{ "Event": { "published": true, "date": "2021-12-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-19", "timestamp": 1639958582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e2c89ac9-9bad-448f-a6e3-f2538b3b7ffa", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958fe71a-6113-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639949728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949728, "uuid": "fb46fed6-9eb4-48dd-85bc-be7dc4b1c9e1", "comment": "Malware payload (Mirai)", "value": "efebfa801199870b6f6adadd97647b54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949728, "uuid": "5ff411e0-d68b-4c61-953c-90225d074904", "comment": "Malware payload (Mirai)", "value": "00cc4a2da528aebecfb8460ed536745e1326f2ba4e22f24be97cba127d7b2696", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949728, "uuid": "e099480e-9f7c-41eb-bc6b-930613e8d859", "comment": "Malware payload (Mirai)", "value": "11f0c51730b3e7dcf1b4766f05b69af143d2a0f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949728, "uuid": "abef0496-2754-4980-997f-e309ea053f34", "comment": "Malware payload (Mirai)", "value": "69f8f6e73bcb3a89bcb7d48997f7526f76b0ffd329f840d1a1687d2485b3340d567377d2f2138fe6bc6f454ec40093fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949728, "uuid": "9366a159-6740-4e4d-a7a0-7139df5985e4", "value": "T1C6F2F15095EB020DCF7D043E4E7E7A1A1650C7E5946819A8AF49E137ABB8F35120D3D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949728, "uuid": "9344dc6c-cc42-4304-9d71-91847079b155", "value": "768:ikJ7XE4M0pkdoqemSRX61uoIer+f5JJ/dGGaEnbcuyD7UHQRjV:ikitdoHhIhaZVgEnouy8HyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639949728, "uuid": "8a8c2a28-186a-4586-b789-5e6d50815246", "value": 36152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639949728, "uuid": "f3122e6c-407f-434f-807c-e1ed30325603", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949728, "uuid": "ece3335f-777b-45d3-bb80-bb0b51e494a1", "value": "efebfa801199870b6f6adadd97647b54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef3295c-60aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639904405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904405, "uuid": "03d7ba37-190d-4a53-b1f3-78773eca453c", "comment": "Malware payload (Mirai)", "value": "f7be04e8c7fee9af0bfbf017da8dc9ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904405, "uuid": "da3b9db4-9821-4e69-84c7-6559845fb280", "comment": "Malware payload (Mirai)", "value": "0118bbf4cb0f6eac467a99dec66e311bec400298d1fb4f34419522e9f3a5d910", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904405, "uuid": "6272a134-dd92-4df7-8ea4-e94d73606a2e", "comment": "Malware payload (Mirai)", "value": "517f065419521e397c778afc86a48c8470833d7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904405, "uuid": "48b83c36-949f-44c0-8a3e-c7d406d46910", "comment": "Malware payload (Mirai)", "value": "4cb355c659055f8e21dd16a7e7b40d49974abd0de39d49fcc2108dfeb41faa0a427b481e28977c12c2f2de579eb2463a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904405, "uuid": "b2bc0be6-6174-4f8e-aeb3-9480dc98a6f8", "value": "T1C0A2DF1821CDEA32D1B0803AE13DC357AFDB43B652FE31391E08079DE48491AD7BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904405, "uuid": "769863c2-f3e8-44b4-85bf-e4a41d7c22f5", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSb5hymdGUop5hXo:Ypoh/DxCvhdR4IjWVFbS9s3UozJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639904405, "uuid": "35776c52-4460-4d7f-9ff6-bf9b736c1f17", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639904405, "uuid": "2e5f9f92-bb42-4f0e-870e-bdd849bcfc27", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904405, "uuid": "c37e09d6-b8ab-4822-b46a-dd554108cbe0", "value": "phantom.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46ebf43-60a8-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639903877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903877, "uuid": "5ca993ee-fdd6-40cc-b6c4-529ab1f2ca2a", "comment": "Malware payload (Vjw0rm)", "value": "42c752340356522cee767e5c2afe5f7c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903877, "uuid": "03b3a582-0118-49e8-b3e6-4d82880809c2", "comment": "Malware payload (Vjw0rm)", "value": "02a75696ab10f5203c0ef720767311d56aa63fb80a3a2191f134a944a84d421b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903877, "uuid": "d65bd73c-7f78-4efb-b889-85eef382575e", "comment": "Malware payload (Vjw0rm)", "value": "153c7a7151a22ae7cb895a64cdaa2ae4bcce6cd4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903877, "uuid": "f85b1ebf-d065-49ed-af00-446577979734", "comment": "Malware payload (Vjw0rm)", "value": "2f92e3683e86d26e15a36278adf9dfa854e10a08e615c7a8f548ba619da0a7e5d162b39c99d47918a8b02c3c954c43a4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903877, "uuid": "6adf2b25-907b-4720-a61a-015acd856365", "value": "T18DA29E8D7C11F955D630B32075AE6E986FFC630BDA02929E341E66405B7231DC6EEA3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903877, "uuid": "6ae7d4fd-39b5-4a69-8a16-46c95c091ede", "value": "384:2tLD0KSCSzmb5RkcWmAziRWAlSNskyAtnnjmXNCf/vZzpdZGe:w/0LAa32RWVXy2njiCvZ1dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903877, "uuid": "76312cbc-8d79-4e19-9e12-c7ca49314f49", "value": 22647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903877, "uuid": "7f76d853-d746-45a6-a73d-fcfcba3791c4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903877, "uuid": "7af5827b-8717-4fc0-9f58-92127e8eda28", "value": "receipt_usps.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e4272e-6081-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639886772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886772, "uuid": "fd4e785f-8add-48d7-ac5b-2784cae2a883", "comment": "Malware payload (RedLineStealer)", "value": "2e556ee575f3f72f349fa9cad4566bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886772, "uuid": "5101bc25-cca8-47c1-8323-8907412d3e0b", "comment": "Malware payload (RedLineStealer)", "value": "0312b8b55bcbffb99d4aee533b73fa0a61b87e3dc96c74973c2614bc3bdf3c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886772, "uuid": "cd3fab25-1eba-4dc6-bcbe-961e3d93881d", "comment": "Malware payload (RedLineStealer)", "value": "922533ee320c58959b94516a0233405e632d58b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886772, "uuid": "ee902d07-1800-43e5-b1a1-1fb8046a33cb", "comment": "Malware payload (RedLineStealer)", "value": "dfa2ced36ab48078a83fc56c533df66ae07b6a2620487db3dd848df37287729d8285a6a8716985d5bc400396a458d015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886772, "uuid": "17ae6aca-4688-488c-81a5-2e00081f37b2", "value": "T1B284DF00B7A0C034F5B752F84A79D3AC793E79A15B74E0CB12D12AEA5674AE0ED7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886772, "uuid": "d45143cf-dcc4-4123-9021-5dcfdbf39ef7", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886772, "uuid": "bf16d978-8d26-4159-84d7-f05bfdfbee6d", "value": "6144:1uNMy3+hrU4j0x1LHQ3be3WYeP2TG++3voiKj4B23HyqXM:1uey+r9yMS3NePEG++fO823H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886772, "uuid": "9d1c40ba-8e15-41d1-bf31-7c1f487404de", "value": 406558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886772, "uuid": "1ff9415e-bb41-4fb9-a6d8-0c97f30d99f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886772, "uuid": "1669782e-9ff8-4dff-9f57-8777ade13c07", "value": "2e556ee575f3f72f349fa9cad4566bea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb1c734-6114-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639950062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950062, "uuid": "010d69d2-342e-4d23-8b1c-93f938795479", "comment": "Malware payload (Mirai)", "value": "40138fde8522189d662f5e9132d2008f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950062, "uuid": "5e3f1dcf-32d9-4c88-adac-3b5101f0e70a", "comment": "Malware payload (Mirai)", "value": "032efc7d77ebdd96e411dbafde7cbafae09e9246eda6f5d8a6008d12dddef741", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950062, "uuid": "a6cc68ae-29e3-4dfb-bb26-0da8d7293912", "comment": "Malware payload (Mirai)", "value": "67f5cbcbff434053b83afbbce9a651e4a8ea1f22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950062, "uuid": "79eea5ac-c157-460a-8f2c-2b7127d4924a", "comment": "Malware payload (Mirai)", "value": "5e2c08cee1e7206ca8c3ffe7dac16dffb72a310b28017c89f40d7f17bbf8767bf19b818cca3ab3c4de01d2bd955ae768", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950062, "uuid": "5df0b1cd-c2ef-48b5-a043-c45aa4df4f18", "value": "T12D23F1E805B917FBD94AD5F059F20BC11CB05B62F543F91BAE4CB8CBA9068642817BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950062, "uuid": "a6fe7aa4-1e17-4366-b32a-23a0cab863f8", "value": "768:xXLL88BFQrRKBP1hT7jvEzcVGU+3VV4jVIIDDNRtOCMuVzbMfn/FWJgGlzDpbuRx:x7RFyEBP1JXszlspjO7udin/FCVJur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950062, "uuid": "873e0e80-7105-4928-868d-04973341459b", "value": 