a596e04a5e", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214405, "uuid": "7a89e1f3-ebcd-4843-baa9-e6c896de4c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214405, "uuid": "de12cf3d-52ab-4b99-a2d9-f3f3d320255d", "value": "62008ab8d2d61523a0d2bbda022e94b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cd2266-c655-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679230399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230399, "uuid": "4ae89821-8b8a-4d3a-af6c-3cab5e515f27", "comment": "Malware payload (Smoke Loader)", "value": "a89c355d8da55ce5920dde1d1deba5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230399, "uuid": "138b1608-7cca-4970-8c12-cea0e97c4eb7", "comment": "Malware payload (Smoke Loader)", "value": "9b2cde69ebf49f745faeba7b7cf8780d2693ec360e502aefe07628da290310d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230399, "uuid": "a24f2122-361c-4ec3-bc70-699e741de509", "comment": "Malware payload (Smoke Loader)", "value": "482ecb9eb7329d0c7b0a32bd575caf1f3315da02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230399, "uuid": "ee3a2c37-9556-4547-978c-65fe2e2fa354", "comment": "Malware payload (Smoke Loader)", "value": "c21d830f8fa35490a1c235ec7a64ba77ee1f638c173e7d8e015945fb6e7e3051e273ec906d9816ecbd488700fb964369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230399, "uuid": "59f906af-3624-4b2c-9db0-8a729d97ae6e", "value": "T15E54090393E17D48E9268B739E2FC2E8B71DF5B1DF497B6532189A5B08B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230399, "uuid": "e165b0e0-0ede-4c7b-90c3-fc59af62edda", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230399, "uuid": "e22dda18-0a3c-4809-8727-9f2d437670f7", "value": "3072:QDKaXtLrEDfnTnEvrj19FqlidY2/bZQcT75RLn7t82KEV:wXtLrGnQzjr/tQc/j7KEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230399, "uuid": "d469240e-df1f-4351-abac-797150f72ef0", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230399, "uuid": "9b13a2b1-bd1c-493c-9f8e-fbc142a68e87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230399, "uuid": "26d6269f-b3f0-4cd6-b50b-ca8d16576b34", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657b65c8-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211661, "uuid": "0bd8c56b-4795-4fbf-871a-19fca5c723bb", "comment": "Malware payload (RedLineStealer)", "value": "4013993f475e748153f30be4994dee9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211661, "uuid": "7ece5988-b8f7-40c3-b56d-03b4ad51de78", "comment": "Malware payload (RedLineStealer)", "value": "9dca65b45f4e509d246dff0507846ac759c621eac518bde608a1250bfd877f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211661, "uuid": "5892d96b-9bac-44ed-bcd2-95d42894a5c0", "comment": "Malware payload (RedLineStealer)", "value": "1c297e3e551bbcb14bdf80cf6792865d4fe86ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211661, "uuid": "132ee118-74c5-4646-a428-80bbf03c2fec", "comment": "Malware payload (RedLineStealer)", "value": "38ecc303d40efee3680e7a2cc14f2086361701a31fe5f3636677631dd38f9c94acbe95c09f3c08b1cd80ec014b0efd54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211661, "uuid": "6f1ebf80-06b5-416a-aa61-0fa731da29f5", "value": "T189352307E6FC5036E8B463706CF60AC31E367E62667452AB220FB90F1DB21947636717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211661, "uuid": "d6f2f10b-cbf5-4013-b55b-cf8bdaf98235", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211661, "uuid": "a3ba1d6e-5241-4710-8aa6-8f716f899f24", "value": "24576:LyuY4dru9xi9MQFQ5I6xwe3vmnOwsufDs7YS:+Adrl9MQFje3vmOwsuD8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211661, "uuid": "b91ac76f-5e60-4483-9945-1337ae0a8100", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211661, "uuid": "fde612cd-6564-4912-9f8e-8a1d70bea22e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211661, "uuid": "19f2ef9d-5fb1-45b2-a11e-cf4378755dd3", "value": "4013993f475e748153f30be4994dee9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497df317-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224929, "uuid": "744e2dce-6685-41bb-bdaf-6a79c1f79ae9", "comment": "Malware payload (RedLineStealer)", "value": "b5418c27415e870dcc345c7343104618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224929, "uuid": "46353347-c714-4459-b9dd-72e9f3f38ba9", "comment": "Malware payload (RedLineStealer)", "value": "9e965495abfb70be5a6d9a980ea7cb2782cd87e47287697cf9aa955a3a92f5fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224929, "uuid": "004d06b7-6267-47b7-b98b-43f4848e0643", "comment": "Malware payload (RedLineStealer)", "value": "31ea9b4c591f0089d58d809d3706757c9b74ad59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224929, "uuid": "e8cd3f12-5c48-4d46-84ea-cc7cde588e75", "comment": "Malware payload (RedLineStealer)", "value": "a9ca060d3d52fc569c42d4468576d733d3f6d6d9e65eb64b985b538947bda6762614000d14be182e816b3210bb3f0673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224929, "uuid": "d4a7c7f3-ca20-435d-ade3-464beddb2b21", "value": "T12B05120BF7EC8422C9B9477018F256D31A367D515F28822A339FAD9958726B4F2343B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224929, "uuid": "ee79c1ab-9d05-4f2a-a32c-34ce4fd9cbe9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224929, "uuid": "8c6a688b-8e22-47cd-a809-1a1e1d5cb94e", "value": "12288:ZMr/y90Yuu+q11fLkt2VFb73yBv3ThSjwr8zL8SPqVUP1F47V:GyluufHkt2Lojh78HqVUPziV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224929, "uuid": "a1b76ee5-5a08-48c3-a2f0-01c291ac4774", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224929, "uuid": "ddcb0420-905b-44de-9f3d-3e888a4e1a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224929, "uuid": "6b5737d7-4b5b-4a4f-996c-853258a3a955", "value": "b5418c27415e870dcc345c7343104618.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1df6e3-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212583, "uuid": "bab82efb-92da-4d68-9bf8-2a8830104f83", "comment": "Malware payload (RedLineStealer)", "value": "c82055979adf621efcf02d1dfbc37b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212583, "uuid": "325cc2e8-532f-4021-ae6e-80bde2e549b9", "comment": "Malware payload (RedLineStealer)", "value": "9ea1324a656399c41e1210d4261e78ba5bb5f6885c4e52ee8d2849d58885e4e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212583, "uuid": "f736778b-bc03-4d12-9aac-611711d072ec", "comment": "Malware payload (RedLineStealer)", "value": "04e93b60fb91176009c7e180322649a617fcb18d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212583, "uuid": "589b7d24-dd87-44f9-9b97-7869f7bf0571", "comment": "Malware payload (RedLineStealer)", "value": "122477d096d26685be071fd6dbaf7a36c67a7675b5bf3592aea0a353e0d269f8d8469ed2f4917aff43e49c84dc99bbb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212583, "uuid": "55e520fe-32dd-48d7-8558-a84923dfae44", "value": "T1DF052306B7E88433ECB407B049F712871E3A7DF66A71939B3795985A0CB29D1B4307A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212583, "uuid": "beb809b6-4ffc-4b38-9ac3-7a6e3b872118", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212583, "uuid": "9e5ddbca-c912-4efb-95f2-d756136715b8", "value": "24576:nyQWzMQbB+R+ipNycJ9lb2HhIdpQt1FlrF8:yQWhbByLHB/b2Id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212583, "uuid": "dfccf42f-1cc0-46c4-a3ca-93973c0c3cfb", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212583, "uuid": "54b82229-a67c-4d8b-80c6-c9ac7f5c34e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212583, "uuid": "2d7347b3-eac1-4243-a2dd-baa2ee1494a9", "value": "c82055979adf621efcf02d1dfbc37b0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c14dee5-c60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679200156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200156, "uuid": "01d188dc-1cc8-491d-8387-63f60b825589", "comment": "Malware payload (Mirai)", "value": "8d055eef60bfbb2c032b3c1040d16ced", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200156, "uuid": "49a1b233-6a12-4c64-9d72-6412103c320b", "comment": "Malware payload (Mirai)", "value": "a0f9645a393b88617e7e5f1409179d3289ed7de0eaa61042e1146fd073d0e64d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200156, "uuid": "88324a10-107f-492e-8cd7-3a2377a17f71", "comment": "Malware payload (Mirai)", "value": "5cb1a891a30e598df3ae8b451955e7c721348bd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200156, "uuid": "c3b8b1d1-15b9-4123-878d-e02da8018161", "comment": "Malware payload (Mirai)", "value": "343bf9a27c200829ca6c62380ca8427100fcbf2d5ce055462da60dfa8671c3eec68e6f37c2adb5355b5fbfd14f7705c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200156, "uuid": "b8253845-7bf3-4677-86f6-8035aa3d94ae", "value": "T17C530A85B8819A25C6D113BBFE1F018E3316976CE2DE73129D141F647BCB95F0D2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200156, "uuid": "3fa38a16-52f2-4159-9171-bc10248a549d", "value": "1536:wdngqwABzQwr+csWY7wFELrGFzVLU1K6VacL/IkUiemgpKWD:Xgzd6c/mwokhLUwbmgpKWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679200156, "uuid": "06fcab81-0531-40af-bba9-2c83ebe4a7ec", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679200156, "uuid": "d6e003c5-ba95-494c-873f-c9e24718bc68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200156, "uuid": "ea65b095-049b-4512-8e13-e4dfd68f2cd5", "value": "8d055eef60bfbb2c032b3c1040d16ced", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e61795-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679214407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214407, "uuid": "9cd26167-104b-42c5-8b28-a616b356b047", "comment": "Malware payload (RedLineStealer)", "value": "5ebe1ef9ef49bdefbf56ff0b9039719b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214407, "uuid": "ae1a69ff-8c9c-4b90-8c86-ff5fba651e5f", "comment": "Malware payload (RedLineStealer)", "value": "a22ea9858725b03ca301ebbfb22cafe02404426662dc805e33064afcb1ea14bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214407, "uuid": "930be171-5704-4cf1-9af9-15ae8c0feec1", "comment": "Malware payload (RedLineStealer)", "value": "912bc83b0e3ef11ff2cdb6473db067e6197b5937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214407, "uuid": "e2b91690-d0b1-4a9d-865d-2e6f544ef224", "comment": "Malware payload (RedLineStealer)", "value": "5a6a01c0a2d1a49ed1657e9082c76fcf93f4f31857a11ef77b58316148859bd5d617bba303a5e26e0f284c59390e0b18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214407, "uuid": "f49f6ff6-2ba4-4ddd-9efe-310d2f914c73", "value": "T11145F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214407, "uuid": "378a0a15-1b11-468a-814a-2006ffd4dc21", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214407, "uuid": "8afb6511-7927-4ed8-87a9-d7d8530d22a0", "value": "12288:6xL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:8bXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214407, "uuid": "94804ee5-527b-4545-9f1f-a57cafd4cb9a", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214407, "uuid": "2aa1be50-a5ca-44d5-9450-e21b3aaa4c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214407, "uuid": "39891568-6d0c-4d57-a286-bcfe35bc61cd", "value": "5ebe1ef9ef49bdefbf56ff0b9039719b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab43f02e-c62d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679213496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213496, "uuid": "2c526154-3e5e-422b-a02e-0bd04b4e62a4", "comment": "Malware payload (RedLineStealer)", "value": "fbfb40bf8045e27ae79b10748e13efc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213496, "uuid": "98bac4a1-8c53-41cf-af4d-167d0e5b7eab", "comment": "Malware payload (RedLineStealer)", "value": "a235a9d0b5491607b3f7ba214f11df59a8648729a43721806ee80705ddbff427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213496, "uuid": "f2eaf04f-dbd9-48d2-917b-ca001f199039", "comment": "Malware payload (RedLineStealer)", "value": "09238b9cde37bbffe23ad170cc5f5380b97d0128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213496, "uuid": "efda9661-14ab-4480-8b3a-9aecd4f16f9e", "comment": "Malware payload (RedLineStealer)", "value": "fdcffffd8bfba327a53d90eb2e4fc70f1aec13560e2bc27d50dfbcbfeee594fe953bb42b3945f831c5ec8df80f4d5080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213496, "uuid": "42357c56-fb8b-4be9-b492-118bf91494b9", "value": "T1D1352357F7EC8063D87197B014FA03D30A367DA16F34969B239E9C6A0C729A0B635727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213496, "uuid": "6ac24b09-44fa-4682-8dec-9b7a28d12f79", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213496, "uuid": "f7a8828f-6472-47b7-8f1f-cd4af0af1fe4", "value": "24576:MyMbUFqsnC1ZW9flzHaIU8SQwTMlhd9qtcm6:7MAZCuJleI+dMSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679213496, "uuid": "e7972bfd-0137-42ed-8ed2-83862e797d0c", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679213496, "uuid": "2a73728b-8c61-4d2e-979d-b367d287a679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213496, "uuid": "ee519a77-7eba-4640-8aa1-bff5320b4b22", "value": "fbfb40bf8045e27ae79b10748e13efc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22789d80-c609-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679197805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197805, "uuid": "399fc6b1-568e-42af-acc7-6fb60edcf10e", "comment": "Malware payload (Mirai)", "value": "c892b0ff44f353f9c6535e074888cdac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197805, "uuid": "ee66e8d9-faae-4a0b-b234-5fcf137ee2e4", "comment": "Malware payload (Mirai)", "value": "a2773ede9d2cf982247c64326aa49cefa51814b9d89f88a44a5e65cc08aaa1e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197805, "uuid": "729c24d9-d550-4a11-baff-ef3d0c5af1c6", "comment": "Malware payload (Mirai)", "value": "1a7612e0e24bf7ea81ea07803525a2d7751d9d17", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197805, "uuid": "d098279a-7911-4574-a419-74d44f6048d3", "comment": "Malware payload (Mirai)", "value": "2e30eba056ed7c449ba905d949419c16f7c4cf129d2a141e1d59f36d4fbc899727c4756f2f72c48992e92929354e0698", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197805, "uuid": "66926780-4faf-4448-a890-8ac899db6c90", "value": "T16A2329C4B583F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197805, "uuid": "719dbd71-f1df-44a8-8999-c80490b32fa9", "value": "1536:4LInPCqAAXJLE7cxtd28N61qBNMGvk9YXPSP0Hoa:FCqxpE7cxtd200qvVvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679197805, "uuid": "e8423f52-ec4e-4c8d-bb13-009b0b1d5b44", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679197805, "uuid": "cdb6979e-0458-4a9a-a3c8-8586bf948f1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197805, "uuid": "3c1110c6-88bd-4954-8b16-125172d55aca", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85457882-c651-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679228894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228894, "uuid": "a0d665a5-8c6c-4f0f-a22a-1817612e20e9", "comment": "Malware payload (Stop)", "value": "455af1bb362309e8e601673014ad6a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228894, "uuid": "acce5271-8366-4e70-9de2-05958e1a8edc", "comment": "Malware payload (Stop)", "value": "a3112b9913731d75b5833ac5d970bca55cba22b240312ad724f5098ca3348feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228894, "uuid": "1e5ddc45-ac67-4c75-b99c-e3e82e8a7d2a", "comment": "Malware payload (Stop)", "value": "3ecfb64e2eab27093b6dcd9dd580ef62110a6685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228894, "uuid": "afcdc4f8-817d-417f-bd6f-b4cfd0bff1fa", "comment": "Malware payload (Stop)", "value": "128c0b81fdc433c5aaf3d66e9169bc57fea135c762e1f38b64968a5b7f92a6d08f68831ec8a880a7cfafadf404a783fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228894, "uuid": "f9d43ba7-6b60-45cc-b4a6-cea90110fe12", "value": "T15605D003D7E17D49E52A8B739E1FC2E8B70EF571DE497B7532188A2B04B0172D663A84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228894, "uuid": "ee02c037-3e28-4cd3-a084-73f6139b9dac", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228894, "uuid": "0772214b-a2ed-4d22-9af5-8ac78d870d75", "value": "24576:d01W2giDa/6uItRMtSEd1KbHDFHfIgLkwd:degiEoRcNd1KbjRAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679228894, "uuid": "85f2269f-97fa-4db4-8d30-451c1e98ffbd", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679228894, "uuid": "14f43767-b850-4164-a7b0-7e34a60be111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228894, "uuid": "0f063045-037f-44a6-9fca-c4fcb5bba6f0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd56e7e-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212611, "uuid": "166cd921-9dec-42ac-bcb7-8832e9e57829", "comment": "Malware payload (RedLineStealer)", "value": "d8932271d5f1596f036d2c0f1cd17568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212611, "uuid": "a4d156a6-ac7b-4722-a875-32f642e08053", "comment": "Malware payload (RedLineStealer)", "value": "a4014cc317e4ee9077af6f554e4cb2208301e887ba15ff5121e4f20474c063ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212611, "uuid": "1133c338-2243-41b7-8d20-0686ed4e3328", "comment": "Malware payload (RedLineStealer)", "value": "eaa9ed951b776059b173ae887d36f4b51d303b14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212611, "uuid": "f60e87aa-1312-43af-b713-8207e9245bb5", "comment": "Malware payload (RedLineStealer)", "value": "96659cff6da91e407e61d60460b6941e68ebb714c822defec6ecd5bd524e59283380098d3fdccbd1679f06cf05ae930e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212611, "uuid": "54c9bd39-df7b-44e9-b55e-18749df4b9bb", "value": "T10845F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212611, "uuid": "559f530b-bafb-44d6-8cab-dfef7a7cb03a", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212611, "uuid": "5e133fc9-d9f3-46a2-977b-d9b6c26b2a8c", "value": "24576:eLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Uko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212611, "uuid": "5b5ab9b0-5224-4111-a768-77b0a1bd7691", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212611, "uuid": "ff6bcf1c-a8f1-4998-8426-084c6e6c5401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212611, "uuid": "474c2cdb-5dc1-4dd3-b58b-0947a6971914", "value": "d8932271d5f1596f036d2c0f1cd17568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ca263b-c63d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679220488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220488, "uuid": "0a3f501e-8ec2-4e67-a131-03535ffe0560", "comment": "Malware payload (Mirai)", "value": "bca52b81a193e3fdf7f517ec99082012", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220488, "uuid": "e74e751a-3241-4004-92e0-9c8106797990", "comment": "Malware payload (Mirai)", "value": "a53aac2e03f4a82794bddd36ef6076ca890303f5b1856dd85069357fb2f93068", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220488, "uuid": "d918be29-430b-4762-9f2e-9e93b57b3d98", "comment": "Malware payload (Mirai)", "value": "93d7ad11463d6d50e1d072de1936e8f93ae6da86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220488, "uuid": "3b777a58-1c63-4e03-90be-69d1b939561c", "comment": "Malware payload (Mirai)", "value": "07796137f227f177da6f533c983f9791bf638d812710205a21e95b80dfd5f5a2f3a0608fab164ce76871d98d9c5b97f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220488, "uuid": "51275581-57c5-480e-9a3f-48bd0f68aa6a", "value": "T19463964D3E319FACFBA8463457F39E10A35823D526E1CA85E29CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220488, "uuid": "2e61970f-7dcf-42e2-88fe-f7f0388508ee", "value": "768:RzZWyvL5MsRXxPx2pqV2UZz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UjGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679220488, "uuid": "0b2b52b9-7e13-450b-9039-a385110ba1ca", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679220488, "uuid": "69a62300-e41a-4a2a-b624-8eec831f5aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220488, "uuid": "d33719f7-9962-44d1-947f-7e0ba2995b8e", "value": "bca52b81a193e3fdf7f517ec99082012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d37e21c-c679-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1679246114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679246114, "uuid": "f074634a-8245-4e67-82ed-eabffde9601b", "comment": "Malware payload (CobaltStrike)", "value": "0212ad8f93405ad10af5abad3b5e8ae5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679246114, "uuid": "0cc174a2-bd2c-4d5a-8e24-7f62109b70cc", "comment": "Malware payload (CobaltStrike)", "value": "a58150ce39e22e8e67f9b582c3064cd8701cdabb4f1ac7ae22c8fc6e0bc2e93b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679246114, "uuid": "341427dc-f85c-4a2b-8a43-385eefa93991", "comment": "Malware payload (CobaltStrike)", "value": "c9cbaf6b9caff6e02dc43f2ec782d5e24a4852f1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679246114, "uuid": "1ff920cf-cda8-48d6-b633-3c0867135045", "comment": "Malware payload (CobaltStrike)", "value": "8f32e100281bc1d508dcb24ab369269d1af4491f68482e6b6e0ce0fcb247f3ca908cb7398d47ba58fc8bfbc4c0fc534e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679246114, "uuid": "737050b0-5186-4000-905d-0ae2a17d8839", "value": "T125B21A7FE71368E9C506D5B485EBA733DC7139B249E6A32A1634D2B42E017B02F6E904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679246114, "uuid": "39b31ae4-74ba-41a6-b798-9858ac6fbcca", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679246114, "uuid": "c879bb14-2814-48b9-87cf-c4a797bf5d75", "value": "384:qqaCF31cix+Dc4zjuwPLZCFF46gioZUHeMDnG:gMFV+DjrLZ08X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679246114, "uuid": "26307d27-eb58-438e-9e54-c64b3de2edaf", "value": 24608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679246114, "uuid": "8681d810-896f-478e-a3c7-937cf29bd7e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679246114, "uuid": "1b0a4f9b-1a9c-45bd-9d02-28ec8074c4cf", "value": "0212ad8f93405ad10af5abad3b5e8ae5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219ebaec-c609-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679197803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197803, "uuid": "f618141f-55f7-4229-8fba-bb1670ec455e", "comment": "Malware payload (Mirai)", "value": "6675a66d96b151e89f3f86fe73bb7957", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197803, "uuid": "5dbb1d10-96c0-49b6-94cc-93236413e4ab", "comment": "Malware payload (Mirai)", "value": "a5e85c85886f4df6f350b713a47a70725667a702818d6864c635f366cf89a866", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197803, "uuid": "34b101fd-af66-4009-a37b-d4db6c3f6445", "comment": "Malware payload (Mirai)", "value": "d9d504a97e0dcbb3257cdee43b4104828dd6dad0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679197803, "uuid": "1bb1f548-c661-42e4-a284-27018daedc91", "comment": "Malware payload (Mirai)", "value": "dde1bbe2349416b076fefb0f485973179ae95047c93317d95514c7520ba2ce339afc7a29d6caf19603f18554ecdfa78f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197803, "uuid": "cb769120-a4fc-41a7-9dd3-ef23d874669f", "value": "T129C32B46EA409B13C1D61777FAEF41493322DB55A3DB330689285BF43F87A9E0E17A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197803, "uuid": "f12925ae-d71d-4fd1-bece-f7b9e1f066b4", "value": "3072:OwS6r2/xdwSW5hL30423oK5BWPKvuD+JsVM/9ajVM/:RS6r2/nU303oK5BEK0+JkM/9qM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679197803, "uuid": "0d1ac32d-0c34-4f97-824d-f9df27f3eac1", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679197803, "uuid": "d77fec94-a761-4329-85e7-b40d090c0959", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679197803, "uuid": "505de2e6-5366-4bed-b378-8ee99da2cb94", "value": "Josho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0186f33a-c66d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679240699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240699, "uuid": "b1975b35-ad9e-4e14-a5db-07a16985713c", "comment": "Malware payload (Mirai)", "value": "e641a58ffc3f33d13566bf959be2bf98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240699, "uuid": "e96238d7-483b-41ff-b21d-f47a30605222", "comment": "Malware payload (Mirai)", "value": "a60dc3f5a7c09edac5dbcfb072f77b7b397d3704481b8817837eae83d4657902", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240699, "uuid": "a35e6e10-d289-41f7-aaf6-c23d0c331211", "comment": "Malware payload (Mirai)", "value": "7dd49a79d8d818e4797df7902c41766901f58edc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240699, "uuid": "28f93a08-3eca-4330-9d5a-248f54544e25", "comment": "Malware payload (Mirai)", "value": "56be497cb37275a8ad928c71877ab86bee34f419b59e9f8ef5eff734055c8a810c23a753911835c41e92f4e307a52a21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240699, "uuid": "dccedbe3-6bd8-4adc-b141-dac90e105c80", "value": "T103730856B8814B12C5C5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240699, "uuid": "b059798e-5cbb-41cc-a89c-d70369013766", "value": "1536:mln25xPBXk1wnnkL7+KE007kHhVkyazN0bIqvikNnsvHTGsV5GYIWf:rxpXCMkM/2ja4NnsvHqsVERK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240699, "uuid": "f792f5df-7fc8-4cd9-951b-2a9f77ab70c2", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240699, "uuid": "92e83e9f-86a1-455d-a163-228d176060ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240699, "uuid": "40b5e837-20a5-4a2d-bb7e-e6e1e2d8d910", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fdf8dd-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212924, "uuid": "d15da4d7-9334-4c41-9d5d-49813b5f17f0", "comment": "Malware payload (RedLineStealer)", "value": "e8bea1bd8c331ea1d6323b2190631c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212924, "uuid": "d38f5a1c-949c-41b2-ac13-ed9a67480a0e", "comment": "Malware payload (RedLineStealer)", "value": "a6fc148f609c04cbfbe02cc1c14b9116be652c6884c3a71c3b3079242ddfe13b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212924, "uuid": "3c67d6e7-6ad0-4c11-bda2-ba2c1eaed9ac", "comment": "Malware payload (RedLineStealer)", "value": "49ebd878451b1e41110501bb56bb2ea450a3cc18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212924, "uuid": "95887124-c395-4857-9e5a-737f38ea4978", "comment": "Malware payload (RedLineStealer)", "value": "c9ac9baf04887c32f4b9feab7d14b79ebd49301fdc2de128ff52907b1ef0eddabdfbf588d179d76559a2c4c6045cb79f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212924, "uuid": "10f40557-3886-4501-b0eb-884c0665ef19", "value": "T15645F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212924, "uuid": "0ae7b264-cef5-4661-a922-f388ff8b09fa", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212924, "uuid": "ded1bc21-fe69-4525-a0f0-cb08871b7766", "value": "24576:GLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:cko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212924, "uuid": "007697e1-a38d-4235-8fde-2edf15c909e8", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212924, "uuid": "af7f512f-8700-41e9-b507-adc213bcc381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212924, "uuid": "5b22742a-f421-4d67-831a-f1c70becd28b", "value": "e8bea1bd8c331ea1d6323b2190631c8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b67062c-c66d-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679240716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240716, "uuid": "f33f201f-656c-4e9b-a3a8-1c7436a7f76c", "comment": "Malware payload (njrat)", "value": "123acf74540b652a549c5d664b627663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240716, "uuid": "8bb4b912-d9ee-452c-aac7-56257ff4d1ab", "comment": "Malware payload (njrat)", "value": "a7a1f3e3bfc8abc1006276f3cb3bdaa1ff697b9fde421d6d2a181165db11377e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240716, "uuid": "fc5aded3-bb40-4e43-af9d-eda42a6f01fd", "comment": "Malware payload (njrat)", "value": "57a8230ac3fa6fe42a563c3355aa0512f4939098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240716, "uuid": "6e128ac1-7286-4ec3-88c2-3619620d2235", "comment": "Malware payload (njrat)", "value": "b5994d177298e9f3d1e44b65914efdb3695056780c0934763cab220b756adb6ed060713f75d47182770a39405c70712a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240716, "uuid": "fd1a9424-e923-45e8-abdc-1bc53d075c0c", "value": "T1D793E84977E56524E1BF5AF75471F2004F34B48B1602E39D88F219AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240716, "uuid": "15ec31f3-d179-42ac-9bef-69d857242ea0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240716, "uuid": "32cbbb32-8515-4947-aed8-88c0b95333c9", "value": "768:rY30UBnkpjTMpALPGMtsas88EtNXhe9Y1mxCXxrjEtCdnl2pi1Rz4Rk3asGdpxgM:lURkVbPGHz88EbB1pjEwzGi1dDWDxgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240716, "uuid": "32b14843-f184-40dd-aa1c-f13bfc4aad1f", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240716, "uuid": "741d9c7b-18e4-4113-99dd-d39c0cdc3c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240716, "uuid": "c6b56bad-cef5-403d-878f-002920ba4d46", "value": "123acf74540b652a549c5d664b627663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c21657-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679211425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211425, "uuid": "41c4bdc7-f0c5-4a52-91a8-33d0980d6ed5", "comment": "Malware payload (Mirai)", "value": "8541392c5263ffca86dd1b0820709e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211425, "uuid": "6ba037e6-4be7-46c1-bf7a-444671e5c831", "comment": "Malware payload (Mirai)", "value": "a8056b641b9fa87d1310c757a9e329ac268f2e2d987b2e1aea16ded05ecc062c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211425, "uuid": "9a389b7d-0060-48db-a153-d01beb9ab857", "comment": "Malware payload (Mirai)", "value": "705a1c7fa631d7075aa40949ff317c0b29b164f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211425, "uuid": "f60fa920-44f4-4663-9834-2cfb11409191", "comment": "Malware payload (Mirai)", "value": "d9da807a2982bce77c7459c1a0190d9247747ed89a6c69756ddfeb5ddd0c3d3e1627978151461b17f640fd8eb733e107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211425, "uuid": "4e238823-f89a-43a4-b3bf-3cb7332f310d", "value": "T19AA36C1B6251C6BBC08746F52BDFA6604423F83E0B32724A73E9BCA93F158C95D6E741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211425, "uuid": "d2efbc72-af6a-45e8-be6d-aaacb4f301a2", "value": "3072:Vn2nW3WPWximT8o7yS9LRk3u4QphaRdmHyVQX5A+u+cm:hxyS5FphaRdmHyVQX5A+u+cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211425, "uuid": "018718e3-8b71-414d-bb76-03f3b5aca0eb", "value": 102931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211425, "uuid": "b660e12f-994f-44e9-b236-31cf27045d48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211425, "uuid": "5c47d694-bda3-47c6-8ecc-6e8513b4450b", "value": "Pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bcf29e-c63c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679219841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219841, "uuid": "44cef44e-e69a-4ac4-882b-049c963d4ba6", "comment": "Malware payload (Mirai)", "value": "dca2529ffa38440d59610830a0994168", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219841, "uuid": "ae578021-1a35-43f3-a142-b673948428ae", "comment": "Malware payload (Mirai)", "value": "a8288404d533d174accaded4f571c4b12c21048054c12fa05646666fd7c3999f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219841, "uuid": "60c41f8c-e679-4e21-908a-79057dce2fca", "comment": "Malware payload (Mirai)", "value": "a895bdb37b0c789c479c103d01257add45f3c619", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219841, "uuid": "7747a8be-2340-479a-8f80-83ce1669231b", "comment": "Malware payload (Mirai)", "value": "43891ea97c3245877589f55b938da1f020702805bd4eaa6ca8884d129c92e266fb3140d9255035fdc4b73b7dcdf9e4fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219841, "uuid": "7bfae47f-0bd1-43ae-9185-2f89e94c4a62", "value": "T1F0632A96BC819A02CAD412B6FE5F519E331623D9D2EA7207AD15AF2037CBD1F0E77241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219841, "uuid": "daf184a3-050a-4c55-91f2-f173ba6e6e79", "value": "1536:sWPKw0DX+CaF8wl82EFyyLJwq0E4SFDTFUI070R3tvH:sWzGX+n+2SbinYBUxIvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679219841, "uuid": "6ee445ce-ec3d-4a48-9ff9-1ea7dcd98a5d", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679219841, "uuid": "5c1a1db7-6520-4568-a261-e38497563980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219841, "uuid": "ae7a29b5-7516-446a-8a5f-d81ec4a37067", "value": "dca2529ffa38440d59610830a0994168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4080374b-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679212888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212888, "uuid": "106478f8-06de-4310-a892-b5aea209ac7b", "comment": "Malware payload (Amadey)", "value": "d93548bc82ebf9d1ec3aaa8dd1cf9500", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212888, "uuid": "73c50b8e-099e-4ac2-8e8f-d8da75a5f3ff", "comment": "Malware payload (Amadey)", "value": "a966610c7123233e5d0f1a92724918a04ed3e96efaab7e5a3d43843da7eab0d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212888, "uuid": "71a9e2a5-3163-429e-a013-baa392ca875f", "comment": "Malware payload (Amadey)", "value": "775b71012faf1294c6018b0e5335edc70b3a07ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212888, "uuid": "33571ec1-68b7-4e26-81a9-37aa67b85fd6", "comment": "Malware payload (Amadey)", "value": "0e6bb0f7de0cfcd73647e43421fd69c3140fb521b40db49fa64d894f27234fa2be88c3a8f2805744ee32400d8f4376d3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212888, "uuid": "fa987cb6-8b9b-4c6d-b8e5-678d53340d9a", "value": "T18D45F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212888, "uuid": "ef1bda3a-a3da-421d-9636-e3ade5cf3c23", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212888, "uuid": "267f99ba-e66b-4913-bb00-b8f3f526e511", "value": "24576:3hVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:3Hb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212888, "uuid": "b6c0ce14-7b13-4aca-b2b5-fd53dd4a2fb4", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212888, "uuid": "f54afabd-1703-48a3-8380-e43f1a78fec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212888, "uuid": "83e56dbc-5727-4922-84fc-89ac14908031", "value": "d93548bc82ebf9d1ec3aaa8dd1cf9500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3c45a9-c60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679200131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200131, "uuid": "c4023b20-9768-4e06-88f3-9833cd793cc1", "comment": "Malware payload (Mirai)", "value": "58349d14bbde84927bc081950f705925", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200131, "uuid": "3efe1cdf-32dc-4381-b63c-df38a9e5a769", "comment": "Malware payload (Mirai)", "value": "a9676b9bc26b8467c07b21656a28bd1d8c49febb498757877fabf6ff14db3600", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200131, "uuid": "37717f4c-223c-48a5-b0db-6bcd611a5f2e", "comment": "Malware payload (Mirai)", "value": "001c04d7bac3816019fe332b576a3cc6bc9354d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200131, "uuid": "6977c132-8efc-4d89-b9a5-e17663c3f3d0", "comment": "Malware payload (Mirai)", "value": "2c063a41eacae6769d8733ab9cec5d94d106c0cfb37fbaa5b70fa9e01bcde1998ddbc31182796191cfa8787575472e88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200131, "uuid": "4327514a-649d-47b7-b5cf-526971b9f697", "value": "T193332942B22C094BF9E65AB0353F0FE093BFE94024E4B584695FEA458236F775486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200131, "uuid": "649b8b86-d94a-4ca8-b89f-86d8fa352293", "value": "768:bKfsbnHAt1ezbnAgCN7RkIV3fgB1JRNNR7E5u3pX3FVFssuWXo9yZy:w6HAt1ezbnAXZUB/v3pXV/3XoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679200131, "uuid": "21aced27-a5cc-4f79-ae64-37506de6842e", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679200131, "uuid": "8829bc15-41c9-4a78-bae9-b276129bc4b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200131, "uuid": "a7843039-12bd-40b4-a5f4-af6a72028b21", "value": "58349d14bbde84927bc081950f705925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16461910-c64a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679225702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225702, "uuid": "d17c06bf-0247-4225-9471-e5f69a8a68d8", "comment": "Malware payload (Mirai)", "value": "a057cefc76051a2da9a0137bcebf789c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225702, "uuid": "da11694c-7f61-46cf-8df0-e1163bea05fe", "comment": "Malware payload (Mirai)", "value": "a9c0ae4cfb6b31823a270531df87a27e14dfcad2c7acbae4b4fe45f688ed452a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225702, "uuid": "aa0d68a1-9aa7-46a9-adbb-61b1b646f59b", "comment": "Malware payload (Mirai)", "value": "c3c820d4446256ff049395f462538e5d910fab76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225702, "uuid": "796779cb-8e64-451b-8002-9af43121461e", "comment": "Malware payload (Mirai)", "value": "5cfa2166cc394e779e8a8f62a4126919bd90d54555796a9ade4b6f92920799c457c2c49f7b0b28a3c9994e6a50c23623", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225702, "uuid": "83e525d3-d853-4afe-aacf-b2b2c7720471", "value": "T148438DB4E42A9D54D0850174A8B48F750FA3F2C883621DF73BAA46B1540BEB9F60DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225702, "uuid": "07ed5d0f-f878-4e11-af70-f0d5b3a3629d", "value": "768:f3Dm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfTA1eCHo1Y4dbC2WwJZY10U:bm+JDpP/Z7VrGQD8A1eb1dbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225702, "uuid": "d23c3b73-81c0-48a1-a29c-a2a340abdd86", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225702, "uuid": "b0a29af3-c6de-4a16-baa5-86b15bc64821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225702, "uuid": "6caa907b-9448-432c-a9a7-5b1cb51a8a50", "value": "a057cefc76051a2da9a0137bcebf789c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b695cca4-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223394, "uuid": "37979673-6d2b-4c13-990c-365a6ff4bd83", "comment": "Malware payload (Mirai)", "value": "3041d159cb8cf7de830fd9b1f815d95b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223394, "uuid": "b9d7288e-c8a3-4a2d-b064-751bd8e6a7da", "comment": "Malware payload (Mirai)", "value": "a9e30200bc9881cbf91c7619dc5cdf0fecdf913a37d034a1ea442214a7c0e7bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223394, "uuid": "f1a12212-b5f4-412c-a95b-afc2a144e27a", "comment": "Malware payload (Mirai)", "value": "7a11a6bca9b1efdaddf0d0fa3742d3174fab8338", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223394, "uuid": "d5042bde-1d83-4bfd-a3d9-3c41d64e77cb", "comment": "Malware payload (Mirai)", "value": "927e6503d406c36606f064bb778b18994aeafeb9abffa5ca2dc2adfb62f961b962db60e727d8e010b95580b375142550", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223394, "uuid": "ba09cabe-f38d-4948-acd0-8fdbb3a34ee6", "value": "T1E9538409BF650FB7DC6FDC370AEA270628CD640A21A97B357D35D818F21B25B19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223394, "uuid": "ecc69cf6-4812-4f1f-b611-f7638c2d698e", "value": "768:NscgJbH5csKKNLFAfR7/eY5TdeSeq3evHDAvAXiLIQUOoJ:NTgpHys1Mnj3r3UHDo7UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223394, "uuid": "02618bac-54ef-42ac-a376-121b1de3827b", "value": 64356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223394, "uuid": "f695004c-10ae-442d-a44d-4dbc704de57e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223394, "uuid": "c823ac57-e2ed-4f04-a29b-883c81c03c14", "value": "3041d159cb8cf7de830fd9b1f815d95b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1f6b6f-c631-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679215006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215006, "uuid": "c363df46-197a-4692-948c-39e48a3697d4", "comment": "Malware payload (RedLineStealer)", "value": "089195461b5217deafe8ef95a4e34d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215006, "uuid": "f4c2bbde-815a-44d0-9c22-4163f70f3633", "comment": "Malware payload (RedLineStealer)", "value": "aa2fac7fb3b2f9f624e8b2b32e7973f6b0201593f37cb13e630ae6c2582355c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215006, "uuid": "948f9b7f-4b7d-4c2c-9283-8db4f5672c5e", "comment": "Malware payload (RedLineStealer)", "value": "618ae864a367328d7cb3b3d5fedb9ce6e60be371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215006, "uuid": "35753e73-2183-42a2-99fb-d91578146a83", "comment": "Malware payload (RedLineStealer)", "value": "90a1fe758ff9839e51bf2476b4309e244dc1c23d71b8bf2b486580436969c4f190a5b1e6633888d34a92edfaee9976b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215006, "uuid": "4288ad27-cf9c-425a-b49c-29c286980e5e", "value": "T1E845F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215006, "uuid": "a99ae0ef-3d41-4b4f-9a02-2488420d8807", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215006, "uuid": "ddee8fba-c3c4-4fa1-bfae-d726d16d8132", "value": "12288:8xL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:CbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679215006, "uuid": "c64cf389-cd60-4096-bba1-7ddae9ee3adf", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679215006, "uuid": "09a576a2-89b0-455d-ab9e-2f07c1cd8c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215006, "uuid": "e9574d7f-5b35-40a5-a156-13936c647168", "value": "089195461b5217deafe8ef95a4e34d75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e96f4a9-c633-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679215810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215810, "uuid": "06684f57-083f-4e01-80a0-cb4cac51f738", "comment": "Malware payload (SnakeKeylogger)", "value": "18daeaba24efb8cc61c61145e176610f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215810, "uuid": "5e2b459a-269d-4458-a323-f584479ec0cb", "comment": "Malware payload (SnakeKeylogger)", "value": "ab0ec92fbc76f0e6ad0fb6007d96d0b7b35984f04a84cb85fb21a9e765158a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215810, "uuid": "f5211d9e-69fe-420e-a59c-feeaef53ae97", "comment": "Malware payload (SnakeKeylogger)", "value": "7dc652e28217b4858f43183fd7db9798389e3c0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215810, "uuid": "422b8c2c-f96a-47bd-910f-e3987f53e6d9", "comment": "Malware payload (SnakeKeylogger)", "value": "e3b793e806c034cc6958f0e8df605559cb9318c5a1bc6b53e4c9056d8c9a07a73eccb6a301062d03efe28d3c5898ac19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215810, "uuid": "8594a534-82d6-48d7-90f3-aea2cb1695a6", "value": "T15CD32A1D27F88800E6FF997701B15252C776B842192ACE1D1AD1F55A1E7DBE08E0BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215810, "uuid": "9d16d290-5345-4c44-993c-37686c10d2f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215810, "uuid": "0576f4e4-0a33-43bf-b065-f9aa9b235c4d", "value": "3072:531b8p/ribHea3WCWztb8CJrVwBZ86FbY:j8pTIWhb68ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679215810, "uuid": "31f94466-6aa5-425f-910c-16a88a79fe89", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679215810, "uuid": "f20a584f-fb72-470c-bab5-b4c09da5c98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215810, "uuid": "1fd0d63c-c17f-4619-89cd-1a7a43eec60a", "value": "$49,127.00 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffc3bad-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212914, "uuid": "66ce8264-2c2b-4777-98f6-ce9606be5953", "comment": "Malware payload (RedLineStealer)", "value": "fd3e458932b60e3cf18b1802b3d3f2bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212914, "uuid": "ecd5f809-e2b8-4f85-87d8-8bdfac51066a", "comment": "Malware payload (RedLineStealer)", "value": "ac0ffcdccff29de1937ecb2e13fbc246654cb4532ee07aa9d8a5483b9c872cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212914, "uuid": "a7b4f256-0d79-4416-a1ad-cf08b92b730d", "comment": "Malware payload (RedLineStealer)", "value": "46f66902c60ac8749f6be4ffc1f2818bfa2b3f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212914, "uuid": "566be460-251b-4025-aa7f-a13683a74f7c", "comment": "Malware payload (RedLineStealer)", "value": "ad87d52a1ca257e7e160d7efe10648debf18a8fcba0a7b884c2b8baa254f371ddf1e5ed1f41c97b8dbb71ff021846569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212914, "uuid": "40c8a583-92f6-48b7-9c97-7c6b6451dcda", "value": "T1E945F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212914, "uuid": "70a3e265-60fc-4d81-80ab-364905565a42", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212914, "uuid": "1c924dc7-52d6-4534-ad71-6fe60d4b399f", "value": "24576:KhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:KHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212914, "uuid": "7f5afa1f-9ecf-44a6-8f8c-1730b116d3a1", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212914, "uuid": "438555eb-f438-4abf-903d-e6c0cde348c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212914, "uuid": "c764acf9-8352-4c5b-b37a-8cdcd3173c44", "value": "fd3e458932b60e3cf18b1802b3d3f2bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dc200f-c68f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679255578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255578, "uuid": "7ed7f775-5b1b-43f2-8e8c-f1c62002d046", "comment": "Malware payload", "value": "c1ded96d871970fe7884cb9349ef0aa1", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255578, "uuid": "6c1d4cea-b1ca-4582-ab14-bc4f7e156ddc", "comment": "Malware payload", "value": "ac3d6089d459195800931784a175b31fd65e20a937488acd95477db7dd253280", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255578, "uuid": "2ece5910-5c3c-40cf-aff7-0a0104020ff1", "comment": "Malware payload", "value": "352550368487bd0d39fea33bf271fc1c649f70da", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255578, "uuid": "59a99e19-8eee-49af-aabf-7aac3d5edb6c", "comment": "Malware payload", "value": "23f1b6ce75569a65be95e47d6534cf2aee2f79692ce594f0f04b673d1f957a1e2a37eef19dc9c211cf1777281afe85b4", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255578, "uuid": "0d91f131-7dad-4522-b2ad-43b1f492a80a", "value": "T1B5D2CF32DA409D48F9E5D40B5C46B9780838FBCF13DA39D6760C0E46BF41919FE266E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255578, "uuid": "6d0efde2-85b5-47c1-9541-ed2ff5f53c7d", "value": "768:iKxethJpY4zLlVu7bSrYC5wvyQyojZ8OrPqIAJjuPy1gs:ioAHpY4zhAbUUyOjPPZBPzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679255578, "uuid": "2feea232-85c3-4416-b0a4-5fcdacbb941c", "value": 30963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679255578, "uuid": "7de61434-02bb-46f7-86e9-29d0de56ffce", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255578, "uuid": "e84e41a5-045f-441b-a19a-d88bdd7697ea", "value": "Update.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978fecc4-c65b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679233220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233220, "uuid": "2d5392fa-725d-4929-924f-89707ccd3295", "comment": "Malware payload (Rhadamanthys)", "value": "f3eb8d5dc24d8a10c8c940460a22e498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233220, "uuid": "ae885358-99c6-41c2-8a75-2c445533bc1b", "comment": "Malware payload (Rhadamanthys)", "value": "ac5cc00e6f0747b7a6816c60eb6ed16bcb5bb562267f9db0d4fc0fa62b0b16c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233220, "uuid": "f74211d4-1012-4e9e-a306-b08b86ce8af5", "comment": "Malware payload (Rhadamanthys)", "value": "c17bf2bd59d0a50de97510fa423640e597a95735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679233220, "uuid": "70ae6f2b-16cf-487a-b541-1c59a480750d", "comment": "Malware payload (Rhadamanthys)", "value": "e0db94351572d5c2cb03c548c5bf2b6917e66ef8accac3e8a7073498437d0cba38110fe0f195fbb133a3867e0d8f07c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233220, "uuid": "d14e719e-0344-40c4-9409-7e28c7375201", "value": "T117743B4383A23D49ED264B739E1FC2E8B71EF671DE897B6532189A1F04B1172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233220, "uuid": "51d1c1ba-8152-4dd1-809d-ff4cfa1cd5ea", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233220, "uuid": "0e619ea0-ef9d-4254-a78b-e747156d0bbb", "value": "6144:du/LulBxqtD+5ckHuNoSHYYlcKXJ7+aFJuRiYYzbmdE:du/yzq1+WUuWSHYqcnCuR0zqdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679233220, "uuid": "0526c9e9-f305-4ad3-a9cf-4ca286d041d3", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679233220, "uuid": "d046c42a-9217-4a73-8c7a-5a505274453c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679233220, "uuid": "47fc0e08-01d5-4274-bfad-8060b838f049", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd6024a-c64a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679225711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225711, "uuid": "3309567a-4929-428c-abd0-210cb1c7d961", "comment": "Malware payload (Mirai)", "value": "4412fb048225a6c319b29777447ee69c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225711, "uuid": "a85ad4f9-eb8f-49df-96bb-d82c43dae79c", "comment": "Malware payload (Mirai)", "value": "ad531691ef76175736bf579c774a34b9266875a3b25e623b234d210244d9f536", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225711, "uuid": "c8ad27df-dd62-448a-994b-7551184ed6ac", "comment": "Malware payload (Mirai)", "value": "21c404ce86e83794dd87498dacb6ed6a81d81cad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225711, "uuid": "611c242f-499b-42ca-88f9-46ea4b557f69", "comment": "Malware payload (Mirai)", "value": "b0f50b92ff2784cb22aff1141b05eec5664eeb1d60a29270e235945bcd0b2a4fae6314bbe62aeb41373a1d37a9bdfb6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225711, "uuid": "35559a6c-c081-43e8-b0e3-ad03cbcaa1d3", "value": "T1CB336B36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225711, "uuid": "71fe6d64-83a1-4754-ac50-f016dae16467", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225711, "uuid": "892c880a-67a1-4dc6-82dc-a709fda7352a", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225711, "uuid": "f479ad30-4bac-4808-a3dc-1d9da9b4b71b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225711, "uuid": "679fdc47-6314-4739-93ec-f74a471eccf3", "value": "4412fb048225a6c319b29777447ee69c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b993bdd2-c63d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679220392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220392, "uuid": "b84e7d59-8dd1-4b29-a7a5-e247a491089f", "comment": "Malware payload (Mirai)", "value": "6eb7ec6c0f81f12e39ac2b53963f36e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220392, "uuid": "2f97ce6c-960e-40c2-a177-963bfb5feba8", "comment": "Malware payload (Mirai)", "value": "ad81f4ba5b1e19c22423eb0087fc3cb1752325de62cff9170ce96da823744ce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220392, "uuid": "b94e35b2-ac21-42df-a67f-0f31fc696a37", "comment": "Malware payload (Mirai)", "value": "4c3423f8ce339537c822b9f1e44c20d90229418b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220392, "uuid": "7d062c7f-7dfd-4119-bcfd-9c0d140d7034", "comment": "Malware payload (Mirai)", "value": "4c20dd82d83aa4242672b54fd2bdba6a2a3206582a047184ec115a9a6bd3a6c9cb0ed0ef9adc0c7f4f3dee0397559fef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220392, "uuid": "e7ea59ac-d666-498c-b6e7-250b65611c66", "value": "T1AD4329C4A6C3F9FADC11197C716AAF729E73E03BB135EA8AC3D915739911602910239E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220392, "uuid": "cfa8a1a6-22d5-4e16-84ca-731295e9a1e5", "value": "1536:T+aBMuFoUEgyFSZPSWY/aKVv76SXIVVSr:T+CMuFogyFSZPSWY/bVT6oIVIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679220392, "uuid": "f9ff5ec7-469f-4f65-8861-c1dd866d8d5b", "value": 58652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679220392, "uuid": "d1f22273-70e1-4038-981e-0328a7f4b54a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220392, "uuid": "c2db2052-020e-4936-b60d-fb4a72f3a0b0", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d8913a-c66b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679240081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240081, "uuid": "9c7ea394-7948-4df4-b9ac-35da294f6fa4", "comment": "Malware payload", "value": "50f31873c5df2e169f1ec5ebab8ba2c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240081, "uuid": "6e72b125-f95d-43dc-abac-9ec2d690c821", "comment": "Malware payload", "value": "adcf0ee814651b8a561d827d7ecc7a9aee660a950511c1ffae7d16f426f8de14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240081, "uuid": "afc1d96e-bbbc-4e8c-966e-f4a12cbebdc5", "comment": "Malware payload", "value": "43dfd3859c1763ced1eee0d0ea934a76aaa0fd4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240081, "uuid": "d94b758d-ea1d-4588-a3bf-926bfc89c3a3", "comment": "Malware payload", "value": "42b177fdae486a2cb0588e3176eafb9751cb58f931d889e507bc0276aec5e7960c43882798609ba5fc8f08bf298dad15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240081, "uuid": "721f6a69-84a2-46dc-80ce-ba813124afe6", "value": "T12AE65B03F89191E5C4ADD170CA268262BA303C895F3533D73B24F6B92F76BD46A79358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240081, "uuid": "b61100b0-83aa-4be3-8fc3-b92f3ee8233a", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240081, "uuid": "6e29d362-094f-4e9a-8282-52c26196c119", "value": "98304:S1FHdnwJ2Sb6Jax44M8jeOsoyE2/4zxBgtydeIcj:2ZxwJXb6i4MjnsgnzxKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240081, "uuid": "6039d8a8-cf7e-4644-b65f-042b72ce95d8", "value": 14546944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240081, "uuid": "c5a73d14-4a10-44ae-9197-f0e2d5e84f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240081, "uuid": "fcc9ea49-5124-48cb-9558-1f0143765bdb", "value": "50f31873c5df2e169f1ec5ebab8ba2c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fa3cbd-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214081, "uuid": "1acd08ae-3450-4987-abcd-21caebdaefc2", "comment": "Malware payload (Mirai)", "value": "c8f3a2fe20f054aadfb1fc04934082e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214081, "uuid": "72cca764-426d-4394-a266-6b0ec01d71c6", "comment": "Malware payload (Mirai)", "value": "ae37d79b89118192fb5019ae7c00ff26d8f4d3540c21a93390d549b62a07fddc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214081, "uuid": "d027b0bd-478d-4896-8580-01ec6c6b583a", "comment": "Malware payload (Mirai)", "value": "63c97e8e76c77bf3b832a2a598b28d36c6588385", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214081, "uuid": "17fad658-dd07-4be9-975d-94518fcea414", "comment": "Malware payload (Mirai)", "value": "2a6f24aa8e7f326f29717ca2f2cb23af8bf7e5dd1cdbf2f2519b11a75f04ab05e9ff7f9346f89414b3b2b9ad5a1c3b3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214081, "uuid": "987e7e00-29e9-4cb8-b475-cc4b5fbff40f", "value": "T1E4932B85E602D6F3C4431AB602AB5A1A4B32FD2A4A3B8FB6F71C7DF45F125C43116791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214081, "uuid": "1e52e922-b2af-4bb0-b1a6-413dcca95b5a", "value": "1536:9MHKa83OJO8pvPACZgHMnWosGGINHYrLeDRT5hMVT7PMWshe0QzUzJYQ2Wk:A8b8FPACy9zGGINHYrLkT5hMVTrMWUez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214081, "uuid": "e5b9c436-52aa-40ea-8325-19697df51bf5", "value": 91537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214081, "uuid": "72489703-5db6-4903-a23b-14e1f977b955", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214081, "uuid": "793648b4-7050-46a6-8b92-69ba3fbbb856", "value": "c8f3a2fe20f054aadfb1fc04934082e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187234af-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679241167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241167, "uuid": "a1c7b2e3-7a97-49db-a586-3bdee0ab6d3b", "comment": "Malware payload (AgentTesla)", "value": "108008cc64021d8956d298e3c8222e10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241167, "uuid": "d1791a40-485c-4660-be5b-28bed4b22b28", "comment": "Malware payload (AgentTesla)", "value": "aea9f3a5b0b8c4666ab439cb138d073d3458da186b4e09c02c6e7c7c10f1ee91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241167, "uuid": "b0ea6a8b-1cb9-4289-af52-27cb0a6f4a74", "comment": "Malware payload (AgentTesla)", "value": "a45f723e9662563780739a1bd148a0c923cc1530", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241167, "uuid": "beee25e6-dc1a-42ef-a2d8-b63760eea9e6", "comment": "Malware payload (AgentTesla)", "value": "c3b1a6a680a0ae8b109c277f339635b5c71de5c060d3e87eb6fafa326200efe1438ea7cad83ed98ca73b95b7b7f796f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241167, "uuid": "0beb46c5-494c-45fd-adef-1ed813d3035d", "value": "T18B456DC172B084A3E89F05B35D39A42C1876BE4E6095D32D7A6B7706627233372AFF45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241167, "uuid": "8192626e-2a5a-43a8-86be-bcace5b74832", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241167, "uuid": "47c967e0-0a09-44d4-bd19-53549042a93b", "value": "12288:abEcmhVDQyP8zyvHcTmCU2I1SMHatFpKtOi4e:TFvP8zyv6mCU2ptFpzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241167, "uuid": "4e0c33e7-b376-434a-b7dc-2dbbca6b6271", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241167, "uuid": "b72d8622-940e-417b-8412-cc95c7bcb2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241167, "uuid": "3b209c05-fe15-41fc-a353-a8f8bdabdb30", "value": "yeni sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75b822d-c697-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679259016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259016, "uuid": "acda2e55-9eb3-46f7-8897-7dc3e819a3d8", "comment": "Malware payload (DCRat)", "value": "33dbb523c14738bf48d314111c00906c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259016, "uuid": "054a112f-ccea-4e1c-a3af-7a34a6f63c5d", "comment": "Malware payload (DCRat)", "value": "af625576485e2091fbfa4568c3a3c546bd2a8f470cb69afa09f6bcf0ebac1d1e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259016, "uuid": "e9621cbd-9a1e-44cc-b79e-d80ad6541af6", "comment": "Malware payload (DCRat)", "value": "83da7977d5b08038fac809b0f7c9a57c008f285e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259016, "uuid": "d980502b-3971-4f45-82f5-16adba1558b5", "comment": "Malware payload (DCRat)", "value": "d04ece90f2f4e55acb3857754d0e957ddb8d56bea7b4cee0f9d8cd806651da02b7b9219ffef90a244124c260bb657e8d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259016, "uuid": "02d89d92-c2e3-4511-89d8-0473e7e06b94", "value": "T1C5556C01BE44CE11F0082633C2FF455847B0B9516AAAEB1B7DBA376D59123AB7D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259016, "uuid": "cc39e48e-a31d-4845-8b6d-16b924e6ea5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259016, "uuid": "8810c64d-0b2a-4242-b87c-7f3393492580", "value": "24576:Qc1ovc94+x/XIzyRGezpFezu4GTVSbvaBTJpbvol3:FG3+xz9lFezFGT8bEda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679259016, "uuid": "e06fcbff-6919-4e55-93a5-d44922d714a2", "value": 1353728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679259016, "uuid": "a5d0835f-de22-49a1-831c-d65fe1e80764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259016, "uuid": "69fa8eac-1885-421e-b301-9a7b4d319e11", "value": "33dbb523c14738bf48d314111c00906c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d9de39-c656-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231180, "uuid": "16d11a4a-c373-481a-a60f-46f73096a540", "comment": "Malware payload (Rhadamanthys)", "value": "99719531adaefc2c8544a65562aa8af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231180, "uuid": "9c48c8a4-44ba-4eff-b593-ce874430bdd4", "comment": "Malware payload (Rhadamanthys)", "value": "afd1d0be379b7b5a8a46a28e68f81e388f6875410f955e8ca09dde8e228b8935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231180, "uuid": "be3adfbf-93a8-46e1-897d-e201b57dae8d", "comment": "Malware payload (Rhadamanthys)", "value": "bf0bd1742a2589b5f5ac032a3efa81d95f961e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231180, "uuid": "659391a5-8b4d-43ac-a35e-67f57261fdc6", "comment": "Malware payload (Rhadamanthys)", "value": "fdb6fdf9f711c9bd18e55cfde944287f5a71f40a0ab6e2935b5fc4954907eb5ace3fe53ba0305fc8d6064c7c9a93f67f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231180, "uuid": "1a5b7bc1-9223-4b7b-9c20-7978ed5ae27b", "value": "T155744B038BE57C49E9264B739E1FC2E8B71DF670EE8D776572189A1B44B0272C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231180, "uuid": "81a2f4c6-72dd-4cc2-8063-49335bfdbf6e", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231180, "uuid": "f4958200-2f9a-4c5c-84ed-f948633ba2d0", "value": "6144:BukLtMpldm3UshTaWQDQeGDfqFvqu8pQHEutMs42ldh/:BukCrKbQkeG7qh9FHEuQ4dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231180, "uuid": "1b1572a7-b959-4e0b-b36c-4770cf3e2be3", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231180, "uuid": "5219d785-917c-44e8-9b91-9052f20fd10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231180, "uuid": "2172625f-221b-4906-bef1-0076babb67e0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152bf5f7-c652-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679229136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229136, "uuid": "8fccf18d-c0eb-45bd-908a-9519b529dfb0", "comment": "Malware payload (Smoke Loader)", "value": "341b640825ab593e78ee885e03fb5a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229136, "uuid": "3c193295-9b4f-42a0-ab27-e33c7e4416ce", "comment": "Malware payload (Smoke Loader)", "value": "b1046697b412d90daa3aacf1d2e90cd0c432f7e28f9b4889f931bedcf6976c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229136, "uuid": "a09223c3-a9d1-4c66-b377-0267a30a6a96", "comment": "Malware payload (Smoke Loader)", "value": "37831b3ec28937aec111c43ebb9d2784c2d37eb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229136, "uuid": "ffd08ec7-ca9d-43ce-81ce-53b62817dd68", "comment": "Malware payload (Smoke Loader)", "value": "d08a20a90de92eea1558ece4bcee446d3ee5626480a4638b336d25cd34c2e3bd65efa92ce8ece8ac0efc82ca67028b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229136, "uuid": "3576baef-5f48-4c0c-bc40-92dc47015cbd", "value": "T158741A1392E17D68E5264B739E1EC2E8B71EF171DF49776632189A2F04B01B2C1B3B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229136, "uuid": "0cd05d2d-63f6-41f0-9e33-bbab5649391b", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229136, "uuid": "abfa6ea5-d48f-456f-b34e-0bbf156726e0", "value": "3072:Ul1l0pS1CLHQo+cMfs5d9UwAp/nuHOXL3mdw5efXm7xp/RV/tqH:W1IS1CLwo+45nUw5uiNm7fTgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679229136, "uuid": "4f035dd8-fcbe-40a3-9e49-400114b2726c", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679229136, "uuid": "85042ab5-d4ce-4c84-a243-2048f63830ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229136, "uuid": "c15f1fce-a1af-425a-9efb-5461f4132765", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7852c063-c624-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679209545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209545, "uuid": "2c7d49c4-5071-42ac-98f0-71a2f539cd35", "comment": "Malware payload (RedLineStealer)", "value": "72a6d36b67c6c61748796c55229b492b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209545, "uuid": "08b4fb7c-ba24-416a-870c-7f81ef14d5c7", "comment": "Malware payload (RedLineStealer)", "value": "b28ecb1217fc264ad58701fa40f7768943d70413ad5f6a1a0f43943ccc554a9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209545, "uuid": "2876fc86-aa52-4fcf-a013-0f10eb80fff7", "comment": "Malware payload (RedLineStealer)", "value": "5f9099eece407bfa0eb1e4d5bc817e725e78321f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209545, "uuid": "5b67c53e-5ff6-4add-af75-11d42df26329", "comment": "Malware payload (RedLineStealer)", "value": "b8bec302c9d3761f319f162aa1a358de925c66f3d95f765a9683758961232191dc4b04c1fea30171597ea928f6f91bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209545, "uuid": "44a12346-3455-49f6-92e7-ef9ddc35381f", "value": "T137051253B3E88163ECB4377465F606C31A357DA59D7883AF274498AA0CB25D0A87237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209545, "uuid": "5e2a17ac-55b9-4f34-994c-f1bf25d152ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209545, "uuid": "06a02a1c-fe60-4a2d-9b8a-ee9d0019a00e", "value": "12288:gMr6y90u95B+WGZlsvKhwrxfkqMscy2iq815MMksrVYq562Qjip+S6/gI5SCGzBj:KyR9Lq7YBx5lxYrbeGgeSCgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209545, "uuid": "717ae0b6-4b15-4bf4-87c4-74b6b4a37979", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209545, "uuid": "699cc28c-ec1b-4950-9c05-29b744a34a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209545, "uuid": "756c05ca-2340-42e1-8d05-78b172a4b422", "value": "72a6d36b67c6c61748796c55229b492b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f09ab3-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241316, "uuid": "6040300a-bed8-4a48-8a61-967f42ed04e0", "comment": "Malware payload", "value": "8bb62c137e5579831ce3c008967133a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241316, "uuid": "f64534e9-938c-4471-a989-99f99608662f", "comment": "Malware payload", "value": "b290af5494ee28e77cf91a1708ef8e107ff0389509e581d2a16198d3542db62a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241316, "uuid": "5e6e631b-152a-4284-b61f-5f5eaddac860", "comment": "Malware payload", "value": "2000be243b8a9a6cfe1fedc39a33b86bff25918b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241316, "uuid": "bfd8c2da-b677-4093-bb89-b1692fb182fc", "comment": "Malware payload", "value": "8bff3701777e2c41c5968316adec70fe666a8089eb49abe03c45188e9804ed8030735e784c1bd853f2c361f2873597e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241316, "uuid": "edaa8de1-728a-41d1-8fdc-9026538ad12d", "value": "T1D395BE51F223DA49C2195371CA81DAF017B1BC09EE129E1B7999BF1A7E733C03B25792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241316, "uuid": "035395c9-0443-4f4a-b26a-47ce04c5f66c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241316, "uuid": "47dcc53a-c596-4eee-989c-2435647bd4bd", "value": "49152:AyLjIylGC+wzZAElWCaPbGZfkuR6C3bLQt+HObUJJGy:AygPC3A2WCaPusuLQt+ubUHGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241316, "uuid": "93d761a3-5156-4d2e-af28-ff1f5980dd32", "value": 2039808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241316, "uuid": "4903b614-d9cd-43b4-a6aa-85f0db4a031c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241316, "uuid": "7ad28054-99f8-49a6-b831-f81e1ccc7013", "value": "8bb62c137e5579831ce3c008967133a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30026b2c-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1679241207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241207, "uuid": "a0c7d80a-9fb2-4df3-86dc-b03258f03351", "comment": "Malware payload (STRRAT)", "value": "7ce3e372d644ecd63ec9393e12f10f3d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241207, "uuid": "cfd082da-5123-40c0-bcfa-246dfc4342dc", "comment": "Malware payload (STRRAT)", "value": "b2a713c200db40a2516497ba113d3198742535cbb07745e625ce658ace882d69", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241207, "uuid": "9c88c149-ab0b-40ff-ba43-06725f66b244", "comment": "Malware payload (STRRAT)", "value": "9a8fb48b8c803ddb01357dbe4cf2aac845403926", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241207, "uuid": "4475bd79-4c70-4685-bfae-c3f5b606f235", "comment": "Malware payload (STRRAT)", "value": "c4d6f8ec782eab5e3603a6df9af4b475222e3a7d7521aa08b2a16459b757a9caa77a7e56fd7f4d7a4ef70654b61ac12f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241207, "uuid": "63141b8b-78c0-443f-b60b-d073c1213a49", "value": "T1D10412977E15C669D164BC8F8102504CEE476BA27D11B336CC31D1BCA9DAD7FA8DC086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241207, "uuid": "5c920058-ad8d-4114-ab48-16ddc25864de", "value": "3072:0L7ikOOC1uBkeQERXx1uQmThP/w6Fr/eU3UcX3adbYkURt20rgy8ZItdUB98ZUuQ:RFOCABkeBSQmThPIoEcX2bYkURkCgy87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241207, "uuid": "38ccd37b-a73b-46b0-9083-0a36f449f6a6", "value": 189267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241207, "uuid": "eee04310-e229-4e0c-9406-a9c3aff7c274", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241207, "uuid": "b56e50bf-ae45-4e0a-af55-14095218af01", "value": "IMG-SWIFT190323.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fccd45-c61a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205168, "uuid": "00b91ab8-d1cd-4a39-b1f6-205e5bdcd633", "comment": "Malware payload (Mirai)", "value": "ee8a8e9c9f19d97bd6b3463c1c3a0e94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205168, "uuid": "4143203d-e9d9-4444-842b-f98e44804d29", "comment": "Malware payload (Mirai)", "value": "b33f28fad9cc82bbf22e2bef8f5293646a118c8ce03fd7ff8c5e68a6a0f234b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205168, "uuid": "f1b4b8bc-b66f-4791-bcd3-924f51379cae", "comment": "Malware payload (Mirai)", "value": "3e4c0a1a21fdb91848507baca9179be8c80e0980", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205168, "uuid": "8033158a-feb5-484e-994b-c0bf3648eb70", "comment": "Malware payload (Mirai)", "value": "6f88f7e2b94bf8be878a38d5779b2473a271290f03f9ee1c507966a5cebdd7c1e382b5a756136bb61c93a747fe50f91f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205168, "uuid": "10143dc2-8ca3-443b-8083-c293bda58c11", "value": "T1EFB2D1908BD15706C6B0B475A37CCF922B3B05A4C6F63936262093BC96554A633BC9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205168, "uuid": "78cd3d0c-32ee-4478-b243-022347c5e39d", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+B/AGZhymdGUop5hu7e:4GaKQFH0rs3zWoDDRsjt7LB9U+B/rZsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205168, "uuid": "65d8d75a-ab40-4007-a3c5-2ffb14c52cea", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205168, "uuid": "e7c5ef71-0973-4e7c-9c78-3808fe56d151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205168, "uuid": "80457e57-1c56-4410-a9f6-c5eccc7494ad", "value": "ee8a8e9c9f19d97bd6b3463c1c3a0e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e996507-c656-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231084, "uuid": "0878081d-acf4-4276-bfac-38cd541fb47b", "comment": "Malware payload (Rhadamanthys)", "value": "583db29b3e336bbcd2afe36350580252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231084, "uuid": "8fc6591a-491d-481a-8485-ad898f51cd84", "comment": "Malware payload (Rhadamanthys)", "value": "b3a67550c3184a27373f3c2d1c3139df6a3585bb12253c7768258d6b7da78c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231084, "uuid": "4d3b1899-8327-428d-80a4-c99e469c536b", "comment": "Malware payload (Rhadamanthys)", "value": "ddf96780714f52906a53bf05f6bd23b1811d175b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231084, "uuid": "0873841a-df4c-45a5-a354-51b9d1f361bb", "comment": "Malware payload (Rhadamanthys)", "value": "c385cccb69d6b0ab68223e8a28463cea8298b6fbbd51ddb8567714279ab13e0a160a0bccb447bf5b013d633dc1db97a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231084, "uuid": "f7ebfc66-2f8e-42c5-896b-acdc3430d31a", "value": "T109743A53A3A17D59E9264B739F1EC2E8B70EF670DE49776D32188A1B04B01B2D173B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231084, "uuid": "f02b0a71-9b0b-4033-9372-97dc45946561", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231084, "uuid": "aa61136e-7ba0-4cfe-886c-cf8cc624349f", "value": "6144:NuELlqtYs7fQ+KSa99IZtjdsx+LEMSzl4f7h/:NuEkiGw9Gtxsx+wxzCf7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231084, "uuid": "25dfeda8-0cb4-4034-be20-f06194c6eece", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231084, "uuid": "a112c2d0-d259-4a60-baaa-8376dcfcd89f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231084, "uuid": "4f642aee-e064-47ca-a66c-0298b3590da0", "value": "software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a8a810-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679241194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241194, "uuid": "d5560c3a-c6f9-4f3b-b468-0670e084c60a", "comment": "Malware payload (Formbook)", "value": "c846e5801deeb04632315f7de3480497", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241194, "uuid": "efb84c1f-e659-43b4-afec-542217eae417", "comment": "Malware payload (Formbook)", "value": "b3d818198549a48d483091284fe0f2fa0e43d7cb6f95cb4a09014742a0f89eb5", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241194, "uuid": "19ba3e42-156f-41b9-92a6-dbbbeeeabe41", "comment": "Malware payload (Formbook)", "value": "218db31d81d22651414941218801cb5c33d9bfe1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241194, "uuid": "0351e5e7-0e85-4c7e-ba7a-139447aef4d7", "comment": "Malware payload (Formbook)", "value": "3fa319b8abc5b75572b4069c85c53be7c3e285d3bb16ada40ae9a41657da23fe2d872ad648c196c396dd786b116351bb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241194, "uuid": "b5370e93-8001-4776-8b11-d2a9161e383a", "value": "T1B1E44AE1D68488E9FD694B76A8339C3614677D7EB9B4601D661EB6322B732C30077C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241194, "uuid": "1407e9c8-552b-4903-9350-e934755e39ce", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241194, "uuid": "c3f0171b-b7af-4c40-a591-d2312d3e4815", "value": "12288:IYGGr4VVVVVVVVVVVVVVVVVVVVVVVVVVVVVHUIcJFQXXI1dsRCrVd6:IYeUX2Qd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241194, "uuid": "2d3b3b12-d8cf-4097-af9d-87d640d5fe04", "value": 714137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241194, "uuid": "8b5978c4-7121-4a64-85c9-7f9fbc010edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241194, "uuid": "b1fcb7f8-a3e3-4991-bbc3-6110b283e64e", "value": "DHL SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796fbdb2-c624-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679209547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209547, "uuid": "dc839c82-3e87-4740-b6d1-5077aee0dabb", "comment": "Malware payload (RedLineStealer)", "value": "dc9b6d5b98f68f23659fa764ef60fbad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209547, "uuid": "f3a9330b-f155-4b65-b960-2c6598fbae51", "comment": "Malware payload (RedLineStealer)", "value": "b4006834cbda33f61d10adee97e4d778500660376de8e1ccaa8bef01030e23b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209547, "uuid": "2c98393b-2ed9-40a3-8e06-30edc2b83dd8", "comment": "Malware payload (RedLineStealer)", "value": "68acc2169d805a83c26efa6d7e9885acffce774c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209547, "uuid": "7e41f014-4de8-49be-be67-93b14538ffd2", "comment": "Malware payload (RedLineStealer)", "value": "632c707e6d2e7cd0dbb31c87c35b7640d8ef6f4a517e230eac30109c87af8ce57c15e247a4630180d212f7f3d1ee9a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209547, "uuid": "1ef3ea15-9751-4693-8ec4-7e52b2004e5f", "value": "T15345F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209547, "uuid": "9ce4696f-feb3-4666-9e69-699ef4672df3", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209547, "uuid": "35b0728e-e47d-4544-a60a-f377d5045038", "value": "24576:cLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Gko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209547, "uuid": "cc1ad6df-deb4-4214-9ac1-aa714bfdec93", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209547, "uuid": "17207fbe-48c5-4fd4-be08-87d7da42e540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209547, "uuid": "c677af04-dbce-4394-b76f-b3157efbba21", "value": "dc9b6d5b98f68f23659fa764ef60fbad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f48d883-c6a8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679266251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679266251, "uuid": "2655947a-23a4-4197-9148-8b231a082d30", "comment": "Malware payload", "value": "030f32cc7a2574ddc91863fee8ed3e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679266251, "uuid": "f6d0aca4-51c8-4fca-ac8f-5b05106de113", "comment": "Malware payload", "value": "b57bfc810ae752405f7a05a0f4ef682f279a5b1d5e945ab8211c64c3800b7aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679266251, "uuid": "196d80f8-258d-4006-8b50-f94a24abbdd4", "comment": "Malware payload", "value": "715e73bf3de357fea339582a6ed935ca21db5283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679266251, "uuid": "ec43605e-b230-4bce-8aee-725994c4574c", "comment": "Malware payload", "value": "33ecf53b2c20c9b9a463f9ee83aa238f0b69762079d652a5794be8e1baea682ec142c2d9afce900b74f217a7df849a21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679266251, "uuid": "741f276b-65d6-48e8-a854-ab7d689f8a58", "value": "T16D74AF06B6951DFAD177863CCC1B2906E7F278061334DBBB03A542617E23B416E6BB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679266251, "uuid": "4696b2ba-e05e-4fc0-9608-b54232d1cbf6", "value": "a2567245b026b55caf4b6d5d51a59fdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679266251, "uuid": "6721cb13-dd43-4c3e-a9e2-4b190fea6237", "value": "6144:I/PgwJfmzNJEDOSKYnkjzFJKZhD60r4lrCF77RoKFRaWtUf:OPfmzNuKYbZEGGrMop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679266251, "uuid": "a11ab83a-7e2d-46bf-b060-c418cdb1a993", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679266251, "uuid": "efc36fb5-7b89-46dc-8902-6935439fad43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679266251, "uuid": "a70e4126-a189-4aec-b47a-96d91db5d5e6", "value": "b57bfc810ae752405f7a05a0f4ef682f279a5b1d5e945ab8211c64c3800b7aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00776966-c651-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679228672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228672, "uuid": "858a0f29-4a81-4310-bd1e-00a1761b7d45", "comment": "Malware payload (Stop)", "value": "f6631c563897f708ef18bd05fb176855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228672, "uuid": "bf927d67-5699-463d-b381-fad055955aec", "comment": "Malware payload (Stop)", "value": "b5b9d615b49d24e3feef37ea7b69c173ba25bce61617c919f22d0cb8d754c632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228672, "uuid": "7c80df48-987f-4923-a64f-40437929c15e", "comment": "Malware payload (Stop)", "value": "09056ce6c7ddaa2c89bfe9a80e405d9542e0aed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228672, "uuid": "16beb6e2-60c3-4ecf-8c05-1ab7f8cf17b3", "comment": "Malware payload (Stop)", "value": "2e081673981c07bc00cb0bdc844008403fe43cf3a463ee214dbb1df7a2a7340f314d28ef5a13b0792f796e72661f1f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228672, "uuid": "681a972b-1656-4910-9eda-509b43d630de", "value": "T12005CF53E2A17D45E925CB728E2FC2AC770DF5509E59BF6D222CAA2B05B00F2C273715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228672, "uuid": "79af30e4-f106-49f3-a232-f1340c167686", "value": "41f83c8707be0871bf2bea8f993f5e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228672, "uuid": "c0d7466f-f93a-4087-871c-9ea43dce8ff8", "value": "12288:0P0Ggj73ntMr/WG51PhP9pJS5O0gW9Lso0GvmJxHpmu9/ND73IXh:sQnmr/WG5rlpJH0HVsKmjh73IXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679228672, "uuid": "fb74d267-ee87-4c61-9ff5-a32e8d169f1a", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679228672, "uuid": "02135733-f575-4271-8d62-0eab4f236c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228672, "uuid": "76ff3ab0-eda0-4964-89ef-a6924f8e0d4c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be94758-c5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679185070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679185070, "uuid": "9e365d66-9561-4322-b982-c44a9d83e7cb", "comment": "Malware payload (Heodo)", "value": "d74b1f44c22da7988580293a12b8f2a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679185070, "uuid": "d6b13705-1b47-4d68-bba3-6f1f7920a405", "comment": "Malware payload (Heodo)", "value": "b5c43726ac6b60ef52f82821006c0bfc97c1fc6e897c4aae306c57e01b3acde4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679185070, "uuid": "4033bcbd-45c4-4f29-8558-0380b9d67933", "comment": "Malware payload (Heodo)", "value": "6f6be5d2d61710e6f146b490f70fa01c11300577", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679185070, "uuid": "1942679c-0463-437a-9144-b201dd7289f1", "comment": "Malware payload (Heodo)", "value": "060d6e8692b8e9da59bcff2433ced004c5ab89e57309bb7a1f8a245372b4b42e095a7e31dee8041bc18352cc6ef6f345", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679185070, "uuid": "737a63c5-f34f-4892-a50b-0a91cf1c6cac", "value": "T182052368C67295D1DE81E635B5321A09FFDE0791680338EDA4FD6C3D29F0E40973B522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679185070, "uuid": "f0f65928-a170-495e-9ba0-a052d3d595a8", "value": "6144:BA/fqQLsh2uoOObj+gmM424czDPECwRAc7cDA08yuMol31:G/fqmm2sObC7ezET7vh731", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679185070, "uuid": "26c59d6b-0ec3-4271-b85a-7df8a94ac217", "value": 832001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679185070, "uuid": "28bd3ff8-f157-466c-9f65-335c5f13f45a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679185070, "uuid": "82f77833-b0b4-46e4-9002-6460caea4136", "value": "d74b1f44c22da7988580293a12b8f2a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3d0042-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679241440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241440, "uuid": "47599b7c-f861-449e-a88a-ee9383f06a37", "comment": "Malware payload (RedLineStealer)", "value": "2c2c48eef02174e8f733567487802ea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241440, "uuid": "93ebcbb9-86dc-44a1-9a49-83b34d1b7a90", "comment": "Malware payload (RedLineStealer)", "value": "b76bbb384e4d37fa437e57197cc3f87430620cd9a6932c5893bd19b53e11c707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241440, "uuid": "50d65a79-b408-41bf-843e-d7dbd466b2fd", "comment": "Malware payload (RedLineStealer)", "value": "fcdba5d0c5ddea9db6e999d6a06cdbdbbb4255ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241440, "uuid": "158fabe5-6223-4d46-9295-505d9b34c626", "comment": "Malware payload (RedLineStealer)", "value": "ab6a36bde741839dcf75f268ef8ca9ae94548f50468672bd3b25ee7bb4fe808baff4149b56e1f41dfa637530d8684ece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241440, "uuid": "a9152f47-a2a0-4514-8e28-ef8c76684b92", "value": "T1D6052246B7E8C073CCB917B058FB43831A357C725DB4966B2394BDAB1A729C4A4313A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241440, "uuid": "113ec6a9-9ab2-443a-bcce-a5c1179c073f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241440, "uuid": "86595e53-7069-4c2e-bb36-66fbf6b067b6", "value": "12288:WMray900nLaGr3GIHdkpaCIFs6x0b3M0KcqaEf0uX+nm7C74gX62ZOs+S/4GSmj4:oy/nLLq2kwCLq0bHdPE8uXorMgK3sjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241440, "uuid": "564df9ec-5195-458f-ade7-d0df27b4fa54", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241440, "uuid": "8f22b341-1e87-4e85-88c3-034c1fc2c95e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241440, "uuid": "2ffbc28e-2efb-4c1e-9247-e0c1f9b7e33f", "value": "2c2c48eef02174e8f733567487802ea3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed41ab41-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241524, "uuid": "30b657c0-5f97-4c8b-9ad6-ec0c5eac2ded", "comment": "Malware payload", "value": "de034bf5fc21baed72913f5080791388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241524, "uuid": "a51d2d95-5cba-4c2e-8183-d9c11c8545be", "comment": "Malware payload", "value": "b834772e5a6dd271d47c346f01eb50ab72dae32c8a6ba946bbf2b83267f44653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241524, "uuid": "46fe7a53-fc59-4e7c-9b59-91a55f3906c9", "comment": "Malware payload", "value": "ae9e05aa2f7a999af6c5ef055f2dd4d0b9613356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241524, "uuid": "5d61a346-5eac-4b28-81cf-a77f10e80ef9", "comment": "Malware payload", "value": "507b550efddaf38633ff1615fa6e969fcd65f54b93bce27b9ecbbb87836deed2e93d6cb92137edbc7b54b0d7b12c2304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241524, "uuid": "432cc40f-5f82-4703-948c-06067398f5fa", "value": "T1035533AC2E104DD6EF6D8D74825E25E630B3BD444086CA33B36F08862D5D8E5D5DCEA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241524, "uuid": "6992bcba-961f-4a07-ae0a-6825158d682b", "value": "24576:Gd6jcmJcYsqrfqRnUjbD9B2Oqf5OG7g43AoHnfzlf+FmX8B72VVpNgGSQGrTYUa3:GMjXRbjn9BQ5OG843AoHfzhcmXE7DGZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241524, "uuid": "810d61d3-649c-43af-a59e-b70acc22e30f", "value": 1374156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241524, "uuid": "ae9b1753-0b38-43f8-904e-f0b6c00c9295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241524, "uuid": "b7559480-b87d-4bce-9315-91f8f43fd72d", "value": "de034bf5fc21baed72913f5080791388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4115e318-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224915, "uuid": "eb6e3453-0b78-4b54-8291-8a5e4b269bc1", "comment": "Malware payload (RedLineStealer)", "value": "69c0948035578c6f8beef14eb3523d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224915, "uuid": "c2f8bc4b-5444-4d2f-be2b-39c69d9df0a9", "comment": "Malware payload (RedLineStealer)", "value": "b8ae86c46c5d7b83f8d487c83c52264a0aa38284617802c665434cd80afb800a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224915, "uuid": "8cf38582-6a2d-4f79-a985-87067ded8643", "comment": "Malware payload (RedLineStealer)", "value": "b20e7a84596c3ac938ed32b4c7b444c416f88e9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224915, "uuid": "ab1c63f6-5434-4698-9f59-1a1220fc6e21", "comment": "Malware payload (RedLineStealer)", "value": "052f2277dc1995adadd2fdd8f23d78d17e884044de1cadaf60ce38af217daef843d9df1d1115fce7ad92da7224fe7f73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224915, "uuid": "e06e9ef7-ce96-403e-ba9d-f07023754a20", "value": "T15045F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224915, "uuid": "c576c9ef-695f-4a13-80dd-e688067f307a", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224915, "uuid": "f1b87f3d-f9fb-447d-8f8e-953fc2b5e265", "value": "24576:79h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:7/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224915, "uuid": "87ed801e-e00b-4e68-b452-2747beaace58", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224915, "uuid": "2e9d477a-e251-47f9-96b8-e2c231add262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224915, "uuid": "5cf9d573-c81a-4a8a-9e2f-1003e156b478", "value": "69c0948035578c6f8beef14eb3523d3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c306a4-c60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679200121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200121, "uuid": "26c7b71c-a917-49e4-9379-ff571526a732", "comment": "Malware payload (Mirai)", "value": "e5d451a95e9275ea51a651ce60f07011", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200121, "uuid": "5098eeb3-a48e-42eb-9c74-11be8f2d256c", "comment": "Malware payload (Mirai)", "value": "b9e2c6ddbbb93618453040590c7b7c5f263a2c37321cf0be97ad1a486665badd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200121, "uuid": "d627ea24-2d98-436a-875e-583590a05cb1", "comment": "Malware payload (Mirai)", "value": "aa1900ec5c3a1cdf09e5ff1392d333e279735d56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200121, "uuid": "7029d0d5-d115-4038-8f4a-182bbbfa6adc", "comment": "Malware payload (Mirai)", "value": "d0992bf6c5b2ddc4902d2dbf252f0cbf5c9b0b6526e69fb267f8cf493e9585bc81629167c3266e94bd0141cbf569e400", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200121, "uuid": "c6cecc58-b582-41eb-8e79-8dd8b4971404", "value": "T12F338EA6D5BDEDA8C1544AB87D258F389B73E0008A533EFAE644C6598047EECF1593F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200121, "uuid": "66951c92-128c-4cfc-b085-801342eaae4c", "value": "768:xaC6ywt6ZFqZqWdee9GkruwJMKdfAPs3gTzG+lOzLEVCwobGxCj2:xaHywtsZEJMKKPs36zG+l4LEV8ixCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679200121, "uuid": "eee3347c-77ff-4ac7-907e-71c25a094b04", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679200121, "uuid": "827bec7b-3129-4aae-a19a-3031cba91960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200121, "uuid": "b1f1197c-744e-47c1-b604-c6a856296652", "value": "e5d451a95e9275ea51a651ce60f07011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fd6dfe-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217943, "uuid": "f7a381ab-74d8-41c8-9684-d84d84fcc228", "comment": "Malware payload", "value": "e592b4ee3edc53510510333c86ed1fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217943, "uuid": "999be3fb-759d-4113-a2dd-e796c3789206", "comment": "Malware payload", "value": "baebbe1c07822b391186377e4cad418876ce3acff892f52d890833949799f4c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217943, "uuid": "8cb7c530-fd0c-4c69-a629-6c320ddb2fbc", "comment": "Malware payload", "value": "f4c652a85a512377a5eab81c1f12041f7ec39322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217943, "uuid": "1941f620-b2c5-4305-ab48-3c48b51cffd5", "comment": "Malware payload", "value": "376cf0a0f0c2f16b9b5c233eb1342f0492e5468b2e17a10c1bf0ddd47cf1433218b56d10eb1da6b616a169a00861b5a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217943, "uuid": "eb413128-c875-44af-8cfb-f37595cb33cb", "value": "T142659C0BE79480A5E477C2B8C557870AE7B27444035093DB64EAE76E3F27BF1663A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217943, "uuid": "3ca2ea00-bdcf-41dc-8285-4af1506f3f47", "value": "1d388f762a3af07ee59fdb8929f0736c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217943, "uuid": "f6f45225-05f8-43e4-9cac-6aae0121ed77", "value": "24576:zAhiVAjfxM82qyLIqhZcP/Spfm82vRiSlD2Z/rSS6Agxq:zAhiVGxM8DyIqhZcP/S9m7Ervgxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217943, "uuid": "bf1abae9-4c7a-461c-95a0-d17543cb2a23", "value": 1518672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217943, "uuid": "df01ba70-f5a6-4cd4-a728-86ea9bba33a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217943, "uuid": "60c43ff2-6f29-4198-bf8f-1bb594cbd062", "value": "awt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9f8c50-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211967, "uuid": "6520ca86-6606-4226-8792-4ea145b3cf70", "comment": "Malware payload (Amadey)", "value": "57febab8679112b458f9ddb6e5de29ba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211967, "uuid": "f6625e77-c043-4b98-aeb4-c23d6e9dd245", "comment": "Malware payload (Amadey)", "value": "bc1cba078ffc6f363f54a45e455a1dcfbcf013f20c90a7217a7d642251d4b4ed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211967, "uuid": "78ed24c9-63af-4b73-ab82-8760fa18abbd", "comment": "Malware payload (Amadey)", "value": "ec4c5e869a8f8ff3d7cc243203359f6e212f08f9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211967, "uuid": "946db1b7-6962-4e44-aed7-ebff0f9bf829", "comment": "Malware payload (Amadey)", "value": "fa4325d872222be36bfd3a88ee1ad6221f61be1367ba2953d1b15107cd65bdceed4e155e3bdeac487fefc7174a42b409", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211967, "uuid": "3f2cf7c5-5485-4419-91da-8ad69fed52ab", "value": "T1B945F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211967, "uuid": "e019fade-8ca6-4b0b-8904-3e49ca18b5d5", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211967, "uuid": "37a9c081-d8ba-421b-b974-577f8f426a56", "value": "24576:YLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Kko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211967, "uuid": "cec256d4-e38a-4ca5-82c0-bd3f47b3f667", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211967, "uuid": "ce8db731-715a-464b-9237-00c290439447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211967, "uuid": "c553fede-2bf0-4c0c-bf5f-c8f2df6d28c3", "value": "57febab8679112b458f9ddb6e5de29ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f8118f-c64d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679227365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227365, "uuid": "9a1336a2-187a-4d89-b55a-2a0e568739d3", "comment": "Malware payload (Mirai)", "value": "77a08422a459d32e33bd46de0044c973", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227365, "uuid": "bbcf92fe-18cf-4e5f-ac9a-8cd64553caa5", "comment": "Malware payload (Mirai)", "value": "bc99f02f552b520e01cd795d4b408573604de638a3680700940b58bc575e2e5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227365, "uuid": "4b753da0-8718-4ce2-9df1-9c4be3343653", "comment": "Malware payload (Mirai)", "value": "03477eb49b9ea7d04e998c057916dcf2eb4edc70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227365, "uuid": "c78d9579-8dab-4049-b1b7-ca663187710f", "comment": "Malware payload (Mirai)", "value": "11c0755a21f5615dca50ee72a3b0967c658a03b4caf0fdc8a3b7494529ef01deed55a89cee3752f3ee6cd6d9da6c98be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227365, "uuid": "7fe65c14-d6ab-48dd-ae09-e7cb0428e28c", "value": "T162435B52721C0E17C4A31A70263F5BE08BFBEAE021E4B685699F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227365, "uuid": "951f0583-6a70-4ade-aa94-b07042277fe0", "value": "1536:eF6QcATQdskHosl9k1dP9tT0bI666hJa105:tqgtJHk1dPTgbI6x4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679227365, "uuid": "dc41074c-d179-4f19-98b3-281322371c88", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679227365, "uuid": "47726f96-b32b-4ba6-b4e9-e174fe6dd587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227365, "uuid": "2d15332f-ef68-492a-a936-be8b2b5e7853", "value": "77a08422a459d32e33bd46de0044c973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56e92b1-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211366, "uuid": "d997e926-8cca-4610-a5bd-2937d949d0bf", "comment": "Malware payload (RedLineStealer)", "value": "187268b681803a60e85f73c90bcc8344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211366, "uuid": "084cbb2a-6f9a-4b2f-a1ae-2dfebd59a52a", "comment": "Malware payload (RedLineStealer)", "value": "bcf5a051480a9a8196df26cc5a84b84b860d23d970981a17e255d05dc58a83d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211366, "uuid": "3f01879d-f6ab-490e-a39e-b0a65ce7ed49", "comment": "Malware payload (RedLineStealer)", "value": "f1f1f2adedf2d537d0ded8d0d56d0d6ceb643535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211366, "uuid": "727b7f3d-f0fb-415f-a35e-59c6725efe2a", "comment": "Malware payload (RedLineStealer)", "value": "3e5c2594214c62892c75025c9cafc1906190ad13c71ef6f0f521da119ed5fba115841e0bc8b4f2286a9613e896f20623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211366, "uuid": "615545f1-a306-4800-b4de-4f84c2a260b8", "value": "T1F5052242B3E49073CCB417B018F207930B367C915AB897BB3B59AD9E4D305967839B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211366, "uuid": "cbdc3e83-a8c8-4875-b1d9-7060ebe469fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211366, "uuid": "55f3b62d-5688-46aa-9687-88a0ece25e7b", "value": "24576:TyQ5fbfmwzhO1yjuDFEyd6Jz7QZCcmymF9+lrI:m6fWjDFb6+Z348", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211366, "uuid": "8b90a107-e976-47d1-9d90-3946a7d30db3", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211366, "uuid": "82098db7-4b68-45d9-8d6c-7e07823ed9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211366, "uuid": "0a3d2741-0457-4c8e-a67f-d0a2913ea948", "value": "187268b681803a60e85f73c90bcc8344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13799fdb-c68b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679253614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679253614, "uuid": "40e2b619-2614-4c52-ab80-73ca4038cd94", "comment": "Malware payload (Stealc)", "value": "48a778ae7cfb00d4fddc958807f11813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679253614, "uuid": "a70d6e8e-c875-4e09-8c69-c875e16b71a9", "comment": "Malware payload (Stealc)", "value": "be17c8aac5b1f95da13702092d5d3c37c98f12d0ff7704f163f43a2ab890bcc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679253614, "uuid": "9d4eb7d4-9fcf-49ea-b7ef-96e64775b6e8", "comment": "Malware payload (Stealc)", "value": "f1fd1f797ad35ff305a829151f02dab3e959cd81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679253614, "uuid": "70a7310a-c497-45ce-b20c-19f7a35058c5", "comment": "Malware payload (Stealc)", "value": "c9713476c6ccada5b10122a951d5da6f50b7b8d962e02642eebfa6fcc25897854de611c1987e2b6a7363975e447ec119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679253614, "uuid": "ba2a718e-3f53-4165-b9f9-7cf7c8fa9ec8", "value": "T1E954F943F2E17D54E925CB729E2FC6E8760DF2609E597F6D221CAA3B04B10B2C173616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679253614, "uuid": "057ea1db-a8e0-40ad-bd01-7741e1d10eb4", "value": "c901cf1b33a79cac7fcfec57ffb66976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679253614, "uuid": "d29bcf0c-1630-40d0-a025-7ba7a27318a5", "value": "3072:ODEH0FXwLE1tl9NbAsSNiJoA8qLczTH4ON5nbrRJhef34vx8S:SXwLE13/8z8P8MuNnvLhef3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679253614, "uuid": "0ad26959-f0ac-429c-8969-1ee322f62de1", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679253614, "uuid": "ea451670-5329-4659-a187-80391c0f2ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679253614, "uuid": "0c4e05c0-5b56-43ed-9b37-4aab7d55b018", "value": "48a778ae7cfb00d4fddc958807f11813.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d2f285-c685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679251209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679251209, "uuid": "e7a8944b-c443-4ac1-ade7-4538640c87ae", "comment": "Malware payload (Amadey)", "value": "e2d2f8d3ce4b85cfa4fe4ed1558210ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679251209, "uuid": "91aaa34e-d083-45d2-9c7e-dfcf422343d2", "comment": "Malware payload (Amadey)", "value": "beb4dbad0971b8d0d54abac0bd599b882710b7abb058870ca36363b976328245", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679251209, "uuid": "f18b4c38-ddd7-4060-aaa2-0452f0d7c620", "comment": "Malware payload (Amadey)", "value": "38ce578e3f7bf9e44cd1d39f0428bfb0661c6516", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679251209, "uuid": "afafb5e1-4704-458b-b3ad-07d61dc39b8a", "comment": "Malware payload (Amadey)", "value": "a42acdc2a384954ea3830cfaa33eb15329105671cff3f026413daade93f2b657b5b966accfb431e125c12e7c3aed0f34", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679251209, "uuid": "33c4899b-e48b-47da-9ae3-fa780de5031b", "value": "T1CC54FA43F2E57E85E925CB729E2FC2E8761DF5509F49BB6D221CAA3B00B0272C163715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679251209, "uuid": "3eead2c8-2d2a-42a0-bb90-969bdd369d17", "value": "c901cf1b33a79cac7fcfec57ffb66976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679251209, "uuid": "9a807c91-44f8-454b-88ac-d9e27ad03d52", "value": "3072:sDPH8XhL1vjbtf78UOIextiRNx3wgrpM3eLLRd5nbrQJhXx7:NXhL1vZwmYiNx3pMOvChX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679251209, "uuid": "f82b87f7-f958-4a3b-9df8-20a54ea08528", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679251209, "uuid": "6e8586db-9175-4551-b9e0-876e4e849f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679251209, "uuid": "116d0e21-7d60-4f7e-8020-df2aa096d609", "value": "e2d2f8d3ce4b85cfa4fe4ed1558210ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d312d1c8-c60c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679199390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679199390, "uuid": "46488101-b0f3-40af-a6e5-ef8dd527352a", "comment": "Malware payload (Mirai)", "value": "9d2295557c30cbf330ac6899968a4c93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679199390, "uuid": "c190df2e-38b7-4170-89b2-2cdc55744f20", "comment": "Malware payload (Mirai)", "value": "bffa7f3f79b6bfb41bb63d1342f2ca2ab577a924687e2ca2aef25e015b4f2054", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679199390, "uuid": "d11ed078-0734-4be4-b026-5ee80ad6bc08", "comment": "Malware payload (Mirai)", "value": "4f2a8eaed0d883297942e450ac3b693dd479e63a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679199390, "uuid": "f51ac051-4633-4947-a4e9-e61019a4997f", "comment": "Malware payload (Mirai)", "value": "9f9be57cad49624e9f362a747072e9ebb10049a3edb4bc8984063097fac61427299fa2d98b52110c19fff350c33562d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679199390, "uuid": "a8120840-65f6-4ebb-b4f0-fe1e8520a219", "value": "T1D663A506BF214FF7DCAFDD3749A91B05258C641B21A97B397E34D828F64A24F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679199390, "uuid": "da4af63c-3a78-4eef-b1f0-9e5ece6e2e2e", "value": "768:QxNCJ0EYlDYhHnhwqsFDwLX3U6ngBhN6PNUpGXS5SyeweVKe0n3oNWpkmPqXitMI:QxNCJBYlDFwwjhwPTXSNxIKzn6CpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679199390, "uuid": "c59ac4a9-450e-48a3-8e4c-87060bfce055", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679199390, "uuid": "995f8e98-49f7-4b32-ba45-4b60e2988d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679199390, "uuid": "0f8f6f86-16fd-49eb-b680-d7b35bc1b571", "value": "9d2295557c30cbf330ac6899968a4c93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ae855b-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223364, "uuid": "70e8aee5-67f9-4326-81fe-e0f981a4b424", "comment": "Malware payload (Mirai)", "value": "ebae3c62a9942750e358eeb83ffae460", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223364, "uuid": "aa7d604c-cc70-42db-9200-861725fb9d40", "comment": "Malware payload (Mirai)", "value": "c12a6f42350f57b904ef69e32c3a6a69333fd1eb4aa2f402776fc0ae4779fb7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223364, "uuid": "05552e2c-8363-4423-ae2a-7f845f92d91a", "comment": "Malware payload (Mirai)", "value": "e730290c808ff02051410b276a248552eb99e590", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223364, "uuid": "88417901-95b6-4183-b212-62a233ef820e", "comment": "Malware payload (Mirai)", "value": "52ab496c5504b474b4e84fdf5158f699420f61ce702983c2b6bbe67fb41ae04a1b1553e95f9b342e3be0f1362d99d289", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223364, "uuid": "4bcf8ab6-a78c-4a23-b8cb-b2bdb12684ec", "value": "T110231A96F4019D3CF95FE7BF84134D08FA21735160A30B2A57ABFD936C721A99E12D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223364, "uuid": "9b7eae37-5e22-4186-a708-c290e4d0d927", "value": "768:kaPiKOKCJyo7gtJnfTrYsaerX7cCyJ08Iw9YeJTKS8V5:b6KcyoUJfPZ/rLcP08IwWeVN8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223364, "uuid": "906830ed-89b5-4687-9aaa-01c346f7513d", "value": 47252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223364, "uuid": "aaa68c6b-be26-4c75-827f-16ffb54bb48d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223364, "uuid": "266bf0e2-f1db-4f07-944b-7f22dbe7ede9", "value": "ebae3c62a9942750e358eeb83ffae460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b92c92-c64a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679225692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225692, "uuid": "82d3294c-5f0a-4f31-9007-702499e04a23", "comment": "Malware payload (Mirai)", "value": "dd7922fe047546ad0b64d36bfe34a045", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225692, "uuid": "fb1e6202-3526-4b3d-b414-b08da46fa5e5", "comment": "Malware payload (Mirai)", "value": "c215aba69799b33174eddd736a803cafe2c89030574bbfa6add97c2d942d79fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225692, "uuid": "93c6b1c2-e9b3-4cc5-8f4e-591c8ddc6b81", "comment": "Malware payload (Mirai)", "value": "b16c7d35b4ea3f405f6bff9ed593bb98a55e742d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225692, "uuid": "cd20a4d2-13ec-4b44-aae3-303eb9a0818a", "comment": "Malware payload (Mirai)", "value": "7db6bd08eda597ceed844c19e96a63105da13b90a2b138b5b9810c86c74c0b05aa9e8f510abb1ae24f44bc3d9b0a9cda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225692, "uuid": "bf972fd3-5bcd-49c4-9db1-9f40a83edd31", "value": "T12AB31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225692, "uuid": "5db8d8fd-8ce4-42e5-b480-d1566490eaa2", "value": "3072:MDVLSItJP+Xsp4JlN3HsjmH1cuEgvniuN/:MDV+ItJH2l3HsjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225692, "uuid": "5898b64d-b013-44fc-b3d7-fa5de457a7b4", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225692, "uuid": "f1837c0f-147e-4963-b056-454a164f179b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225692, "uuid": "4a383cf8-fbc9-4dd3-98e6-6db6aed55f8b", "value": "dd7922fe047546ad0b64d36bfe34a045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cf9675-c627-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211049, "uuid": "cc6bdcaa-3f2a-477b-8e1e-065cfa313133", "comment": "Malware payload (RedLineStealer)", "value": "1ae386361199c7496af963ebebae3f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211049, "uuid": "8f33a92f-47f7-4fad-8d41-f3647e1ca809", "comment": "Malware payload (RedLineStealer)", "value": "c21baf813837da9edaa04bf813f01338f9159f8e349e90764067607728723813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211049, "uuid": "035ad373-2485-4753-9254-dabc0533cab7", "comment": "Malware payload (RedLineStealer)", "value": "8108a6282ee8e0b931abe6252d242877df93af7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211049, "uuid": "996f0516-98dd-47ab-9c83-1ff9edad8f30", "comment": "Malware payload (RedLineStealer)", "value": "a7888ec58c67c4ebaf48ed3d18f48a387bbd660e53d87e1c5e4e77dc667d06792fcbdd5091c082535f3f1255fa4455e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211049, "uuid": "375df6f4-9749-482d-a77a-fb9efea060d6", "value": "T15045F10392A17C49E9664B739E1EC2E8B71DF2F1DF5D7B653218DA2B04B11B2C163B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211049, "uuid": "04fe5a60-5966-4cc0-91f6-aa2351c5e6f6", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211049, "uuid": "7b410b06-4dd8-477b-9586-f1444786b419", "value": "24576:UdrxnnySqJxCY2MNaboMVEQxSrvmK9ch0dzt6Jub86X9mkR:UPnnoqdlbVvivmK9che6J48q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211049, "uuid": "ea449b44-666b-4692-8b8d-cb308b643dc1", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211049, "uuid": "3abf3947-2b22-4b2d-a658-87ad94182b84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211049, "uuid": "7d606e30-81b0-4214-be2d-287999dd87c5", "value": "1ae386361199c7496af963ebebae3f6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303d1b02-c631-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679215008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215008, "uuid": "811f2ce3-e4a1-4212-bd3e-65ba50a877e7", "comment": "Malware payload (Amadey)", "value": "36ffb5e523c466a7a49864c4716e8843", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215008, "uuid": "d1964af6-8381-43fd-82f0-3060cb6ae54f", "comment": "Malware payload (Amadey)", "value": "c2286a3f3c64d2bb524116bec2dde1d463bad214908a12d9a004dcda192dafae", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215008, "uuid": "da003230-4a03-46c0-bbe7-a8f0c044f1ff", "comment": "Malware payload (Amadey)", "value": "29f568f45ec8859039ca5304bf8221231788f872", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679215008, "uuid": "c9e702b1-fba0-4df7-a173-b79bbc414d85", "comment": "Malware payload (Amadey)", "value": "ea31ac8433b3306dcd6ba2f9ceb01e3eac9fcbb8cc5345bbd5a17314737e10a505432e012cd325b49e2783795b6e670d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215008, "uuid": "985c9971-fd09-4a8e-9e12-e2fc054a1ada", "value": "T18145F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215008, "uuid": "82205e7d-053e-4261-8b5b-b5e2e95f9a63", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215008, "uuid": "08b9faab-baac-454d-a162-f316c204fc79", "value": "12288:WxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:YbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679215008, "uuid": "085798c6-de73-42ed-9c98-408dde327ee5", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679215008, "uuid": "67a20398-4c33-4f0f-94f7-6608667e56ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679215008, "uuid": "1d2a3401-0fc6-44f6-a569-142bfa4be33a", "value": "36ffb5e523c466a7a49864c4716e8843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ac4437-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212284, "uuid": "10076d79-6f57-41b5-bc79-344b5fac3470", "comment": "Malware payload (RedLineStealer)", "value": "a097af29092cd5932700d930320f01e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212284, "uuid": "bb09c81d-53a5-4096-a998-451a0a02cfe0", "comment": "Malware payload (RedLineStealer)", "value": "c32cae932fe33d5868c10754aac3be042364b60c372edabeec3e4f9b87730bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212284, "uuid": "188f53f4-18fe-411f-b4eb-45b50d7c4fb2", "comment": "Malware payload (RedLineStealer)", "value": "91fd515013cf22f187886c66de8c52d63e16532b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212284, "uuid": "6cc3bdb9-6f30-4510-996f-65f1a6f8f67a", "comment": "Malware payload (RedLineStealer)", "value": "54299193c670bd62452375e0739d8fd320ca363b2bc076f4f1eb84b0e4c35f60ef203810fcf23c3fff6d249f4f22a2ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212284, "uuid": "da430ac2-35e1-45c0-a873-66f6f9d4c598", "value": "T1C945F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212284, "uuid": "d6ac3a23-9bbb-4a04-bf55-9dfd9933dac8", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212284, "uuid": "9b7e9d50-354f-472e-bac4-817425f9fcad", "value": "24576:wLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Cko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212284, "uuid": "a700cbf8-b1a0-4f9a-8b7c-db679c447c89", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212284, "uuid": "07968a07-6797-467c-b8dc-abce534e9799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212284, "uuid": "5e48cd90-0645-41e9-aff0-a5e10b79969f", "value": "a097af29092cd5932700d930320f01e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75deda2e-c642-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679222426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222426, "uuid": "99329721-e63b-4819-bd69-3ab6a1a3ce02", "comment": "Malware payload (Mirai)", "value": "2b8b33aa97cc3728a250e4bc341c9f0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222426, "uuid": "6ddc4a8a-fe76-4bf9-aec2-8f5df9326406", "comment": "Malware payload (Mirai)", "value": "c334a8fc7502501d4e9a619f238a15dfb72eaaa866cc39bb719e1363478e6c8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222426, "uuid": "f823073c-d206-45fc-9b8a-4d65afd4f6de", "comment": "Malware payload (Mirai)", "value": "d2443ab6847d44e53e20bda7be5751aabdf86d95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679222426, "uuid": "645c70b5-9aeb-4618-a0c0-6befdd233ef5", "comment": "Malware payload (Mirai)", "value": "7ec66ea963b591a2cea622f8955ed2d6050da32d12f0e5df8abce171cc8f916b4ecc6e17477dc3c386cf2184078e05bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222426, "uuid": "f5d8a487-f76c-47db-81ac-016b15a133ec", "value": "T1F8C34C46EB418B13C0D5177ABAEF42493322A755E3DB730689146FB43F867AF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222426, "uuid": "fab209fd-6ea2-4b32-97e6-882ec85bb7ed", "value": "3072:qoqNW/XvtKf5wXYgwzJ8a5MSsCHjoUM/9hb8Eit:dqNW/XvtKf5pgwzJ86MQHjlM/95Hit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679222426, "uuid": "d779cbd3-a059-4290-80cc-ccf1fa15faa0", "value": 119494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679222426, "uuid": "9f6456f7-7f2e-46fa-bc12-8380efc96499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679222426, "uuid": "098a3d6b-a27c-4771-8885-d2f6ac4efcad", "value": "2b8b33aa97cc3728a250e4bc341c9f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ada3f9c-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212905, "uuid": "6f7b8340-daa0-40ce-8197-7627730ba614", "comment": "Malware payload (RedLineStealer)", "value": "ebb28dd10cc23c9c3e5a78b6ce41a208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212905, "uuid": "394ebd18-c5e1-4467-82d9-9070f8b7f820", "comment": "Malware payload (RedLineStealer)", "value": "c387ea7bb5e9291f7ab9d34907a40707c51ae9c7021984c279e211ee50cc4a91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212905, "uuid": "2f88938b-ee95-4812-9442-9398e1a8e8f7", "comment": "Malware payload (RedLineStealer)", "value": "fdc0c95ece71a7f200bda43cf19b5e222962ad05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212905, "uuid": "7969e748-64fb-4534-b6f4-0f1ab14f3a31", "comment": "Malware payload (RedLineStealer)", "value": "e21e06e86756bd5e69014ccc0ac25d7a261152aa30cfb0f670b11bbecb10880d3f22c5b2a92f68f421e851f5398731d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212905, "uuid": "5ce00e8f-e633-4301-9b31-6c2976889dcb", "value": "T17E45F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212905, "uuid": "9f2e725c-f3f8-449f-bbd7-8cf9fc8f6b9f", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212905, "uuid": "00c2671f-d6c6-4aa9-873b-ffec9f9ff58d", "value": "24576:51F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:51FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212905, "uuid": "c7db9aab-de75-4c40-82a6-0bb800f9d10d", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212905, "uuid": "cf3c8d4b-79dd-49ea-9898-4a0402f98f58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212905, "uuid": "5d80fe2c-5f1f-4f1f-ac2e-efdd2a2503cb", "value": "ebb28dd10cc23c9c3e5a78b6ce41a208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9645847b-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212602, "uuid": "1addeb50-fd78-4fbd-a522-f0ecece6392a", "comment": "Malware payload (RedLineStealer)", "value": "d2f0e74589db1a78630906ee175c7640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212602, "uuid": "9898dc36-03df-42ff-b9a2-6b9b71a7d8d9", "comment": "Malware payload (RedLineStealer)", "value": "c43cf8caf6c377e8f150ebeb59d048d86f9decd610974a5924f8de67e5253860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212602, "uuid": "a28765f4-0191-4f60-aaf5-7ef70126393d", "comment": "Malware payload (RedLineStealer)", "value": "84d9f7469bcbc23a7ef2e9b15cd8df70f19af19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212602, "uuid": "cf2c44fb-9d85-429d-ad55-dc20515b86a8", "comment": "Malware payload (RedLineStealer)", "value": "231e2c72c03043c4aab1e867e2db2cda3ac1f21564baf5e5ca34fb034935ec36bc09d28766aaff233ef1b19eb7f47211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212602, "uuid": "a26775a4-440e-4557-931a-def2cefd86dd", "value": "T18835120BB2D94062D675037016FB07D7053A7EA09A7886AFA74EFD1F19727D0B03636A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212602, "uuid": "5810e068-cd0f-48dd-be7d-96aac356ee65", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212602, "uuid": "13af4b6e-e267-4771-9533-4630be462fbb", "value": "24576:oy12YIhSVyUgAO9EnaDlvfZ6fvyD8leKmq:v12iNgAO92aBGMieKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212602, "uuid": "a2c6f3dc-8500-486b-8e15-27231ad10022", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212602, "uuid": "51506769-44f5-4c46-8284-c821f7ae0b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212602, "uuid": "25af1490-7b49-4271-8d1d-9547c12e843c", "value": "d2f0e74589db1a78630906ee175c7640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4aa160-c66c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679240687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240687, "uuid": "ec9a4669-ae70-403e-9072-90985ba0efd3", "comment": "Malware payload (Mirai)", "value": "8552b68e0afea62c2e8556bf8f300db3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240687, "uuid": "90de071c-7477-4435-8237-6bbf9b108c95", "comment": "Malware payload (Mirai)", "value": "c5908f004483a1a97143b91471ff00e1652b55e6f20285308fa38c0e7287494d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240687, "uuid": "37b42ad8-67df-49c0-bf68-2fa9b3cbece3", "comment": "Malware payload (Mirai)", "value": "61e1033b6bb654503392db1ddbc01e90b84da955", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240687, "uuid": "296785d8-14a2-4885-b98a-204e645ad947", "comment": "Malware payload (Mirai)", "value": "b726320dd2d0cca9a882c40669545510400e14e7440e30c14b6441b8a15009e808245c7fac3c4ad0e73247b7b8604e2e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240687, "uuid": "31382d26-b933-4b78-a6a2-ddd0df607edf", "value": "T1DA83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240687, "uuid": "e31af05d-1258-4787-9079-dba2d916318b", "value": "1536:iVLyu95K5Skj752dCexuV/8UZlDwfkJ4MYfWC:iVLyMghFezxu5VD1en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240687, "uuid": "5a1e9c3e-6e49-4c72-9da1-28ebeb0b25e2", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240687, "uuid": "1002cfc7-2d92-4d94-8d67-17be019653e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240687, "uuid": "58e7114d-6c47-426c-a69e-21a56b0d140f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0be3804-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212271, "uuid": "74ae8e2c-0f83-41cc-bfc2-df224a7d075e", "comment": "Malware payload (RedLineStealer)", "value": "8444aa62a3edc3e651e72de98cbfde79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212271, "uuid": "0d4a17db-6689-4c57-8fbb-2ad589650fd3", "comment": "Malware payload (RedLineStealer)", "value": "c5fbaf3d50afc6fe7880f167abd5ca3c9ab2151c6ad79ac93edf7085880821a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212271, "uuid": "8a19cd57-55db-45f1-922a-25f03c6089a5", "comment": "Malware payload (RedLineStealer)", "value": "c81328fcedb4a4adf98ce81914d3832af34a04e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212271, "uuid": "d66bd067-2671-48e8-a9c8-ebba7a339eba", "comment": "Malware payload (RedLineStealer)", "value": "19c303e08f5620d60353695250dd1ad069e4278607eda187499c04c764e36d5c9766755d2cb4dcf2728e746566f3298d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212271, "uuid": "42889ead-3279-4558-bfca-2bb766a7619e", "value": "T12C45F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212271, "uuid": "19e7475f-7166-43e2-8261-ae012c6451b5", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212271, "uuid": "6c197fa4-3c9a-44ed-991c-be7c84aca888", "value": "24576:ahVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:aHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212271, "uuid": "9a3f5f40-3cd7-41b4-881f-83ded55fbd05", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212271, "uuid": "1e9dcee7-d0eb-4270-84f9-3c2ea37779c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212271, "uuid": "44ca3522-feb5-4575-ba59-f55dcc9c9c1f", "value": "8444aa62a3edc3e651e72de98cbfde79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062cea80-c64e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679227393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227393, "uuid": "4013e1ea-37d5-4cf9-8095-762ed9c5e2f0", "comment": "Malware payload (Mirai)", "value": "25e9f2b18d54898192c8648e9b1dd47c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227393, "uuid": "0a47791d-e0f9-4d46-a0d2-61aa31625b21", "comment": "Malware payload (Mirai)", "value": "c62c43add5440cee452fb3078561beeb1236517ba541ca9bb02fbca2271ca634", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227393, "uuid": "03022071-6942-4002-bcdb-43a149905709", "comment": "Malware payload (Mirai)", "value": "d0d411abb7edfa5dce8df506f48e870fce36196a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227393, "uuid": "d079856b-667a-49fe-93a9-860ff2d02bf9", "comment": "Malware payload (Mirai)", "value": "c1cef3252cad55cd8fb6fde74ca8bdba5da8d18d5a1eb69b883d28f276469ca0feb94177f34695a952dcc674abf7563b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227393, "uuid": "a7a8383d-5f68-4a58-a2bb-a4c409f33a97", "value": "T17273D70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227393, "uuid": "060be780-482c-4b06-9ace-d959eef9c466", "value": "1536:bpxe5qoct9fdlQBI6rYnnUFndlBotYG9CJa10qDv:Fx3oANdnWndvomgC47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679227393, "uuid": "2caafcef-fd57-4db0-87a5-1b29560bd13d", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679227393, "uuid": "14753afd-b212-421c-9768-396662ac2a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227393, "uuid": "c3a0e1c4-428f-4056-a9b3-c2cc5d2ab711", "value": "25e9f2b18d54898192c8648e9b1dd47c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6b45b5-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679241493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241493, "uuid": "77930e5f-24ad-42a9-a4b2-6ab1eeb3d954", "comment": "Malware payload (Rhadamanthys)", "value": "ddcd466080475f3542d30691311cec3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241493, "uuid": "76bc7b1d-d6c5-4edd-a342-9352d6f8d09c", "comment": "Malware payload (Rhadamanthys)", "value": "c7ca2f9065557a6d8fb0c02c75804d386b77ffca4466678b201c09e916afa096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241493, "uuid": "ca25c0c1-e38b-4a99-9754-3351a1fde00b", "comment": "Malware payload (Rhadamanthys)", "value": "5e1f2a6c5208afb6f90bf1ec62f53fca53174d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241493, "uuid": "4969f04b-726c-4a01-9808-7e9a8db64c29", "comment": "Malware payload (Rhadamanthys)", "value": "c64c89fef7d645d0c2ccd9dabf103cce6b4bcbd789d0109a1f06c3a6cba60b3ebc6f816b70a4a2a308039b0b97165a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241493, "uuid": "97d4499b-e95d-4056-89e4-d9711960004e", "value": "T1A8743B03F2E17CC5F925CB729F2ECAE8765DF6509E49BB6D125CAA2B04B0072C263715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241493, "uuid": "2fc7fc9c-7e77-411a-9cc0-ebb3cec6af7e", "value": "cf9749211bb5c4a3fd321170f5076a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241493, "uuid": "bfcb52bb-b65d-4eea-8a9d-a6ec8b6571f2", "value": "6144:e8unLv58M8MKDTB6pD7hZHalzLkL4UGh:DuntxEDQolU/Gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241493, "uuid": "701bd6f4-dcd9-4528-9850-56fea63bc5bd", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241493, "uuid": "4fe971b6-a60b-4a34-82d4-c1d43c15b2ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241493, "uuid": "f26e68fd-8bd2-423d-b2bd-5a4e8fcc9591", "value": "ddcd466080475f3542d30691311cec3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adcd080-c652-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679229306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229306, "uuid": "4bea3a61-605a-4883-904e-46f34d5a0a1d", "comment": "Malware payload (Smoke Loader)", "value": "cd5226af6fd298b7d3838ede90d47c1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229306, "uuid": "bb201fb3-710f-44cf-999d-dc7fd7776d38", "comment": "Malware payload (Smoke Loader)", "value": "c8107dc62a297f65f934c8b0c9c956c34662217aa8cc95e910bb9f70f001edcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229306, "uuid": "7dc36074-8ed7-467f-b877-97fca3c3159c", "comment": "Malware payload (Smoke Loader)", "value": "bfb3a08d49cdd1369c8f677ee5ae5e6c0193a117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229306, "uuid": "cb5b7298-1142-428c-97f8-20e5f3ddf69d", "comment": "Malware payload (Smoke Loader)", "value": "fbc0952097103d2ff792b5237d0e26c9b779147466ad5e17f62c771ff139e555acbf7bda20390991ec8a6cece12026b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229306, "uuid": "5cc3ad4c-e3f1-494e-b069-a00bf56cf260", "value": "T18374191392A17C59E5268B739E1EC2E8B71DF371DF49776A32189A2F04B01B2C163F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229306, "uuid": "730725b2-ca37-4d80-b680-f1ca14087991", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229306, "uuid": "0a4d59dc-39c8-46ce-9251-db916e7bd99f", "value": "6144:AsGT1iLGia0wi0uzOl4xCgnybY+EjVipp/YH:k1i6ia0wi0uzhxfnd+sViTQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679229306, "uuid": "372089fe-146f-4bd3-92a6-e98379efb19b", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679229306, "uuid": "8a024574-5dee-49e0-adcf-1191a4a37ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229306, "uuid": "2a9cde97-8482-44b0-b8cc-fdb44ed3e36d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7cfe90-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226655, "uuid": "a79da547-30bd-423b-8dd6-c0ab1a69eed8", "comment": "Malware payload (Mirai)", "value": "ad02c2daa21e3abc99020bf4649366fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226655, "uuid": "db0d8b03-9814-488b-a9b3-0df1895f84c2", "comment": "Malware payload (Mirai)", "value": "c8f8ee95e08ba46d7628c590a559e68d5a70bbdaec190bfdc7934368409307b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226655, "uuid": "3eb90d28-f07b-4c1e-bcbe-70f7ac89492b", "comment": "Malware payload (Mirai)", "value": "f7a9eb2b01c77d1ad96022e9bb756139dcf6b328", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226655, "uuid": "8c89a192-b741-40cc-8786-44d85922bfbe", "comment": "Malware payload (Mirai)", "value": "288640871f9ee758bd22777d8adf722903017a67665a67cb312820682f477187061556e88ce43d32bc81286a75e8b5ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226655, "uuid": "fdd5574a-1d34-4bda-93cd-5b0d1b9abf8d", "value": "T114331951B8C2A627C2D013BAF6AE968E373073E8D2CF3227DD611B113A8551F1DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226655, "uuid": "8c55045e-0b99-4939-a52e-300fd652f5d3", "value": "768:Mtn+Pi2RhlZoIip1jIs44nHsX7+qP06Fz20AVOstYaSF4Xgt2FgNJwJZY10U6:MX2R3ZNiwaAFz20eOaYaSFGJa10X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226655, "uuid": "55ddecf4-c6eb-41a9-b079-7f42893fc3d2", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226655, "uuid": "6c19c242-3c8e-4e08-ab06-84e4c1aa43ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226655, "uuid": "f37f8146-dc0c-4d50-9d14-4cdada6728c3", "value": "ad02c2daa21e3abc99020bf4649366fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71eb594a-c619-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1679204810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204810, "uuid": "8955a931-315e-403b-90ba-edc95832f71e", "comment": "Malware payload (Gozi)", "value": "c71cbf60e9013deda6bea0387b909db4", "object_relation": "md5", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204810, "uuid": "5aecb5d2-7e40-48b4-b1e3-0e97c060e5f6", "comment": "Malware payload (Gozi)", "value": "c99f4de75e3c6fe98d6fbbcd0a7dbf45e8c7539ec8dc77ce86cea2cfaf822b6a", "object_relation": "sha256", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204810, "uuid": "eef46a9d-af61-4b2a-8e8a-a4af2746966a", "comment": "Malware payload (Gozi)", "value": "5409dcfd982f3bd941247cbf2962a6fa00c0c38d", "object_relation": "sha1", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204810, "uuid": "e1878caf-53ab-4242-bf10-085d8c7707f5", "comment": "Malware payload (Gozi)", "value": "f56db9bda066f319f39c45cdad69789df5c0194c0188c07c80dcf34b9247f906eb320bb957222c5614f875025158fdf1", "object_relation": "sha3-384", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204810, "uuid": "daaa65de-6a78-4b0a-a8d4-cb667d0a003e", "value": "T1E8C1D693AA7246F01133419FC1ABBB24B93016B76C545C301D19E9187D76E9F826DEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204810, "uuid": "1af7517f-5b67-45f0-ad0c-07842b8c9dcc", "value": "96:ma3aQGuIzMTPPvQCCRoJZ+ArgJC4RcezE9MBfB/MIra1nIurD1nTty4lj1PRWl06:ma3aBuIYTPPvQ1OZ+GMC9e6MVo1nL1nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679204810, "uuid": "bd9ae561-7062-4afa-9db2-a1ffd6041d78", "value": 6118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679204810, "uuid": "e0a58b04-4441-4f3c-a068-6a33561c67ee", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204810, "uuid": "a870a546-0ae2-4574-a8d7-660e0884b91e", "value": "AgenziaEntrate_decoded.