46144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950062, "uuid": "4b8c281e-abcb-4b2d-a595-b73a77d2d5f2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950062, "uuid": "eaa9fa97-70fb-462a-ac84-b086387f76c7", "value": "40138fde8522189d662f5e9132d2008f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e0c7cb-6081-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639886834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886834, "uuid": "a2397310-acf8-4824-bced-9951aecd5f40", "comment": "Malware payload (DCRat)", "value": "363f884437ae8e4af273fe471085f960", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886834, "uuid": "827b5071-932c-48be-9968-d3aa10232049", "comment": "Malware payload (DCRat)", "value": "03932a45a4930fa81f20cea4598a9845262d89ff410d23f28731235a898a22a1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886834, "uuid": "56a340d5-0173-4485-b62d-461a401bb4eb", "comment": "Malware payload (DCRat)", "value": "1e4ecbbea9e8b5c2eb58cf6da72d4356e116b8b2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886834, "uuid": "ec978884-fa7b-42af-b688-fd0f34cef39f", "comment": "Malware payload (DCRat)", "value": "94574bc172303b3240bfc64e98d1b217a53724afe59f5e802cea3951ac098a93ce8516829d4ce7e33ebabc1f27d813a8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886834, "uuid": "0c7c05f4-f2cf-479c-a6fe-325afd902b61", "value": "T17A549C00F7A0D439F5B752F859B993EDB63E79A15B2590CF22C516EA0A34AE4DC7030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886834, "uuid": "27057267-afbd-4738-9dc1-78218c4df68b", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886834, "uuid": "a4b0347e-88d0-42d0-811c-126020e22622", "value": "6144:RxXQJ9HtWlge/kDTi6Hhmo0ufB2M3Z3kpg:Rxw9HQge/CTi6BBZ2M3Z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886834, "uuid": "a04f96ed-4189-4684-8191-1afbe3e61e18", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886834, "uuid": "6e041926-6e6f-441c-952c-a105b66e2631", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886834, "uuid": "729050e7-5bb6-4402-9174-dd4493d22123", "value": "363f884437ae8e4af273fe471085f960.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a88694-60c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639916469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639916469, "uuid": "b083c19f-70e0-4913-ba58-7d7a171bc67f", "comment": "Malware payload (Mirai)", "value": "613baa8ca00b0f6ea9760c084dc66cb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639916469, "uuid": "2e770c06-608b-4685-8dbc-bceacc5412aa", "comment": "Malware payload (Mirai)", "value": "067fbfffe7ce057e03401656fce15659e57e0a46b18894d07c50ec8d15412124", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639916469, "uuid": "3dbb16a9-7de5-4164-804d-3a5555819a80", "comment": "Malware payload (Mirai)", "value": "d0f1357892f8a405a85fdb6dfbbb9daa045e88e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639916469, "uuid": "f8538069-2a6d-4e43-98a2-29b99cc4b7e1", "comment": "Malware payload (Mirai)", "value": "f7b718f51725152e0c5179728d6d6db01433ea4907409073bf4b5333745f52ff959cd57c272356693eea9bc2d09aa233", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639916469, "uuid": "157f99d8-fb2b-47df-9755-279af111804f", "value": "T1FA73F7C1BC819626C7D11377FE6F118E371553D8E2EA72039D241BA47A8FC1B0D2BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639916469, "uuid": "f3b04341-3eeb-4b72-aa59-e4f8a17f9bfa", "value": "1536:z/+xmOLS9HgBgTp/+26o3sueZtAoOuMkWsr357JGQ+:z/+xmOfgF8uwYw3xJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639916469, "uuid": "577556f0-03d6-4f1a-be09-e254b7effec7", "value": 78844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639916469, "uuid": "e92bd845-cdb7-42ba-b016-d0dc5672d86d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639916469, "uuid": "6f0319ca-92f5-4903-b884-1c40e6b67241", "value": "613baa8ca00b0f6ea9760c084dc66cb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcd7654-6113-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639949745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949745, "uuid": "80d599e3-db7a-4089-ad70-236b58fd8d93", "comment": "Malware payload", "value": "bdcb1fcea8ddedbbb96b59192f491ccf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949745, "uuid": "1e5e1ae8-7a0f-4092-9ac1-14ca1d856836", "comment": "Malware payload", "value": "0c509ef013dfce57781ecc38a4d04cf17c3c720e0b06c05e19c4f83e042b7e14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949745, "uuid": "c5b6bcec-ba4a-4bf8-9cfd-4f361169b7f7", "comment": "Malware payload", "value": "a098f929c4080e70b6703306f2383fa7447e8af3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949745, "uuid": "5aaf5657-24a8-44bd-9372-7e370beaaaf4", "comment": "Malware payload", "value": "0e00941fb50cf58db72acb522a45d7dc8ef15d1a029a392176a41c209ee5f39ffed253b004f653f6207b7cb1e1cd01db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949745, "uuid": "ac77ff9e-d349-4e27-aba8-a62e4ca1a04c", "value": "T139A34BD2A028CD7CFC89F97A852B060F77B076641F820E2565F0FE976D259614C5FE28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949745, "uuid": "98abde6c-87df-4685-a0ef-fd6fca527e13", "value": "3072:NqDEAGEw6Ew6EATEAuEwr4sUQmuT1AdFG/4YR3EkBO:NqFqnG/4633BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639949745, "uuid": "e534bd65-7fe7-4fb5-b04b-b1112378a2e8", "value": 104108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639949745, "uuid": "02208676-2bce-45f9-84ea-becfa0ee9e9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949745, "uuid": "1b1986d1-61ea-46e0-802e-fe191e2b7405", "value": "bdcb1fcea8ddedbbb96b59192f491ccf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626f2583-6126-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639957802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957802, "uuid": "b9994911-6ce0-43c0-8db8-cf3460b2a785", "comment": "Malware payload (Mirai)", "value": "00fddbad100283566a6782a09339f96f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957802, "uuid": "e1f32e8e-270b-450e-95b8-1ee5d7b9d02c", "comment": "Malware payload (Mirai)", "value": "0e52771d3e07be37b90d0edd29a9fcbed75248a3632dfc0005a503a1fc88b0f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957802, "uuid": "72c5545c-54b0-463a-b94c-1c8c2af6ed2b", "comment": "Malware payload (Mirai)", "value": "4e032c3149a6894d2708d12296f60449005c90fe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957802, "uuid": "216e8bde-8172-45d7-ab9d-cfc18dbb99c1", "comment": "Malware payload (Mirai)", "value": "8a47a8ce0231b678bf29c9a7760af2ae12eb4657e2084e0d85829fe80e897aedacc1193d305f493a16d0f1db593a91dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957802, "uuid": "c33e071a-e1c4-4ac9-9795-8fae36b7de86", "value": "T1A8144C86DA804E13C0C71BB6BAAF414A33229765D3DB73069D14AFF43F87A5D4F26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957802, "uuid": "d1521607-da05-428a-9fff-ce79db2059dc", "value": "6144:SH258C0ny3jaeONEEZGDOSMCqIqpmM/9hmqwhDMSUgV:SH2m1nYjaeONEEZGyhLBH/TmqQDMSdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639957802, "uuid": "3eee006e-fb23-446d-858b-d67a51262ffd", "value": 205505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639957802, "uuid": "a94ebbd5-c96d-4ddc-b7e0-f11627de923f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957802, "uuid": "9c690f16-ae33-4c30-9701-97aa7ed6f5fb", "value": "00100001010001001000001001.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccc1a85-6082-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887382, "uuid": "78899366-b195-4d3a-afe5-ac375e725d5e", "comment": "Malware payload (RedLineStealer)", "value": "5d51612368406ee2f2bd4a78c9861e0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887382, "uuid": "85c5e403-dbc9-4459-9619-d64eb92af991", "comment": "Malware payload (RedLineStealer)", "value": "0f58130b7bbfe5ffa1f79ea66fcbb7f3998bd3b7ea53de7f509e36334002986b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887382, "uuid": "3248919c-3b4e-4e2d-a11d-eb7a49f9721a", "comment": "Malware payload (RedLineStealer)", "value": "32524da9585a827cc4e42da5b01996fa3f75dd4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887382, "uuid": "1d7d2480-3c58-4eea-a3a3-bfe53af46244", "comment": "Malware payload (RedLineStealer)", "value": "a0fa910a17d3bf8b55c0f90b8e4f5b063faf0a685cbef395f61420a9cdb432018691c6885640f3c9a76847a4d44a5a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887382, "uuid": "b7bf7723-4108-4c81-b46e-e53ad4d00a53", "value": "T1B984D000B7E0D034F1B752F44DB6D3AC7A3E79A26B24A4CB22D516EA5A746E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887382, "uuid": "02f66ad9-8a9b-4e7d-8413-f8a35f1c1025", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887382, "uuid": "d0d81a6c-ad22-4146-8d60-1aa8e7372a17", "value": "6144:KzshTve85lg2KTzLkvdq0nTUZKz9tyR4kS3K9RKElse+zTMwnqXOjhiEjrFPxoxB:P56uq0nAutyR0K9RK0se+X9PjrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887382, "uuid": "8134787d-8060-483d-9892-0d1920e5095d", "value": 