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311d5573-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226606, "uuid": "1f1029cd-317a-461e-a14e-6d6e7bf163ca", "comment": "Malware payload (Mirai)", "value": "87335fd1533ed77248baf363770c2d0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226606, "uuid": "a141c320-0ede-4c36-9b46-83ab47669cfa", "comment": "Malware payload (Mirai)", "value": "ca8e858ecae7a953db74c973193282bd5b5ca41681941b5952548b882a9aa90b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226606, "uuid": "8e591834-d0ea-4927-b28d-b8c1f5bc941c", "comment": "Malware payload (Mirai)", "value": "705053fc3d9ebd09d07021cf1e44037ca7a81387", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226606, "uuid": "ca837625-28ab-41f3-a50a-6dcb6e6a39c0", "comment": "Malware payload (Mirai)", "value": "da0c38b5b88f1dfadc79d25830f656aa5ce273676c9a6778588af7e0e2284f629227aa1c6836de33927d3256b31a4e00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226606, "uuid": "8d74967c-d442-411e-b664-5780f83371d3", "value": "T1BEA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226606, "uuid": "bc323bbc-a87b-494c-a5b3-8a9a22af16a6", "value": "3072:VK1z13U6HzHoXRtmTUhQogKEmmFVcqq0GnDZT:VK7DDeKlogKEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226606, "uuid": "08aadc30-6399-4f7a-817f-0aad284ab6f7", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226606, "uuid": "fe4e4571-1397-4bc0-8728-47cddd433fb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226606, "uuid": "f0ab4c31-4a4d-46e2-8449-8525ca14a569", "value": "87335fd1533ed77248baf363770c2d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d06d6e-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212900, "uuid": "8b107688-0a61-4407-9216-ad57d8a21ddc", "comment": "Malware payload (RedLineStealer)", "value": "f4c748148f9b0430c4c40b3efb6d37f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212900, "uuid": "34d4c1ac-39ac-4add-bc2e-626fcc30e1ff", "comment": "Malware payload (RedLineStealer)", "value": "cb3e32f670453411fbb8a7a63e7f1b31f001e8e0aefcf70bdec5f2e057f78e4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212900, "uuid": "c7c60432-0103-4dbf-a17b-dac11f811cfa", "comment": "Malware payload (RedLineStealer)", "value": "85fe5d520d67e35745a562066ce83522fd75f762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212900, "uuid": "4e7b9b30-27ef-4d65-b75f-0798790a3ff0", "comment": "Malware payload (RedLineStealer)", "value": "48be0d4719f005f5ba39a2f9592d2327a693e5281a2c2670789e2aeb6bf893ccb981887f1cc079aeb42ccf5602446812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212900, "uuid": "b5ebd75f-df4c-4f2b-9034-43e2369f3cf6", "value": "T15E051212E3C49133DCF627B055F703932E3ABCA14DA412AB17916D9B1DB2198F9B136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212900, "uuid": "eaf6b1cd-c911-4542-b37e-b4fac0b2932a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212900, "uuid": "58d94d48-b9e0-4f41-b622-55b832972e9e", "value": "24576:EyAR33zZNuFdN8nggCX/CD0yQHmp1oq3lx9:TARH1YFdN8n9PKmQq3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212900, "uuid": "b15d46e2-2103-4447-ba7d-1f54028c5ba0", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212900, "uuid": "25a00adb-b577-463c-b93e-4cc3f0d4083f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212900, "uuid": "4a34a845-a220-41f4-b30d-bfbf41ffe6c3", "value": "f4c748148f9b0430c4c40b3efb6d37f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df43dbf8-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679218308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218308, "uuid": "a1bfcc9b-1c29-47c2-846e-0f645889783f", "comment": "Malware payload (RedLineStealer)", "value": "ebff635dc32332e97d81077f0c5e2726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218308, "uuid": "740e4378-e35f-49c0-98c7-abd76b818b58", "comment": "Malware payload (RedLineStealer)", "value": "cb94b689b4d92eef77e32334201271fcc9ae884bafd0419b176935c00f59a4d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218308, "uuid": "ba7cdfe9-4892-48e6-81ed-88f7704abad1", "comment": "Malware payload (RedLineStealer)", "value": "99b2fd556e3d086ab63625ef38c8e4c8e086c1a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218308, "uuid": "10275ee4-ee6a-43e6-b08b-3da362ec01bc", "comment": "Malware payload (RedLineStealer)", "value": "8aad426be9a82543646bc17356eb009e6e60a61ad65313ffb3315c2a28d9599bc2dc255c6f5b94fcff6dfd99729fa4dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218308, "uuid": "a3529abf-8757-4c35-88ed-73fdcb8b326e", "value": "T1C9351207FBECA436E43567B018F647D319367D914A384697229BAC1B4CB25A0B63733B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218308, "uuid": "80624de5-92bb-42e6-bb61-399f8228f3bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218308, "uuid": "476f0876-438b-4709-86bb-9c73bbbe9695", "value": "24576:QyeVQPsCMixj9jYQXC3vPeSfw3ogs+Id:XeSoRh3vPvfw3Zs+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218308, "uuid": "84006173-4fae-4082-abac-73d9e385d54a", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218308, "uuid": "a131ea3f-eff0-4182-a0e2-d476ee7a6421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218308, "uuid": "83fff082-a311-425c-8c5b-6ca60008e6e6", "value": "ebff635dc32332e97d81077f0c5e2726.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423311fe-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224916, "uuid": "b13fb0af-0839-451f-af6e-aff7574044b5", "comment": "Malware payload (RedLineStealer)", "value": "72ae14c289092cc8ee24e374f1674209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224916, "uuid": "c86e5a07-bccc-4959-a19c-ac6ec24e151a", "comment": "Malware payload (RedLineStealer)", "value": "cb9ddff1daa05e888682cda741056028296a3c82ac48f1ffa4f9228a39aefdba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224916, "uuid": "9aeb0657-e6b7-4f41-bc67-633e05890cd0", "comment": "Malware payload (RedLineStealer)", "value": "a103d6a2c70c68ad353d034ae573464455d04198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224916, "uuid": "75188271-d180-4841-a398-b5aca2f167fc", "comment": "Malware payload (RedLineStealer)", "value": "981441c5211b6a436befd89df6e14fb45bdb460af240776b693b2a0f0721ace1e935cc598f441ed712ad4d84d8c48015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224916, "uuid": "ea7194f2-3d6a-46f7-b575-13d8897279db", "value": "T13945F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224916, "uuid": "48cc6874-d5d3-4cde-851a-af910436041c", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224916, "uuid": "21b41874-459e-4aa2-9531-0c1421c0c9a9", "value": "24576:o9h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:o/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224916, "uuid": "1e5ebd3a-5b65-487a-aab3-69724e4c302c", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224916, "uuid": "2572e212-e525-465b-b4ac-efec94071f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224916, "uuid": "ed009e46-8ad5-43d3-a4c7-2d038bdb9641", "value": "72ae14c289092cc8ee24e374f1674209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40103aa-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679241428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241428, "uuid": "b55c878e-fbb1-403a-b91b-bf135c8da33d", "comment": "Malware payload (RedLineStealer)", "value": "9e1da378deefc5e584b1110b15db2142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241428, "uuid": "26d13974-b9a2-4b73-ac69-016c98070c73", "comment": "Malware payload (RedLineStealer)", "value": "cd06000339b527d3491da7b29707a058c664d279dc307e23e5dd5a10b4bc5965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241428, "uuid": "f28a805b-a4e2-4096-a9b0-c6ff42ffff25", "comment": "Malware payload (RedLineStealer)", "value": "ab58c2bbdd366430eb52a908330786d44654885c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241428, "uuid": "cb9420b2-f976-4aad-869d-355dc9388228", "comment": "Malware payload (RedLineStealer)", "value": "06592c6476402f3ef7d4fcc66a702a57fddfe3813d450e2aa0b06fb20dc40fefb197f9cee71e2e41056b6c9208373893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241428, "uuid": "28b5f670-ad1c-4816-a572-0762efb6e012", "value": "T17545F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241428, "uuid": "aed378ba-83d3-419a-817e-3aa5c90c95de", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241428, "uuid": "afd81194-51b8-4010-86aa-0f28ebfca4ad", "value": "24576:O1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:O1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241428, "uuid": "a7ca36a9-d547-4482-89cd-f8b2be285aa7", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241428, "uuid": "3f62bf0e-974e-4475-a6f1-193e95cf95a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241428, "uuid": "e3688891-37a7-468b-8111-678bfd2b669f", "value": "9e1da378deefc5e584b1110b15db2142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947a39a1-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223336, "uuid": "c90affb7-e6ac-4ff8-8b9c-cf0c8d42b15e", "comment": "Malware payload (Mirai)", "value": "ba4864226be4a65d26fdce9f307726c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223336, "uuid": "19d807e6-4ff3-4b2f-92df-17735720b379", "comment": "Malware payload (Mirai)", "value": "cd26aaba1894d5346d3e2f50dd942a3d296556646d9db85b74f54fa1ee8a7b61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223336, "uuid": "f4752069-67c2-4b88-981b-007db955c769", "comment": "Malware payload (Mirai)", "value": "a11e538f820b7724f022309d19878adcbaab4e36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223336, "uuid": "daeee535-5601-44bb-91b3-e50e9cb377e8", "comment": "Malware payload (Mirai)", "value": "f9e55b5f772ceec8042d3720bd0ddacb07e2636136cb9c90f547ae7a38eed452efd12085dcaa676de4d4f5547fbe2728", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223336, "uuid": "2180a8f1-0231-4dc5-875e-422b506ee38a", "value": "T18913F892A8929E26C2E0237AB6AE41CD3360B7E8D1DF7217CC115F4477C951F0D6BB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223336, "uuid": "c77290c9-35a1-4b8a-a413-cfdd8f54f9fa", "value": "768:Co530bBgTh8gDgrkK2gJTjrKDzn5rEWR5LwYoyDnjztDt4RWSnH9kn33RPN:CL9g1XDMuzn5gWRiYoyTjz1SnH9YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223336, "uuid": "2afaf183-1886-4ea5-b825-43aed006ada4", "value": 42252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223336, "uuid": "699ea9f9-006f-42dc-a3b9-717141df522b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223336, "uuid": "113597b4-adf2-42d1-86b9-4417fade5137", "value": "ba4864226be4a65d26fdce9f307726c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc326516-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223457, "uuid": "73cc3dce-e2b8-4b39-9e45-45c89294be39", "comment": "Malware payload (Mirai)", "value": "c41204773a57581b1af51c51f907c6ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223457, "uuid": "75bb19ad-bf9b-4855-ae82-2988dcc4fae5", "comment": "Malware payload (Mirai)", "value": "cdab4e10a459af4ad4982e26106b0439bc3835ecf132a5db25a4994813a96ace", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223457, "uuid": "a056482a-ce09-4c10-bce4-ded21be5f664", "comment": "Malware payload (Mirai)", "value": "b7b787d861f1a62826bc2223dec32274294b64fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223457, "uuid": "15c016a1-5650-4c07-8ea7-19ea32fd39f9", "comment": "Malware payload (Mirai)", "value": "3db54e9a145f5516541de42b0bbc61613f1f65e21c595ee2fdebfe170cf9f535358a0e8979c671b7bd2b81bf1a862500", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223457, "uuid": "3e0f6717-c121-4710-8df5-a3aed7c71a6c", "value": "T175C2D0E07726F931C4206C3EE52A4D8A3A51063C90FF393664259C358EC169B67F84FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223457, "uuid": "be9e8524-2979-41e0-aff3-390769361927", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrLHd9q3UELuSi:NKy4qfqoeJdXWgTwLLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223457, "uuid": "85e4937b-6434-4cb5-a13f-13f68898033d", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223457, "uuid": "c042ba2e-d5c1-43fe-9a26-f32735bb4c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223457, "uuid": "28f6ed34-2361-4c8c-a1dc-95a0edf3a3f1", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f8ce0d-c699-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679259974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259974, "uuid": "cc42ad9c-c828-434a-93e6-fa9aafda24eb", "comment": "Malware payload", "value": "b3d6593c527977e92fc57935bb964f0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259974, "uuid": "562b2be6-59b2-4c99-9bd4-eaabdd717ef9", "comment": "Malware payload", "value": "cdb6371ffc409aa05e57992e5c541aa75b7b3ea1c9c8581571714feecae87576", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259974, "uuid": "dab8ce9c-923d-4448-9bb5-8df03a97e750", "comment": "Malware payload", "value": "1043579a9bf3cc737031b2c0dfeaa8402ea5c390", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259974, "uuid": "3da8f8b4-4a1c-4475-abca-efd3795d6749", "comment": "Malware payload", "value": "343a130e2af35fcbaea5becb8ebfc3070ea5449fe9367cc01215ec5fc264c495f9c334e18baba01974811156dfb433fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259974, "uuid": "76086052-8331-46cc-a076-3f4178595376", "value": "T1EAB3D707AB51DEB7C85FDE330AAA860120CEE45612E56B6F72B4D96CF70B94E08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259974, "uuid": "36cbd23f-23f6-48ca-a8fc-5e89a14f0542", "value": "1536:UeeTu2u8IM46rrMNf4ZcrjYYkUNTEM4+rnBlLNzgLUmkiIF8iCKrmne:UEgrGf4d0EMvPZgUmkiIF8iPrmne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679259974, "uuid": "0e16c7d4-0408-42b2-ab83-f196650562b9", "value": 108974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679259974, "uuid": "e7be03f7-80f4-473f-bb5f-33e7633c3fb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259974, "uuid": "d80770b8-433b-4824-ae40-2bb76e5c9e3d", "value": "b3d6593c527977e92fc57935bb964f0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889c5a54-c623-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679209143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209143, "uuid": "48e33f2c-7b6b-48ba-a97d-f233d434c50b", "comment": "Malware payload (RedLineStealer)", "value": "d611f6db4e89addeec8353aa6bf1ba73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209143, "uuid": "5e1cfa85-2138-47dc-8696-ed5a90fa3a4f", "comment": "Malware payload (RedLineStealer)", "value": "cdc7fec4fe988cddbe0c2cc63610d2503c0205ff47ae7cad7f08ae36c3d84498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209143, "uuid": "426c39b9-36bf-441c-9863-efb1fdaefd9e", "comment": "Malware payload (RedLineStealer)", "value": "56ada47afb2425c56f0cb406f52bcefcfe99cc6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209143, "uuid": "c4c2bec6-d2d3-4169-8ecf-26828b9e61af", "comment": "Malware payload (RedLineStealer)", "value": "3f752558994272006cf6dbe619fad55420de9b256410a982fe1da529559125be5f85a43d4234d2521391364063d3d5a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209143, "uuid": "a6aa7cc9-39d4-4b71-897c-1bad5b4d2b51", "value": "T1D285D012B0F08171D5EE643AC5E5EB750D7BED600765E8E753A43F1A3B30A93BE2052A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209143, "uuid": "ece8bdd3-6957-49c3-b89a-3790e78e2e88", "value": "780ccb5bd4f70128b668c3ed756c35e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209143, "uuid": "3376b926-4ed4-4ad6-b53e-25604b8f2393", "value": "12288:ms5WXho3nTu7FOeBKpHmM7ShW0sJLAltXy6GkJROHRnz+y+W:55XeoHmNhW002tlG7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209143, "uuid": "f96488c2-44ef-4b09-86aa-cb6a15b30172", "value": 1725952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209143, "uuid": "0919b374-71ce-467e-b207-0766370153dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209143, "uuid": "5f91da00-38ba-469e-abc5-4c47b13d8c33", "value": "Bonk_Desktop-2.5.1-win64.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8dacde-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223429, "uuid": "4e207865-6fae-49bc-8145-ff23417fb397", "comment": "Malware payload (Mirai)", "value": "4b6477a6d952cb0ef71a858fe748b301", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223429, "uuid": "f8f01baa-2bcb-4cbe-a485-2113ec3f9042", "comment": "Malware payload (Mirai)", "value": "ce66d86994a77f8c14ded977692b1a1654384afe2d10a3236a3970178be846a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223429, "uuid": "69fe2e6b-a140-4f39-b31e-f66db672371a", "comment": "Malware payload (Mirai)", "value": "95b63ee1465866880624fb526e7a2c390d593c85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223429, "uuid": "bc8c12de-135a-427a-96a3-4fae0b85dda0", "comment": "Malware payload (Mirai)", "value": "b879e82f4e52d346c597318f97ce6f28d936cc267574ea6615302ab7c351cc71e9c5e998bf342d3f13984a6396245243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223429, "uuid": "ada3ef62-8114-4d19-a9b5-1931536b3852", "value": "T1ED533BD964019E7CF5CBEBBE81620D09FA31B21160931B277767FE83BE320689C56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223429, "uuid": "2f8c14bc-afc2-4216-af66-003dd3d0ccff", "value": "1536:F/ytXcDqNAGryDYS+BTfi7lJHg1p7HiqWPLvg6VlwB948N:FOgGmDYvEJqpWtDjwDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223429, "uuid": "5b9f56d0-5068-4938-936a-27747bf9e0f5", "value": 61068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223429, "uuid": "f6dc4fda-eb7c-44d4-bbda-c8d7bffcb38c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223429, "uuid": "398891d0-6478-488d-ac24-0603d3dc9c48", "value": "4b6477a6d952cb0ef71a858fe748b301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a277b3-c61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205729, "uuid": "e79917cf-0383-414e-9cde-e3e646af9d9b", "comment": "Malware payload (Mirai)", "value": "e3fb91106acfaaf717e4fac0587d0781", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205729, "uuid": "ac1b8424-088d-4a19-b937-7f296a098ad1", "comment": "Malware payload (Mirai)", "value": "ce712b97da1ae3229c2c7e6d4180e3484cc9c7c8ae6d22b338c1cdd5c5ca22b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205729, "uuid": "cfc2e986-cd5f-4b2f-b684-f0abaca86d7c", "comment": "Malware payload (Mirai)", "value": "d3ff93b01577dbd87d19f23f98651cc572c5ee65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205729, "uuid": "0e53540b-4fd8-437c-bef3-0838ed0ab1b6", "comment": "Malware payload (Mirai)", "value": "ea662c7296c4148dcaed36f89c01b23bd3c20b1eb0fe9725d2429803a38ca616d6e06240f5df3fbc6e6d65588f499b85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205729, "uuid": "06b1920d-d601-4060-a787-89d4328ce0bb", "value": "T1DD539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205729, "uuid": "c0d590cb-d6de-4eab-b19c-6b778affe6b4", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205729, "uuid": "180781aa-f40b-4ec4-896e-c0ead2b9fe8c", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205729, "uuid": "a0b48163-5c5c-402e-984e-28bc9b50b81a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205729, "uuid": "6e0aa928-5694-4262-a3b6-94eb633c374f", "value": "e3fb91106acfaaf717e4fac0587d0781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515683f6-c656-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679230955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230955, "uuid": "4c521281-3157-41a1-a623-a7470bd89128", "comment": "Malware payload (Rhadamanthys)", "value": "a725a96c64bd1cf97b38ba4372ab3c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230955, "uuid": "eb4eecba-0096-4d9e-a482-56d077b1d273", "comment": "Malware payload (Rhadamanthys)", "value": "ce8377abe16baf1f7fba0fdadcd3b7f715a1adf65c18ef71f90972b7e6d97fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230955, "uuid": "ffe6c045-4c75-4c7b-99f4-607cd319adb2", "comment": "Malware payload (Rhadamanthys)", "value": "ee058d108316a55151aaab4722104c38de6b1e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230955, "uuid": "01d121bd-cb12-4b40-8be8-e6958ff5d1b7", "comment": "Malware payload (Rhadamanthys)", "value": "4a04a9a373e0aefa405738a66f4e0532f5b1b1b93e1c5d8318c3844d66b2634a29bf4fb6b2a0766e4cdc1bd0b1bc3e25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230955, "uuid": "e3d25a60-0ae5-4ea6-955f-84524fa119ef", "value": "T16C855DF21293FED4E72F1D48C4043A409C14186767BC9658FDCA2A9793E9964FF9CAB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230955, "uuid": "32065741-cb9f-42b7-b010-30d34a96e021", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230955, "uuid": "ba6ed756-465a-4e95-b30d-b1c1d9c94954", "value": "24576:UMl7JT3YKNKtu1Dze6HDpLRldGYgqUrOvyA4B9JWfpvLKeeJdbDH+150wgxsNY2r:l3YaGrqUCMH+8Az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230955, "uuid": "86106094-42a3-4263-80d7-948cac27e452", "value": 1862144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230955, "uuid": "e376154d-a9b1-41d6-87f1-3dc09931db3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230955, "uuid": "417b940e-906d-41fc-a1e4-5655fb1bd02d", "value": "ppi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a123f2-c690-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679256007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256007, "uuid": "7ee6fdcb-36b9-4148-bae8-003f70c8be77", "comment": "Malware payload (Mirai)", "value": "f9ff6e4d200611b630c3f1e57eb8f5db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256007, "uuid": "beb0cb69-ca2b-4f48-8cef-daa9e30842cc", "comment": "Malware payload (Mirai)", "value": "cebc8e745f28f6241ba52708fade1fc312b697e4d5fa4762913fa8b29e500fd2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256007, "uuid": "598f6021-6b6b-4a57-a774-4c52233cbff5", "comment": "Malware payload (Mirai)", "value": "778df3e3bba5f3ef42a88be882293410bc57efe4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256007, "uuid": "0bf6cdb2-4c21-4628-9042-87e25c37a643", "comment": "Malware payload (Mirai)", "value": "d8134544fc1da3dd9571cac404e75afeaa88949cf6f85732598bb0a37385398a5ea3999608cb13154283ba1a23840838", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256007, "uuid": "4d93f02b-4698-48e4-b26f-bcf3e83ff7d8", "value": "T1D3E2F1515245A8F3D6C00C76E7781D8633AD0CB966DEB7462620213DD8DB0DEB67E7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256007, "uuid": "cebeedc6-d52a-4c1e-b478-ef98c50b30d5", "value": "768:jbSlsLzKRVIexti/B1DbY4DvdVyrmC++YafWGniM3Up:3wsiMexti/BdDVM6C2Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679256007, "uuid": "b638edc0-0258-48f8-b19d-9671b8a20460", "value": 31888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679256007, "uuid": "ca0308b5-501c-4ce6-80de-c97fc222df5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256007, "uuid": "0aa8c69b-aec5-4fc5-a8af-b10852374907", "value": "z0r0.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485c5215-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224927, "uuid": "7d8f83a9-3cec-4d35-aec7-cf78f6ff1bc2", "comment": "Malware payload (RedLineStealer)", "value": "9d13d31d769e06ba0f88d68bc7d5bf7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224927, "uuid": "8dbbbcf7-4204-4b02-8d45-602644e48a5c", "comment": "Malware payload (RedLineStealer)", "value": "cfc1dca08afd2b1b997f86ace07a24f5b439c9b7748ebf7e9ef135e7819ccbd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224927, "uuid": "7c8e4bde-bc57-4097-898d-6fdc5827580a", "comment": "Malware payload (RedLineStealer)", "value": "b86e85442bb35459dc4637592bfa5a2c06a681b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224927, "uuid": "e64042ea-d923-4500-853d-d10aff379b49", "comment": "Malware payload (RedLineStealer)", "value": "1b9183dac2164a86d6d7c3bbfe971087a476af515998c22bc91306c69270f93ade79b4425c7b6c020d0a3e1e80819894", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224927, "uuid": "910bc29e-5c5e-482c-ae71-320d757d8e35", "value": "T14445F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224927, "uuid": "705168fb-b1b8-48ba-a90a-7ca3b56fb2f5", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224927, "uuid": "5229aba5-257e-4129-9b9b-f63a1de73bca", "value": "24576:09h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:0/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224927, "uuid": "9d1afcd6-56d4-465a-b4c3-b2f61ada77ff", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224927, "uuid": "54b13f9a-427b-4cfd-99bf-12f8beb3c761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224927, "uuid": "e82761d0-8e8a-4632-b188-3edd68403fc7", "value": "9d13d31d769e06ba0f88d68bc7d5bf7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab676524-c66d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1679240984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240984, "uuid": "db8f40f7-2e23-4390-90d0-bb68aea74144", "comment": "Malware payload (DanaBot)", "value": "5d42f440e40348c27dad1bbf67495c45", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240984, "uuid": "8f41cefa-ae11-4a3b-a3b5-4a95760fe33a", "comment": "Malware payload (DanaBot)", "value": "d0391253f3f2579645360c9122b5dafd2bf5774ce25bba8da87a3d2599e889da", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240984, "uuid": "60d93741-b21e-47ce-8d3d-9fec65a0ee2f", "comment": "Malware payload (DanaBot)", "value": "6653b6fe29027525a9470e2e7c7093c1d91eb890", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240984, "uuid": "f6b7b50d-2d18-4878-8c97-73b6f328d647", "comment": "Malware payload (DanaBot)", "value": "177feaee79cd875f55a5a8e803671dce144faef6665a0da7d505da7edb0f53643a412daf58cdb60c01a832ba17605bcf", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240984, "uuid": "6a2895d8-7466-4541-9a80-a42aa83f1d1d", "value": "T1B8D5124383E17C88EA254B778F1FC6E8B71DB670DE5A776D31189A3B05B01B6C263A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240984, "uuid": "6aed7df8-c890-4533-9a20-983468475e71", "value": "8b512f0a0b2cd54ff600ee8ace8b2bd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240984, "uuid": "f42f4c01-15cb-471b-bc2f-70760fbcafad", "value": "49152:pS2H3YHl7oTyWvffmK4QnqPu313dRscDMqu4aXCIgl06J8:pRHrlvfemDh00MV4DIgNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240984, "uuid": "e0e7fc41-64e7-438a-b4e3-b64b5f75d3e1", "value": 2782720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240984, "uuid": "12ad46a9-31eb-4619-bb1c-44528d22da98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240984, "uuid": "cefe57c2-b487-4ec7-9ab1-a7ea719ef618", "value": "5d42f440e40348c27dad1bbf67495c45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765c0c37-c63c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679219850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219850, "uuid": "771176db-c0fc-47f2-8bd6-7708fd303e3b", "comment": "Malware payload (Mirai)", "value": "708348609509038c79b7b276ef689192", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219850, "uuid": "877cee4c-b1c5-4af1-bd95-0f8f76d04ebc", "comment": "Malware payload (Mirai)", "value": "d04836519a3163fd9fa86e50784a02f6b0e9e26f1c9e8ccbe3342ef5be309922", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219850, "uuid": "57994441-f5cc-4fac-aa6e-7f19e6abb366", "comment": "Malware payload (Mirai)", "value": "2088e68a3f1431c13d0d1abc3b1e5a0d53808a3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219850, "uuid": "19c2b7b8-47b2-4b9d-a7a8-19ebf96a43f7", "comment": "Malware payload (Mirai)", "value": "082e92a2969a78c31741a67ee36f41ab0cf145754f5d740ca5d7baf808ca21246cc71fbcf148e4131b8af7727b37b4b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219850, "uuid": "e04ef7fb-5a3d-43a9-a93c-562911c65b99", "value": "T1F8231996BC91DA0AC6D023B6BD6F60EE330163DAD2EE3247DC145F2476CA90F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219850, "uuid": "cb2d2df2-a7c5-4dae-ad98-b9c05bd8096f", "value": "768:MILmQU8Fug1UrvDjSS2xYOx+2bziW9WX2yF4GuWnHbtwpYMS1HKKlvqBJ5e2ly6K:e8IgSrbjSSF0iJ2yF46n7twqZ1HXls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679219850, "uuid": "f4bcc737-2329-43e9-921c-e47c713a22f5", "value": 48268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679219850, "uuid": "91e181d1-f963-4bd4-94ef-b104e0938eab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219850, "uuid": "6854bfb0-59c5-4b92-bf6f-52bca8b11859", "value": "708348609509038c79b7b276ef689192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ab4e3f-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241290, "uuid": "f0124ad1-dd01-47dd-8e10-e06256fe438a", "comment": "Malware payload", "value": "5c510c429e66c32ffa702387f8ac2e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241290, "uuid": "15c6ebe6-25f5-4c2c-a654-7644ed1362bd", "comment": "Malware payload", "value": "d0a95db58e6b6b01227607638d7a1627fb9c4ddfa034a14cbb23df4d6066c3c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241290, "uuid": "9c83120d-b287-4e29-a6d9-a226ef77d549", "comment": "Malware payload", "value": "cac1f3b6824fa24bdd56bff5981b64e1ffab8f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241290, "uuid": "014ae881-97be-448b-96de-03bcc2db0e1f", "comment": "Malware payload", "value": "8fa7db776e358bd925397c54b9747691095310c81e6123f7f725c07ee6616a1fdf27890e403d8bd89125395eea71cd2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241290, "uuid": "12f0fae4-56a0-49ec-a9d2-cc4a7ae3116d", "value": "T1EAC5DF734D7AEE97E2DD2FB4A01129ECDDF810179B5AF644E88129D25ED8388CE441E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241290, "uuid": "205b2b04-7855-422b-b655-f6207aa47713", "value": "49152:ImPz3zC5TYs2BCEG2xwXMLwLXKo6MMbLy2Vk:/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241290, "uuid": "ab7879d1-de66-418e-a4b4-e940fbaccf50", "value": 2623810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241290, "uuid": "51852a31-68c0-4677-a859-ac713237ede4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241290, "uuid": "a5628f1e-bf82-4825-9083-ec70f10b4a25", "value": "5c510c429e66c32ffa702387f8ac2e33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0da5592-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679223384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223384, "uuid": "13b60b08-f35f-4691-ac54-2777e829c024", "comment": "Malware payload (Gafgyt)", "value": "57425317483f680d06eeeaee0fb63410", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223384, "uuid": "553278e0-eb29-4927-bd55-95179bc5475e", "comment": "Malware payload (Gafgyt)", "value": "d10e417a5e8c61a4a9c3e72b1779a88e2e08de78b0b0bccad2e0c77b030a5277", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223384, "uuid": "b59eed90-dbae-42af-84e2-989ff9ac3dac", "comment": "Malware payload (Gafgyt)", "value": "17014c3f79a2906efd3ebc99e0a6ea8492d95724", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223384, "uuid": "62560f50-ddf9-48eb-bdda-b5719ab1be31", "comment": "Malware payload (Gafgyt)", "value": "028d9d9ad2944488952c2570dfe7a287f3299d827499d84d6312f0484405e9714e571344e5c361f4ec85259a9de4aeb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223384, "uuid": "8f635621-a9ac-4ad4-9807-750197911e01", "value": "T15EC33B06F5508753C1C3177AB78F561A77232BB897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223384, "uuid": "42fad5bc-ec78-47cf-a4bf-49902cf34033", "value": "3072:ed3Da04A7iNmLJMQJBO5hd5Kynz2FAdmyDQUJ1UX4Tn:G3Da1ciABO5hd5K3FAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223384, "uuid": "a7886a50-3dea-4df9-8f6c-d56887abceae", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223384, "uuid": "cb5938ab-f105-40db-b9dd-c5ff5fd24f61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223384, "uuid": "72cc171d-e6f9-4e68-8187-bd1f9b554458", "value": "57425317483f680d06eeeaee0fb63410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570ed3c8-c69d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679261459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679261459, "uuid": "c87f8e23-64d9-421c-b03f-eeb753c6b3d3", "comment": "Malware payload (RedLineStealer)", "value": "c593d5ef6894d1bed8f05ed63bccf76b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679261459, "uuid": "aa2cd2d6-12d1-458b-a08d-0401b5335048", "comment": "Malware payload (RedLineStealer)", "value": "d1ed5c87a486e7db2d4abe0d034da89901bdb6ba3d99b17851c54d5e4082775b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679261459, "uuid": "043023c9-d69c-45b5-a206-74f99b330053", "comment": "Malware payload (RedLineStealer)", "value": "8c733f67b871f5e0e674832f6f15f5f40df84eab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679261459, "uuid": "67f70e4c-6c64-40f8-a8b2-826cd0ce7d23", "comment": "Malware payload (RedLineStealer)", "value": "8696e478e9d8009271b64dd239ff1452a3c7bb537deed62e94137ef178bd1f0e4ad0b450e3839d8c411ea2def4752340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679261459, "uuid": "39c57d3a-071a-4eaf-a6fd-30e137c9fbf5", "value": "T178A46B003B98AA2BF135E5775757813242B25ACBE5D1D785CC40E37A7A31370AE4EA8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679261459, "uuid": "0837b7b2-c480-44d5-94f1-5592c062279b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679261459, "uuid": "f84cd208-ae71-46a8-98a8-005e97c2e055", "value": "6144:TYh2DDjXfulUArZHt3zXVKlYuNqc+SV0vvjepXURncXslzU02suZG7CKuEhMK59A:TYhCDDfuUUDXVofsJDlRuZpni2CCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679261459, "uuid": "9a2ceb43-4d1d-4c32-b75e-5e3944e8825b", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679261459, "uuid": "89ae33c0-4cbe-4f47-8f66-d8781c4f865b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679261459, "uuid": "d7884dd4-2d1d-4bfa-aa55-3fd7a123c237", "value": "SecuriteInfo.com.Trojan.GenericKD.37466017.7300.17822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffa7cf8-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224913, "uuid": "786e5cd9-2ba8-47dd-8f7e-a60ae3adf604", "comment": "Malware payload (RedLineStealer)", "value": "5c7d0fb64b39201964fab08d22b77331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224913, "uuid": "89ff6af0-0971-48a7-b2fb-52f52090cfaa", "comment": "Malware payload (RedLineStealer)", "value": "d241f7543698d51ef84f9e45acf39057515ae7c30427529bc71e32c2b3e53b6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224913, "uuid": "81c8fa83-257a-4933-a4c9-1c160b3b2b3d", "comment": "Malware payload (RedLineStealer)", "value": "a61374032eef7dbf92dd19ca41cd6dfc369343ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224913, "uuid": "fd498c76-902b-4bda-bf81-7df45d1baf08", "comment": "Malware payload (RedLineStealer)", "value": "89dcc3db0936b6f9f7917c387be0db4edc6453f1a48c5eec8b993bf72004907947b9d0bb7be8b7cc4cb17c4a70c456da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224913, "uuid": "70ba9a25-2872-49c5-a572-b5bdefc7c97b", "value": "T13F0512529BDC8833D8A61B709DF606832F353CA15C7C971E37D96C9E48B3994E5303AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224913, "uuid": "97e6bf29-83c8-49e5-89d6-e75b952637cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224913, "uuid": "5426e47b-8f8c-44e1-9ecb-f4a45adac53c", "value": "24576:bydEF0PevYFykCa9Mt/Lsi66BFfXUaWPI:OdEF0Paa9Mt/tVXUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224913, "uuid": "f9cf4bfa-0641-4137-9d0c-2dbf3d1102be", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224913, "uuid": "a7b04a75-e47c-46a9-a1dc-7375217f385d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224913, "uuid": "3986af48-65fa-4018-b7ff-08ad489e1dd0", "value": "5c7d0fb64b39201964fab08d22b77331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5601c54b-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679218078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218078, "uuid": "d687f07f-6538-42d4-98ec-35e4315052e2", "comment": "Malware payload", "value": "77f8e3b25b993cc1e83a79639238c8ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218078, "uuid": "af8ce5a4-1e84-4541-9bb3-87ee3b2dc5ed", "comment": "Malware payload", "value": "d265c776dee443ab0d511e1381d5b5f24f02d67b6de611139638fb4f4314a686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218078, "uuid": "5cee7447-b4a7-4406-a8f8-d28aef11295a", "comment": "Malware payload", "value": "4a5c9a29a7bd1a1156b89e5cddd272d2d12bf89f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218078, "uuid": "3f606da9-1b37-410d-afe3-98b377624aa8", "comment": "Malware payload", "value": "63b131485eaa9fdc5461d34e1a7ae320c1a0ff32f0ee9655406bfb35cb020c73fb7cf8a78f0f9ebbae3a8d13a2d6da35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vimeworld", "colour": "#4FFBCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218078, "uuid": "6cee5d76-6df9-415d-a199-5c1ce669f41e", "value": "T155721926C7A40C42FD7B9F3074F886067E3179912FB4C6EF8165C2584BA27826A7C376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218078, "uuid": "6f36edff-837f-4251-aae4-9ffe9df29460", "value": "84a83eef8237ed147efd088b8e576a83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218078, "uuid": "1ad58724-1635-4542-ad2b-ec22e0587bc5", "value": "192:0+qusvKUz3Z3X27yNbCh4vu56/vqS78DWpHeLWwsU7K6CYX+LeV:gzvKW3lGWe4vueqNDGNMK6jOLeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218078, "uuid": "61ad1921-205e-4c51-9c09-d91d91aaac16", "value": 16464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218078, "uuid": "189ae466-afb8-423a-8a91-9b4181ad6fc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218078, "uuid": "1f67f463-ccaf-4a53-abed-2c15039f4e26", "value": "JAWTAccessBridge-64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917a57ef-c61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205722, "uuid": "8ef7b101-36fb-440a-8b17-af71b271b65e", "comment": "Malware payload (Mirai)", "value": "c8970937a14d743466d14961273eccd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205722, "uuid": "45e61a3d-e6a1-4dd9-a1a9-19500bbed612", "comment": "Malware payload (Mirai)", "value": "d3337fd5e26b5fe1caba12e75d2ede1decc157c99dad09b3090fe6300053f395", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205722, "uuid": "1be8a5a1-2381-49ff-b1fc-a4220c914613", "comment": "Malware payload (Mirai)", "value": "c8b9ea05c35a90821d4405064af77864c0720cac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205722, "uuid": "109081c1-2bcc-457d-9269-8b30ea012b63", "comment": "Malware payload (Mirai)", "value": "9eeb62d0c42da2480905e10ebd908941b1e54ae78e5d69b3808320b3cdf03c92e21b0aa6d097771d229fe23a60fc311f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205722, "uuid": "6a77f306-9783-4f06-af7f-c799525b4a9a", "value": "T108536DC6B4119E7DF5CBE7BE44220D0EB821626150931B27BB6FFC83BD721A48956E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205722, "uuid": "8376f032-0a9a-4dd3-b274-8323f17b92ba", "value": "1536:kPqRg0FZTbSX5xZLepSGossFpxhOx2X/ZOqc/yA8P:p5ofF8I9cKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205722, "uuid": "53593088-266e-469b-8ab8-e8caab737856", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205722, "uuid": "3ab856c9-9e69-4984-96f0-d1e9a4ae5554", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205722, "uuid": "379b306c-8390-40df-a789-009bf74046b0", "value": "c8970937a14d743466d14961273eccd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6679293-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212280, "uuid": "b2629347-7c0e-4ded-bb25-e7b6abff64b7", "comment": "Malware payload (RedLineStealer)", "value": "414ed17bc684b0061c02fc7c0c69b523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212280, "uuid": "cd05f4f6-9c71-4e02-8e7e-0136192dfa00", "comment": "Malware payload (RedLineStealer)", "value": "d3cb1563b9b378ff01abe5fd02ad845bf5e501298fdef7a9c1679b1a51f10ce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212280, "uuid": "e3d56144-3ec0-4da0-b9cd-4d78f6eb902c", "comment": "Malware payload (RedLineStealer)", "value": "5da5180d09728bb312cb24eb54c9b8933e403e97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212280, "uuid": "3479769d-5cac-4088-a2c6-9c6305c84d17", "comment": "Malware payload (RedLineStealer)", "value": "9c3edfcf58e3ec045ea93aa070500045fd9197a90b8d49711e26314bc6ad65cab8ef64e1c5bbbd0cd44217c3d0c4b15e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212280, "uuid": "40eae746-5488-4be9-9d32-4643de28d1c4", "value": "T13A45F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212280, "uuid": "cbb9253f-f49a-468a-b60c-d98a65f9061e", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212280, "uuid": "80feec72-56fa-4dea-9793-3cf4ede0447f", "value": "24576:6hVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:6Hb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212280, "uuid": "4317ceea-1077-49e8-a59b-3070bb88e15f", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212280, "uuid": "468dcab0-087e-4826-ad85-60c87ee560fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212280, "uuid": "94ed0d1c-bf2f-4b63-b02b-d1043c017bf7", "value": "414ed17bc684b0061c02fc7c0c69b523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6be6a8a-c651-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679229085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229085, "uuid": "1859eb3c-3804-4e64-be58-cc6531024590", "comment": "Malware payload (Stop)", "value": "caa68c6afbb1c91c9c815293f55f919c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229085, "uuid": "fa32ef53-4e0d-49c7-a35e-70e916380804", "comment": "Malware payload (Stop)", "value": "d3e4e4c70db693465dbb2a31f30ce08961d424707c1283280c0101c85d56e699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229085, "uuid": "6e187819-9dab-4196-b29a-36487969af8f", "comment": "Malware payload (Stop)", "value": "32666dada6ebd84f2e3c1fd8e1119282ae68fb91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679229085, "uuid": "28c6a6c0-dc85-43fe-b485-d23aaf91269d", "comment": "Malware payload (Stop)", "value": "cab7a54af6bc4a624cc329bb102e72d437c2b7915f8a1b06a66ae68fbaa54a514ea7512ea62770d024f82ec49141f386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229085, "uuid": "70c998c5-b221-4585-b889-6388842e3653", "value": "T1D205D05383917D58EA264F739E1EC2E8B31DF171DE497B653229DA2B05B11F2C263B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229085, "uuid": "aa4d8df5-847a-4d3e-a6a1-258c3de1cfd9", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229085, "uuid": "0dc6ae09-6027-4462-b44a-982a887d0dbd", "value": "12288:3P/p0YXo2lrlpVANRm053lzVnSU+BRpoVnUqLYttIFhL:/nXJ9lQLm05JBS9QVdLYt2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679229085, "uuid": "620e1fa9-ed5b-4220-88ec-f8ede8437cbe", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679229085, "uuid": "9ec26d6a-d430-459f-a7fd-f90154982ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679229085, "uuid": "8fab365c-45d7-473c-b0cf-e2382518729a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690eff1d-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211667, "uuid": "c7540c7b-39f0-4291-8669-a6dfa80c7ed9", "comment": "Malware payload (Amadey)", "value": "3bfc46a0301d03297ad1e9eef76545b8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211667, "uuid": "7763f913-2391-4e59-a290-2c0524f8765b", "comment": "Malware payload (Amadey)", "value": "d484f714e7f9c07c1a480ec1aa6ac598484851accf0aa23f0185da64e736abbe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211667, "uuid": "19964115-cf8e-4a5e-9f09-ba61551b6ff1", "comment": "Malware payload (Amadey)", "value": "b96c5563695101e0a423e9f0debc24eb57eb17d4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211667, "uuid": "4c89179e-f2e8-43ab-9c91-ed27959ab40f", "comment": "Malware payload (Amadey)", "value": "33be54020e6bd4b4120c29e3636954bcdc40533ec921202b038b3e923692bde3686de71e6abc3cb124baf1fd2366cf8f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211667, "uuid": "9d3dde8b-09b3-4e9f-9200-1e288f3e4331", "value": "T12445F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211667, "uuid": "e87edd78-d71a-4939-be59-0b58c3259757", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211667, "uuid": "79c28143-84e1-4b2f-ae02-e86b9ab28838", "value": "24576:YLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Kko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211667, "uuid": "8f33cf04-0e5d-4e72-a939-6e46dee4f8f0", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211667, "uuid": "7bd570dd-f6b0-4f04-ade0-59f5fb3380c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211667, "uuid": "c563511a-5300-412a-8dcd-a9bb00e5ca14", "value": "3bfc46a0301d03297ad1e9eef76545b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f76ef7-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223451, "uuid": "cb2eac0b-74ce-4c87-ab6c-1ea0a901df6d", "comment": "Malware payload (Mirai)", "value": "7ff25148066c6cfd8373526d4ab6fde9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223451, "uuid": "6b0c5bda-c6b3-40e4-aa2f-d43ff6e6b2ed", "comment": "Malware payload (Mirai)", "value": "d4ab8319aee5838a8e3ad580b314f8207d3e3490e2dcbd40feaa718bc1060ef3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223451, "uuid": "6f88255a-5f0c-4122-967f-c47cc791b3b3", "comment": "Malware payload (Mirai)", "value": "4d9ea7c4602b3ae2d75273dfc47df7ada0f824a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223451, "uuid": "61423bb4-61de-4032-a5f6-6d5af8e82470", "comment": "Malware payload (Mirai)", "value": "bebfa4373388061c75363774777ff3e8780c4e55d89eea9995889e6ec150a78b47dc6e055640f36837f024e0bb197232", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223451, "uuid": "7972f975-a7c4-4dd8-9a75-4504cd5e2b25", "value": "T17EA2E11172A32D65E3ED1C3DC96A835BF9A71BFC80F532767D406620C90924A3E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223451, "uuid": "b52c770f-a48b-478f-b443-55ef6c7dd5ee", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjhUyhymdGUop5hA:vvQn4j+ZO5fKAlxns3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223451, "uuid": "8a5520d9-56df-4850-ab43-64e993fc33a7", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223451, "uuid": "9f5849b0-5f26-4852-86c6-6c92bd244dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223451, "uuid": "309f935f-ca3a-46ac-b56b-21bc77a61a63", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247c3826-c64a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679225726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225726, "uuid": "c8832729-f530-42af-84a6-7c3b182e3c1a", "comment": "Malware payload (Mirai)", "value": "eeb76c4e032eaf235d9203a4ef833063", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225726, "uuid": "bd113101-8cb7-4d83-acf5-26174192e3aa", "comment": "Malware payload (Mirai)", "value": "d4d92db463384981c2f2eebc3ecc166ea28635d04ce549e7d7f5970444e93632", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225726, "uuid": "61ebc8af-5b5f-451f-ad18-9e9a0a20cc72", "comment": "Malware payload (Mirai)", "value": "24d5fd8f7252b01360f860dc9e1f2d2138e4e1b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225726, "uuid": "5283a0ed-e13b-4ea9-b924-4b539c276894", "comment": "Malware payload (Mirai)", "value": "e365c1916106156b63b980eb91ed90a1dc99f6315f4fcdb737446a2cd1223f9e46973065ad34cc60b39fddfa753c4be8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225726, "uuid": "ebe004b4-1693-4e98-b29f-54ee9d1a1945", "value": "T187631B95B8818A21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225726, "uuid": "6cf27913-6bba-4dd6-af72-a78782292de5", "value": "1536:hgnAkIP7B9stYVenVQmlct8URqOSQHMgimu2aa7LLJa104t:ZP19st6en6mlcEku2aa7LL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225726, "uuid": "b600665b-a0a3-400e-8792-f37a2caededf", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225726, "uuid": "2a1c24c0-074c-4717-a121-cfa085b8e39e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225726, "uuid": "167213ab-ce2a-43a4-9ff5-a857e082e980", "value": "eeb76c4e032eaf235d9203a4ef833063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb6f3c5-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223461, "uuid": "fc7455a5-ec53-4362-a190-60be918a56f8", "comment": "Malware payload (Mirai)", "value": "68839a4e92269424c25a7d763aa89a3f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223461, "uuid": "ce5c90eb-d6c6-474a-acaf-cccfceb8b450", "comment": "Malware payload (Mirai)", "value": "d62c175a6bd9675a688d54db667606776d4b30fce296559637f64966862934cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223461, "uuid": "d93451dc-e14d-4841-bd04-67c8ece11485", "comment": "Malware payload (Mirai)", "value": "e12b8c44eeb8a66026ab280640af81519abb4d00", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223461, "uuid": "d90ae379-6b05-4d2e-92e0-7722a2df39ad", "comment": "Malware payload (Mirai)", "value": "33761815c0d84cb01587f9019058715b6e0130466ccf0c1151cd1a94e56e09971313b5c8b6baa02a6cde0343e4884fe3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223461, "uuid": "c04acf82-4740-4514-8394-8ffad715a2da", "value": "T1B4B2DF3C1B151AA8DE1EC0BD83990B603CB81B359182AD5B6206FDD79F968B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223461, "uuid": "2827d27f-1fd0-459f-ba56-12e27fe83548", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui8VUhmdzJgGlzDpH7uNj1V:neD8ZSWvZHZbs1row697qohQvg9CUhiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223461, "uuid": "4b87857f-8c9c-4c17-8ec3-c9968d5e0b79", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223461, "uuid": "b5ca1862-f902-40e4-961d-815d699b24b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223461, "uuid": "039b4890-f359-4a67-a871-7a978ce81756", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f58371-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211373, "uuid": "ca366a2c-5925-4c81-b1a9-dc1279a4890f", "comment": "Malware payload (RedLineStealer)", "value": "10d6f532285a2fecd5983867080ba794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211373, "uuid": "920573f1-97b6-46f2-899c-419ef77d9b8a", "comment": "Malware payload (RedLineStealer)", "value": "d636df46571d51af2e036fb68edfa616a826065add31895ce1d765ca55af9bf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211373, "uuid": "435dfcc5-dc41-4567-8730-c18c97b67c53", "comment": "Malware payload (RedLineStealer)", "value": "80c9097813e0eaf7674d2ea49b89ab2c50fe5b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211373, "uuid": "740eea1d-fd36-472d-919e-e1bb1df78555", "comment": "Malware payload (RedLineStealer)", "value": "87459736f0524f028e4ed05d66cba027c2b547eaa23924ec88d8de563151b645c06ddc0eeb2533fa5786ce538a1996ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211373, "uuid": "3b6ca16f-100a-4307-b43b-55abd191f547", "value": "T1CC45F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211373, "uuid": "d8355572-8aa2-4b24-bb13-ca8e53b2251f", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211373, "uuid": "cc0d08bb-c4d9-4c29-b668-3be8e9c580ab", "value": "24576:jDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:j3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211373, "uuid": "95e6c9a8-6b0c-4c8a-9797-4921f8de8fda", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211373, "uuid": "edd0f4e4-19ba-4bca-a282-4e4f3840f0f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211373, "uuid": "ff14b39f-80b6-49c9-a804-101616804413", "value": "10d6f532285a2fecd5983867080ba794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbf6059-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679241173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241173, "uuid": "dfdba0e2-b9d5-4948-9413-c5d55729aaae", "comment": "Malware payload (AgentTesla)", "value": "7d3a378a340548eddfb5aa407d85140f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241173, "uuid": "c2a34430-a96d-4a70-823a-edba830cb481", "comment": "Malware payload (AgentTesla)", "value": "d646dec6cbf9574218af46bea0040773a935fe3c73578c233486d309e1e65ced", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241173, "uuid": "b142d3f5-062e-4d41-9359-1257cf9866ea", "comment": "Malware payload (AgentTesla)", "value": "7acbdb92cf1069e2965a81dd98005293fd6ae8c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241173, "uuid": "fb9c4eee-0143-4803-9675-7e85f0b84d47", "comment": "Malware payload (AgentTesla)", "value": "677afb6ea8e7f05e24776c620833494cd6c1445e031b7f9493754ef30b55af9516aad616863fd32c20ac6f2cce480d74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241173, "uuid": "d7c7fa96-4351-4088-a36c-7a4e77b7890e", "value": "T197458ED5F150C8DAD96B0AF2AD3AA43024A77E9C94A4810C59DDBB5776F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241173, "uuid": "653b2570-9766-43cd-9b75-ade2b96ac26a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241173, "uuid": "0e99d53a-4802-4932-80df-046c810ba86a", "value": "12288:AC42iNADQScmhO/I+TSZA0zGeC0RwlUU5hqgtEBswDekp8S7qJHnXyuaq:412Ve/R+DfRAN5hJQ/hq1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241173, "uuid": "fa3bcfd1-7c57-4ca5-9050-30dc90ff6683", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241173, "uuid": "7b016705-fc7e-4f3d-b96c-1916bbb1c3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241173, "uuid": "6bae1ecc-245b-4d6e-a6de-4749bb65a4b3", "value": "yeni sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f05f983-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211972, "uuid": "3c1731e2-a032-44db-9178-f258e1605c2b", "comment": "Malware payload (RedLineStealer)", "value": "8794a65ca4fc1dd7692ae28b9626101e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211972, "uuid": "d3c417cc-7c88-42fc-b394-5da25e65399c", "comment": "Malware payload (RedLineStealer)", "value": "d676b38ae9aff22bbf0a5726009d544e330292eb754611a9d8bf50a98cb30455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211972, "uuid": "0e7d9909-b341-4db9-91f0-3fc740e7b693", "comment": "Malware payload (RedLineStealer)", "value": "53d3d6c95b235083fcfedfd945e7df9a259a56ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211972, "uuid": "9b1bf765-846b-42b0-a588-fb16f906fb62", "comment": "Malware payload (RedLineStealer)", "value": "1145bf3b8cf66fa512e4ab368dfd32439daa5bb2bab63e50ba259e6c27f729311c7c38b6ede071bb22012d2f288d0929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211972, "uuid": "9dd4ada4-f7da-4e77-b94a-87732832dc05", "value": "T11745F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211972, "uuid": "3eb16266-3fb3-4d18-8675-65e8fdf5c6fa", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211972, "uuid": "48492e66-8b0e-4be1-89e4-8f1d67fd4bfa", "value": "24576:e1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:e1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211972, "uuid": "dbd7a2e5-180a-4044-9ee1-055cdbe56ed5", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211972, "uuid": "29097d6b-44c6-4696-aa2d-b4663ffa3901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211972, "uuid": "3a68fb5b-b9e6-4417-a907-84992f870656", "value": "8794a65ca4fc1dd7692ae28b9626101e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5720c001-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679212926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212926, "uuid": "dee2e3dc-2092-4468-b6c8-a09d316eb747", "comment": "Malware payload (Amadey)", "value": "f35e1f0adc4f35a6f7a9ea0469803757", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212926, "uuid": "d3b3d998-2234-4cec-a617-8079d6965d74", "comment": "Malware payload (Amadey)", "value": "d6b5364e6238627d1a3f2539c78498f214d04efb05dfe7ac0cc79b9055d8e8bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212926, "uuid": "57e10415-f130-491d-ad79-aa917c476adb", "comment": "Malware payload (Amadey)", "value": "733398c98d3ca667136fd429579b49dc916a4246", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212926, "uuid": "6730e16e-0468-44cf-a51d-c9cf2eace204", "comment": "Malware payload (Amadey)", "value": "f78934823a3b0e4df9fdf6349aa637fd209857df3d9efb59bcbb4286d55202e87a838488f30f6cf999e113a111d6bae0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212926, "uuid": "5390c540-e343-4476-913d-09c0dbf077aa", "value": "T1D845F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212926, "uuid": "497e5eca-8edd-47fa-9317-fb9aedc17c71", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212926, "uuid": "647d226d-a52b-48c4-ada5-2a2cbdfbab32", "value": "24576:m1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:m1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212926, "uuid": "eddc2e40-29b9-47e9-9b82-3c974b4502b0", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212926, "uuid": "fecc80cb-0978-4152-afce-4d738cd7a69f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212926, "uuid": "5d0fc673-484f-44f9-a607-997f368ab163", "value": "f35e1f0adc4f35a6f7a9ea0469803757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2899a4-c666-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679237716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237716, "uuid": "a8bda0d6-3ebc-4e11-af4f-73c6257446ab", "comment": "Malware payload (RecordBreaker)", "value": "b2767e277c25ce9cb08f8d4d3b48f135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237716, "uuid": "57b858ea-428e-4684-8be5-8a9b40092d22", "comment": "Malware payload (RecordBreaker)", "value": "d7dbd00ed7ac7cc441643b96aa96a1bc994f64ad20fe2d894f5a51b3d50ab53a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237716, "uuid": "87913d60-8fcd-4bf2-b72c-b351843315aa", "comment": "Malware payload (RecordBreaker)", "value": "3f73c8dddf8a9ab8b346251ed7f430a884e017c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679237716, "uuid": "7c090c31-bf4b-49dc-a8af-d222586f365f", "comment": "Malware payload (RecordBreaker)", "value": "ff68346dd032a45ea8b341761d34c84289b40372c09eeb18469b91f3b1947b0954668af652788b1a1accf8f388aa127c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237716, "uuid": "b0bb857e-0447-4ac8-ae88-1429ff7f3b67", "value": "T12B54F81393A17D58E9268B739E1FC2E8F71DF671DF497B653218AA2B04B0172C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237716, "uuid": "6217b701-609b-4aab-b14d-9ee7b53a2bc4", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237716, "uuid": "7c54466f-922f-459c-934c-28a9bde6d707", "value": "3072:oDsVXnLjNFHTP33ApIUlbu+FMdibV9qh4FUc5ZLnKtmhfu:VXnLjDL3+1lbu+mKV9JFUwjDfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679237716, "uuid": "f057f7eb-944c-4cc7-8d61-d46c040093ad", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679237716, "uuid": "4ff2909f-4a67-423a-91f3-d6f52aa8daa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679237716, "uuid": "f52f866a-f04d-4e67-ba22-524482cf5bb8", "value": "b2767e277c25ce9cb08f8d4d3b48f135.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f275041-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679223354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223354, "uuid": "c501babd-76c1-44d0-86db-8bb37c65a6a1", "comment": "Malware payload (Gafgyt)", "value": "0203f2f2c90badad38e2062c528c59b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223354, "uuid": "ee689886-69f1-41d0-a526-a0c7ac7c93ca", "comment": "Malware payload (Gafgyt)", "value": "d837d2a8c7b5c6f5d291ad11b608656a894b4099cb4f4f5beca62342fe078903", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223354, "uuid": "2f0e9682-f02c-4f4e-9800-96f0fd82906b", "comment": "Malware payload (Gafgyt)", "value": "4577ffd60b163a4ad1abb3e3bb5da125491476f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223354, "uuid": "5aea4b2f-fdd3-40f2-8a9f-74b0ff2bcf33", "comment": "Malware payload (Gafgyt)", "value": "55fd198e8af349dd773ebfc53220639ab9a98130cce1170edef56b171012cc7bc6f49664538aebfdb8186cc2502d50e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223354, "uuid": "cf2b8186-9e3f-4c4b-9614-9b794793ff3b", "value": "T1D4E33B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223354, "uuid": "51ac0153-0d19-4dd4-897b-3af907c18405", "value": "3072:adHtg2Nav5HqvGgBMKmh9H5S5hTKGRvEM/9RuDK37m5wTsL/Qpyn:KNZNav5HquA09HE5hTKGRcM/9Ei7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223354, "uuid": "ada6afd7-efed-4f1e-a0bd-23fc5ac9c43d", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223354, "uuid": "e7799d12-fa4b-4ed0-b7c5-d0cfaec0f957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223354, "uuid": "af9f12e7-ef44-403c-9371-9b435d3f8484", "value": "0203f2f2c90badad38e2062c528c59b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75633aa5-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679241323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241323, "uuid": "02850b39-6557-4a6f-8a60-088e3f0cd715", "comment": "Malware payload", "value": "2317da6da9ec92faa9caef750b26caec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241323, "uuid": "2a20fc01-ad5b-44e2-862d-87ebd0b8426f", "comment": "Malware payload", "value": "d8436af1abdf9396fc1a1f893b0a43eb82652f9c41297d3a1ae0c61eb33681f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241323, "uuid": "533be59a-32df-473d-89fd-055567b90de3", "comment": "Malware payload", "value": "8ad74ff78e2522f3de1dec5014f06b58321c774d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241323, "uuid": "ecefefcb-ed7c-4d34-8542-43fe499226ff", "comment": "Malware payload", "value": "b162d143e3cc83181dfc0c14fcfb09a4891d74667edcfc7c38da17e1be58e3321e1d693c3704a673d7ad3e8915bda523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241323, "uuid": "d6619326-d90d-4039-b964-e188c9904eea", "value": "T19DE54B2BE1A350FCCA7BC070876BA573B572B86951307DBF2590DB742E62E50262DF24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241323, "uuid": "4e40b1f6-2ba5-487b-970f-9101cd35a45d", "value": "98304:Cf4ix3tX2mzKHmCTBk1XoHtLgF9o11clR73DArjRjjoHuLc2orGpV7bAUI9+dB:CAiLLcg2Fi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241323, "uuid": "07905f7b-38a4-4fd2-b7ce-cc8baf06823a", "value": 3246144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241323, "uuid": "9118015f-a907-4a4a-ab27-8994b798e844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241323, "uuid": "be149d68-0f9c-4d51-bbd5-2d839d25815a", "value": "2317da6da9ec92faa9caef750b26caec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f500eb71-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679225216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225216, "uuid": "6a142571-ae41-4c1c-a4f1-ff84727584ca", "comment": "Malware payload (RedLineStealer)", "value": "dadfc89a7b3e8c763e2dfdd2e793e69c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225216, "uuid": "5249c9e9-c619-4f66-b282-952571ba199c", "comment": "Malware payload (RedLineStealer)", "value": "d903d714eaa8eecd704a53f90873cbc2e525fcd5a7a9957cca5de1eca0d79a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225216, "uuid": "486b44c5-9062-4538-b77e-a0b3c2161e55", "comment": "Malware payload (RedLineStealer)", "value": "c5fbf6690edf7056cf71f3c3c407bf218a4d627b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225216, "uuid": "dab5a8c9-918c-4539-842d-ce3f818785b2", "comment": "Malware payload (RedLineStealer)", "value": "dd5adce55a44ec6ec6c7f5b3be75ada03014a4b735ea47c061f878301fa877234997b5fe04dbac2e11848869f1fb6eca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225216, "uuid": "3acede4a-3ad4-4097-877d-fe6979a7cc9e", "value": "T17B45F10393E17D48E5268B739E2EC2E8BB0DF170EF8977653218DA5B05B1172E163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225216, "uuid": "f4cfb423-ec5a-4378-b2d6-de6ec767abe9", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225216, "uuid": "622385f3-0f61-4866-ab4a-f6a4f85b83f5", "value": "24576:1WksAUpYGbPrZhqNdhHkLPSPiBKo7LZvLtPY8GOCGRAR:1WkUYiPrXodq6qBLBJAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225216, "uuid": "b46704c1-fde9-43a4-9f3f-bc62ed8067fa", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225216, "uuid": "18fe6585-f3c4-4ae1-8eed-ded790a12747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225216, "uuid": "400c16b8-62c7-40bc-a847-c425062b74e9", "value": "dadfc89a7b3e8c763e2dfdd2e793e69c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9f171c-c625-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679210146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679210146, "uuid": "0fd1922d-761e-4ea2-ba63-017c641ac695", "comment": "Malware payload (RedLineStealer)", "value": "4b829e7c667e854315a9bc3bb6ecec4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679210146, "uuid": "aea205ab-7838-49b1-a420-0d48ea834db7", "comment": "Malware payload (RedLineStealer)", "value": "d9223192651f7cae9a1259e9d0743830f76f5e25e4daeb31a8071e74a94dbd7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679210146, "uuid": "c7338274-2ac4-4ec7-99e5-e0f1550b6d55", "comment": "Malware payload (RedLineStealer)", "value": "1538fd596a18b4da9ffa9158151723938e8a648c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679210146, "uuid": "aa453762-ae5d-4258-a767-01917151b0e3", "comment": "Malware payload (RedLineStealer)", "value": "ef2bfb2c6623856f73013ab7be0a53e699c35b4616d6c8ac6829e6dee65c2b65a13e8c393504588c21777a154eef8f23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679210146, "uuid": "106d4b6a-43fc-4d04-8e4d-a556cae40990", "value": "T17D45F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679210146, "uuid": "b584f275-41c9-4a12-ab22-22031dd7fcee", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679210146, "uuid": "7662d5be-259a-4e9b-aecd-fd191538a5fd", "value": "24576:VDJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:V3TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679210146, "uuid": "b56f8358-7c7c-40c9-8a32-f014429f3533", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679210146, "uuid": "c8b8ca92-339f-4470-a87a-f5319a3d8cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679210146, "uuid": "7433fcfe-00c7-4e14-bdfb-e24fb1bdac9c", "value": "4b829e7c667e854315a9bc3bb6ecec4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece4e799-c63d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679220478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220478, "uuid": "2c89a9d3-7e4b-4397-a7fa-68af9a35b7f3", "comment": "Malware payload (Mirai)", "value": "f30cad982b9afd0696ff5452934aedc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220478, "uuid": "08a44303-b01b-430a-9b75-8cd66a3f1d99", "comment": "Malware payload (Mirai)", "value": "d9241f918ce0ea8c95ac36d4b0a4e4b2d00dd9b23af473499cda04e95743558f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220478, "uuid": "fca11fc4-d1ee-431a-94cc-ab30577499c4", "comment": "Malware payload (Mirai)", "value": "0544c5439f5f350101ae2da2c2dd620fce4311ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679220478, "uuid": "0c7e0115-e342-4593-907e-459dd6befca3", "comment": "Malware payload (Mirai)", "value": "0a0265020f954935dc492bf8d428f61c6103e9fc5839c25df3c68e23139dbf4b9fa88f06f1ac8e39b194484aab5213e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220478, "uuid": "81cab2b0-ca2c-424a-b3ce-65d14ff38974", "value": "T112732ADAB800DEBCF40ADAB64567490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220478, "uuid": "5f9a9b16-bc7e-4d75-95f7-15372b45f304", "value": "1536:awW0PKt9cwxjQ/bIXIdZzN3ND8Utia84GLf84Eo5WOK+7c4R6yN:awsgVdZzNlFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679220478, "uuid": "418f1e4f-00a1-41c7-8324-36b6c4dfb12b", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679220478, "uuid": "350ac0c3-be07-4c5e-91c5-b21d0be87093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679220478, "uuid": "1720a6e9-a455-4a0d-949c-b6e4a7cd03fd", "value": "f30cad982b9afd0696ff5452934aedc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f090a69d-c64d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679227356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227356, "uuid": "2c6a4bd4-4bc2-43f8-b9c8-47cbb8a228f0", "comment": "Malware payload (Mirai)", "value": "a9bbf02d77fad0ae0b2b6a11f81560ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227356, "uuid": "8c3429e4-6f1b-45e0-86a1-6e03a52541f4", "comment": "Malware payload (Mirai)", "value": "d9986109a399b92200e3a7ae1f4135c4dc4581f2779f35b79c88162a024a2f42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227356, "uuid": "5261e327-d620-4af2-afbc-0b58841a1238", "comment": "Malware payload (Mirai)", "value": "7bbe01ff301a83dacb2a02e9910a9d0edf91f644", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227356, "uuid": "0c2e23b2-dfe4-4486-a043-d62fd23d2923", "comment": "Malware payload (Mirai)", "value": "a21ccd8408f4dc29fd34f99fa5882871987fd45e749d8f48da8a3b1b64c860cce555056b04aa2b4fd793d885affe1dcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227356, "uuid": "f7f164c5-07f6-4755-ac21-3b4a707813ef", "value": "T167D33C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227356, "uuid": "e90573a3-0af5-4483-905f-a0764571b0d7", "value": "3072:BxioDMQI5nrDaO4nt3qZg2IWu6b4JX7LkDM/98PmPw/t93:DioDtI5rent3qZgPWjWX74DM/9smPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679227356, "uuid": "67a371f2-41b5-4cd2-a730-620eb65e8fe8", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679227356, "uuid": "bc584438-f3a9-40c5-8f3e-095f6c329b73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227356, "uuid": "e01ec585-6c6e-4206-ace6-65c08b12bc5d", "value": "a9bbf02d77fad0ae0b2b6a11f81560ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee6d2d1-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211677, "uuid": "6d99bc5f-a364-4fa8-b150-e237584ffff3", "comment": "Malware payload (RedLineStealer)", "value": "496dca44c0cb28ae652aebfd59f4664a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211677, "uuid": "4a880922-7108-4eec-8d4c-3343c4e769d8", "comment": "Malware payload (RedLineStealer)", "value": "da3001e0f32a2b6215fa1a76a5cb9c6aba29312f3199999c58de3d1dcaa23355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211677, "uuid": "babd5041-1191-4fc3-b22b-cb186d6f2d50", "comment": "Malware payload (RedLineStealer)", "value": "32c9bca045facb8a1e5e35d19c50bb2f37c54ef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211677, "uuid": "c335d572-4331-4def-bc35-2380c511d248", "comment": "Malware payload (RedLineStealer)", "value": "619ae5e565854701002304f0944bdd768d45b6bce05e7546d0bc8f68701cc39000c1f25993de6d5cec1fe3c0cca53915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211677, "uuid": "4095b1bb-376a-4732-9cad-6264eaca3d10", "value": "T1B745F103A6E17C58D5264B739E1EC2E8B70DF5B19F99B76533189B2F04B01B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211677, "uuid": "f7b8254e-3e0a-4e33-9f96-4252be2723f1", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211677, "uuid": "af8545e8-0415-4aae-9d14-256b1d3ded23", "value": "24576:4DJ5TY38yph1yoB9sIRpm5diGwRx6e5Hsneu61WqNiRRZVIbUuR:43TYsyLheombiGwRr19u6jka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211677, "uuid": "3919f80d-1a63-4a8d-a3ad-39660a6e0033", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211677, "uuid": "7b547757-c6c6-4891-963e-3ce7a40749ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211677, "uuid": "c1b772e6-6b49-4b65-8927-485a245a644a", "value": "496dca44c0cb28ae652aebfd59f4664a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce67e95a-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679214414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214414, "uuid": "b1796d13-50f8-40bf-9d0c-89b7c5640d47", "comment": "Malware payload (RedLineStealer)", "value": "6470bc4c661192b4e3fa14628a9f84e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214414, "uuid": "2ba8b211-62ff-49f0-9cba-3c6d8ac9eaac", "comment": "Malware payload (RedLineStealer)", "value": "daeff6dbaac18abd51aeb097379b67255d732ed2ea1d6ab12308941df7022835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214414, "uuid": "911b0863-dbdc-48eb-9c92-02a7fbe64a06", "comment": "Malware payload (RedLineStealer)", "value": "027e7ad08ec7f4b93961720070df139402edbe65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214414, "uuid": "e6674ae7-02c4-429a-944d-230b4989be46", "comment": "Malware payload (RedLineStealer)", "value": "fc31e8868cb156f32e37087adcd825f36d187df656aa8f98248caf4466f4936d7c1a81fa84f67e2653ada9d9bc142296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214414, "uuid": "c67310c5-3688-4b92-82aa-ecf117f938b6", "value": "T10D45F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214414, "uuid": "4a70d6f6-6291-43de-be2b-91ed5f17f841", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214414, "uuid": "7d7399e7-8319-4311-934b-81e356e71696", "value": "12288:kxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:qbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214414, "uuid": "102f9a39-344a-49f8-a235-bd774d5d08da", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214414, "uuid": "6f8418cf-58e8-404d-9f0d-90e08ed2908b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214414, "uuid": "718ec759-b7b7-48be-a3b9-c06efb849647", "value": "6470bc4c661192b4e3fa14628a9f84e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960b1641-c60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679200146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200146, "uuid": "f4177562-c019-40cb-8808-0d656967558c", "comment": "Malware payload (Mirai)", "value": "5bc3a695651fcdb0c77684edb7b11cd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200146, "uuid": "5d09d5f1-8054-457c-9ac9-42e7fa96db59", "comment": "Malware payload (Mirai)", "value": "db38360e5dcf9adcae8cb2456c0bfe67381a48245c87857805cd141a16c35e6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200146, "uuid": "fb2ccc06-b3bc-4e7e-9796-75e8e4440c46", "comment": "Malware payload (Mirai)", "value": "735add449efef38cd3a8f5f43cd1427f48c8c1b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200146, "uuid": "35451410-c406-46ad-9374-499406b94cdb", "comment": "Malware payload (Mirai)", "value": "e6d67c80fef2836bc96485528d26307afd253ee8f7757cd47369c963b585aebc328792bb0a303065349e834cafb6e839", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200146, "uuid": "dd74f811-a175-4217-8d8e-08f672f433c1", "value": "T1233329DAB402AD7CF89FEA7E80160E0AF22127551093072B67BFFDD37E321549952E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200146, "uuid": "4c6e7b68-5c95-4229-becd-1f4ed4e1ac25", "value": "768:YYeF3KUcEWPJMQcDOFgFHc5L98Lu/WevBlp0+5JTozBP88N1qxZ:HcKjEajEFu8S/p5P0+5JUzBk8gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679200146, "uuid": "cd5909f7-dd14-48a5-95b5-e4aff56e0d64", "value": 52796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679200146, "uuid": "27ff8de7-f672-456e-9895-76c45c9528b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200146, "uuid": "05882213-f282-45aa-8bc3-5cb4f03bc928", "value": "5bc3a695651fcdb0c77684edb7b11cd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea2edaa-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224937, "uuid": "be8490a6-49f8-45dc-8cd6-84ae1f730633", "comment": "Malware payload (RedLineStealer)", "value": "c53c27002e832b0413cc69af644d37ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224937, "uuid": "1bb61abf-f064-4649-a22d-eabb0a5daefe", "comment": "Malware payload (RedLineStealer)", "value": "de3f14c1912a08861f27778bb595509ca358a7294736254ef99514dd97dda287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224937, "uuid": "1cfd2eac-ec9c-43f4-bb1f-65dd81019ba2", "comment": "Malware payload (RedLineStealer)", "value": "93053a81eafb607a67cec591bbb3bcdc25d8b170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224937, "uuid": "1b53e055-3300-4532-9862-fc56115051b3", "comment": "Malware payload (RedLineStealer)", "value": "9ce004ac87ea8837af23e842c3a83b1a163c6a9300c8ad9ee94524c43bb7a276a1e7907718388202d2d6c2aabe892314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224937, "uuid": "e68645ed-565c-4685-9e96-0a21907d58cb", "value": "T1B945F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224937, "uuid": "aa8d1f91-ee0c-4597-bb2b-d680f7744aab", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224937, "uuid": "95416e05-9f6e-417d-bbdb-ec6923aa25fc", "value": "24576:P9h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:P/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224937, "uuid": "e61ac6ac-4005-40cd-a1b2-67f878c1ee99", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224937, "uuid": "c3c80a23-751a-4cec-b54f-eee1c97eab67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224937, "uuid": "b93b153c-6779-40ff-b2b6-b740c4386d42", "value": "c53c27002e832b0413cc69af644d37ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50317f07-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224940, "uuid": "3ca6cd20-ef7d-4708-8ba3-dec90a2592c1", "comment": "Malware payload (RedLineStealer)", "value": "cca8437ac776665376fd740cf0dfb80e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224940, "uuid": "4adbd53c-8bca-45c2-9033-d85ceae7a556", "comment": "Malware payload (RedLineStealer)", "value": "deee1c5b280bdf7a56b1301febae596e4534291a8845c860d9e5f1224eba39a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224940, "uuid": "5769339c-9ca3-4808-aad6-971c905b31c6", "comment": "Malware payload (RedLineStealer)", "value": "e381d0ca0763b495690c913f74edc85fbb9ab5ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224940, "uuid": "7447738e-18cd-4e2b-a6ab-f1066dc7ff3f", "comment": "Malware payload (RedLineStealer)", "value": "d0fc886f77f4a13316189982d2795e427a010e33ea6a3b8adb3f4a53ea20a9254087c922ba59031c179b5e1658662d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224940, "uuid": "cda474d7-57a8-481c-a072-6ed6082c9dac", "value": "T1D645F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224940, "uuid": "3ef67f93-ae66-4f10-a31e-bf7efa235826", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224940, "uuid": "d92cc387-5621-4d11-a92a-b20bd742551a", "value": "24576:C9h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:C/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224940, "uuid": "ba7ca11a-6b46-440c-8a17-63ce4fee4d9b", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224940, "uuid": "6fbfc72f-6d33-4a94-aac9-1cf688f9f2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224940, "uuid": "3cf3002a-d2fa-47a3-8675-297f9e8937f1", "value": "cca8437ac776665376fd740cf0dfb80e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753ad359-c619-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679204816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204816, "uuid": "090a2b47-8e5b-48e5-aeed-4d2c9035489b", "comment": "Malware payload", "value": "b274990ed4f675320bd635963b586f8e", "object_relation": "md5", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204816, "uuid": "d179e24d-97b1-4df8-91d9-05d3e090a619", "comment": "Malware payload", "value": "df4f432719d32be6cc61598e9ca9a982dc0b6f093f8314c8557457729df3b37f", "object_relation": "sha256", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204816, "uuid": "9cdd78c0-90cf-4054-a662-e36b047cb6c5", "comment": "Malware payload", "value": "cf825bd4faea506517063d07da21c2280d8942af", "object_relation": "sha1", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204816, "uuid": "4a91e055-bc83-4db7-9356-aae3d94aff79", "comment": "Malware payload", "value": "4640b3a8b830d64afd23f5d78c898786e45a2fe2b8cf0579d74d7d64d595edee4613d4b15012b847cc4af4abc37fc6cb", "object_relation": "sha3-384", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204816, "uuid": "a520453a-8ed8-4dea-a519-f37348f22cc2", "value": "T1AF13D12749149067EB1ED3F03A5EB1AFA6E5953439149813DF023E3D5DB28A1833B787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204816, "uuid": "e36ff00b-c0af-41e8-9765-a96686cb07b2", "value": "768:YNbvbVGgYKd2Usr2yS5PLHBjderMpEvpZi7/kMPWq9aky77XTm9:YlDQfKdpfh5zHzeApsnI/eZDLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679204816, "uuid": "772890e0-7d77-4159-aba1-95e92a419a1d", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679204816, "uuid": "fd512446-d1fa-4383-b86a-c4a2707cf14a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204816, "uuid": "207e744c-d04d-4f7f-8d4e-9b5e4e887637", "value": "shellcode2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c61fc8-c644-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679223453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223453, "uuid": "42a4ad6f-6dd7-48db-a52f-77b05c0954e9", "comment": "Malware payload (Mirai)", "value": "fb4005755fcc09d5ba9b2629ac286f3d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223453, "uuid": "8d833d1b-65cb-46a5-91e1-98c19d39b677", "comment": "Malware payload (Mirai)", "value": "df698f53b406b681d986cdccc1fc9273be700701ab1befd79490fc8940251bf6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223453, "uuid": "a0c6f016-8c97-4912-aa98-322be0a7d620", "comment": "Malware payload (Mirai)", "value": "6311433cd5ea372ff6fa5e3de0b7f66ec9c463cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679223453, "uuid": "7bd663b3-186b-4405-bd56-d608b4d5d7b3", "comment": "Malware payload (Mirai)", "value": "e1adbe8c9e7617f80f08824fa6bc2ee4a3c8b0fdfcec4450f5123b1c282461407134215021b2b574b434cd1a29868b21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223453, "uuid": "d087a669-885b-4464-811d-f4fed8e7446f", "value": "T1B982CF3061AB74F4CBE10031EAAE8EC6A7160BF8D0FD36E317586B78C94610251F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223453, "uuid": "629630ca-944c-45aa-bb02-09cfa2d72937", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaAwhymdGUop5h5lN:6/V0P6+kom0tVAoNvm+to11s3UoznlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679223453, "uuid": "158dce0c-7a85-4927-8611-a55952b0098b", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679223453, "uuid": "b434792c-f4b3-435a-b860-2b78028ce948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679223453, "uuid": "d1bba3c6-1c58-472a-803b-ccea8fb33cf5", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4087bd-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211669, "uuid": "7b5f3ce7-0014-4f67-bda3-113533bb85ef", "comment": "Malware payload (RedLineStealer)", "value": "48c95c1943480e0c460bd9770cbabe03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211669, "uuid": "dbf49725-ca05-4eb2-b2c7-90c4963c7965", "comment": "Malware payload (RedLineStealer)", "value": "dffe2408b6f1f3c780a71d3df883d2104dbeabf567d0808b9555da6ef5cd2e62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211669, "uuid": "3e9c3608-9d0b-46cb-9749-ec35583e37ec", "comment": "Malware payload (RedLineStealer)", "value": "f545578d8f1e44ff537fdc30a266aa2eb81752f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211669, "uuid": "79eae968-7c7a-4683-899b-a138d80ca930", "comment": "Malware payload (RedLineStealer)", "value": "0ee05488c74baee1ba408658070026db263d09bdb59bd095a3f68a13fe9d12200ece4ea70c546e15e7e2aed90575115c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211669, "uuid": "8a602300-644d-4021-98dc-fc17905d0523", "value": "T19845F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211669, "uuid": "78a87157-a467-436b-af61-50e6d2e4aa98", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211669, "uuid": "43188d89-fcaa-407d-ae14-e997bf230ad6", "value": "24576:shVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:sHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211669, "uuid": "8c9c97c8-96a8-430a-a7ec-7f3d7948ba81", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211669, "uuid": "9e0f6430-ea23-4d30-bf0e-6f90ef4dec5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211669, "uuid": "4df304af-a69a-4a75-9ba8-c6f59c749551", "value": "48c95c1943480e0c460bd9770cbabe03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0d36a1-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211375, "uuid": "ea4ced85-3abd-4e94-9a38-095033c7e7d0", "comment": "Malware payload (RedLineStealer)", "value": "3079353b5e50a0ffcb4ae222ae5e5b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211375, "uuid": "a1f109a1-b765-4a92-b9bf-9583743491a4", "comment": "Malware payload (RedLineStealer)", "value": "e04befdf3608303c5aeed13bc9c2765c15e7d9ec6614c2d8253013b9ff4c630d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211375, "uuid": "0ac9058e-0a7a-4520-884e-371fd3fe93dc", "comment": "Malware payload (RedLineStealer)", "value": "1abeb42def4b09b6c7efef6f503768f17e06d08a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211375, "uuid": "0677d312-119c-4bc0-a1ea-8617b1aaac9d", "comment": "Malware payload (RedLineStealer)", "value": "c1196a7c20eda8244b77f23ecbecd455b1f93ac7c44d10b3c889dbd2f9560a632452b4a288d9a0cea90603594e9a048e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211375, "uuid": "7e0cf0fd-430e-4e8b-a0b7-d22624a3fed9", "value": "T14745F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211375, "uuid": "040edc0a-3d0d-49fd-8d8e-f8ac87aa51cd", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211375, "uuid": "0876cf1c-0681-4b86-853e-beeb25d25363", "value": "24576:u1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:u1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211375, "uuid": "39d4ca5a-b62a-4445-b854-d7419454dba2", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211375, "uuid": "2947d5dc-2367-476e-9abd-65c7101d483b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211375, "uuid": "51c47d09-b675-46c6-8985-b8a8477506a0", "value": "3079353b5e50a0ffcb4ae222ae5e5b80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00851a1e-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679217934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217934, "uuid": "cd268078-9e3a-4455-82b5-d5bfb26d0824", "comment": "Malware payload", "value": "607b43e7b39d49633884cce8f87142f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217934, "uuid": "528b37f6-1a38-4415-a990-88fc99a0aa9e", "comment": "Malware payload", "value": "e0cc68aa921a5a952e2c1935574bd3cb34316daa1ed6af865fbfe10d0e4d8397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217934, "uuid": "86d1cfb5-ac2a-4210-9ef6-f48959c91eea", "comment": "Malware payload", "value": "33c475e55f11cb4536303dad212ae9419ce6244f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679217934, "uuid": "56e423de-ace0-4712-9e96-d33ed39fffbe", "comment": "Malware payload", "value": "255fb9c4192073d355d796390e805a3f276a3f2e5f20d9a3f1d8fc61a88367db6ed69f44da1d6087080a9033890b8ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217934, "uuid": "591b70c5-0d48-4e32-ac1b-cb32ea0b7c93", "value": "T134B69E46B6B410A8D47EC178CA5A9B27CBF234644731ABEB17B003522BA7BF5563F314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217934, "uuid": "3ddc52cf-36bd-40e1-b909-821fde84ac00", "value": "ddb8bcd4eb5eb9c7be7c38c0795e438d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217934, "uuid": "34aa16a2-0295-4577-819c-a6b1f992fe33", "value": "196608:fS5yBeOC0wlBcF1pPbk0Z43dtUmmgUWzj9qwBwp2zOlM6cJUf:fBo0wlBcF1pT8dJm1Wz0wBwp2zocJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679217934, "uuid": "d2c9a000-edcc-4c32-9021-23be316ddc39", "value": 10471992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679217934, "uuid": "75d76295-19a4-498f-b18c-8b69fe17c0b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679217934, "uuid": "6930be96-ba3a-41c7-a323-4b577f96ee35", "value": "jvm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f43379-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212596, "uuid": "74aea022-9029-4b1b-a4ea-e6dc4ccfe81c", "comment": "Malware payload (RedLineStealer)", "value": "b6cd628c342988c3e9f01990447071ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212596, "uuid": "2421b1a6-f139-4b2e-9328-33b8f3ffaa1c", "comment": "Malware payload (RedLineStealer)", "value": "e154248864d1acea8532e97befc39e06be275e77f3caac5ab0a839efd54ac678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212596, "uuid": "cd712bd4-1304-4b6d-87db-3f4dfa3f11d2", "comment": "Malware payload (RedLineStealer)", "value": "09ec130ea700d1e4714bd76160fe8dddd9fa8514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212596, "uuid": "b8c646f1-c1dc-475a-a2d3-858ff6c4472f", "comment": "Malware payload (RedLineStealer)", "value": "aa8f7f22cfbb1ebf99c0c0b09c2d87918b735f12d95eee306c254ce2dee09e2082cac620bbd51f9eaf8febe77730fcdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212596, "uuid": "efa69729-2d17-4113-a0a7-d20b70195dfd", "value": "T18745F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212596, "uuid": "0e4a64bf-f0a7-47e0-af94-081f751e999d", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212596, "uuid": "88033af0-2cbd-47b4-af52-2a20b293815f", "value": "24576:wLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Cko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212596, "uuid": "1af6ac91-5a24-4a02-83ec-69df0c38b172", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212596, "uuid": "fd1afb16-7ba8-4cbd-bf8d-df0b9ddad981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212596, "uuid": "587ec7e2-c4e8-4391-aff2-e8d77809d1d1", "value": "b6cd628c342988c3e9f01990447071ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d785697a-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212282, "uuid": "b869c3a8-0d03-44ce-a54d-0a466419d010", "comment": "Malware payload (RedLineStealer)", "value": "921eba44f98735c64c6066f866913c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212282, "uuid": "8bebb028-a4e6-42a3-93ae-82d1abffaa43", "comment": "Malware payload (RedLineStealer)", "value": "e1c08e7290a5e13d2ae7b1756e0ba0dd8250e2e7dae1a44cfb3e212b9d4c0ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212282, "uuid": "694ed5cc-c1f1-4f87-a21e-9dd2d767f0d1", "comment": "Malware payload (RedLineStealer)", "value": "5746c5f3967a8a945ed8f48335d7887ec39586fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212282, "uuid": "c6d25136-2aa6-4f6c-9f75-1febf5fe0e0e", "comment": "Malware payload (RedLineStealer)", "value": "f39e45be9f7e9f2a63ed5f9ab5989f26b64427ea6b90ebe81437469d2426b332011b671ddacb4cea8d33c71cc6a6cf8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212282, "uuid": "378b1e39-eb37-44bb-a426-eec47d75dbf6", "value": "T13745F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212282, "uuid": "23486b7d-05a4-47d2-b233-2d4a3808db09", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212282, "uuid": "c0387ea0-8b90-4973-a538-535d9c707cac", "value": "24576:JhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:JHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212282, "uuid": "b911f892-fe26-456a-a296-f556581c6933", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212282, "uuid": "ac4e6ad7-8dd2-4e35-8053-02dc2b5dd486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212282, "uuid": "138cdd42-b79d-4836-90b6-aca3ef3a1730", "value": "921eba44f98735c64c6066f866913c9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713778f2-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211681, "uuid": "d5839661-1316-4384-99f4-300920762f2f", "comment": "Malware payload (RedLineStealer)", "value": "526ff1b5dc4f76044ee1ca30d284e017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211681, "uuid": "25b08ff3-a2f3-46c4-841b-14560366f8aa", "comment": "Malware payload (RedLineStealer)", "value": "e206c8c21d0dbf196ff2bfb667bd554168b1b52ebd8e3e4e70590e080bdb3ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211681, "uuid": "b2d7d243-c689-4ede-a538-08da56f510c0", "comment": "Malware payload (RedLineStealer)", "value": "92630a6c1189d225fee0f3d70e0d0d63ced8e1d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211681, "uuid": "e05550b0-cb00-4f55-b4be-e08cf2ac65a9", "comment": "Malware payload (RedLineStealer)", "value": "0c10269b82404fdee42ea4c583e4fe9495b7b3efe002937d7436a4bb30a4fb6926827ac27be69851ff6cbac853e1f6b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211681, "uuid": "c35d78da-91db-4ad7-85c4-80efb8e0c009", "value": "T10045F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211681, "uuid": "51e7203d-0898-4d44-9a99-4925ee8cf501", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211681, "uuid": "148514a4-7f9c-42e5-b0cc-f21e3d5549f9", "value": "24576:q1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:q1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211681, "uuid": "11a29821-c6bf-49bd-8bb3-be12d2b5b956", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211681, "uuid": "6ad3b66b-3e23-418f-b548-8f525a97acb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211681, "uuid": "dbe0829b-dc1f-477d-927d-6d0b5afce0ed", "value": "526ff1b5dc4f76044ee1ca30d284e017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76897e6-c650-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679228576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228576, "uuid": "3e8b12b0-e668-43b9-ac9e-e6b2417c4bd5", "comment": "Malware payload (CoinMiner)", "value": "28df2ea6fc55b9173fd86b5267cbe5c7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228576, "uuid": "acd52053-7427-49e5-904e-fcb0de7511b2", "comment": "Malware payload (CoinMiner)", "value": "e22fdca86ebf199ba600299082ac4d7e33699a346353ff96445361117193428a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228576, "uuid": "1d94db80-846f-4b02-a815-f297fb0881f9", "comment": "Malware payload (CoinMiner)", "value": "a21eaee7a80585efd952942588634f27d1d17b36", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679228576, "uuid": "2adf5200-e799-4938-948c-021023eca230", "comment": "Malware payload (CoinMiner)", "value": "cd9b6fe94c26a4d1163311b904c250c258a4b19a7dc0614284aa5b2b10b78969df2c7137687821bb35446764d80a6f1a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228576, "uuid": "d6320c38-b001-4e9c-b573-68b20969338c", "value": "T19B24AF26302142E3C867CA3D19E2B1D1DE39B8126755F277BF4A356FC537582B39432A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228576, "uuid": "9b3f59ca-3c6e-407c-b0bb-462b420afc0b", "value": "df35d969e1568731b4c070bee6bd7122", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228576, "uuid": "873621c2-d442-4c56-83a4-eef6ed04eb62", "value": "6144:xmTrv/uwytIGNN5J83FITMr5dxAWGbbmQ6u:grv2wyDNXSoMFdxLGbbm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679228576, "uuid": "b7d57fcc-3bc0-495c-bdfa-ee72663d1d6e", "value": 219032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679228576, "uuid": "0da461ad-3524-4f14-95b2-60db9fcecd3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679228576, "uuid": "6899eaec-7c8d-47f8-972b-f06f5610a885", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826cd177-c678-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679245640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679245640, "uuid": "017c4b5c-913d-49b5-a55c-5ef578cd7a7b", "comment": "Malware payload (njrat)", "value": "ca2ff13c2cffca5507ddd42ccaa397be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679245640, "uuid": "fe24fadd-8d02-4149-97a7-3e74f7b81b76", "comment": "Malware payload (njrat)", "value": "e235fa50b2fd6764c53eacb33714815824f4d0448fd5c6ac5ff6d6877eb66891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679245640, "uuid": "f544e80e-1c9c-4561-8c15-b2627c96e2e8", "comment": "Malware payload (njrat)", "value": "14785a8b6d0296fa41814c2e11818e5ca0d4352d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679245640, "uuid": "3aea3dca-f203-4db8-8acf-25f3d06365c3", "comment": "Malware payload (njrat)", "value": "ebe4e8aa883cc2405afd2cd314157ab6bdc5156a50c1672fd59228c421f5602755da114e310eb2e1c20ffc3a1d9dd156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679245640, "uuid": "0a3c8144-2a71-423f-b649-3366165df88d", "value": "T122B22A4E3FA9C856C4AC177486B6965003B0E1470423EE2FCDC560DBAFA3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679245640, "uuid": "47cdd30d-6d0a-405b-a1c5-addd5bd85695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679245640, "uuid": "c3f4da50-a444-49ef-a724-e834e561490a", "value": "384:XoWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZ2B:w7O89p2rRpcnuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679245640, "uuid": "ec8cf1b1-13a4-43a8-8e3f-e6b5062ce9f0", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679245640, "uuid": "5c27587d-6195-4557-b197-b55b34fcb6ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679245640, "uuid": "3ac4276c-9c3e-471a-8dcd-4831de6ab60b", "value": "bKB9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a87e35-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679214403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214403, "uuid": "1a5d1eb6-d26f-4665-9c71-25421dbafec2", "comment": "Malware payload (RedLineStealer)", "value": "639e813e6da1eebc4c26a17149565d16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214403, "uuid": "70e5fa77-381c-4a0d-8c9e-0fac96d797c9", "comment": "Malware payload (RedLineStealer)", "value": "e2a2272774a90e7985b2de904cc248d8eac11945af9bd674b711d9b17eb7ce29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214403, "uuid": "34c1768f-95fe-456b-991d-c666bbbed9f4", "comment": "Malware payload (RedLineStealer)", "value": "4bbbdc2cbbfd37f2c09003941d9050cfe50f8c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214403, "uuid": "f7fc2226-db88-4e31-b908-784e78a1f11c", "comment": "Malware payload (RedLineStealer)", "value": "c3f31eb6c2ea88508868ec38bf112e7b562610cbbf2b29b34a32295c612a831fd0667987a77cfa6c3749c7dba33cd966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214403, "uuid": "9ab8a3ca-600f-49c2-b761-cc5d9f3866e2", "value": "T1B1052203EBE44837ECF563B048F617930B3578919C745B676A51AD2B0DA3284EA3637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214403, "uuid": "afa8d6c8-d5bb-4e19-802b-846af80783a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214403, "uuid": "0ef596ec-3158-4f62-a0a9-2c0a6c4c08dd", "value": "24576:WyKHUMC5W+r5S9i3EEmRj1l9VvDt3B+BLK:lKHlSWaEqmRjT9VvDpoBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214403, "uuid": "5ee0c87d-8e40-45f9-85ae-e8fda7d1d24c", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214403, "uuid": "da9fe877-e8f2-4677-a6a3-bc8932325bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214403, "uuid": "7a885739-1562-4ec8-866c-67225e208872", "value": "639e813e6da1eebc4c26a17149565d16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbe38c5-c68d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679254809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254809, "uuid": "5987e2f8-6da3-4ea5-8e8e-2d35c8d22982", "comment": "Malware payload (Amadey)", "value": "27099a586ea99f4528e4dd0368c03831", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254809, "uuid": "c891d818-8c9d-4fc7-b7dd-ec59d4d2e980", "comment": "Malware payload (Amadey)", "value": "e2e96ee6134ca1a56ebe9083ff1298722f845ef15051668ce62aa781fefab5e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254809, "uuid": "28ac39c8-54a1-4898-8f44-b60201cebb5f", "comment": "Malware payload (Amadey)", "value": "7b9663ecb7896e0aa6bee6084ada221b1cefb624", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679254809, "uuid": "55d121ae-1bc7-4501-8e3f-3ba45d4f6579", "comment": "Malware payload (Amadey)", "value": "f0b99cf61062c6224226277f67670017374bc295657af2bc066a5d88c4a6c6067e1db8be0b2de3252fad57cbbcc1d3e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254809, "uuid": "2fe20e6e-ee39-4f7d-8061-e72009dd86b0", "value": "T1EF54F913F2E17D44E925CB729E2FC2E8771DF1509E49BB6D221DAB2B05B01B2C263716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254809, "uuid": "67986a82-64c4-4e46-959c-2446b51f93c9", "value": "c901cf1b33a79cac7fcfec57ffb66976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254809, "uuid": "60d6b3a4-f994-449a-9352-add8c5be5ba3", "value": "3072:pDSHoX9L8Ttm1qgKHaHOdp6HQ6fmja8jFC1QM15nbrDJhw:nX9L8T00CHOj6HQtjaoHYvNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679254809, "uuid": "9ed4fdd1-986d-435f-b632-0f2d4401d81f", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679254809, "uuid": "710fb16a-80de-42f0-a353-d7e9f717aaf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679254809, "uuid": "3db8515a-3c64-4c0f-98b0-b62805c89d95", "value": "27099a586ea99f4528e4dd0368c03831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63949809-c683-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679250313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679250313, "uuid": "d5e92311-feb0-4af3-b545-38abab2dfcb6", "comment": "Malware payload (CryptBot)", "value": "5e62ce2c758268030b2e673252c7c199", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679250313, "uuid": "316a1dbe-e8df-41b9-a5ff-37e8a86d6817", "comment": "Malware payload (CryptBot)", "value": "e39e047850594b792efd9c8ad328c9c32e15c77e9b4576d1c664703c7dcc8fdc", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679250313, "uuid": "47502a21-1027-4c37-bf99-6dfd8abcf73b", "comment": "Malware payload (CryptBot)", "value": "80963e2c068c9b75bec6214e817435cbba17bbe0", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679250313, "uuid": "3dfb17ea-5528-4358-834d-941be328a5b4", "comment": "Malware payload (CryptBot)", "value": "ac492255677dd3b4b23dc106fea83701e7660bb22fe4dcf54ee3b772e136d2ada5144a3c09d9f603582f22fde7c5ee9a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679250313, "uuid": "2435b30a-c19b-4333-ba41-7acd425d43e0", "value": "T177662333A3387289D4D1D878442BEDE1B0F61E3B8E81A17874D97BC836758E4A7235D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679250313, "uuid": "967538ad-c0b3-4107-9348-46120429079d", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679250313, "uuid": "ae7a483a-4097-4b5c-89f6-e57b07e78cf2", "value": "98304:WI9ZCfZk3RIGgWhMIjVRr7SaB/JjNv+w3S+/KWpnMgcKrVuOtGTIDzO+kA6w2:WQoZ1zWhMIpBdJp+XGKinMg3u9MzeO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679250313, "uuid": "6e0601ba-cc62-4ec2-aad2-4b05c4909af0", "value": 6575104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679250313, "uuid": "0c7e9ac5-908f-4509-8df8-ce2ed99c06cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679250313, "uuid": "1ce63bcd-1464-422c-8b92-fe31d5afe26a", "value": "5e62ce2c758268030b2e673252c7c199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbf8b63-c629-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211675, "uuid": "62234858-124e-4761-b33d-9428d28b208c", "comment": "Malware payload (RedLineStealer)", "value": "4ebda2e8aadb0c4b6ac1a9146cd01ff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211675, "uuid": "8a8b07ec-f0cf-413d-9bae-94413b5b7647", "comment": "Malware payload (RedLineStealer)", "value": "e4bb034ae47776c7c1553e74541aae6a674efe94c9850992802798dba34bc092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211675, "uuid": "5106c828-b876-4a6f-abdf-be5df0273f80", "comment": "Malware payload (RedLineStealer)", "value": "e10129ba2e48cf06f3bb0096be188d0459dfe1bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211675, "uuid": "2baaa674-3868-4967-b1aa-b24371f93eaa", "comment": "Malware payload (RedLineStealer)", "value": "47b7c055896a47dff31d3b596a5599ad7420a5fd81f65840bdc70e1a58f0e57d209536325df4277b3cd0fb83bf36755a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211675, "uuid": "069595d5-851b-4040-a44a-1cf7db1a495b", "value": "T12345F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211675, "uuid": "8b01c87d-62ef-4ef6-bf5f-796336c40803", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211675, "uuid": "78ddb34f-fb61-4e66-838d-9baf53102043", "value": "24576:a1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:a1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211675, "uuid": "71d3c73b-e351-4eb8-ab20-9eb7fc12a954", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211675, "uuid": "b823fe50-9ce1-4794-b688-3121382ca7a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211675, "uuid": "8b970da6-4404-452d-bad9-07ae509dbe5f", "value": "4ebda2e8aadb0c4b6ac1a9146cd01ff5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f344ce-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1679241245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241245, "uuid": "c7eaef66-fa1f-4a40-9ead-113aaecad774", "comment": "Malware payload (AuroraStealer)", "value": "ddf23780b1cc1759bb0f1817a83e67d3", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241245, "uuid": "c1aacdca-909b-4cbe-9a8b-e29985366645", "comment": "Malware payload (AuroraStealer)", "value": "e58dceabcf10f3ab98083246426d9aae6deb371121dbf3306723870ea838c5e7", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241245, "uuid": "8c837570-c5cd-490b-b391-031bf282b27f", "comment": "Malware payload (AuroraStealer)", "value": "3c95e6ca22c8a6ff6b3490e7a83e95ef582abfc1", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241245, "uuid": "e2d7e74e-9697-4e8f-8cb8-6d0e39340007", "comment": "Malware payload (AuroraStealer)", "value": "b3848f29c526383430c73dec0badef4731d6e2caa7138688fb13d3520b12f9a47183083c1a6a6a66dab556900077926f", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241245, "uuid": "9ed61cdf-2622-4261-8df8-7fddfca280bf", "value": "T1BD76C58CB65635EEC807D4729AA92C7DBB20746B531F8243C127169DEE1E997CF240F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241245, "uuid": "e99a9b11-33f8-402b-8264-e44fb409e814", "value": "98304:SdjxunlgScTvilUJQ38e8dR2SfX6IODGfL112bfl:SdjxClgSc7ilieK9X6I4GBAbfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241245, "uuid": "349cad90-5f72-48f3-bfd3-942b92ab1124", "value": 7432812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241245, "uuid": "31390d9e-6f9d-4814-858d-28a7277e32ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241245, "uuid": "c2058b3e-c4f7-4c8d-8fbe-9983f0aaaa2f", "value": "ddf23780b1cc1759bb0f1817a83e67d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea34b72-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679211381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211381, "uuid": "77eb4f9f-8c7e-41d0-9478-2c42f95b2c06", "comment": "Malware payload (Amadey)", "value": "3134d3167a3ba4d3458d64d8281d1422", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211381, "uuid": "0e549d9e-94ba-4ac5-a996-2721dc27ee00", "comment": "Malware payload (Amadey)", "value": "e6aec0ec3b3930ad494b266c6169950330b3e9d0d26acaec0296a874c811f817", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211381, "uuid": "cc9f74cd-65cd-4122-b0c8-806241dd1e00", "comment": "Malware payload (Amadey)", "value": "dff778c32fd70eb91817da5e7b0c6498752486d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211381, "uuid": "f5746092-53f1-4d61-a3b5-dd4aff259d4f", "comment": "Malware payload (Amadey)", "value": "341e6de5244c472f57de4193e93c5595e0e5ca9dc7603ffdd5db8e95ef3746ffb4e0f5dfb7af4ae200fa9741995b28d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211381, "uuid": "b5671271-26b1-4778-bffc-8db30b2a62ce", "value": "T15C45F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211381, "uuid": "c0ba81f5-3fde-4252-a821-508dc02da6a4", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211381, "uuid": "078c7cbb-77d6-4d46-bb2e-8101e7a6d06f", "value": "12288:GxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:obXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211381, "uuid": "acb25cad-f362-4b49-a83b-5f27ffc7c77c", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211381, "uuid": "38069c99-39b9-4416-a741-516bc7dde841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211381, "uuid": "5db17780-5fec-4005-a3cb-ec0ef9a00926", "value": "3134d3167a3ba4d3458d64d8281d1422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc32ca50-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212290, "uuid": "520a2981-020f-4cae-bdf6-4339d9c72ded", "comment": "Malware payload (RedLineStealer)", "value": "a546d3586db8e60da2a40bd7c669027e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212290, "uuid": "4450657d-a630-44d4-a1b5-c4c9919dd8f2", "comment": "Malware payload (RedLineStealer)", "value": "e72dca8f9427bd62942bfc96a91b9cb9d374ddafd8bf974ce1ae9b168431f5ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212290, "uuid": "b2d0e959-046d-43f1-a312-aba0f874d71e", "comment": "Malware payload (RedLineStealer)", "value": "bf45390806d5bdba6964e72dddbe83b231060531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212290, "uuid": "8e61eb19-bb83-458a-a5fe-fc274e38f563", "comment": "Malware payload (RedLineStealer)", "value": "17b0f132bf9b283eab8db1e307b8669c4a20b8ccd18d272aef16f6271d0dd038d808ee2f41f73ecad763ce1b5913219a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212290, "uuid": "5b661f2d-1881-4138-94cf-7cd9dc1298e9", "value": "T1A9052301FADD4532E8BA63B048F757830A367DE3983C47AB1792589A0E72640E57377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212290, "uuid": "90c52977-0419-4af5-98b5-1caa82a640d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212290, "uuid": "4b483644-6ba0-442d-8c66-9c08abd4ab79", "value": "24576:TynRFZ9kVc8i8mvjjVsj177svDrpM/T9:mnDZS8fA1XsvDVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212290, "uuid": "979de298-f7f9-4bdd-a40a-48c8f2ebfd1d", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212290, "uuid": "51ab2e79-2718-4b6e-8fed-480534757206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212290, "uuid": "ebc2c39f-f965-4f8f-83f1-40777ee4e10c", "value": "a546d3586db8e60da2a40bd7c669027e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fe34b4-c68e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679255258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255258, "uuid": "7da00fd9-80b2-4e78-91b8-e3c87433cddc", "comment": "Malware payload", "value": "837492679607de448a42a7b42c471ee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255258, "uuid": "d8b08b71-040f-4e5a-8d60-53999223d0de", "comment": "Malware payload", "value": "e7366f1160c2e1c16e7d620178eaa35c7becabc84e8bb04f0e2f818cd5411677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255258, "uuid": "07bdcc5b-0aaa-4076-9b98-d847eca882af", "comment": "Malware payload", "value": "23d42bc25da78c4115bf095ba63de87f2d82bde2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679255258, "uuid": "a2023b05-23b3-4b84-a1e9-dc8235ed417b", "comment": "Malware payload", "value": "4c06b53945b905eafbb83b173ead893fd6187bf74c58d61dc4ef8947db4951348883540c9e0744b570f37e749c05568c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255258, "uuid": "7ee87fc4-4538-4d5b-9d0a-2e30ebc8d3ea", "value": "T1E016334967E00DF5FDB6A139D8429916EBF1B8130764E6CB039CD2671F37BA1683AB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255258, "uuid": "a8470e68-4032-4175-9a6d-017ccfb656d5", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255258, "uuid": "b0f0dcd4-70d4-483c-9d5c-fce688500d3d", "value": "98304:WKcjFTzkAXkBHucqmbxaQBkU5xusZ7/wCsa:WzF3kAXqHjxbAQvaNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679255258, "uuid": "15440be8-90f8-44e9-a9bd-534aa6f7a9f6", "value": 4107505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679255258, "uuid": "a3e0c33f-281c-41ac-9ce4-ff0b2e588414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679255258, "uuid": "9f408c84-4fd6-46c0-8380-0c6214e0d92a", "value": "837492679607de448a42a7b42c471ee1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76117fd6-c624-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679209542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209542, "uuid": "dff474ca-25cf-4638-885f-6d77ce263bbe", "comment": "Malware payload (RedLineStealer)", "value": "f214fe105916f1cdfd113f59d851a37f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209542, "uuid": "b9df3e60-5291-48b3-b73c-3a1755fed3bd", "comment": "Malware payload (RedLineStealer)", "value": "e7e91a0ee9a594dd6b398872dd432391298c93b642f1289782a71e5316a390dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209542, "uuid": "39c44ef7-ec79-4f21-a344-14efbb1951d0", "comment": "Malware payload (RedLineStealer)", "value": "a8aff9bdbee498dc9e185b9fe2e2c27c0dee6f59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209542, "uuid": "4b41bd26-cc4c-42b9-b25b-9b1b7b7a6741", "comment": "Malware payload (RedLineStealer)", "value": "af0ea98469ccae3d5e1628000cc7661be585591800580c9c913372af09ddb61856504e23ed2473337d6565644411dc85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209542, "uuid": "3d077191-d6a1-4660-9bf9-ef32e8b47918", "value": "T1C945F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209542, "uuid": "c8b13695-478b-4b12-8fc2-3f1a95f5fd51", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209542, "uuid": "63ff8c68-87c7-4324-a6eb-1f1efddb187e", "value": "24576:3hVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:3Hb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209542, "uuid": "2d3b706b-8271-4e54-9569-4d09b010f93e", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209542, "uuid": "82d17763-a7f9-4d62-beb1-fe468743af12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209542, "uuid": "b22548a5-1123-4775-aca9-81cc5e23af4a", "value": "f214fe105916f1cdfd113f59d851a37f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446bb1b5-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224920, "uuid": "d18397f8-359b-4036-8803-0ed5f134383f", "comment": "Malware payload (RedLineStealer)", "value": "8d74b48c08a14fd10e478ff1884da29c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224920, "uuid": "16947443-1443-4ea8-a2e6-ef7c5176ccb9", "comment": "Malware payload (RedLineStealer)", "value": "e84e3c82aa320af1632dc76eb9471bbc71998b020a7e18f5b4573fca65f3d75b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224920, "uuid": "c6a161c0-bafc-40a4-a67e-b2b00611321c", "comment": "Malware payload (RedLineStealer)", "value": "bbc6860f6fd453edf27c0395970470e5ce8d78ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224920, "uuid": "853e9d88-718f-4477-a925-aa424a1f5de0", "comment": "Malware payload (RedLineStealer)", "value": "4c1b0b80e433fdd3ae0189df941fcf340e65e1ad16efad3e5408eae2d73f7bd6f5e8dee6cc1be4afbaa5309392861e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224920, "uuid": "cdc21c64-668d-4fc7-bb82-cf7907e7b9e6", "value": "T12425225B9BE84422E8B5437429F743D319357E602A38835B238EED1E0C716A5AB7137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224920, "uuid": "ef0e7b13-0dd5-4fc5-b2e0-991de0d70d09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224920, "uuid": "41288496-6360-4d3d-a0a4-a1bb92b58de6", "value": "24576:/yilt4xv5D093DKU61GblIGKhqtJVYL1KC:KiF9560lEhqfVYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224920, "uuid": "077c7857-939d-460c-9f42-d6741485d3db", "value": 1051648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224920, "uuid": "fcec9a96-ec96-4515-9fde-833688f244b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224920, "uuid": "fe77c8b0-d42c-4cf8-80a7-2f8b6cf22f3d", "value": "8d74b48c08a14fd10e478ff1884da29c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a78508-c654-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679230207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230207, "uuid": "5dbb805c-0e11-4fc0-a765-966ce0083ed8", "comment": "Malware payload (Smoke Loader)", "value": "55c0724e15d3a4c5a6d6636b2c5be95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230207, "uuid": "7ca17720-e715-4ddd-97c7-dad916375712", "comment": "Malware payload (Smoke Loader)", "value": "e8a52e8f371f9e1376e871cb87f0ea98eda5f3f5a0ed0605554be21ea131ed5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230207, "uuid": "0ddd589c-e24e-4fef-99aa-0d5c03833905", "comment": "Malware payload (Smoke Loader)", "value": "2fa5cbe6eb2af15d6935d560eafd688141e10c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230207, "uuid": "f9b1a255-8738-49e6-a1a1-e154cd779dea", "comment": "Malware payload (Smoke Loader)", "value": "3e966c1eacfcedd57f4d4b287a63a3935be83a4e101e25a832043af97b9ba8888bb27fe1b02b52293db7fc8867dfa311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230207, "uuid": "3856b9be-44fa-475f-b5a5-43c245cf9a9c", "value": "T193742A1393E17C59F92A4B739E1EC2E8B71DF1B2DF49776632188A2B04B01B2C163B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230207, "uuid": "38f13423-97a3-42f6-9452-88d01076d752", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230207, "uuid": "e3b27825-9319-4c2f-a17a-098749b2094f", "value": "6144:3VBb1/LIjzPDpfYzwmlneffz0NrPIS9TBH:T1/MjzPDlEwWnejMFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230207, "uuid": "c27f6c31-431f-4597-ab0b-ad8f045ae0c4", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230207, "uuid": "947759b7-bc7a-4fe3-aea6-eb5124579373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230207, "uuid": "a5d7da78-ec66-47f9-b73d-e38d8f112a14", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6539b8b8-c640-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679221539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679221539, "uuid": "48845fea-d23a-4977-ab09-ba885f7b5ed4", "comment": "Malware payload (Gafgyt)", "value": "6bfb0f570f5282c1df9e011bb6dab841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679221539, "uuid": "a01cf46d-1d47-423b-8383-b3a527c4d2a5", "comment": "Malware payload (Gafgyt)", "value": "e8d7192e8cfab7cc9c7eeac3aa07be67f7acaab5e0ad7dcd2fab905b4a9fd013", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679221539, "uuid": "e95e1607-1740-4353-b240-5aab0ea86fad", "comment": "Malware payload (Gafgyt)", "value": "e2cb860b2979e2109c383519020130ecb81923d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679221539, "uuid": "f64e99cf-6959-4d4b-8eaa-bf43a69dc1ab", "comment": "Malware payload (Gafgyt)", "value": "e258129b29b9f12713c4771187877bb534e2a51d4128de937a9a9b6a215a231ec3ff048fdcc3cc1ee7cd1eda41317064", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679221539, "uuid": "78e97a8e-0ed0-44ec-a4ac-db7903ae9713", "value": "T1D2A34A17B613C6BAC08787F41ADB9A314923B8BD1B236206B3D4BCF63F026A51D19F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679221539, "uuid": "69036fcc-c80f-4ba3-9023-a0e087de879f", "value": "3072:62RPcCPOkfQfNipGd6phaE/JVog99um2XFYZb0e:6I3fQ8rphaE/JVog99um2XFYZb0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679221539, "uuid": "aaffb7d9-381f-4f7c-a3a3-0db8f806ad90", "value": 102419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679221539, "uuid": "9e49071b-41f0-4712-acee-de2c3280451c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679221539, "uuid": "390a4783-4cbc-4946-ad5d-77e19a1d9b11", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1da0183-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212273, "uuid": "ea7d4135-d36f-414e-a2dc-d0dd516c6f74", "comment": "Malware payload (RedLineStealer)", "value": "869334e1ff38e72228a2d4d4475d2535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212273, "uuid": "87485ff3-bc88-4204-a4a6-0ed4c2680e53", "comment": "Malware