406558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887382, "uuid": "243adb6b-4a7b-4017-a3db-1dc20c27f851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887382, "uuid": "13d96df3-5b8d-4a20-bf0a-222f115c9812", "value": "5d51612368406ee2f2bd4a78c9861e0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba3b830-60f9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639938732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938732, "uuid": "f7c5c4e6-470a-4eb5-bcc0-dbb4228cc7da", "comment": "Malware payload", "value": "ac6a259542b4bc8991b19d442dcf9c2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938732, "uuid": "2bf11c99-fab8-488e-aedc-309df03bef8d", "comment": "Malware payload", "value": "103d94a94a34b56b53baf0f7971c4e15e469d49e4ec0aa8d9b38b60efc61741c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938732, "uuid": "08b56bcc-72f5-462a-908c-86f61db73e26", "comment": "Malware payload", "value": "3665b3ac8eb3747739f40d2027d38751364e400f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938732, "uuid": "5ac4e5a5-abd9-4e9b-b804-e693c06fcb20", "comment": "Malware payload", "value": "4ec551490a57ebf4658174dbcbb906eb0d69e5c2308a117242e3c76705fd3ecf9bb282238f880572c2c791c8bbd41f11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639938732, "uuid": "4e3eefd6-1f95-4c89-8c45-e977bd993eef", "value": "T171743D07FF84AEABC44DCE7445BFC31603D6D0AA56D6922732BCCA5C7D9E3089693984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639938732, "uuid": "39258e80-7a00-4e8c-ba63-4615fbd36271", "value": "6144:YCWUWbbMK14mECiqWmOaC1ztPASfIOV68eU1fY5hEQrDh895BtLyhbkMOzqOFSAZ:jvqOyURY55PYOhbkMOGOc6z9FmiIuCYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639938732, "uuid": "e29b078f-459a-4d3e-9df2-0befdec43beb", "value": 367468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639938732, "uuid": "ada8e4ef-ef84-4c38-b88d-a95f6e9ce0e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639938732, "uuid": "97ccbeb8-5b91-485e-b82d-193561421705", "value": "ac6a259542b4bc8991b19d442dcf9c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fc5e23-60e4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639929616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929616, "uuid": "6b236759-740c-4e79-a3ac-030963b857ec", "comment": "Malware payload", "value": "ec8dc07e4dc9ec8071233979aaa1691b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929616, "uuid": "3942a5e9-e2a7-46a2-bf95-ddf5d56dd2df", "comment": "Malware payload", "value": "107c2a2b6e621ad288c2eab8aec456c44cdf5cb79c9b76c75da5627060227c51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929616, "uuid": "24680241-3a0f-4620-992c-08ac3fe5d5d8", "comment": "Malware payload", "value": "9fa36049b9e12ba4545192e7df1b110f351402b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929616, "uuid": "0075f172-3c8a-4bba-ae8c-5ca98891eaef", "comment": "Malware payload", "value": "581c8e7d953d5f84ee5fe2b9c6434ce186e7fb8a13e8070997425ff14ae039d95d6e1bc99e0a78170f0e3e76fe9b61a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929616, "uuid": "9d8f4eaf-4ce0-4e57-a88a-2dd35178e587", "value": "T1E3B30804F8448727C2D327BAF78E439D7735566457DB33116A38BEB82BC6B982E29170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929616, "uuid": "a2cb67c5-cbfb-403f-8fd4-945dd4622b14", "value": "3072:9lX2jKRi0ZDvCTpzv7DSubUmGVrQAXiUXouX:6j6ZUpzv7DImGVrQAXiUXouX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639929616, "uuid": "b239a350-75a9-4198-be1e-b0dd14f44c9e", "value": 112657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639929616, "uuid": "887568a2-ee8b-4207-9215-52cf1e756d05", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929616, "uuid": "a6b59d7e-ad1f-455d-967c-c9a3fd5154ec", "value": "ec8dc07e4dc9ec8071233979aaa1691b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e13cf2-6062-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639873575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639873575, "uuid": "b8ba01c4-6ac1-433d-b113-bdc1e1d5e270", "comment": "Malware payload (DCRat)", "value": "9ccb0301e6a4e08b09fc9fb76e973cc7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639873575, "uuid": "2350444e-8170-496b-ba93-420e07f86466", "comment": "Malware payload (DCRat)", "value": "151a46a906ce9c9ea079cd3b9d2911d68b5c800f3b07df514d9e90a31163fbe2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639873575, "uuid": "4183102a-2bd3-4367-9010-0a20116b6e0c", "comment": "Malware payload (DCRat)", "value": "aa184bafe6ddc676961619a0dde2413ff4ac84ca", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639873575, "uuid": "25e35292-9afe-4439-8f90-de1fd4f005af", "comment": "Malware payload (DCRat)", "value": "1275aa10ab9e33f22fd1e82c8d2450d0df2d39f8c95b0d3f2ff5eb44623e81465a196702513a7148edffc3af43c7de06", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639873575, "uuid": "ad9f3f8e-5864-4b00-8ac9-8f938b350890", "value": "T1A8549D00A7A0D435F1B766F449F993ADE93E79A19B75A0CF12C156EA5634BE0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639873575, "uuid": "f31c2fff-e439-4622-ae64-2be5cc10e903", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639873575, "uuid": "fc160a2b-53fc-41e4-9490-fe9756bb267e", "value": "6144:q7oct0AGT7fvdZnRdmQ3JacmSqFBq/qjNUEGnUObA:sgHf1ZnRdL3JaPSo1GnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639873575, "uuid": "21254d3b-f9a0-4110-977f-0ccef32f4ca8", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639873575, "uuid": "df4fc9a5-5c4c-4660-894a-deaa3674a05f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639873575, "uuid": "27c5a8b8-cb89-4ad4-a868-b694f1034820", "value": "9ccb0301e6a4e08b09fc9fb76e973cc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654db790-6080-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639886511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886511, "uuid": "1fc0cc15-cbcb-4afa-a2f6-dc4417265558", "comment": "Malware payload (Heodo)", "value": "e471223e9ac4b4248bcab67086b0fa5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886511, "uuid": "b2e27a18-5f71-4abd-a8ce-027956a1e2e6", "comment": "Malware payload (Heodo)", "value": "15bd3da050b9305cdcec9907ceedd5b2d02d12b0c18270fd64a2a2726d99c850", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886511, "uuid": "586a6a24-9ad9-48b7-9d02-a5b9b773fd28", "comment": "Malware payload (Heodo)", "value": "6af552034d9f324f1eff905b9b895ddf532d2e4c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886511, "uuid": "2064225c-d350-4e5b-9e1e-89de01b3788f", "comment": "Malware payload (Heodo)", "value": "ff6b7155b124ee96df86abd3dd409528204cf0a45bb2275a28d4924c9abd5b0d86a94031eb0a3ccaee7d38d8982a5337", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886511, "uuid": "d7449d26-16ce-4b07-b32b-7ecd583b0ea1", "value": "T148648D11B683D072D5BE04307978CA96096D79318FB4CAEBB7D41A3E4E702C19B36E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886511, "uuid": "ed97a78e-c611-4bde-8775-a0ade783f289", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886511, "uuid": "1eb0d906-e0c4-4bcc-8221-e92a7584d3f4", "value": "6144:+AriSO7B4gYcl/qjc5dQD8JCedcsqAOBCWOE+:+AriSOG9c0jc5mDQxqf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886511, "uuid": "79f7ff7e-2b7d-41ca-b082-ba8a04335d26", "value": 332361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886511, "uuid": "8943c566-c925-4826-bc66-972ae023f144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886511, "uuid": "bf71b2c2-3d43-4c00-847d-ad1818a198b0", "value": "emotet_exe_e5_15bd3da050b9305cdcec9907ceedd5b2d02d12b0c18270fd64a2a2726d99c850_2021-12-19__040146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60ea12c-6083-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887988, "uuid": "8cd74f99-52ef-402c-9ff9-40eca1e03686", "comment": "Malware payload (RedLineStealer)", "value": "7578dd3df758e449aa8b9c5aa4fd775a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887988, "uuid": "dc628a42-d445-428a-ab1d-9010d6c077f6", "comment": "Malware payload (RedLineStealer)", "value": "16ca0133e25f806a786bac8e87f85db16c5c492ec5435d46ab5816e79008aab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887988, "uuid": "71657d5a-473d-489c-ae5c-89dd9d4ad36d", "comment": "Malware payload (RedLineStealer)", "value": "d0746e1a353970b5f15bceeb995cfdfe3ef74eb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887988, "uuid": "9b38c10c-616f-464f-a083-d745619f8559", "comment": "Malware payload (RedLineStealer)", "value": "ec791342c2d7c2f4cbb4972ad29e3c7f2dcc8f5c06e89127d01e2d0572144266ba8a549e3303c1be8089bf247af2b07c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887988, "uuid": "a4f457c1-ec0b-40b4-a8e0-b581a27ddbd1", "value": "T14E94CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887988, "uuid": "d72ab77f-fa70-4665-9dce-7719e054f1df", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887988, "uuid": "ae8d6d98-f3c6-498a-a54e-f43bb3ec0e96", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887988, "uuid": "838f9f4f-2d6b-4c52-a0c1-9c5cf1ce0a9e", "value": 411145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887988, "uuid": "86fada89-94e7-4cd8-af23-e71dbe10073e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887988, "uuid": "77b3d1a1-05d0-4378-968e-99379d9970fd", "value": "7578dd3df758e449aa8b9c5aa4fd775a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997d929f-6113-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639949734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949734, "uuid": "4eaf131e-f766-4d0a-b0e7-542f3adde8b0", "comment": "Malware payload (Mirai)", "value": "2337924f4205418dcabc187897162c55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949734, "uuid": "82b29ef4-24b9-4227-a2ef-4a13f8a59ced", "comment": "Malware payload (Mirai)", "value": "1a44ff2df3a77c8b58bfddb126f47b2e0fd4e8c39d21ba9e7565230b911c1b38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949734, "uuid": "a06a8c31-0044-4895-8406-6e4912fefe77", "comment": "Malware payload (Mirai)", "value": "222b5a335156007481833d978df8e1fe791ab153", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949734, "uuid": "c504b391-5abb-47a1-b04d-9ccd8929f5d6", "comment": "Malware payload (Mirai)", "value": "a5c2efff74c1d5919ffac6829f362125f19645c8a62f39db0300288ddd7f5322fec29ce91c231dcc84c3da1e0f5b9e9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949734, "uuid": "80948110-3ee2-4fc0-b801-a00c53efcb11", "value": "T1BB6302005782F4522C728AB4AA748D6D3F91923CDC7F339525DB8FA0AF12A6385C56D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949734, "uuid": "860f11c3-9b54-46dc-91d3-d7507163be2c", "value": "1536:6OFSklNkKcaJrg5wUvfwCeyXQVpz1WLGsCEhi0cALmxS:6OFSMabw/yX0pzQLVCDnymo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639949734, "uuid": "a87fa0c9-b79b-44bb-bc53-ed7312499be2", "value": 70892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639949734, "uuid": "d125783b-778d-41e9-b9cd-996b3ca190e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949734, "uuid": "02af1445-e7bb-4ef2-8261-7e6715cee463", "value": "2337924f4205418dcabc187897162c55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7ad75a-60e4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639929603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929603, "uuid": "8be9c828-a37a-4fab-bb4b-9c2cc5021d0e", "comment": "Malware payload", "value": "ca88dc6a0dc2f113b71f69e9ae45d16a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929603, "uuid": "36bcd4c6-bebf-4d56-805d-875096de9c8b", "comment": "Malware payload", "value": "1a4f6cf1002e9d5acb17b7a3609283768cba74c328d3e3e02a5edb131144dd19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929603, "uuid": "27659760-10e0-499b-bb50-4378ef3a459b", "comment": "Malware payload", "value": "63d7cfe0c8570bc50a3fed2396a90432aef44afd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929603, "uuid": "f889748c-6293-42e2-8297-0203a5eb4287", "comment": "Malware payload", "value": "117d22469b77840cca6c01fa10dfd83f93614b9deda7ac128a8d13c20ddc80067ee7af437823ffb22b42a35c1a9f6050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929603, "uuid": "5fbb700c-1471-48f2-83f3-91ee88646af4", "value": "T1AC933A0799A59F77C0C7EAB919EB59300326A9520B2F1F5961386BF4438F9CC740FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929603, "uuid": "1bfcf666-2388-479f-9e49-793a1f09ca69", "value": "1536:fI7+hcIM9naHAAGtKhmA+J/FosGvJtKqCdDQtmW49VquLeefkcX:YNIMZoAAG0hS/FoHKquYm79VquqefkcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639929603, "uuid": "0d2edae0-7de4-40a2-b8b0-67813104ece2", "value": 94356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639929603, "uuid": "ee01cfe7-af21-4392-beca-24d34fc7982d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929603, "uuid": "6e64152a-bd07-42ec-b055-2bf25c07a8e0", "value": "ca88dc6a0dc2f113b71f69e9ae45d16a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9216d0d-60d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639924125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924125, "uuid": "0093dc50-5625-43e6-bad2-cf3f0f041e78", "comment": "Malware payload (Mirai)", "value": "31a8f6cb7675a9f9f427c47b923882ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924125, "uuid": "d7484cde-f321-4dd8-a64e-9efcb198a988", "comment": "Malware payload (Mirai)", "value": "1a87f8da583dcb1ff2bc2e4c9c62ce902e8b1de9af28bd26349943ee5b720967", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924125, "uuid": "66cda365-7f9e-4ad0-961a-7a2dfed6fff5", "comment": "Malware payload (Mirai)", "value": "aa6e039d523d39a335533a801580430377bcec3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924125, "uuid": "24aeb3fc-911d-48d7-979b-0344e193344f", "comment": "Malware payload (Mirai)", "value": "223503e1f8ad5378a52ad9876e0c4ccf3d881849897b4a3114d78910a01e8fcccdbadbc33998413e26304a04f9771dd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924125, "uuid": "1e833727-9191-47b0-b01a-4f59459e6663", "value": "T15CA30896F900DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924125, "uuid": "65c06439-2294-47c3-b62c-cfe23c458726", "value": "3072:nkrWBIvC/IymEdH8ffn6OKmuxVqDr78fz1e:nkrWBIrym+836OKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639924125, "uuid": "9e654d72-2baf-4957-8a69-59615c6211f5", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639924125, "uuid": "4567707e-2b1e-4e18-9136-a217b38ebd46", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924125, "uuid": "f898472e-5144-4b52-ab22-dc360e4a424a", "value": "31a8f6cb7675a9f9f427c47b923882ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc8f420-6115-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639950409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950409, "uuid": "774b033a-1f26-4d05-b6c6-11a4e162c4eb", "comment": "Malware payload", "value": "904c08d0998e20519afcad2aeff32026", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950409, "uuid": "e21f8f5d-c4ac-4f3b-b433-589e56c1ada0", "comment": "Malware payload", "value": "1a8b20bbaafdbefa934bd9807af8a8dab09b58e973800e5de4f5d762c48be327", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950409, "uuid": "1e2b3902-ac6c-475f-9acf-55cfaf679a7a", "comment": "Malware payload", "value": "a4e9c2ec6d09b7c11af8000553a98516915b3178", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950409, "uuid": "7f053e2e-46ac-4824-880c-dfe1becebd3f", "comment": "Malware payload", "value": "55dd53f7924793bca84611f87533813b37c58666e82d34e47ace41a080fe75ff2b5276e3f510656502a57c4d887a8c30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950409, "uuid": "8c5743de-55d1-4068-ba4f-416115a943df", "value": "T19EA3D64BF8915952C9D09377FA1E23C9335BB3A4D2D97103CD884F20778E8692D9E6D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950409, "uuid": "5277bd00-6e2a-4d30-a22c-58672070ec73", "value": "3072:Nu5s+pGEgXdqjnTj4pOxxr6s31lt9J/xNZ0F4toaPJLCnAKm:g5reA3IMh17/xn0etoaPJGAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950409, "uuid": "f498c2ae-b1a9-4a02-b51b-976a0f1374da", "value": 101700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950409, "uuid": "1fa46299-70ea-45f8-af52-87deb7e28784", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950409, "uuid": "f38de7c1-ef8c-4bdd-8f77-95a76868b8fe", "value": "904c08d0998e20519afcad2aeff32026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af774305-6126-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639957932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957932, "uuid": "937abf99-3563-4bba-92a9-b82cb5e404cb", "comment": "Malware payload", "value": "69a9e85a5b3707e79052b04a10bda5a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957932, "uuid": "cc6428d8-5293-43af-88a8-8d0839bec3fa", "comment": "Malware payload", "value": "1d555adcc02b57995d77598a1a7b7689230928f7b71d455e6d654f34e5eccb23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957932, "uuid": "a39b70d0-f99e-4a2f-af26-4233b5faaf8c", "comment": "Malware payload", "value": "7f29a8898fd54cc7f803866577f3918847955b03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957932, "uuid": "7a847410-ff2e-4234-86ab-0f3bb55d5df0", "comment": "Malware payload", "value": "be369002a00348d82ea1ed862e4e8adabaf3f61310d018536f9e12571bf16406cbcda45be55add6dbe90a8d6e734ce82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957932, "uuid": "0698055e-5753-451b-907f-619f4dbf67d7", "value": "T10D1633DBF07826D8E07CCA7815247856E9B1BB962AC791832B1105550B33AA7C71FAE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957932, "uuid": "4b5672ee-aca7-4f5e-927e-80e241362088", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957932, "uuid": "5c6ad381-e5f8-4a4a-b447-4e315efefff9", "value": "98304:7K+Rd1VyFNCPAxlwyHe2jMD8swW6Amzm9eLhLUgC/vasjHrC0DO:e+RNyF6AxlT+2jMD8wJLA1lOLXDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639957932, "uuid": "d3997c2d-7463-43a4-8a54-c24452b9641a", "value": 4393984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639957932, "uuid": "abe42d63-4db8-4c18-9485-bdacc497df3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957932, "uuid": "91e3c3a3-07fd-4603-bb2d-2a9405c1ba0e", "value": "69a9e85a5b3707e79052b04a10bda5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a5a85d-60f7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639937539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937539, "uuid": "dbc2c353-37b5-498a-a64d-1c381cdbec38", "comment": "Malware payload", "value": "b04072a01ba1f12318fdd1ee21196564", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937539, "uuid": "635603a9-e934-4aac-b02c-59b783d2c7d4", "comment": "Malware payload", "value": "1db50451a00a658d3dedcd3f7b68dee2fa5c7fd86bc4695ccc970de9fb349c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937539, "uuid": "5ce07243-dbe6-487e-b712-f18bc724c3fe", "comment": "Malware payload", "value": "8d88edbe59d587888494f4dbf83ef0612106026b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937539, "uuid": "c33aee12-4242-4a0d-8393-13897f1bbebd", "comment": "Malware payload", "value": "837df95833ce1983eec83dd92d73c8f994b32533704a07c990600ca69ddd182b8787d28da83846f8cdb07494eb3342d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937539, "uuid": "87c7c47c-6eaa-45ad-9652-e54a8a794cad", "value": "T1DF16332DBDC1C44BCF93FAF2FE21665FA604284F86EDA603FD99844B5698F5690B0053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937539, "uuid": "8c525407-8277-4bd8-9744-08ea6eea7ef7", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937539, "uuid": "b7deade1-4184-4833-8aae-7bf928551d38", "value": "98304:Jr6KMlWzFoIW171qmtVXytSlrvqRKQXW2:cKM4ZoRqkytSlOG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639937539, "uuid": "838b2961-99bd-40f0-b5b4-bf709d02263d", "value": 4343053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639937539, "uuid": "97d2ba9b-b867-40c9-9e30-c00b76a2775d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937539, "uuid": "cc52c4d0-2e36-4ac9-b3a6-05c0508958e6", "value": "SecuriteInfo.com.Variant.Razy.579786.28822.10733", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78bc4fd-6083-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887991, "uuid": "752c811c-0cba-4b1b-a9f2-5ba6402868e0", "comment": "Malware payload (RedLineStealer)", "value": "983e386ece70ed44b6d32d97fe4f119c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887991, "uuid": "714c212d-d242-4232-8134-47e342834d3c", "comment": "Malware payload (RedLineStealer)", "value": "1e92c2a7f4f03e38ada4d5cc9d64e5afdff110a294a9f1e15c165e0331f3f9ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887991, "uuid": "d99f0956-388d-4c43-ae49-9cd9c6ce66ab", "comment": "Malware payload (RedLineStealer)", "value": "25d523520fb6ac457f879bcc09a1e6ac8be02c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887991, "uuid": "45efd7c3-7fcd-40b5-a126-62e686cfc3cf", "comment": "Malware payload (RedLineStealer)", "value": "4a68248d4534f328f67f9917d749a9405532065470579f925d3c7af54d594dab3ce1188c7eca40d44aa29bbdd64c0c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887991, "uuid": "200468aa-11e3-492e-804a-99ed64c728b5", "value": "T1D584DF00B7A0C034F5B752F84A79D3AC793E79A15B74E0CB12D12AEA5674AE0ED7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887991, "uuid": "178bb064-21c8-4e4e-92e6-dbad27c522fb", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887991, "uuid": "ffc24cc9-7545-487c-84ef-6f13c37383e6", "value": "6144:1uNMy3+hrU4j0x1LHQ3be3WYeP2TG++3voiKj4B23HyqXM:1uey+r9yMS3NePEG++fO823H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887991, "uuid": "9a240e8d-9b7e-48e6-9e66-3871e433faa3", "value": 406545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887991, "uuid": "12b07564-4514-4fdf-9357-846cfdf49941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887991, "uuid": "3fe9a3d0-2fbc-4a9a-aa30-5ac982bd84e0", "value": "983e386ece70ed44b6d32d97fe4f119c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460e6cd8-60a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639900202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900202, "uuid": "bf6b3080-1118-4b95-94b8-ba2df3647382", "comment": "Malware payload (Mirai)", "value": "976cce2c1cc1049536049440af342ea4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900202, "uuid": "783ee4e2-d531-435b-a459-04d2cdbc8794", "comment": "Malware payload (Mirai)", "value": "1fa5c7e4addf3786777679f18dc7b59f2659731849398f86fa54d35b6f66243c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900202, "uuid": "33ee8580-db7b-46d8-895a-5d4a2d9d98da", "comment": "Malware payload (Mirai)", "value": "64ee4556bbbaee14e3a6099cb42e512cd06dd0c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900202, "uuid": "33740773-b73f-4753-8a72-45911c68bd54", "comment": "Malware payload (Mirai)", "value": "15327abe205e8b675296c38c178b5a5359a6c63f73a8dc793db8294b35f6c09d31b7e4e7421e738a9ff2b691879d1cc5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900202, "uuid": "67a77fdb-8bd6-45f3-8abc-e75aa30845de", "value": "T133631985F8C745F5C84B4A3460BFF33FDA31DABA40305A6DEF59AE21DA37A015212399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900202, "uuid": "4e58ecd9-49b7-4474-b772-e6fc126b835b", "value": "1536:+UzrP7BIluOdSIvwigWwMYXJp6lYKONM:+UzryluOsiga8JoYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639900202, "uuid": "f2009584-51b9-4705-a3cc-0327ff429e3f", "value": 71344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639900202, "uuid": "0ec69cb9-a35a-4de7-9cbd-ce978b864f08", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900202, "uuid": "3bd0192d-8ece-4ed5-a55c-83989d514096", "value": "KKveTTgaAAsecNNaaaa.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af12a8d-60dd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639926383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639926383, "uuid": "2c53f34b-8be3-4c54-b9a8-7a59d1efc166", "comment": "Malware payload", "value": "aca1c7798872b99e384eec2fc97cee03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639926383, "uuid": "be2d0bd9-6019-420f-89ae-e29349e29bec", "comment": "Malware payload", "value": "213a6f7e007811b2de7866f9877a16d56bbd2cb0bfcb680204f9edc988b492fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639926383, "uuid": "85d0f9b7-e79f-44aa-95d3-22104342d580", "comment": "Malware payload", "value": "7e614cd0dc3f329ff5264c4d486f6deda972b698", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639926383, "uuid": "ec56f903-8c5a-443c-81e0-eb5e55d09a12", "comment": "Malware payload", "value": "a7b26cc7d9b6433024118a656a14c44a4098cc1443a0c7e83b72bf69f863ab391e53a4eb386c192f43f07321dd12f9fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639926383, "uuid": "01bc050c-bdc1-4f48-a106-69f6c380ace5", "value": "T161A512217AEB295DF024F9B94FCAC37F9B99F4E9514B4E3B2094138B0B55A602F43871", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639926383, "uuid": "c6b54a85-681b-4870-8570-21a1bec5e111", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639926383, "uuid": "8a0c2a0c-edcd-4b98-a09b-4d048e137bcf", "value": "49152:81CmG18Mr04T5RIDvCIet5AbYPK7IfZ+HWuI1rW/KQgQMQuZ7X:eJ4z5RyKXtoHIfZ+2uI1JFQPuZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639926383, "uuid": "3b003c1e-7c2b-4756-b04c-e6198f22bb30", "value": 2234880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639926383, "uuid": "d33bf694-8c69-4d16-87be-49de37e81660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639926383, "uuid": "7c3e28ba-7336-4e6d-ad26-1c224cd48b06", "value": "aca1c7798872b99e384eec2fc97cee03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e8b005-60f7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639937543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937543, "uuid": "1d4f6993-4b85-4099-9321-7b0331dc565c", "comment": "Malware payload (RedLineStealer)", "value": "dd7bbc76c96a5df0c2ad5450f20e176e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937543, "uuid": "33813be7-90dc-430c-aac9-0f2665dd139c", "comment": "Malware payload (RedLineStealer)", "value": "22ba73b6b25b43d0cd99243479019b18e56736f1e1c0f17160c7365db4ff93d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937543, "uuid": "ce3074cf-7c0c-4955-96f2-66c642f51dd2", "comment": "Malware payload (RedLineStealer)", "value": "972697d497dee0ac21cb332eb53a29b968f1c07c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937543, "uuid": "187d8c85-ac66-400a-921f-c5266f535de5", "comment": "Malware payload (RedLineStealer)", "value": "8239cf98798022465e8b939b165e0301c3b99bd55b150e7a830c7d5b511cd9b5fcf620c2e1177fd98631a7e4361269de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937543, "uuid": "13b29595-c9ff-46e4-9e00-5ecdec6b2556", "value": "T118753323E7642732C86B1AB534B2BB2B64AD3C68E11616C1F6BF1457CDB8146FF09178", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937543, "uuid": "07c906a8-5afb-4190-bb1c-6ae06c551f94", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937543, "uuid": "4ddcdb29-c6ab-4848-97e0-a7d1fb9fef97", "value": "49152:M8ldOvTF9UtwycIS5ldljb4BX/hgqFNalPQl:jSrQtHPS5ODvyPQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639937543, "uuid": "efdaa819-c36e-493a-9a95-0207ab556fb0", "value": 1702520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639937543, "uuid": "0f6b0278-2bdd-4c8e-85b5-e06cf67440ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937543, "uuid": "f68fe93a-7608-4e86-898c-35210cf5c58c", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.8681.13828.23246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e844bb-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639923313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923313, "uuid": "a091ecc8-f05a-4abc-95c6-d9ae0ec91216", "comment": "Malware payload (RedLineStealer)", "value": "23f12f24d622a174b2c02ba70b07a1a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923313, "uuid": "af916d2b-5d53-4fc4-bd92-ea54615b6679", "comment": "Malware payload (RedLineStealer)", "value": "22f6150a22017768dc6c1dca6e473aefc6a1d4fa70f7fac51421017d4fcdb9f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923313, "uuid": "37ded795-3606-403d-85c1-38e31fba589b", "comment": "Malware payload (RedLineStealer)", "value": "c476b18a3d629d9e812ad48c159b6dee0bfdc498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923313, "uuid": "7febe1ff-c948-4416-8baf-e02b3bf621cb", "comment": "Malware payload (RedLineStealer)", "value": "3b31314794a9f9a0f651058d8b77eeb3c60659d4373296b10a48fd48ab7a5367d82ff256a63e27d17ca061f7f6aa04bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923313, "uuid": "87928c90-3db9-4cb3-ab70-c62b53049bd5", "value": "T103F4C91FFDC28E54E942477746E3AB384BA556DB332703CF93A4A5E24AC806DDB0096D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923313, "uuid": "c036411e-4e42-40ad-9848-6b03c6e3e642", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923313, "uuid": "6f694fb1-53a6-4ef5-a0a8-1bf1622d639b", "value": "6144:UfpjLFYtuMX/gj+V6rQg7LqqgmBSlA3U0P0TZalE2ymZzguDEW+pjng1HJRZgokK:UYXEyEQWLJ+HfmNQ3jngMokmtXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923313, "uuid": "8afa06c8-aa7e-4b3d-80db-ec975d06d8b5", "value": 773512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923313, "uuid": "e92b9fed-e30d-4b37-a004-9447c6e57aed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923313, "uuid": "5fb05d39-518e-415e-b3a2-760f5c3688c7", "value": "22f6150a22017768dc6c1dca6e473aefc6a1d4fa70f7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1139787e-6126-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639957666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957666, "uuid": "143f9e00-3dfb-4a9d-b0db-43bab4b92e4b", "comment": "Malware payload", "value": "b3432432b49efcc4b5ab1c00c84827ac", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957666, "uuid": "9f623a43-0caa-4299-854c-e6a8e0ec22fd", "comment": "Malware payload", "value": "260f0079de8e2b26fdcf9f45b6257090a80f1afc21b29de703a8ed058c10ec8e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957666, "uuid": "b8807b8c-33d7-4835-9dc0-0ac07bf8fbb9", "comment": "Malware payload", "value": "2de2f8555da4b3f5bcba3ce8fef877091cd9ef2e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957666, "uuid": "6c4097c8-cbbc-4275-8a11-0a0eca01e05e", "comment": "Malware payload", "value": "4b9dcd61e90c2db54b6eff61964dfb6346c30215b89a5c5e17a52d34092dac1d8f1d0004c2dbeca432a7f5ec79bf0102", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957666, "uuid": "f90ab6f9-244b-4ad4-a16c-ce7f1b3478ab", "value": "T15A13CF405BF94184B6B77F11ABBE24A15B777D596E31CE7C0088864D1AF3A40B86AF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957666, "uuid": "3fd86f66-d714-408d-b0f1-6f81d7490f37", "value": "768:JfM5UmoSY/nzQknmnfiQ245bJKQn0pP2uainU:Jf7TSIzQknmnfiQ245bJKY0p3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639957666, "uuid": "524ecafd-7e52-4f88-bf61-da6b4a20333f", "value": 43412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639957666, "uuid": "48957746-6fc6-46ff-9130-7128803b64e0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957666, "uuid": "e61efdb7-2a25-4e65-9625-461ea72c794b", "value": "out.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2751f94e-6081-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639886836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886836, "uuid": "ed23933c-3825-41dc-819d-2e00d85b3563", "comment": "Malware payload (DCRat)", "value": "77c9c1f471446d79fe937d5e73414bdd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886836, "uuid": "7429802a-7383-41b2-9afb-670c8bc1ac50", "comment": "Malware payload (DCRat)", "value": "281549f327a530e786e962b96f77904882a494e6685c6e67d8af8c7752a237c3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886836, "uuid": "3810e902-5b4b-4b9e-8e0e-7bc0c65ee329", "comment": "Malware payload (DCRat)", "value": "baac5e2ea431103d831e352ab5a3b469987a4aa6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886836, "uuid": "a89224d1-5acd-4649-b280-c3991c285d8d", "comment": "Malware payload (DCRat)", "value": "552c2c4740be2e18681baadf60d85a963832832b433e416d5b770149134e4afd7ac58362fdc5b33de338e2dc04029a0c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886836, "uuid": "2d83e43b-88ee-4320-8341-54903b34aee6", "value": "T171549D00F7A0C435F1B762F849F993BC693EB9A16B35A0CB12D116EA5674AE0DC7034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886836, "uuid": "5c5e6d05-06d4-4024-b91e-c54f698172c8", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886836, "uuid": "40639a80-b27c-46af-92e7-16afd822343a", "value": "6144:LPhWSX67JRPagEQ2qSUSzOal6YWfY/QBCXxgvRp8:da7JRSgEQ2qSjzOaYY30CXxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886836, "uuid": "935fae16-4482-4679-95a9-c860d64e8b1f", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886836, "uuid": "8a709eb7-0d3b-44ca-9329-52316266d364", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886836, "uuid": "eb04a0e4-fb97-41f6-860a-e6b8bd87ff6f", "value": "77c9c1f471446d79fe937d5e73414bdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a0d5d5-6083-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887986, "uuid": "3f25c0ea-27c0-47bb-b675-65e85a4a73aa", "comment": "Malware payload (RedLineStealer)", "value": "ee6418963a8f1806f668cb2f60bcfa46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887986, "uuid": "a5bb8241-f58e-4a48-a4b0-ad9834f530b0", "comment": "Malware payload (RedLineStealer)", "value": "2dfa1030005e1b7041ce7644e4a639b7c8291e45572b9b0cc17803f8c8b4fc30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887986, "uuid": "1ed45832-cf66-4c5d-b29f-f9128c676fe9", "comment": "Malware payload (RedLineStealer)", "value": "b8f86099a8130ea0cb80d0ab8106ec2899da42b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887986, "uuid": "6205ca12-8ef7-42ec-b437-fe35edefd74e", "comment": "Malware payload (RedLineStealer)", "value": "1f09f6bcbd1d49f8789bc6322e96c43532943796685c384c1ea17f49a1393544116c522f99aecdd5eb1928c9f64797a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887986, "uuid": "b3297d9d-788c-4c5e-aea4-7f4d2cdac7e5", "value": "T19C94CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887986, "uuid": "e445ab04-0e90-4461-bc69-b9b64af0b52b", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887986, "uuid": "e97be0b8-9e5b-4cee-a7a4-602359355fdf", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887986, "uuid": "fae3b219-0b72-44e3-af3c-912f7eb4cb65", "value": 411154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887986, "uuid": "96f15bd5-771d-4961-b501-3936cb99ce43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887986, "uuid": "5ac0d006-abf1-4ccc-afd2-c9b098a14339", "value": "ee6418963a8f1806f668cb2f60bcfa46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c18e144-610c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639946518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639946518, "uuid": "2c169509-5d8a-427d-b38b-8bf3aa98ef5f", "comment": "Malware payload", "value": "dfd3e26bd236a40e8564764365d5a726", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639946518, "uuid": "5fe017fa-a3f2-4495-bfba-7b82450b42d2", "comment": "Malware payload", "value": "2eecd263f2ccf106ab5ad42ed0bb8c981f9067a1273cc3186cb731aac8fbb702", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639946518, "uuid": "1bbbe05a-482f-48b1-b9fd-559e0f242bb4", "comment": "Malware payload", "value": "c57031bc27359aa0b9df0b20802d3c6397c6bb44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639946518, "uuid": "7d56f030-1adc-48ba-8d89-e3df09a0424b", "comment": "Malware payload", "value": "5abc1982dd18a078e04cf16de5f8c9d1a497d244d08363a4c96126758b75fbe96ad4a1a0247722cf5d72f0693532fe9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639946518, "uuid": "10989df2-2d9d-4a56-9ce2-7b89903ef48d", "value": "T10E94BF00A6A0C035F2B316F85A79A3B9B53E7DE1AB2454CF62D43AEE56316D0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639946518, "uuid": "1e7ee4a2-6a1c-4ecc-a2dd-f5e8d0910fbf", "value": "9b5e0e93b958d7de96d2eb171562e213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639946518, "uuid": "5a594733-3e7c-4221-b996-758900942a85", "value": "12288:qBMuvys834Y6eX7lBV67lL3sZQ8ND8SX:Ls8IYfxBVSyQ8GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639946518, "uuid": "94f0be19-8fd9-43b9-8c7f-d7948a702e96", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639946518, "uuid": "352f5556-3998-4d2e-9f54-5752a6ac0afe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639946518, "uuid": "a66180dd-f58b-49bf-89a9-4989c1a59c6f", "value": "dfd3e26bd236a40e8564764365d5a726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d0bf6c-60c3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639915125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639915125, "uuid": "36894e8c-7765-4f9b-9e9b-dfb09ae2072b", "comment": "Malware payload (RedLineStealer)", "value": "d6c441c9602b2771664d8390ca3a5edb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639915125, "uuid": "8cc6b3dc-818d-40ea-b14a-225ed1444447", "comment": "Malware payload (RedLineStealer)", "value": "2f0b179a55af79242e5bb13674b1a7a2654f23b0818042076650cd67f8a7e53e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639915125, "uuid": "91fac40f-a50e-49d7-8b0a-3ac9a0ea3d1f", "comment": "Malware payload (RedLineStealer)", "value": "ad167b3aef8ba9c7db9c765e80b83f62aafd2dde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639915125, "uuid": "8c3943e5-6169-46e4-afb8-49b8e3c8e080", "comment": "Malware payload (RedLineStealer)", "value": "9385bf3805be52013d82e9e939dba2834ff85c260c782539921b48499b4a01460a4451edb4aa3d1e8784b8750566bfd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639915125, "uuid": "38560b14-8609-4791-9cfe-d4503da6f9ee", "value": "T19484CF10B7A0D034F4B726F44E7AD3A8653F7DE1AB2495CB62D42AEA56346E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639915125, "uuid": "fc743b7c-f6c8-4122-a550-a036634dbcff", "value": "18f86aab7a3779fc3e6eb84d32d1d0ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639915125, "uuid": "fee12359-3e4d-4aa1-bdea-ed80df61d50f", "value": "6144:lPi6qmtILCIkpkM6TocNPoK6PoeZWubwJzOPajIJ+ZMabu0xJMan11zA:l6UWLHkp5In8wJkajQ+eVIJMaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639915125, "uuid": "b36a4bcc-7482-47ec-aa13-2d6aaff4444e", "value": 403463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639915125, "uuid": "a9c8836e-85d3-4a7e-8705-7b61cfe9d115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639915125, "uuid": "bab64757-6dce-4ae4-a723-a8767673c74a", "value": "d6c441c9602b2771664d8390ca3a5edb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03fc23b-60e4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639929667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929667, "uuid": "8d5f7d91-3525-43f1-9a77-fa305e6a232c", "comment": "Malware payload", "value": "a5e03f780e8de0acae07c46ba91a19af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929667, "uuid": "ecc7257e-c07d-4b65-946a-178d6101fb13", "comment": "Malware payload", "value": "2f45cfc0febac4f7ec5d2c82719dc894fbc8792d8a1b0e0b6f76da2b6a229da5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929667, "uuid": "9304521a-9046-4147-9ceb-c6ef9806dab8", "comment": "Malware payload", "value": "983b44b7665453fd96625a9fdde0a2f289fa764b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929667, "uuid": "3dec7c79-20cd-4ad6-9b11-2422f31441d6", "comment": "Malware payload", "value": "e4fd48c93f61bbd6b93b560c7c6c58c0612519edd136c5ab196cecba3cdd1601cf27f76314e49e430e28c2fd3be10e5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929667, "uuid": "1abcc4ec-1a68-4db0-9e62-4fd12becbc9b", "value": "T1AFD3C55AAB619EBBD81FCE37069A4501248DE64682D93FBFB2B0C51CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929667, "uuid": "15d75ce2-6a74-4608-a3eb-0ab87c3fe51a", "value": "1536:o2beTpNb9DERkLMurNpZ3efJp68E1wYqpvd00PUmkVmSFxBC7vXZX:o2cNJLlrvJF1KvdlPUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639929667, "uuid": "befa698a-a848-49d4-9be0-1a6e6f101b74", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639929667, "uuid": "3c1ff412-e869-4e44-b667-ca2b633ad286", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929667, "uuid": "b10a261c-230e-4733-afc1-7e57f1299dc8", "value": "a5e03f780e8de0acae07c46ba91a19af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa0172a-60b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639907216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907216, "uuid": "df430dd6-9055-4185-b452-48d3ef74c335", "comment": "Malware payload (Gafgyt)", "value": "459fa7eb5ec82a305b7fff4ca7945519", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907216, "uuid": "c2614a29-e3c0-4b4b-8289-a7fab4a136e6", "comment": "Malware payload (Gafgyt)", "value": "300abd48b1b4d23dd15520ca24be699608c201cc441486c95196459d061acbe6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907216, "uuid": "f2557798-2be8-4592-983f-ca58677a8bbd", "comment": "Malware payload (Gafgyt)", "value": "8e3087eb7c7e5a339413eb2991f186ea1b3a3c17", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907216, "uuid": "60523754-e11e-464b-8a9a-b7e3c0b016ab", "comment": "Malware payload (Gafgyt)", "value": "872071f7ff7dfb0d493e02f6e2a211074ac9e3563189212d4f037f6f06d335614996454a87fb0a56e1e460b0cb56d3dd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907216, "uuid": "de16d057-56c2-4afa-9af1-de8c386899c8", "value": "T17983082B9251C1BEC08346B12ADF9961AC73FC390B3662067395BE6C3F36DD85E99341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907216, "uuid": "fc2fb208-b04c-4257-a4a7-d11eb54ad253", "value": "1536:7/u1gtrsMcAoaEeI6FIawxyJaZ67hCPfB61BD6wOD2I2naJRU:7m1gZLjI6kxyA67Q81BD6wOSIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639907216, "uuid": "e7bedf31-751e-4b1a-afd7-677893eb1a37", "value": 88491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639907216, "uuid": "c5da8234-cfa1-48c3-81ef-36be429024d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907216, "uuid": "1b126dd8-c5bd-46a6-b7a2-3d363f0cdb1c", "value": "459fa7eb5ec82a305b7fff4ca7945519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba506123-60a9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639904263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904263, "uuid": "2b481363-cbf5-4a31-896a-78b4304432ac", "comment": "Malware payload", "value": "9f883f2908f53b5fb73c1be1a271f740", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904263, "uuid": "57842f14-40ea-4f38-adfa-228f77d5bbcb", "comment": "Malware payload", "value": "32ecdeb650c1a54310c61847b3c86732290a4df1b51e95238868555e144ca9a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904263, "uuid": "68ebf0b2-4611-4be7-924e-d78c823ead0a", "comment": "Malware payload", "value": "8c58e0e886a615cee214ae5d861991cb95739026", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904263, "uuid": "1aa66b4f-4c84-4280-978d-18c597dc0eb7", "comment": "Malware payload", "value": "3e740a068c1ab2216d93d274b3e8fa7c7507a06ca873fa0a94065cc36eaffd725c808c544998488f83f0204241c2cc29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904263, "uuid": "14970fec-3bb2-4b22-ab53-f3cb923c36d2", "value": "T17FD53359854699EFF3A20EB41D0CDCD408877BE49ACC3573D63F0A5D723A40E7A285EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904263, "uuid": "039fdcb7-5de4-4e14-8eed-4d1eb7a4026e", "value": "42b27a080e9ee0252f310f33fbc7cafc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904263, "uuid": "eadd5abe-1d1b-4d39-ba7e-e1a33082d40e", "value": "49152:6OH16R/I22DHXu9c92R6TzHY1jcvO8xzr0rYxGf5NXxCvhQw:OR/I2QHF92MTzHY1jcvNh0/fbXxCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639904263, "uuid": "a5aa3720-b0df-4415-831d-8ed990656564", "value": 2849792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639904263, "uuid": "965f638e-b252-4a1f-90b6-a84dc745920c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904263, "uuid": "d8f00d11-6852-4e39-841b-3c316697f229", "value": "9f883f2908f53b5fb73c1be1a271f740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b7e26e-6089-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639890395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639890395, "uuid": "2a2d3fa1-b4c7-48a1-bef6-fdea5952a1cc", "comment": "Malware payload (RedLineStealer)", "value": "dba1495e97de30ef46a3c2c3bb64732e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639890395, "uuid": "467d0b95-5c26-4b17-a2a9-ed43fc928a7c", "comment": "Malware payload (RedLineStealer)", "value": "3382a19cfeb458ea2619cbdb3f9d55af8ef648b732a90588a942341c33d51b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639890395, "uuid": "a05790d9-6c73-4d31-a540-f4609cea526d", "comment": "Malware payload (RedLineStealer)", "value": "4b6e27cb729dff01c101056170991c3c5b3bfc90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639890395, "uuid": "0bdcdfec-2408-4b92-a52e-d75c5c80bd12", "comment": "Malware payload (RedLineStealer)", "value": "400edd888f94bb7b37e4b4a4dd361a9b086d82a8d32c78abc8db74dc9aa962b7f18e9610c3ad71014380dbdea8edc2eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639890395, "uuid": "bb090c7c-b31f-4cfe-9362-6bca9cc429ca", "value": "T12894CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639890395, "uuid": "b27a785b-a470-4a0b-9a90-b88f929a6ece", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639890395, "uuid": "edfe2adf-c8c9-47d2-be9f-28bc24c4c807", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639890395, "uuid": "7cf97294-c557-4921-8cb0-b794cda474d2", "value": 411185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639890395, "uuid": "529c85dd-0a9f-4b42-af5b-56e59ecc1d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639890395, "uuid": "8d988b34-74ec-41a4-b1e9-472cf7ceda7a", "value": "dba1495e97de30ef46a3c2c3bb64732e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45c2db1-6060-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639872953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639872953, "uuid": "b2dfdb7d-3c25-4c1a-98e5-2b46625e9f30", "comment": "Malware payload (CoinMiner)", "value": "c9284baf6e08d9893252ed57bc85aad7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639872953, "uuid": "7bd1bf00-210a-4165-8778-637bbb2a9da6", "comment": "Malware payload (CoinMiner)", "value": "34f3f2e415aa7276c9b1bb51dbe4928e3847c8e95bbbe0dd69dfd8a749c55a46", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639872953, "uuid": "584e2266-d097-4418-8499-501003dcf194", "comment": "Malware payload (CoinMiner)", "value": "96e6cb3e129d2ea62dacfcc4f7119de211ab014a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639872953, "uuid": "409d0931-df7c-4b70-88cf-64b30e03430f", "comment": "Malware payload (CoinMiner)", "value": "faa45377265702ca7e0718b0725bb163d85ef4673439363e6a7af027dc47d6336f58f0fa70e3713e26be7c1a3dbc8779", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639872953, "uuid": "ef4779b9-ea47-43bb-9da3-f54b15345685", "value": "T115E53393FA5FEDF4D2161879C59420219F0B08736FE358659B9AAB0E31F752302CEB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639872953, "uuid": "5bcdc606-4b81-44df-953a-0b8905e24340", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639872953, "uuid": "1cd3f6f4-6076-4560-bf66-ca9ac452f43f", "value": "98304:fh/ZzT0Gk6VhEQHicVqmW/3Y2HAaYVJFM:bT0UDJCEqm0o2H1YNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639872953, "uuid": "e88371c3-81d1-45f2-b373-cf91b6bef15b", "value": 3278336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639872953, "uuid": "1bbc844d-79ac-40ac-b382-e660c985383b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639872953, "uuid": "6ce5e6f7-5ae3-4f11-b8f9-5df58dff76a2", "value": "c9284baf6e08d9893252ed57bc85aad7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e247982-60af-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639906578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906578, "uuid": "2409c2b1-7aee-400a-99ed-f219a45d24db", "comment": "Malware payload (Gafgyt)", "value": "352c322cc628f7753538e91224d15f0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906578, "uuid": "3bab2bd1-7ad3-470d-a0f4-82214802fc0d", "comment": "Malware payload (Gafgyt)", "value": "359ce8a7d7df066fd4dac02581d6b9eebf050c5d980e6180e2c26d4d1319e317", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906578, "uuid": "c942f26e-20a0-49dc-a86d-814bd1eb925a", "comment": "Malware payload (Gafgyt)", "value": "f168a8c66789df7c451f8289504e64927e4508eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906578, "uuid": "703a791b-ba21-4cde-b840-41a85b4b6666", "comment": "Malware payload (Gafgyt)", "value": "d6bf012daddd2646845e9ca48a1805f72bfc70a9b9fd1cc8877a4f568a83f6718040fbc5258d2a97df03f6f65ce88c4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906578, "uuid": "002b5360-eef4-4fab-b8d2-a6a452029216", "value": "T1B5730849E552C6F7C4821BB20297BAEE0765FD394E7A9E49F3083CF49B724D83919311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906578, "uuid": "423fc773-97f6-49b7-8dc9-1c3358edf4d2", "value": "1536:JC6t6zAYiPvoVjRWS7kJOSRHLWFCL9hmtAdjFcw29yYZqLZ5:x6MYiPvoVjRWS7RSRiwL9hmtAd6w20p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639906578, "uuid": "580d0fe2-eae8-4745-9c5d-67841c1afb46", "value": 75548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639906578, "uuid": "82f62df6-f179-4a4a-93a6-07351a0d64c3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906578, "uuid": "eb23af50-baef-445f-a7d0-a4b59e548cb3", "value": "352c322cc628f7753538e91224d15f0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deecf136-606c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639878125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878125, "uuid": "55961c8a-46c0-4d67-82ca-1361f73292d2", "comment": "Malware payload (RedLineStealer)", "value": "2740061c31d14530ef60e493d4dc1f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878125, "uuid": "c68c741f-b409-42f4-952f-1179a154bfaf", "comment": "Malware payload (RedLineStealer)", "value": "360b89f7627e7ee00e85cbe0678a32837ad2f0030de0c4e50e72421e93fe331b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878125, "uuid": "6d5ece63-f219-4001-8bb5-e9f5abc2f6c0", "comment": "Malware payload (RedLineStealer)", "value": "f7aef03d2e091cbf6725d7ddcc671b1885094ca6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878125, "uuid": "82a5f79b-d173-45cb-bb64-8983acb99eb1", "comment": "Malware payload (RedLineStealer)", "value": "aa88d58d5e5cde85c9cf77a2f1c66a190a8bbf5e4869500ea830886803de01d50036f13001d35b84c08f20b39ac2beab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878125, "uuid": "1e4d6000-d94a-4d55-8c4b-cc6782ed7349", "value": "T156B33A6033CC8914E7BE4F75B8B151A983F4F0176911EB4F5EC654ED1E62B80AB21AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878125, "uuid": "90878306-94bb-456c-8a99-c9348c50c774", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878125, "uuid": "9e7fc7ca-3f53-451e-9b16-5a2bf6a5e5fd", "value": "1536:IsCBG0AhGoHDYWEZX0KCrmr+KBvO2bZDKct0jvmhbx4J9f00q:IsCBLAlHDQZXKS+KlFxUvKsBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639878125, "uuid": "71f27593-6053-4f95-984b-2af187ef539e", "value": 109800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639878125, "uuid": "9c6df382-12c9-4a6d-b4b7-c464ef3e882b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878125, "uuid": "1ea44158-a84c-48d4-9399-09e0c0e45d97", "value": "2740061c31d14530ef60e493d4dc1f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f509c824-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923689, "uuid": "97b484ab-b329-4c28-aab5-73367a73fcac", "comment": "Malware payload (Mirai)", "value": "049e422734914512c8d62b827d8d74d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923689, "uuid": "17d2a522-b0a6-47f7-aa8c-8c3d5d4599aa", "comment": "Malware payload (Mirai)", "value": "36a87b25e7c805cc2f1f3c6fdeadbc830a2ed6d8a1d52558de2c8d9f3d9778e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923689, "uuid": "320bf1e2-a6b9-4ea4-9c94-80c239db37cb", "comment": "Malware payload (Mirai)", "value": "13a140603a54898e49b42418ee3aa62284c377e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923689, "uuid": "8242c85b-19ac-4822-bc81-7b252ec57993", "comment": "Malware payload (Mirai)", "value": "995578c3c6a9a68f66bedf2843e722d7659516a201939667bebccc3517f1f411f16cb4f4d2aa2d91ba76f4ef0db41d2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923689, "uuid": "60a10ff0-acbb-42a9-b675-0e9fa75cbb21", "value": "T150C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923689, "uuid": "4588c795-9587-4da3-9ba5-934e71425f31", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpU+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Eu+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923689, "uuid": "2a32b5b7-68b7-4fd5-bc0c-9f13397ad3bf", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923689, "uuid": "526e5b16-20bd-461f-a6f2-cf96d5606aa5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923689, "uuid": "70f707a7-f71d-428c-96ed-1d85298b978f", "value": "049e422734914512c8d62b827d8d74d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2154610e-60af-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639906583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906583, "uuid": "b5e51be0-5d80-4856-b1cc-1da69d24d9eb", "comment": "Malware payload (Gafgyt)", "value": "8a568adb6c483eec90c73fe98a6e976b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906583, "uuid": "21925bc4-94ac-4b5b-a8a6-8b92df1d7e13", "comment": "Malware payload (Gafgyt)", "value": "36cf7703d97200cdf6dcf97162d0a44da9ffb92dbcdeb5bda4ebbd1b0278e8aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906583, "uuid": "6e258433-ec04-4a4c-b8c6-f79d194e06fe", "comment": "Malware payload (Gafgyt)", "value": "8c9d7a8ef709ba14d2ead725a8ee58a43bc2dbcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906583, "uuid": "4c8a3285-1ecc-42f5-b57c-161af916e2e1", "comment": "Malware payload (Gafgyt)", "value": "ae49d230101ab7089406b9a8f64ab7d94a5884127ca239b84e29b1963b97f682eabb346ce5