payload (RedLineStealer)", "value": "e9b49d81ad95aad14c86775abae3c17621768dfd64390fd622ac8a3edb4bc7e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212273, "uuid": "6bccfbf3-79fa-4324-89ac-e628957ea97d", "comment": "Malware payload (RedLineStealer)", "value": "ec771f717f5ed50543fa8060125d81c274cc71fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212273, "uuid": "42c7439b-b8ee-432b-bd12-516a38f109b2", "comment": "Malware payload (RedLineStealer)", "value": "694732767fef66be7b687249030e425635596822c5f3ce26c3ebc983222ca2b3056bd56da3c7e482acef18f2cf576cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212273, "uuid": "b9a166d4-6db7-48a1-b511-4a1b837bc0de", "value": "T11845F11387E13D48E9668B739F2EC2E8BA0EF670DE49776532188B1B04B1176D163F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212273, "uuid": "df2eb0c6-0ada-4507-8d00-fefab64534b7", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212273, "uuid": "c9f2e608-d50b-47ea-b5cf-3d28cd136a18", "value": "24576:GiB6d7tVCYW2LVKiSPoFbZFCU7joh4H2glJNtiLNsHu0xvO:GigtVCYWKHJdHPlvtICO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212273, "uuid": "5106e347-3f17-4fad-8f87-e5083c46cb0d", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212273, "uuid": "55f212e8-250f-49bc-b95a-db6807d69a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212273, "uuid": "5f44820a-f13a-45c2-91a7-b570ce591145", "value": "869334e1ff38e72228a2d4d4475d2535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa813b21-c64d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679227373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227373, "uuid": "1a4072a3-5148-4b0d-bcd5-02932c83ab4d", "comment": "Malware payload (Mirai)", "value": "168f66f78d3c1f4bc84c21cd3940f4f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227373, "uuid": "1dd456f0-1750-4e75-be35-f81906faa466", "comment": "Malware payload (Mirai)", "value": "e9f8371cab01216a6ffa15ea1d90ec0d96a6e5f290a076d9df96e31ce9b6b20b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227373, "uuid": "6f032182-2f1f-4616-968f-e04c0d6477f7", "comment": "Malware payload (Mirai)", "value": "cf69144b85a69c3b7091fadab7594e0700a23265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679227373, "uuid": "fcf43169-6772-4adb-b090-3f5d1d470186", "comment": "Malware payload (Mirai)", "value": "31796c9609eac2c5bbaf0dc1ae50c1cf85d2941c8d09c7a75de07a0aa58a86b12217318eb92de6c215ca5b78ff80ce4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227373, "uuid": "6351f1c0-fd24-4dac-b286-247af28294c6", "value": "T169B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227373, "uuid": "9bca9f42-192b-4f84-9975-f334684dcac6", "value": "3072:pC/4rdZHsXsZwwR9gNk5mm/QcuLmHniPNb:pCwrvHwsZwY9gOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679227373, "uuid": "da03add4-0111-437e-af4a-e9434e85312d", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679227373, "uuid": "6bbbeedc-794a-4138-a8d0-3c6190738c28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679227373, "uuid": "ca9d4047-b811-4400-80cc-54edf2e04d3d", "value": "168f66f78d3c1f4bc84c21cd3940f4f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b83f3bd-c66e-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1679241253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241253, "uuid": "69016f8b-9948-4314-9f9a-4f1c39b882cc", "comment": "Malware payload (DanaBot)", "value": "60ef46f62c3b27f0ed5d812ba6598ef4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241253, "uuid": "9d09f8a3-4b22-4985-ab06-9082304b6790", "comment": "Malware payload (DanaBot)", "value": "ea0548ff7fce715749d06e5b01f434537d85fad2f3d7d89038e3f744660365ae", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241253, "uuid": "5226d033-262f-4317-86c4-e22e8ff7757e", "comment": "Malware payload (DanaBot)", "value": "48e4812f68c694f28a04199950a35071638d56f0", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679241253, "uuid": "3cfd144d-92f4-4b95-acfe-71f267c93b32", "comment": "Malware payload (DanaBot)", "value": "442a32abece7974dceabadec78146a99bab955606ff6a319f77a0f00aa15ee1866a9929a3a52ebbd877ec8467fa8eb1e", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241253, "uuid": "bebd31fe-c42d-4a1f-9218-a15cc973d9c0", "value": "T10ED5220393913D68E8654B738E1EC2F4FA1DB971EF4D777532189A2B14721B2C1B3AA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241253, "uuid": "5ede8723-0628-4cc1-8c9d-4e6ef3220a02", "value": "8b512f0a0b2cd54ff600ee8ace8b2bd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241253, "uuid": "ad20b84a-3f72-4aab-8d61-5b6e669e8d4d", "value": "49152:XnIZAylZG56uAltDeNNYUgnSbhidCFA7Wygu/APqPBboCupnFFIfY:XIvvGdAzyNNYTnyidCe7WDCAyPZduFFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679241253, "uuid": "8dfbedf7-7235-4ebc-9339-9defaedee9b8", "value": 2783232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679241253, "uuid": "4b7cd388-008e-4835-bba5-3e126a92fbea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679241253, "uuid": "b9f380b8-9c1b-493f-8717-bc825b3ae733", "value": "60ef46f62c3b27f0ed5d812ba6598ef4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d95085-c656-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231008, "uuid": "064340b1-1acf-4b65-8b08-80f21476da16", "comment": "Malware payload (Rhadamanthys)", "value": "2b40b109b333827c0bf1d1a1e3450f3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231008, "uuid": "0928604d-f925-4f03-a191-8be313f118ab", "comment": "Malware payload (Rhadamanthys)", "value": "ea334e6d6b8c953695cbdb56dd4d1ec6b2269bf241ea7084dc032595e5bca87b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231008, "uuid": "e2639277-36f9-4fff-adab-d66c2a7531db", "comment": "Malware payload (Rhadamanthys)", "value": "f1edb3f0e79968c76437c89e299637a340aafff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231008, "uuid": "938bec2a-8f41-4001-a3ca-cee2bf070340", "comment": "Malware payload (Rhadamanthys)", "value": "47e991446486fd4294aeb1b84359690994dd2054313404091ed87b6ee67f764623bdf1ecc488a8becdeca51f37d5e59e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231008, "uuid": "adc72231-0fa4-4314-bef8-554f61e874ed", "value": "T16C743A13F2E17C44E925CB769E2EC2EC771DF6509E49BB6D121DAA2B05B00B3C263719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231008, "uuid": "f6a7c486-a088-4e6c-a609-a65dc6b1ded9", "value": "41f83c8707be0871bf2bea8f993f5e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231008, "uuid": "48c493c0-ee48-413d-bc88-44565a63ae65", "value": "6144:Eu0LrsQpkJNv7q1Kcc8tFPi48SuGxssx7JzE/htrg:Eu0MIkLq1RFZ8SuHsVe/hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231008, "uuid": "61f07961-831f-4705-958c-6d3f44b03f1c", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231008, "uuid": "acda18b4-baf5-4037-aec6-f1d9fd5e1113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231008, "uuid": "a579811d-162c-49a0-87b8-5b67e66897e2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9419e3eb-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212598, "uuid": "6d9a2946-9a21-4b3b-9772-44c0f42e9bdd", "comment": "Malware payload (RedLineStealer)", "value": "cd2d9712d7cd945d26bba8ccfbe0d232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212598, "uuid": "2283ad8c-6e88-4dc3-bdab-4c179e730ca8", "comment": "Malware payload (RedLineStealer)", "value": "ea957db9441945bb39138bef3e0de824eb7f99adc37110db458f30fd6a1aee4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212598, "uuid": "eb508049-2c1b-40c2-bfd3-138112cf77eb", "comment": "Malware payload (RedLineStealer)", "value": "c014cfda0b9f15e3e922fed97a1dc3adc70ee2b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212598, "uuid": "a9d26955-9456-4e46-ab70-d8f5d77651ae", "comment": "Malware payload (RedLineStealer)", "value": "b78817491562cbd59050d5cc40fc332ff997d5a1190411b6a3824d6c9135e88171ddf094e3b80137447e99f404bcc9f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212598, "uuid": "33431ee5-02ea-453d-aea5-161d516511b7", "value": "T1F145F10392A17C49E9664B739E1EC2E8B71DF2F1DF5D7B653218DA2B04B11B2C163B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212598, "uuid": "2c9a4aa9-2e45-4bbc-ae58-0506a2d23806", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212598, "uuid": "a8daded4-84e1-4dc6-a977-72020b376803", "value": "24576:zdrxnnySqJxCY2MNaboMVEQxSrvmK9ch0dzt6Jub86X9mkR:zPnnoqdlbVvivmK9che6J48q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212598, "uuid": "6571ed48-14c2-4f5b-915b-15d46a9124bc", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212598, "uuid": "98116389-6894-4faf-bec3-adb16f87566c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212598, "uuid": "7262b216-7fdc-4902-9da8-1d66ac0a4026", "value": "cd2d9712d7cd945d26bba8ccfbe0d232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74445802-c619-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679204814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204814, "uuid": "a0f43ec6-ccbe-4be6-a322-e29e82888528", "comment": "Malware payload", "value": "92f7179a6449650efb95db473c1a387f", "object_relation": "md5", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204814, "uuid": "f0090d3e-d772-4b73-a64f-e2239d051021", "comment": "Malware payload", "value": "ebea18a2f0840080d033fb9eb3c54a91eb73f0138893e6c29eb7882bf74c1c30", "object_relation": "sha256", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204814, "uuid": "87468f67-5a67-4a9c-90a2-a9befd9a031c", "comment": "Malware payload", "value": "a164bbba7ba8c1c6c059e138773f0de7767c6e52", "object_relation": "sha1", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679204814, "uuid": "23887121-d6c9-4c16-82e8-afdf1f971538", "comment": "Malware payload", "value": "2b5d535a20b0670ee08f0ac61d77c016a83d9ff129551fa1f6ba72647a4cdc76e10e82fb44be0c0515bae4184bb80fb5", "object_relation": "sha3-384", "Tag": [ { "name": "7709", "colour": "#BCA6E7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204814, "uuid": "2b2743bf-3f1a-44a2-bc95-a5068f8a9eea", "value": "T14B53E1B58C434668E1B12836E90F9014072A72E142D9A82B5B5BF7E35178FE5FB71932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204814, "uuid": "bfe82e1e-694a-4d51-966b-7765158be624", "value": "1536:wRXhwRYQPo9MvJN3Ed56Cnuch/zWOj9HkzWvoCt:uhIM9MvJN3tCnuCzWwEKzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679204814, "uuid": "e6607c7f-3cde-40ab-a84a-a2df9405b024", "value": 66050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679204814, "uuid": "d7c160b1-2e3b-4491-b428-f62ebb37284a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679204814, "uuid": "d84784fc-99a3-4f67-9073-6fbd5abd39af", "value": "shellcode1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3283306-c673-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679243655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243655, "uuid": "c90cbc2b-f4e9-402a-8a86-5dcfb6c7e0d1", "comment": "Malware payload (LaplasClipper)", "value": "fb0deff37fe12bbc4f0c1fe21e2d15ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243655, "uuid": "1fe60017-1579-486b-a050-28f99e895605", "comment": "Malware payload (LaplasClipper)", "value": "ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243655, "uuid": "3e71bdb0-0f09-4b22-b028-72de8e528def", "comment": "Malware payload (LaplasClipper)", "value": "180325b8b6e64638e167601c67cd9c53331ba9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679243655, "uuid": "7325fe60-f9bb-4490-a42f-63c39a58d399", "comment": "Malware payload (LaplasClipper)", "value": "b7b5dffd04489690d604412e9c156df7a33fdbb7f9094fc6a2e695c92ae243ef48131f2cf0901acd7a4643a4ed4d4d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243655, "uuid": "7e428f46-6793-40ed-87d6-6e75398bf361", "value": "T1998623B3A9660204E4B2CC398527ECB432F60E7A6A427D7D54DDF9C129334A4F623D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243655, "uuid": "520b4be8-a058-422d-8d71-7729e5c4d784", "value": "f0e8db307701582115b12426e04e3928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243655, "uuid": "e00db402-dfc6-47fb-a91c-9e31fc8aa736", "value": "196608:bdj1WcTeKCVpVAKegYv6Pvz7xCVfQeYDprOtpN6x1Cd:RReKaAlRgxMfvihOwxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679243655, "uuid": "ea61f72b-3c37-4344-8bbf-18bf26f56843", "value": 7839744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679243655, "uuid": "462c3816-c95b-4251-87ac-0242b8f1552b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679243655, "uuid": "08b27040-b426-4dde-8963-4354d19a75fa", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1254260.13336.3751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4580bc40-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679224922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224922, "uuid": "fcf35d22-d922-424d-9856-5671607c4ffd", "comment": "Malware payload (RedLineStealer)", "value": "74d81c37f2d81150dad8659502fa33d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224922, "uuid": "2bb7cd34-8bf3-42c3-920b-868458f79e9b", "comment": "Malware payload (RedLineStealer)", "value": "edc6676b8a30b1fdad69f0ff35c15b8337c1578f9febe4be5ff68dd695926863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224922, "uuid": "1bb75ff1-c3b1-4b41-ae96-4c0fd3c225b1", "comment": "Malware payload (RedLineStealer)", "value": "b7d50e2b8b4b9830f506663ae4108c8cac415b70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224922, "uuid": "b9e08099-bf3a-4a63-acaa-6eefbb222a86", "comment": "Malware payload (RedLineStealer)", "value": "e6aeca2aa358368a078a233297b9297c544c7356a8ba913b430da279cc32bcf0f75d866f8a1d83175014de77862cc3b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224922, "uuid": "2d96dd7d-cdb1-4c15-b79b-d4c54f1d1d92", "value": "T1FD052312B6E8C472D8B917714DF756931F363E409F24832B3BC1A85F8C72598A9313A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224922, "uuid": "e81ac8fb-86a3-44d8-9106-992358f8653a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224922, "uuid": "03c3e6c6-a04b-4e08-9489-3ffc3f8e7758", "value": "12288:2Mr/y90NAn+CXep8op+QHB6kSor4Nu1gcMDQ58knUar8R+wM:py+A+EWbh6fEH15OQ+knUaa+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224922, "uuid": "34e3d27b-013e-484d-b255-1d0feee2679c", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224922, "uuid": "f940c342-4a99-43fc-bdbf-f6be41f49b4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224922, "uuid": "71e8577d-f567-48bb-8bd1-362e115e50b0", "value": "74d81c37f2d81150dad8659502fa33d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3655c65e-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226614, "uuid": "fabb1597-274c-4551-bebc-4e31041b11ea", "comment": "Malware payload (Mirai)", "value": "d97c7a8e5892e21d8a20e338c3e85a26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226614, "uuid": "59037587-4f1b-4cd2-8a22-554a578799ee", "comment": "Malware payload (Mirai)", "value": "edf532eb950e5fdbbb95d8717ba01de64a2411401b7c05e61a778307e87892a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226614, "uuid": "3fe15899-42d2-435d-8377-cceb08ea8194", "comment": "Malware payload (Mirai)", "value": "59203d1e40d21229f7f725273c439e0abcfc75f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226614, "uuid": "ea452fa6-a0a1-4ec8-8046-649afa1cfddc", "comment": "Malware payload (Mirai)", "value": "ec2ad866ab0f9a0f0d383cc02a3203b60b088bf4866e25903ed446dacc9d8b7ec1dbdee336809adaa2f98bc694faf77f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226614, "uuid": "c1e5792c-ddb0-4c4c-8016-32f36e4587f1", "value": "T168B39DABF2071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB5A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226614, "uuid": "328c07f9-e5e4-49df-a084-54bf3efb5d41", "value": "1536:Rg4uLcytbI96rfY2aye7tcOiyRLqlqOgb3a10Z/LWmoo:e4uLcytU967Y2JatcwRLqlqOgbWYqmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226614, "uuid": "f5b38a11-02cf-4615-be88-6ae9a87ddbd6", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226614, "uuid": "1ebee590-a71a-4581-8ce5-970c077dcd8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226614, "uuid": "5368a7fb-4d68-49f4-bdca-c8819cf7d0f0", "value": "d97c7a8e5892e21d8a20e338c3e85a26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c7bb80-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679213198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213198, "uuid": "854a53aa-dd23-4258-a588-f0cc83a42961", "comment": "Malware payload (RedLineStealer)", "value": "09bb3b0bd771b38e9eda0ab45937b9cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213198, "uuid": "08be0418-a7ae-4dd0-97f0-4eb273133ad7", "comment": "Malware payload (RedLineStealer)", "value": "ee386633957d14ea42193b072f32598814a4172af92b6b86637213b8ac43efdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213198, "uuid": "ff91b326-55fc-4eab-907c-5a6c1e210d26", "comment": "Malware payload (RedLineStealer)", "value": "4710bc0ab07f10668668bd4da88287c7592640cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213198, "uuid": "ca9fbd60-0684-4f97-8a52-852dfdb38372", "comment": "Malware payload (RedLineStealer)", "value": "8b3d9bce0e62ae08ca85dab071e83d984d2f3ce05f2a743fd4952593f5fce1ea1b62068b51faf230edda74fee0e2432e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213198, "uuid": "dde2b157-fec5-4fe8-b8ac-c154d37aab62", "value": "T17B45F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213198, "uuid": "99cc2f6c-c83d-4861-8914-3974f654d52c", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213198, "uuid": "81bbd144-e879-4086-9aae-4b32ce2b5390", "value": "24576:L1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:L1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679213198, "uuid": "1261ded7-9503-4a83-9db8-819827698b76", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679213198, "uuid": "f62e3953-3ba2-4c4d-a3f3-04112d248e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213198, "uuid": "dd836d59-a7c8-4a64-8d88-7cdd7463c1e7", "value": "09bb3b0bd771b38e9eda0ab45937b9cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f74bd7-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679218316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218316, "uuid": "aaed2880-27fb-4e2f-82fb-7b4f37162786", "comment": "Malware payload (RedLineStealer)", "value": "b01fe11ba51459db8b92f9fa2cfe0dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218316, "uuid": "85f08dd2-e37e-413c-ba3e-ced9d0f93a5c", "comment": "Malware payload (RedLineStealer)", "value": "ee6dfb2fb2ff6aeceef000fc97be7c17f5f0985464f2409908541f75e597d044", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218316, "uuid": "f6413a06-efc4-4afe-b703-cccbb733e677", "comment": "Malware payload (RedLineStealer)", "value": "724f8c2b66694582acf4479aaeff152741af7ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218316, "uuid": "3dbb687c-27f9-44c5-86fd-bb190cdb8a5c", "comment": "Malware payload (RedLineStealer)", "value": "d8bc98f99b0c3238b031ce6b34474e8044996f8b9857c3230e3d7b7e469248c7c0bf95a9fcc9c4a144631c3cf3c6e9a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218316, "uuid": "3cdc1383-4c58-454c-8ec0-d6304d18a4ce", "value": "T13A45F10393E17D48E5268B739E2EC2E8BB0DF170EF8977653218DA5B05B1172E163B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218316, "uuid": "d25eef62-c276-4914-8be3-0536b1cbd9c7", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218316, "uuid": "6d614b32-aa29-4de6-86c9-058e151899af", "value": "24576:3WksAUpYGbPrZhqNdhHkLPSPiBKo7LZvLtPY8GOCGRAR:3WkUYiPrXodq6qBLBJAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218316, "uuid": "3be5d167-99fd-41be-aee3-332051defa57", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218316, "uuid": "6867a461-f3df-460a-bdb0-812c01652270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218316, "uuid": "1e2af1c7-1dc8-4afa-97e5-7650803d6c12", "value": "b01fe11ba51459db8b92f9fa2cfe0dcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f96f4cf-c658-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679231784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231784, "uuid": "be0c8717-dcdf-4e77-af45-430c6aa2e5f7", "comment": "Malware payload (SnakeKeylogger)", "value": "828462b8837065cca215cb5e8c0d47b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231784, "uuid": "a902ba8c-1910-4413-b510-b0df6f17a251", "comment": "Malware payload (SnakeKeylogger)", "value": "ef211bfaef853190e1ff6800d966d09bd859b5c67ab738cb7399ab08a1f9ed10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231784, "uuid": "7b3d36cc-e7e0-4741-b302-b75e789113ae", "comment": "Malware payload (SnakeKeylogger)", "value": "a9ea44f575b067ae9daeedb434ad5eaede6c93e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231784, "uuid": "4163e2e1-edc0-4137-9f5c-cf5710f2ddba", "comment": "Malware payload (SnakeKeylogger)", "value": "5abed5fa75d5800eb77ab0183ee87526c09ebffb6c7e5600b13e250b8f6bd0dc336a6ab58638311e1234ee0f2e9209a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231784, "uuid": "6b4da48f-6345-44ac-a611-d3cc22845f11", "value": "T19105011CB71ADB61C67ECBFAA075245183F3981F2225E3985DCE64EA7B63F410201E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231784, "uuid": "136add97-8b87-4f22-a631-a36f1d4ea3c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231784, "uuid": "72ace521-3201-433f-abf4-6063b51dc3e2", "value": "24576:I7jkj+ME1cHRwu7upx5kb+MpkH31HkvrZhMwf:I7jkv8cuu7uprk7kHlkzMwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231784, "uuid": "8ed1ad40-f228-47bb-a874-3a0a951374d3", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231784, "uuid": "d988c407-33f9-4e46-a9f0-f3365764e064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231784, "uuid": "d5e6fcd3-496d-43de-9780-bec02c30c01f", "value": "Shipment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f963a6-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212274, "uuid": "ffee1e8d-cb52-41d0-aba3-0d03f3cf5795", "comment": "Malware payload (RedLineStealer)", "value": "86f187e4146143f421bd9b7b88899926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212274, "uuid": "4bfe38c1-a96c-4028-8285-e1f51a0429d8", "comment": "Malware payload (RedLineStealer)", "value": "ef3170313a5f975d800b0a577799a1e5851e3c31952fb003daea21faa7f56f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212274, "uuid": "7c5917c4-2a20-4fcb-aa07-0ad52642d540", "comment": "Malware payload (RedLineStealer)", "value": "218b4b6fb49e4b55c93b393dc20fd930a0431331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212274, "uuid": "ce7cfeb0-ec30-4168-9c69-1002e4b9b753", "comment": "Malware payload (RedLineStealer)", "value": "48c5d782ac410f15bc40a163db4f68b625c2d3b6f1edb62297ee2d3c3f2617e5ab87e6604ad691aa2f0d553c5f67bfd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212274, "uuid": "4051c58b-38be-4180-bf0f-0e91ec20733e", "value": "T17D45F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212274, "uuid": "5c536d5b-081f-4572-a07b-7dec6da11a0e", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212274, "uuid": "7d7fbc34-fe0f-40c6-a964-a87039e60838", "value": "24576:e1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:e1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212274, "uuid": "5b0fa6a4-19e9-4201-a9ea-bb3038e10813", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212274, "uuid": "3339194e-bd90-4e7a-aa1c-a38ded11f0eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212274, "uuid": "2c3014dc-f385-4ca3-b6b7-8237ee0630a0", "value": "86f187e4146143f421bd9b7b88899926.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91963205-c60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679200139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200139, "uuid": "536febee-84a2-4679-9bd4-96cae746059c", "comment": "Malware payload (Mirai)", "value": "502d229ce3644abf560eb8586bd6425c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200139, "uuid": "d6923f03-4fe9-45db-8fe6-cf449c6db09e", "comment": "Malware payload (Mirai)", "value": "efaeb8c8402be95a887b955286d246b2063111294f71addb4119f3041f1eddf5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200139, "uuid": "677d6bfd-b393-4d4c-85f6-0ed9e26c7ef2", "comment": "Malware payload (Mirai)", "value": "b52965cb682967d972a36901bd42db3570fa65d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679200139, "uuid": "43616899-79de-4d41-88f5-1f21d4904ae6", "comment": "Malware payload (Mirai)", "value": "a6439ab70b2d6fc1858ff37f82cf933b75d4c3ddacb063b83ca30ce19bd1f36ab9382b915d49a2cd6182e005d67d42ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200139, "uuid": "3a0f9e76-0a48-4854-854a-388104ce380b", "value": "T17D43F8C17881A626C7D05777FA6F018E33199798E0EA33578C295F907B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200139, "uuid": "b8ef9ed0-fab2-449b-80d1-46763f3bb8ee", "value": "768:C8R4EigtvAmiXdAzoUTQNkSOL9ec0m8oiJeU67F1Hbn3XmwmvTLwCVy/rCxHghWc:lDidvXdEsm8Ebnnm1ShWkB5tL2eoUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679200139, "uuid": "23c2316e-1bee-477d-b278-fbce4c9b946c", "value": 56596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679200139, "uuid": "97c5ebd7-da22-4b7f-a2da-73999c5c4cd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679200139, "uuid": "7a1a8855-0b50-4dcf-824b-59c02c1c718a", "value": "502d229ce3644abf560eb8586bd6425c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0559ec-c656-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679230889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230889, "uuid": "34794361-1ffa-48f5-9d14-4d5a971479ac", "comment": "Malware payload (Rhadamanthys)", "value": "03779a8230806e9ecf5ea8058919576b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230889, "uuid": "060e5418-888c-4052-8ca0-69cdb8be7d9f", "comment": "Malware payload (Rhadamanthys)", "value": "efe9e282c15c20206180a8a03f3e7149a10f0a3f68fc7c35fdcf3d15e4e3c8e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230889, "uuid": "bc822bf8-ad53-440c-aaa4-544919d8634b", "comment": "Malware payload (Rhadamanthys)", "value": "a87a1bc77d0c3dcdb8e5266b88c551edb34c0cbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230889, "uuid": "2678c886-9e84-40bd-b06f-865cea26b7a0", "comment": "Malware payload (Rhadamanthys)", "value": "69c8c24076777273530e26b1750d3e16d139623992d12c189d149af1780763aa40e9fc39133e311be8a083ecf7cd4252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230889, "uuid": "bbe5169e-2d8f-4cd3-8400-a7f7bceb04ef", "value": "T163743B83F2E17D44E925CB73DE2ECAE8761DF5509E49BB6D221CAA2F04B10F2C163615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230889, "uuid": "bdb624df-942c-4603-88e2-c3d6c52cc59a", "value": "41f83c8707be0871bf2bea8f993f5e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230889, "uuid": "fe92a7d3-06b7-4d4e-883c-8cb81fa7bb55", "value": "6144:GukLS7SbE+G7BS7ihsiDjAu/n2svE9hy:GukgKENSgAu/2sc9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230889, "uuid": "ac755bb4-bd11-4598-af40-a24300e51702", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230889, "uuid": "8bb4b684-7d14-49c7-a259-9226cb6f1435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230889, "uuid": "794c1892-2ad9-4d17-805b-5517928eb010", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487d9179-c655-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679230510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230510, "uuid": "9bd48dc0-284d-4530-b9b1-c69065dcc372", "comment": "Malware payload (Stop)", "value": "b474323b754230f052a4b650834ec40c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230510, "uuid": "f6e86605-71fe-4781-b80d-ada2e647b426", "comment": "Malware payload (Stop)", "value": "f0fee7303e943a55b74e19e10f23a0f433e8af720516e2488d19dc7fbfb447c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230510, "uuid": "08dedc16-68bb-491c-9f2e-389d11cd9af2", "comment": "Malware payload (Stop)", "value": "3d4881dc77d0b756af889d903c3d8ebd45fb4b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679230510, "uuid": "f635de60-d785-4add-b2fb-fc3a43ee18c3", "comment": "Malware payload (Stop)", "value": "424c3d55d90f8f1e6c444676d997f7caec047ecd1a3fe2222460345447579a7ac18a4b9c9b70019b6cef1f7a95991647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230510, "uuid": "31999d42-c2e3-4aa3-867c-d3e4773fc077", "value": "T1B805CF5396E13D58E9268B739F2EC2E9B70DF571DE893B6532188A1F14B0172C263F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230510, "uuid": "7d08e596-67e8-4c12-9abb-7bcaf93279b5", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230510, "uuid": "dc10847e-2210-4719-b528-03c648b90bcc", "value": "24576:8lfL0/4tBvr41APSkwYpACcp666JzOdfxl:8lQ/CBj41ezHcpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679230510, "uuid": "05d24dcd-eca1-409c-b048-7295d1be2bea", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679230510, "uuid": "7676ee89-87f9-448a-acb8-bc318deba3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679230510, "uuid": "539eef1e-fa80-452e-bffe-4ee7bbf229f8", "value": "software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c38c397-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212585, "uuid": "221cb8ab-bf23-4abc-8f3d-c820dd8932d7", "comment": "Malware payload (RedLineStealer)", "value": "c52eb4ac91e79e6c1a2c5f31b9b53b3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212585, "uuid": "02b834db-7f06-4906-88fd-a15fa087fdfa", "comment": "Malware payload (RedLineStealer)", "value": "f1b12d155c28e774f2745c793778a4a9c9b23cc0848a8f530e8824e315b8c19e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212585, "uuid": "24f91b49-365a-4178-8b63-220a97925ac0", "comment": "Malware payload (RedLineStealer)", "value": "d8f017b92022e29ee9778c34dd2fe31d943f3f1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212585, "uuid": "44feca71-60b3-440b-97e9-41c395443d75", "comment": "Malware payload (RedLineStealer)", "value": "0a9241eaacd984ee65f266d7bde13c34f6b001cfb478fe1c11bf20129f6cb1f4646d9c3a41d00e9a1362615c040720e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212585, "uuid": "8d3f2d29-d540-4fb2-8fdb-eb788462ac6a", "value": "T1A745F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212585, "uuid": "d9f8cbdf-cd09-403f-825e-c26fe7e7e1a5", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212585, "uuid": "933f790c-3845-440c-922a-9a23de7ae48d", "value": "12288:ExL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:KbXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212585, "uuid": "bc7959a7-3eea-4540-82d6-3a138b9ab2f0", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212585, "uuid": "a882810f-2ebf-48ba-aa28-8ca8ef67fb2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212585, "uuid": "9177755d-e107-4ebe-9927-9cada360b72e", "value": "c52eb4ac91e79e6c1a2c5f31b9b53b3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f6d907-c6a7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679265834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679265834, "uuid": "446bd755-4ff0-44c4-95b4-f62740b9e97a", "comment": "Malware payload", "value": "9e346695bbc4291bc769f98be9e6a5e9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679265834, "uuid": "4bb12290-1e9d-4286-b398-46106205cb0b", "comment": "Malware payload", "value": "f25f69c71066b18364cd405ae80048a8b615c4b0f2cc4cb51b916ef08ba246db", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679265834, "uuid": "da3c731f-e6be-461b-a3c9-8ff8471d6e81", "comment": "Malware payload", "value": "3396a0f6e6270e798fadae572d1a914ebbbcd944", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679265834, "uuid": "3b19a5dd-8a6e-4de3-bd2b-47394fdaddaa", "comment": "Malware payload", "value": "ecf8602408117b8547213d6ddb4353aba86d86ef3cc493e743f16e16b2380e1665924f4fa8af6b0af700a5d1da7b0e09", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679265834, "uuid": "d17f22c8-8fec-496f-9e45-ce51d2d3305f", "value": "T16DC32A54BACC74E042AA83238A1EDE2DA57745B19D4BC968012DD3C53BD3BE4DFF5888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679265834, "uuid": "b00ab094-2089-41cb-8152-88fde06daec9", "value": "1536:ytFYr16AwN5dh/CFK1rUBp2jH3p3mXjSVjPejWuSeZ7kZocYEpa4G2LJ0H/E+lua:QFYrQAwNLhbrUzJr9EQB1x3W9GHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679265834, "uuid": "1afae549-7a68-4ec9-8694-c8646faf72da", "value": 127035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679265834, "uuid": "8d7c1a89-c84a-496d-8702-88da46207879", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679265834, "uuid": "f423176c-f29c-4336-acef-b9808899b742", "value": "output1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61bf0ec-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679225218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225218, "uuid": "acd83b3d-b923-4566-9e19-68c07383ada7", "comment": "Malware payload (RedLineStealer)", "value": "eb0734706587d9148fafb254af106bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225218, "uuid": "96116eae-199e-4211-a912-7a7927deef31", "comment": "Malware payload (RedLineStealer)", "value": "f2958f14dac131c5f0215e035bd7991c8e79e1b019cd344aa5a79eb24e0b3016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225218, "uuid": "25c24794-0076-449a-b639-40b120ecc5c8", "comment": "Malware payload (RedLineStealer)", "value": "8b676b80acd796cb291a92534d72f9d660e6a242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225218, "uuid": "a78dc13b-2f10-4114-bb08-bd1bcc64a8da", "comment": "Malware payload (RedLineStealer)", "value": "08ac56dad33d49831237e620c4ba0f85f7a1d75d5e5a2fd50d68f9cc26fefcbaced23111c3e788d4aa02aef0df29eeb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225218, "uuid": "c3adfbb6-a63f-419f-8af5-baee461e48b4", "value": "T171352217BAD85472E5B5573419F206C72A333E919B3C935A329FDC9A08332B0E53636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225218, "uuid": "53c8a69c-2824-440a-90f0-7d02c33e9df2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225218, "uuid": "f2a80d3d-f323-48cd-b8a0-16d6e58177b0", "value": "24576:oyT1JQ42Uf7LLV/ADhobSPX417PNV6aCULU0KTAttHgUCWXq:vT1Ph/ACBfnCUJnHmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225218, "uuid": "9ecc0a8b-4695-4941-8dd9-0e9cdffded8c", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225218, "uuid": "ff271ea0-5928-4518-9721-8705b549b438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225218, "uuid": "d675f16a-0bfe-493c-8dc3-d9a194b46330", "value": "eb0734706587d9148fafb254af106bae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66af6d3-c699-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679259981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259981, "uuid": "41b2db7c-05dd-4e77-8512-564e00791b22", "comment": "Malware payload", "value": "a20abff4a6aad52009c71cb0beb46678", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259981, "uuid": "d313a950-44cc-4beb-bf28-b73f3d179d4f", "comment": "Malware payload", "value": "f2bfb921db4306e5a0d2a6ee1110d64e1c57afda2441288466ff6aecf23ccec6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259981, "uuid": "1f0d3395-ca3c-468d-ba07-185d81e48814", "comment": "Malware payload", "value": "05051d0f35698bab75bd0df1edb87d8fe30a1deb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679259981, "uuid": "287ee98f-cb81-44df-8cb6-8c1a9ee71e0f", "comment": "Malware payload", "value": "e8c33732d732a7127de96d7367a45df64b20114c879b6c401f2ced6d3f4f12a5d8968bb7bc7e43d4588246f7a926903b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259981, "uuid": "04c3164d-51f9-4445-9288-55f4d62a6496", "value": "T134B32901D5518B27C1D2277AFBAF425D37232B68979B33115A24BFF82BC279D1E3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259981, "uuid": "5460bc2d-0f2e-4e6c-8bff-12c5f2def8f8", "value": "3072:OaKh4ut9WuRg0WGGDa5SMXzfbmNQfPfXv4n:OaKh4uFWGGDobmNQfP/v4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679259981, "uuid": "3debf69c-e20a-484d-a014-4ccb2813187b", "value": 107843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679259981, "uuid": "b77c1f0d-5224-4ab3-80c2-ebd07a55f91e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679259981, "uuid": "f18c06e7-10bd-41d7-a30f-3c227e1615c3", "value": "a20abff4a6aad52009c71cb0beb46678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c41313e-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679224933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224933, "uuid": "b7a33f65-97a8-4b6e-9997-4f47c7f658f4", "comment": "Malware payload (Amadey)", "value": "af2709ee8742f5a5f3f6c72acd909c0d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224933, "uuid": "71519b73-2ea6-4b48-aecc-57976c2dc52d", "comment": "Malware payload (Amadey)", "value": "f2d99e7d3c59adf52afe0302b298c7d8ea023e9338c2870f74f11eaa0a332fc4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224933, "uuid": "20f5861a-5795-49ba-9972-a2046d1c2bdd", "comment": "Malware payload (Amadey)", "value": "123a8127d8f4c28fab018c7564856c6e72df9642", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679224933, "uuid": "4a8ec312-d1fe-4d2c-9e5f-05a9bfa75ead", "comment": "Malware payload (Amadey)", "value": "f8a8983df99ed1d65774efd790cf8a3a86ebe20b20f89e42c6436d5c6fa05a24b0a7d34b26ce5c14071586874538bdaa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224933, "uuid": "d7db0478-ff57-4e91-9512-5772d04b4f8e", "value": "T1F9252303EBFD8462D4B0177019FB47C70E357A609A38962F37AF9C5908729A4E27436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224933, "uuid": "972f4c13-19a6-4e86-8227-86d660ed147b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224933, "uuid": "ac3834d6-6ede-406e-9e2c-ba3889d986db", "value": "24576:FylAhR62PcG6kpyzSjJVW2F1ZdIs3VK6QcyxRcl:glUR62PcG6kLVW0IKVKdcyDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679224933, "uuid": "54fa79a6-7d33-44d9-b178-d58220d0c877", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679224933, "uuid": "840d52bd-d9ed-4e39-97b4-a49a06ded679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679224933, "uuid": "9458109c-c190-4753-884c-3af2e9b75cf2", "value": "af2709ee8742f5a5f3f6c72acd909c0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd755c1-c624-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679209553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209553, "uuid": "1e920425-3337-4ad0-97a4-21849f1628d6", "comment": "Malware payload (RedLineStealer)", "value": "cee31bd94570d023d96eb3835940523f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209553, "uuid": "0dbb79b4-6f5c-4840-ba3b-59b4db74fc2c", "comment": "Malware payload (RedLineStealer)", "value": "f30ebd520a37956b6d645ac1ca4a55ce455a3a168e7775533af90bdf1175502b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209553, "uuid": "8d10e0ca-fc39-4b04-a8f8-e3273d9e93e5", "comment": "Malware payload (RedLineStealer)", "value": "d1fc55dc671982cfa7fdb6f45bb135c902266735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679209553, "uuid": "563861c3-645b-412c-8793-c0c7632fbfca", "comment": "Malware payload (RedLineStealer)", "value": "d1048d4d6bc85b71b9dbef9edd5e703f83db3e1209674a5a4e31f52961b538a544b558bd8c4fdca4c66e9499ecf17a30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209553, "uuid": "73f34194-0a02-4dd5-8a6e-235983b5f833", "value": "T13045F15392913C58E9264BB39E1FC1E8B75DF671DF49776E32188E2B04B21B2C163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209553, "uuid": "6f50cab0-5908-4303-8e67-8dc7277ee115", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209553, "uuid": "8133c83a-0ee7-4dca-947c-a39c10308ec4", "value": "24576:fhVKo7S6ImQruXrQQMxCzSB9h7qIAtzq6orHFkhWW5lNNR:fHb7OubGlh7y8rl4pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679209553, "uuid": "52a010e0-0224-455a-98e2-e88cfd56020a", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679209553, "uuid": "ad408d2e-82cb-4912-bfdf-8321d91c202b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679209553, "uuid": "f7d46e7a-9e80-4e70-9653-0eee00e47251", "value": "cee31bd94570d023d96eb3835940523f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b359a7d-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679211241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211241, "uuid": "525c6c83-65b0-4ced-a027-d54b301ccc8d", "comment": "Malware payload", "value": "b86a3713474572ac7403183c452f3e96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211241, "uuid": "1cc93b69-461f-4fd6-8c57-a23f225b7fa5", "comment": "Malware payload", "value": "f44eec2bc8d7e0a2836facdf58e428c744c80b2a0b9be5d274cc40a8c35c867a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211241, "uuid": "96805bdf-d2b2-451a-9847-f674e268be5c", "comment": "Malware payload", "value": "01c05f6646539700cb50fc8f56459d5fd7bc4160", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211241, "uuid": "8221509f-fcb0-4e07-a168-5e08e0c4390a", "comment": "Malware payload", "value": "de24f320c6ba164ab684fe26b0562cd7d2ae4abd5d2a365a6db11688d6eb759d5b759024107ae5b60cc6f8218ff0f657", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211241, "uuid": "888a4a27-8bcf-4cdc-b68b-187f952bfe85", "value": "T1BFF2E1D9E59A8A41C4DA1179A10EB76F2839F02CD2555C5FB3A83027FF2CF056E2D293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211241, "uuid": "e2742f77-22b0-4efa-b854-9ac67de9f328", "value": "768:nFR+8o1tjWzWg5SwLQ+KysNRz3Jft18b7fAnI/yi9VtnbcuyD7UJLURe:nF48oTWqghkzygRz3Rt+b7II6etnouyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211241, "uuid": "302ebdf4-b747-4324-9b69-d018197f28ab", "value": 34880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211241, "uuid": "6f3cc4af-c867-49c4-abbb-b6e4500b4a04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211241, "uuid": "2673a873-4b7b-466f-911f-908e6d62d2e5", "value": "b86a3713474572ac7403183c452f3e96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6eb021-c62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212589, "uuid": "7e98f23b-245c-405e-be6f-0cbfe8b633c5", "comment": "Malware payload (RedLineStealer)", "value": "bc8222dd5ed1ee43b921a7244c8062d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212589, "uuid": "fecc8975-2f78-4a57-8eee-7c326280b4be", "comment": "Malware payload (RedLineStealer)", "value": "f51ee46e1a666af9fffb9b74f5290889e0b25a3872b7fbf0512541e565a53f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212589, "uuid": "d9ee9485-b35a-48b2-bd28-e32f04ce608c", "comment": "Malware payload (RedLineStealer)", "value": "86878b60c8ea08642e0d99bc75f830ac49f3e9a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212589, "uuid": "1cf9dae8-e8b6-487f-9560-3a4f0424cb02", "comment": "Malware payload (RedLineStealer)", "value": "b960a42f48a25a10a129a7974af3eea72add0401d1568fbfffdf5d3bb8e247f0dc867a0ff5f450abf6e9de2e1b256689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212589, "uuid": "cd98827e-c642-45ba-ad77-892663bd39e1", "value": "T12545F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212589, "uuid": "3053a082-aa31-412d-853b-d7bfb7fb1e56", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212589, "uuid": "b5b2fd74-00ab-4b1a-9792-0c492a225726", "value": "24576:uLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:Eko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212589, "uuid": "9586d8e5-3777-4fb9-9c1a-2e62f7d1194d", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212589, "uuid": "e2d04f02-9436-4b86-9e4d-0ccc410b21b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212589, "uuid": "e2d1ba22-69bf-455a-a31a-920ebb3049d5", "value": "bc8222dd5ed1ee43b921a7244c8062d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20325bb6-c62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211974, "uuid": "d56b0bd4-6e77-497e-9f03-aad088b0f842", "comment": "Malware payload (RedLineStealer)", "value": "90c70966e41cd0d52c682764b7b06d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211974, "uuid": "f8c9abc2-b4db-4232-894a-146830b5ffdb", "comment": "Malware payload (RedLineStealer)", "value": "f52fefdd265069a88b5527fdad556055196a12557e05a2e538718c81c1931843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211974, "uuid": "eb8843cf-fdf3-4295-ab2f-06c557cba4f8", "comment": "Malware payload (RedLineStealer)", "value": "3a1a6d5d356b046079188e8b2459824c9fca9095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211974, "uuid": "73f98f04-1e11-49dc-a6ed-e039252562fd", "comment": "Malware payload (RedLineStealer)", "value": "91306ae0cbffd32489ce7efa30925c665edf5a309b02408d0383c16eb733d7e474c0a5cff16b077d930e926a49ce667a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211974, "uuid": "4c77a2ee-358d-4af5-b325-f700f0a44cb4", "value": "T17E45F10392A17C49E9664B739E1EC2E8B71DF2F1DF5D7B653218DA2B04B11B2C163B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211974, "uuid": "b70be802-b17c-458e-bfb4-84163fbf437e", "value": "6585b9b9ad7d80299a944a8f7e11d434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211974, "uuid": "286840cf-9f82-48d5-883a-b6cde23f27e5", "value": "24576:+drxnnySqJxCY2MNaboMVEQxSrvmK9ch0dzt6Jub86X9mkR:+PnnoqdlbVvivmK9che6J48q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211974, "uuid": "ae07c2aa-3740-4e3c-93b0-4e383085860f", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211974, "uuid": "19e0e7de-84d2-4e36-b89c-9b55ccdf0773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211974, "uuid": "fc21c5b6-46b8-4f9d-b786-7647a4ea97f7", "value": "90c70966e41cd0d52c682764b7b06d38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1eecdd-c61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205690, "uuid": "a1defa77-aeb8-4fc8-95ff-37b6fb18a08d", "comment": "Malware payload (Mirai)", "value": "46f927388714d226a8fee72f385eb50a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205690, "uuid": "666f835a-d6a1-4d9a-9725-b766b6e625c5", "comment": "Malware payload (Mirai)", "value": "f6206a35cde04acbd252b7d9147acec5f22e02be73f7f0b0db256bfd61122dcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205690, "uuid": "95d2c75e-db68-4f28-b30a-c50921654084", "comment": "Malware payload (Mirai)", "value": "6a8f31350963e28b0440ce74322b217646c9b317", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205690, "uuid": "549d15db-bd7c-4cbd-9d78-1f63fa77150a", "comment": "Malware payload (Mirai)", "value": "f6e72e682be28b58281e6c0b8c3fca7008522133b0b4c19c4f3df885e898ecee8b480c0db93aa532a48aa1c08c9c523c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205690, "uuid": "74abd2b7-8b7a-4ab9-aa0c-4419ba99a510", "value": "T100D2E0B51B0B8BCEDEAAC8BAC3E413E019755E126903FD4AB0ACD7435B578C4A147DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205690, "uuid": "c58d57cb-a19d-4883-bf0b-29ff17dec184", "value": "768:qxMWBhAHuLegF1aF4NscfOl8liVjP4JgGlzDpbuR1Jy:qxdBGuLea19acfjlidgVJuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205690, "uuid": "9776a3e9-844f-4141-b565-b2ea72aba23e", "value": 29420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205690, "uuid": "b14aa92a-efd8-4051-a521-0b2cfd29e4bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205690, "uuid": "50ea367b-9676-4ba6-a5cb-f697c8ba3709", "value": "46f927388714d226a8fee72f385eb50a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432c1988-c64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679226636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226636, "uuid": "b584ef2c-47fd-4f4b-8c72-eaddfc7f35a5", "comment": "Malware payload (Mirai)", "value": "de39ddd1b8a3c2af3d886a668d849e7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226636, "uuid": "73abba06-3b4d-4c87-9db8-8d0d87315209", "comment": "Malware payload (Mirai)", "value": "f65f3a40d604050dae249c0d7b986dba0f6ba433115fb6111e69df212edb61e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226636, "uuid": "9245e5c4-b708-4344-aee7-e350bb06204b", "comment": "Malware payload (Mirai)", "value": "871cafa0e48e34b0548c8845139481abb33cbede", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679226636, "uuid": "e44374ce-5b80-463b-803e-c10847700a85", "comment": "Malware payload (Mirai)", "value": "07814149711f90a9487b4652e40176461fe49f2ba44354b33ebb6a3c14cf462c2f94a838b6286ccba38b4aa77b910dda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226636, "uuid": "5c06ccc6-d45c-4fe7-b71c-e660b158c01c", "value": "T17BB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226636, "uuid": "16969ec5-8eab-4e3a-8e35-419877dda40f", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZPoamm/QcuLB1niDNb:YuFX0GIk1MHyphAamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679226636, "uuid": "645c75ef-e78a-4519-b37c-b768e74081b8", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679226636, "uuid": "3e4ecdbd-2bd3-4b97-ace8-e80c648fb4d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679226636, "uuid": "74ebae86-6527-4a6e-9f81-180f786f8a15", "value": "de39ddd1b8a3c2af3d886a668d849e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc74845-c61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679205716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205716, "uuid": "87d6eff4-6abf-45b0-8b19-05ed723d7fc4", "comment": "Malware payload (Mirai)", "value": "2ce3e3d46ba51edda8fb0fbf4e030005", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205716, "uuid": "ef3eefb7-f0b2-4f92-b339-6673c0db3e9d", "comment": "Malware payload (Mirai)", "value": "f6a469be0210970e6c80f87d962055c40b1f24bf7c778e5389541cbff5cf1fcd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205716, "uuid": "ac85b01d-ff40-4b02-985a-1ccf7f9f08a3", "comment": "Malware payload (Mirai)", "value": "bbba8978292ee07433bb7bfe43e106019fff3eb9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679205716, "uuid": "eeb731e8-937e-468f-9a63-8ede4c79f682", "comment": "Malware payload (Mirai)", "value": "950fae987ce594dc5cc85b11b0b0aedf9dd2c5ef71e3443725de191ff99dfd464b8e54c5af87b3a1bbfd4f58f01c3391", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205716, "uuid": "8eaf137c-1723-46cc-b26e-e89080f03642", "value": "T129D2D1EBF2D7E4B0E5F584B9505C10C4E868236A5B3087FF089E52BE88632D51639F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205716, "uuid": "1f985b57-c37f-481f-9b88-40df8a6d40b1", "value": "768:kYSoXdJZtUjkFfNJlVrQeHvPx2csGHEbJSx0sA:kYJdJZGjkFV35/Mcr/tA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679205716, "uuid": "7174c027-5bb8-4b27-a971-76e4c85cc3da", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679205716, "uuid": "384a115d-90db-492c-8021-fed93e05a230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679205716, "uuid": "0f237b93-0e52-4eb1-8280-4eb3254286a9", "value": "2ce3e3d46ba51edda8fb0fbf4e030005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6826ce21-c63c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679219826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219826, "uuid": "80ae171a-cbb0-4460-9ebd-9ada10a7d41d", "comment": "Malware payload (Mirai)", "value": "fee7bbce8632b967d35bdbf813fb9767", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219826, "uuid": "5d99304b-7624-45f8-94c9-b5f97530dcb7", "comment": "Malware payload (Mirai)", "value": "f6be9bb1909fed0d4874c39efcf7a2eab260ec9de51dd4aed50c63082f35d63a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219826, "uuid": "94bdd531-ac55-415f-ab08-9e23143f2c29", "comment": "Malware payload (Mirai)", "value": "024f09a45bf8d5e4b029ff7afbed5d760f30a4d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219826, "uuid": "2681f21f-40e6-4818-b6a7-c29c1d270fb0", "comment": "Malware payload (Mirai)", "value": "e3e30fac5f59ac60f61ff252922ca456bbc10211ab0be7771721ca1d1dc3f6b558dac14dbac38150d86814ee824765d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219826, "uuid": "a5070e8f-2d7f-4805-9e78-861e38e805e9", "value": "T1F893A309BFA05EF7E8AFCC3345D92745288D555A21A83F79B930D928B21B24F16E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219826, "uuid": "5a708cdf-fc67-4e50-a783-f2d246cc863e", "value": "1536:a5DnSB+v5JjQm2b17xk49d6xZLu8vJ4TGo8S:a5TSB+v5JjQmG1GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679219826, "uuid": "321ddb59-ccd6-4d5b-8c2a-1b7399b7fd58", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679219826, "uuid": "1e5e2f89-0db7-4623-bbf2-d9dfbaa4d1f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219826, "uuid": "6942deb5-97d6-4e25-ba17-5d659caf1c15", "value": "fee7bbce8632b967d35bdbf813fb9767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f742b23c-c648-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679225220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225220, "uuid": "cd13d70d-3028-400a-8819-5bcf1904ce9d", "comment": "Malware payload (RedLineStealer)", "value": "d93ad8c87ee668a3cfd7859bb3a9dea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225220, "uuid": "ea0173a9-2742-40cb-bcb1-a40227b964fc", "comment": "Malware payload (RedLineStealer)", "value": "f720be4b399d63824d9dea7993ea8cd4fe0503d0a63ad079a99ff906c88f076e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225220, "uuid": "5e928109-7402-4406-afaf-be0915b8b56a", "comment": "Malware payload (RedLineStealer)", "value": "a80f9745d53ddeb8cc4cfd6edb7feff1336a7512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679225220, "uuid": "471e7312-ffe0-42b1-9eaf-0c140a71b1ab", "comment": "Malware payload (RedLineStealer)", "value": "a4ae72c993d269fa4d8d59914b28f709d4f840b01c9a245d2d21a30142194453e95a4d5520bbd4ba30b52eb3fa26a77d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225220, "uuid": "1574e265-799e-41a6-abfe-d392b13c8c13", "value": "T18545F14393E17D49EA164B739E1FC1E8B71EF671DE897F6931148A2B00B11B2C263B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225220, "uuid": "85fcd23f-8351-4c70-9255-a7914b6c15bc", "value": "322ed0186ab1b10915e176da453e7963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225220, "uuid": "4a1bdedc-3490-445e-8d87-5b45e66318e2", "value": "24576:l9h9DPt4hMaYTFBwZRvrtKJk5vZssiYQbrAfUPR:l/9D14dYTP85rtZ5TT4Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679225220, "uuid": "82638009-befc-492d-9441-8b2246a1cefc", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679225220, "uuid": "48ee252e-875b-4a3f-80aa-924400055031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679225220, "uuid": "9f3d3514-d491-4ca4-8db1-141c0926d246", "value": "d93ad8c87ee668a3cfd7859bb3a9dea8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a69d18f-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214112, "uuid": "ca6dcee4-b5c1-4a38-8840-19377feaaff7", "comment": "Malware payload (Mirai)", "value": "6591066dffb0e6cd6d9c9936ee6e4fb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214112, "uuid": "936e8e07-2ee8-4d77-afc9-c289d942903d", "comment": "Malware payload (Mirai)", "value": "f75267b407e7b24897317c2e008f91b498211bb0845cee72522194559c7cb15b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214112, "uuid": "4199a52c-e2a0-45d9-9732-bf5e914c24ab", "comment": "Malware payload (Mirai)", "value": "d9481850290a687b00ba0087f472ea6f31a3ef89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214112, "uuid": "b2662d49-338f-4b21-9442-b3c06265f3e2", "comment": "Malware payload (Mirai)", "value": "7d41e977014f82ae977906c1dccd1237b86b87461f1c58411d7076aef544fbac4d8c65a215cbd56f1ea873a39b7ed85b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214112, "uuid": "388fc571-fa0d-49d0-b4fa-6cfd93ad9421", "value": "T130834B81A641DAF3D1531AB612AF8B150632FA3A5E2BCEA7E71C3CF45F1058472227D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214112, "uuid": "1b4f7c17-1335-463e-98c6-01948abab79f", "value": "1536:fPL+6/2vwoUUIW/BwNPof2v8m0VMY/Do8h1qmZ5h3lE3i7she0QzUzJYQ2Wk:L+FcUtBwlM2vz0mY/ky5h3lEy7Ue0QzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214112, "uuid": "e2e0217f-4863-47e3-aa32-013a6f9aa161", "value": 87665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214112, "uuid": "16c330ca-c1c0-4b8b-84d2-2029fc028964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214112, "uuid": "4b6d7e70-11b2-45a8-a576-1b7aeb3d7310", "value": "6591066dffb0e6cd6d9c9936ee6e4fb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a4d6b4-c639-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679218611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218611, "uuid": "3a0f88b9-d467-42f2-8412-3f05c80593ac", "comment": "Malware payload (RedLineStealer)", "value": "198e06cde96fbe11df3ea77eed8e9c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218611, "uuid": "2710afb0-d0e4-48d0-8664-03eea69a855b", "comment": "Malware payload (RedLineStealer)", "value": "f7bed1745b3b369bd5d26409a351532cfa7352415ff6055c4f1dd442d6cacc4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218611, "uuid": "fd628692-1855-43b9-9479-ac63a3c77211", "comment": "Malware payload (RedLineStealer)", "value": "3245a8c00011fea6b5643e638779c2c45d63db6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218611, "uuid": "e8ef6d2d-fce0-4dd3-b9e9-f5aa40e6856f", "comment": "Malware payload (RedLineStealer)", "value": "afbe5b1af08e49a1db2fffc3f728927a859345aa0ddf3df519d89b234a7c5ec3f2a3ea603d837a4beb4caf176ed2cb6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218611, "uuid": "bf1e008a-c6cf-45fa-a3b3-c1c4151b5976", "value": "T1DC45F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218611, "uuid": "0e6e03b0-fc9c-46fb-b6a2-c815f2b74f46", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218611, "uuid": "7277e3d8-a1e4-4671-9e15-0d4bbf8a279d", "value": "12288:gxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:2bXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218611, "uuid": "4c0c1fe5-00d8-4ea2-a643-c7a982eb0a55", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218611, "uuid": "d398eccb-f5fb-4aab-8f70-a644ea4e79f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218611, "uuid": "c6ea9e0c-1976-46aa-9f73-cff42656aae2", "value": "198e06cde96fbe11df3ea77eed8e9c41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac028b9d-c628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679211350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211350, "uuid": "daeb930a-c4f0-4282-9af8-68fb22749c89", "comment": "Malware payload (RedLineStealer)", "value": "0329a2b4d64a1513a321eab640283ba1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211350, "uuid": "ee2ed7b6-1775-49e4-a572-61e9df86310d", "comment": "Malware payload (RedLineStealer)", "value": "f895103e0d1e1267078f229e01b3d7126a6e5b922dceb6c4fc45e16f23415118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211350, "uuid": "e63adda3-6a6f-428c-9fc8-0d19997d7d26", "comment": "Malware payload (RedLineStealer)", "value": "1c857ac402025bde0d9daf1d53a0d0eb47381608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679211350, "uuid": "7141e21c-b452-4929-9d9f-362fe3ef6894", "comment": "Malware payload (RedLineStealer)", "value": "d628fef434b27c18e75cf2e68cb22649230255b3cd496b2e172402718cfd58c6973db03ca8e699b49b0aaa1550962aa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211350, "uuid": "014a78ce-6abf-4e69-b905-770519445d44", "value": "T14D45F10392E13E68E9278B739F1FC2D8B75DF2719E997B6931199A2B04B0172C173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211350, "uuid": "c887ed42-f49c-4fa2-9868-32af4db23506", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211350, "uuid": "434842b3-988f-4652-8af9-7639b631c497", "value": "12288:SxL48EidugdwP24A/fg6PRj8l8clbzTvvryMsgj50gzKIO0e5Uk7gsUlMhXocWFF:0bXa+Ik81vqYOyhMhWypjrY6PjnErD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679211350, "uuid": "e355b397-2fb3-443d-9e31-31bfcabaff9e", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679211350, "uuid": "f2dddecd-e7dd-41bb-8642-f84a5247247d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679211350, "uuid": "554ac242-10d8-4fee-8694-eea91d3f11bb", "value": "0329a2b4d64a1513a321eab640283ba1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a5ada0-c692-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679256911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256911, "uuid": "bfc774b6-9db3-44ce-b2b4-40a080f96568", "comment": "Malware payload (Amadey)", "value": "163aa44b6d872f21bb6b0067e451b303", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256911, "uuid": "e158ce6f-5d8b-422c-9c52-aa6f5f76a9a4", "comment": "Malware payload (Amadey)", "value": "f94af74455b29a7c4073a0c2974e9a1d22bf28aeb3dc7338d34e1ed5b771e25d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256911, "uuid": "9019aa51-97c3-4e1f-8ed8-e6f74f95681c", "comment": "Malware payload (Amadey)", "value": "c9b6f0bbf586df36632df19b6fdcf8a238329dd5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679256911, "uuid": "9c8240cf-1f3a-41e5-a92d-5163e42db248", "comment": "Malware payload (Amadey)", "value": "eeff7260ae16f5ed79d29ac1f065b255f5dfe6978b3e9b8def484f3bb95afe558727285d10f29dde7f6c8ba943a71f86", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256911, "uuid": "ecf0a950-e5a7-4804-9479-e113998c5931", "value": "T180540A43F3A57E44E965CB329E2FD2E87A1DF5509F49BF6D221CAA3B04B0072C263615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256911, "uuid": "85fa38ed-10cb-4911-9be7-971cf1c9ef38", "value": "c901cf1b33a79cac7fcfec57ffb66976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256911, "uuid": "a3e203a1-50a5-409d-8e49-e1c9d5ee99b3", "value": "3072:8D1HOX9LWDdEuJKEBxHrU3Skp8gxzdbTdu5nbriJhxE:BX9LWDyuJKEBxLU3SE8g1dbxgvMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679256911, "uuid": "807c0df9-5f44-448c-bb55-3bbf41f3b8e3", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679256911, "uuid": "49b5774b-ad15-450f-869a-19b23150737d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679256911, "uuid": "bc88d913-fd2c-4a3e-9cef-d105ad847f0a", "value": "163aa44b6d872f21bb6b0067e451b303.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac60f3e3-c66b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679240127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240127, "uuid": "2d6840f8-c891-4ed6-b592-fdb7d7d756ce", "comment": "Malware payload", "value": "1fa21564b4463aa7a564a20fa00dafba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240127, "uuid": "7cff1921-8861-4b95-b13c-4a7ff4bc4f96", "comment": "Malware payload", "value": "f9c21532868a2cd3cbeaa22f92c237cb73bff27d73fc49716d81c89eedb72be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240127, "uuid": "767d0a6d-6fdd-46f8-b9db-14dcc3952d34", "comment": "Malware payload", "value": "44d44ad94ede70ae8bdf75ea18660911f5a22915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679240127, "uuid": "db3b2007-22e7-447b-a7ad-4feec6b970ed", "comment": "Malware payload", "value": "fe27df29250e4e449038ec51e201bd28a48739f607214d80f0193247ed8022e37bb05b97ad59aa953a2b2d5f2adafd81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240127, "uuid": "a3d46a1d-098a-4662-8471-02d8edaa2445", "value": "T1F2E65B07F89191E5C4EDD170CA269262BA303C495F3067D73B20F6B92F36BE46A7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240127, "uuid": "13fac9c7-d572-4218-bdf6-0c5aed66bdfd", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240127, "uuid": "bebe0388-3518-42ac-91c2-2c8e5d73c24a", "value": "98304:Z8orC0paqIwP+g/pkrubbwibwHyEe/4/I3eFTF:CExaqvP+0pkruwKw/P/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679240127, "uuid": "44993f95-9950-452f-9ec3-d2bdeb3f27ba", "value": 14546944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679240127, "uuid": "42c2e333-d9d3-4eab-ab63-86a1be970621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679240127, "uuid": "1cebb55e-ea86-4abc-abea-c3f296ed83c1", "value": "1fa21564b4463aa7a564a20fa00dafba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fe4c5c-c6a7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679265666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679265666, "uuid": "8849392f-d7f1-4485-898f-aeae95a20f8c", "comment": "Malware payload", "value": "88976fa95d5f638343755c86067550b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679265666, "uuid": "87e7a989-d025-4b8f-bc90-cc40b5c60364", "comment": "Malware payload", "value": "fa2c8289fb1a7c26774c74f39391df7a68c06f7b2e1aba9f722d8b30fcc5be97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679265666, "uuid": "74bb3a39-d043-4688-96f9-ab1073a25604", "comment": "Malware payload", "value": "9d83f005173bd672087d2bd2be9a9533fa97ce75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679265666, "uuid": "e53ba5be-c704-4055-a5d2-bb7fc144257e", "comment": "Malware payload", "value": "aca6704521c52fd9b4017d03ad0f50465e160bbaa815def0d9792e9b9ae891420e226086be642c9f827f4930988acf9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679265666, "uuid": "880447ea-61db-44b4-a9c4-bf27e1b28aef", "value": "T170441A13F2A1BC55EA26CB329E1EC5E8771DF5909F49AF6D221CEA3B04701B1D263712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679265666, "uuid": "93591db0-2cca-41a7-85d2-6687f9e7f09c", "value": "ae82d5b35631960d283d8dec4bb8f292", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679265666, "uuid": "d136f173-5eff-4dbf-bb51-5b802b717543", "value": "3072:/DqCDXwLvmHW2oUb1rml9dhYx06u7SaM8HTKtzWvl53brYsejg:LDXwLvPLgRmDspWSaHFvYsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679265666, "uuid": "7387bfd8-cc15-4db9-9b90-bf6122b83a13", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679265666, "uuid": "cf591bfa-e628-48a2-bdb9-e2d1e7a20e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679265666, "uuid": "77ff2d1a-44df-4d40-a138-acf03051e9e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ab9b09-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679213197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213197, "uuid": "e3e58b12-da45-4111-9ec8-be4e430e25f6", "comment": "Malware payload (RedLineStealer)", "value": "65eecb1a848dba81d2defc63a8b547fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213197, "uuid": "ef03e847-e2f4-4f2e-a895-b2678ae1e445", "comment": "Malware payload (RedLineStealer)", "value": "fb5bc73cc0e4502572e2c6bf6d7e05b14d5c47c5b912529d87f6929b472e1f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213197, "uuid": "26e4448c-fa51-405d-8339-ec624c9318e6", "comment": "Malware payload (RedLineStealer)", "value": "62f673160935fa3e2c33d51212fbc507a60c82ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213197, "uuid": "c828a789-e3f1-491b-aeba-e116573516da", "comment": "Malware payload (RedLineStealer)", "value": "7477d6ae31fc363924d0ba6f1b48a555e2401efb3d63adcc6c9f9461204126ce3d92377e9ac50ae39da84e08e5bc17b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213197, "uuid": "40ab8f24-5ceb-43d7-9203-8ca789a5105c", "value": "T15445F14382E27D48F9268B739E1EC2E8B70DF670DE997B653218DA2F0075176C363A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213197, "uuid": "8fe610ce-3cf3-4ac4-82bf-355c6af01008", "value": "9c97db954c6eab8dfde4a4fd207d98cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213197, "uuid": "f9c3a6b6-5a42-4726-8adf-6e5039d7be0b", "value": "24576:z1F4VX4ZsIETa80JWFst9LqGfEBz9terTMH9MbMx9upUenl6O:z1FWWbETahMszqGfu0rYHqbMxQpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679213197, "uuid": "c17ae10f-219c-47e5-b858-ebb28b58d3fe", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679213197, "uuid": "37a54989-3913-40e5-a8fb-c2db535cc2ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213197, "uuid": "fa7be7a5-906f-4b4a-ad21-ea2044aa022a", "value": "65eecb1a848dba81d2defc63a8b547fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828bc9ca-c657-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679231467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231467, "uuid": "6516ecec-301b-4f47-8e5b-64e3ae0360c1", "comment": "Malware payload (Rhadamanthys)", "value": "8370a8c2dc388ea4175e3bf0dcb00704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231467, "uuid": "df35ad28-40b6-4217-8a22-bc2617a29266", "comment": "Malware payload (Rhadamanthys)", "value": "fc401d355f39f22ab963ee61d46f38d91a31e5614bb20c82ec6ac1e9b25f300b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231467, "uuid": "14ecd0a1-3515-4d8c-8ddc-36122fb4eb0c", "comment": "Malware payload (Rhadamanthys)", "value": "a41ae8b24fcfe9a866d3a7f334039bc7a1b5b6a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679231467, "uuid": "cd9023ec-e31c-4581-9e2a-bdeaafd1472f", "comment": "Malware payload (Rhadamanthys)", "value": "975d1e54ca01c2b630ce1497b1f05b2031b81ea87a2f9b08a8856e5483e798c92c972b1b6d5d88ff6970fc58dfbcfedc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231467, "uuid": "d6bba5dc-f6ca-4539-80d1-0a9c9e06fa74", "value": "T160743B0393E17D49ED264B739E2FC2E8B74EF671DE49776932189A2B04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231467, "uuid": "edf9714a-3ba8-46b6-a0ac-1a9035e226b0", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231467, "uuid": "a6cb6d10-7363-48ee-9fc2-3b5245f08bdd", "value": "6144:4uBLOxIzv0kjecTQJCp8UHh1qqCNa48+L:4uBKSeYQ/UHSrP8+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679231467, "uuid": "2ce515bf-17d9-42e0-924a-998859ce0456", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679231467, "uuid": "1ef58e45-a84e-424d-a629-699f199fbdd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679231467, "uuid": "1613f093-4026-45f4-af3e-dd1674716312", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3154086e-c694-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679257530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257530, "uuid": "123011e9-66e6-413f-9043-c5618cbf9704", "comment": "Malware payload (Mirai)", "value": "ce38cbd5087d342083411c454c323de0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257530, "uuid": "657ee42b-847e-4d88-9ca1-843013db1ed5", "comment": "Malware payload (Mirai)", "value": "fcca45d65542e191650bd3b986e40fa2ae22963c6ad171dcac2faa850040c035", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257530, "uuid": "89c8c566-7c07-441f-a911-7c72d1eb443f", "comment": "Malware payload (Mirai)", "value": "51f3e7a27677da6f989e76fcd04bff999dddbcd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679257530, "uuid": "76827589-c029-4799-bf71-720e0e153024", "comment": "Malware payload (Mirai)", "value": "766824db6e1862dc1ff2272d443af742705c854016aef60f1fa5f2fe10d3ea38a6961df1da3958f353472353da03b38c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257530, "uuid": "bd524b55-7657-4602-9988-5fe764f0393d", "value": "T16A53021876E768B0DE717C75AD778C436BDAC3BC927C350DA97313382DBD4960A68142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257530, "uuid": "9c8e9432-b58d-4658-992d-9e7067d40950", "value": "1536:G8PjpgB8BBiAnejBvmRcsemaKZLI+5okTdhOEdC:hpkAnejBvWxDZL759r5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679257530, "uuid": "05abcfc2-d37b-4cb3-867a-1eb2dd67ffc1", "value": 64688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679257530, "uuid": "dda93f28-568a-4563-9934-eef7eab49c32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679257530, "uuid": "d13ecc4b-47cc-4f84-938a-d4bae58bdf55", "value": "bok.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d431f82-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214090, "uuid": "2015c86c-fa6f-4574-82bf-aeaaca08a933", "comment": "Malware payload (Mirai)", "value": "379a359adf09bb2f777f653d6f299198", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214090, "uuid": "de8a26ec-ef5f-4302-9642-1c99a87866e9", "comment": "Malware payload (Mirai)", "value": "fd4aaf7c8b397ba777b11d198b52a6a3a47a884eefe38ff0fef710324725466b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214090, "uuid": "4cab1d61-fbc4-479a-b8dd-90ea16799da5", "comment": "Malware payload (Mirai)", "value": "c981fd1cc2c12088119f456e97ce19d4c0088bbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214090, "uuid": "56cda9bf-2b47-442c-ad98-ab5a03a11a4c", "comment": "Malware payload (Mirai)", "value": "283b02d8a06a7f5b5f2d70179bc445f42203779230cb56d92b08818909cbb98244c898802ec97adf6af5837dab3ad115", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214090, "uuid": "61a560b3-9e59-45bf-aae5-c5e800eb0beb", "value": "T1EEB32893F901DEA6F40AEA7605D74721B230FBA60E531A7273573966EE362C43427F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214090, "uuid": "618a7fdf-f412-4033-b252-b5848474a3b0", "value": "3072:YpP/O9W21dMUbkJBsmy1fWJ3AJjYmFZ09DRAoQfgm:YpPm9W21CzBsmy1OJ3AZYmFZ09DRAoQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214090, "uuid": "998b06d2-6977-4a6c-8580-3077c79f7a5b", "value": 109130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214090, "uuid": "7ec66ef1-609c-4400-9096-8b80970e01c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214090, "uuid": "7fc7407d-cf48-444b-b573-b88f8d77fefb", "value": "379a359adf09bb2f777f653d6f299198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03acfb50-c62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679214074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214074, "uuid": "1afbeba2-f045-4ecf-b002-16cfca0d54ca", "comment": "Malware payload (Mirai)", "value": "18d3ad934dc490b37154faee89035b9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214074, "uuid": "afe8fe2a-6dbd-48ea-b364-8961737af9d8", "comment": "Malware payload (Mirai)", "value": "fd646492cf93277eaf0e250f170c099e9b2e6f820b9e37be69fb891875ba2cef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214074, "uuid": "69331de5-692a-4f93-8037-4834b8fae3b4", "comment": "Malware payload (Mirai)", "value": "ae547958ff34415af3a2e4dac665c92dfe22f462", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679214074, "uuid": "a23fb270-8026-4bfc-9acb-ee26c00cfde3", "comment": "Malware payload (Mirai)", "value": "0f0be3fd10403be3b4f46915456ea77352e428e08d9fea4f9f54940158746d786ddfcae926e314995f83b8c5c91f6a8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214074, "uuid": "a2a4840c-c595-4ba1-9278-12e3e24088e3", "value": "T1F1B31905FC004B63C6D26BBBF79B428D77366659ABD733016A297EF02BC17982E39150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214074, "uuid": "c496b2b3-f0ba-4f00-a672-7cebaccc6174", "value": "3072:UhDQ1qlYQInoRyOkEbDzCO1N5Q5h1mb5NH6IEnyi7YHQQ/hVOmAD3m:uXDzz35Q5h1mb5hi7YHQQ/hVOmAD3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679214074, "uuid": "7735ea1c-0cbb-4549-aed2-c58eb7ecb2da", "value": 116037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679214074, "uuid": "25b0e943-248c-4608-bf24-cfc1036eab0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679214074, "uuid": "ab3593f7-3425-44a8-8f68-6677baa483c9", "value": "18d3ad934dc490b37154faee89035b9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c43593c-c62c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679212907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212907, "uuid": "85df558f-4922-4fbb-9625-9ef5399f698d", "comment": "Malware payload (RedLineStealer)", "value": "f1a1b37d49a18834d8f6f0f149d8bea7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212907, "uuid": "0957a211-4a45-41cf-b78d-994ec83ac807", "comment": "Malware payload (RedLineStealer)", "value": "fe357a7c3dde1ea765fca25dd9ad0b027293a077b73c34357dda8a00aae070db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212907, "uuid": "9150c107-f741-4913-a46e-8bc9667d2d01", "comment": "Malware payload (RedLineStealer)", "value": "6d281f159d4a912483bdccb3919ebff6a639516f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679212907, "uuid": "994e16d8-d2df-49c6-86f1-357524c74854", "comment": "Malware payload (RedLineStealer)", "value": "f735f57e8977e1ad4b6751d37cecf31382f513c6546c874f7fb9274a61e6b2c3ddb2a961d30e1e2067c20a2355774dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212907, "uuid": "c42a04e3-6d5d-4ab6-aa7b-7a1b296ce59f", "value": "T1D045F11396E13D58F5264B739F1EC2E8BB0DF6B2DE89776432199A2F04B0172D163B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212907, "uuid": "a4af39b9-7a9e-4ea8-8113-d301a067250f", "value": "d5555405ac36a198d312d7dfaf56a1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212907, "uuid": "fb72a59a-704a-4e48-9cd0-aeeb37d1269c", "value": "24576:oLdkRpGh0fHRQSSbvuODeV8CBrRiO4rTdTlJr/fYO:6ko0vRzSPDARizTlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679212907, "uuid": "826f3912-7785-46be-bac5-fb1a7c427283", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679212907, "uuid": "c9b5d9cb-d039-4599-ad50-c99e5eaf7354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679212907, "uuid": "2e4d41f2-08c5-4a7a-8aa6-69b9cd407621", "value": "f1a1b37d49a18834d8f6f0f149d8bea7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ed1bf5-c63c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679219816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219816, "uuid": "65df0419-5a80-4c0f-b832-09f131f78428", "comment": "Malware payload (Mirai)", "value": "ce98de6ede9562a3ff59fc3d9af2da00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219816, "uuid": "c2ca0be7-b0ed-4bae-bdda-0bf90be06a60", "comment": "Malware payload (Mirai)", "value": "fef267138e25aab5ad74ae3fa03f8acee9496d28bd9ef3f48f151931e7ad66f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219816, "uuid": "f9ad7540-566c-454c-a16b-11db8df1d5f7", "comment": "Malware payload (Mirai)", "value": "d4594ed9e2e79939d6c8c296d05c98a08f235ecd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679219816, "uuid": "0867cf63-63d5-4e4d-8a6c-769d1982d9d1", "comment": "Malware payload (Mirai)", "value": "a00e67ed604e1f7b5f2abf796058df327dbfe2a651ede41f6ae8b72fcb3b353d397f213bf0575f12631bdd09e93922b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219816, "uuid": "fdb834df-8eaf-4eb3-90c4-96245e1d98f3", "value": "T11453AE63C4641DA4C1544AB0B9288FB61763E60087633FF5426ACBA99057EFCF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219816, "uuid": "0f0a8109-b695-43d2-8f59-c87f22ca13d3", "value": "1536:oagv1AOp/umClcqse6yYGsYh4USijKmR7GrxhCKkdV8:ox11KmqsNI47iGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679219816, "uuid": "b428a175-657b-458d-9bdf-6db668bd25f1", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679219816, "uuid": "61c383cb-d59c-4cf7-848f-b9057452257c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679219816, "uuid": "644f6fad-f7bf-4751-b650-071537063126", "value": "ce98de6ede9562a3ff59fc3d9af2da00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364240ee-c62d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679213300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213300, "uuid": "cebb00b3-f8a4-4fcd-900e-a4f4b5651119", "comment": "Malware payload", "value": "98384c775d89c7004102a744de17c942", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213300, "uuid": "30ba8780-0f1c-403b-bd04-f55e156510ab", "comment": "Malware payload", "value": "ff79c54a78fe3d16dea2b1ec728c5a7978e36d8ff7bd16710575f79113ad4477", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213300, "uuid": "31723ce4-c257-4f27-b652-0c9c9c54b9e8", "comment": "Malware payload", "value": "98a5307679d5f9c964b168486bc9f2ecedcd9a87", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679213300, "uuid": "29ed98ce-388c-4810-9930-4db40df94be7", "comment": "Malware payload", "value": "f117abe4902992da582139f686ef61b0c999153bc6ee8f33d4f8fded074fa6f78caf32c711b1d051441180f2b997d292", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213300, "uuid": "f443989c-0642-4c17-b604-8884f3d6024c", "value": "T1D8B39E0338409432C8E7D87834FCA6E2567DA92117D9D98B73AC39AF5F172E1176836E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213300, "uuid": "e62efa0e-ae88-430f-96eb-729ee5d7c88f", "value": "eb34989b8fe3c43ef88d833129f3453a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213300, "uuid": "d08a415d-4286-4631-a615-0f2d55dfac1a", "value": "1536:YwmSM5I1i6RltCM1Dkae5+0nayQEjoLG/SrwCRyeIgRUoBolOvgwl7VeVPxB:xE8Pt2+0ayQ0Yp7RyerJoOvgwlxIxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679213300, "uuid": "b97fdfe4-d502-4e3e-b80b-cf96385b00e2", "value": 116728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679213300, "uuid": "8950975f-ea7d-475f-bd35-b559db49a3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679213300, "uuid": "35034653-2a85-48fa-b08d-5b6fb03aa7ea", "value": "98384c775d89c7004102a744de17c942.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e639cf96-c638-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679218320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218320, "uuid": "9258d63c-ebd1-4ea2-a78f-a7b7b4118ca1", "comment": "Malware payload (RedLineStealer)", "value": "ea01e5fdbc241d39bfcac4181f4e692c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218320, "uuid": "0c832a57-eb21-4db7-98da-797a48154d5a", "comment": "Malware payload (RedLineStealer)", "value": "fff809cd3075c9bda09d88d912f2e60db884a36bf7fe0e7e1a94917e0b616225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218320, "uuid": "f7afdcb7-6e23-4dde-8584-51374cdd337b", "comment": "Malware payload (RedLineStealer)", "value": "4234c3a88ddc4157b298729bf38a30ab542b85ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679218320, "uuid": "126e4c28-14cd-4d43-bb03-a333d39a0296", "comment": "Malware payload (RedLineStealer)", "value": "98ca18a447ef0554accc7220ecb6e7c9956741e65f8c26d22b6e52288d5058c77018435995d3e3b7aa35971bb5c2b6c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218320, "uuid": "581953ab-4015-4cc1-90f9-2305ae21aba5", "value": "T196051207E6F89532D87017714DF603C31932BD919A3483AB239FAD5F18A26A4F236767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218320, "uuid": "04c63797-afbe-4629-8534-a0b71881ec4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218320, "uuid": "66379818-9144-48f6-9957-d3e664bfa11d", "value": "24576:eyCZffFqOxEoAwDQ1agjVkAg3vDhJZvz:tifFp3Ao8aAmJ3vDbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679218320, "uuid": "f83de90d-bf06-4439-bf91-9557c9cdd7f4", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679218320, "uuid": "aa99f134-4c78-4851-abfa-fdd2ba4038e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679218320, "uuid": "2689db13-6568-4cc5-86da-3a33f10cf0ee", "value": "ea01e5fdbc241d39bfcac4181f4e692c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }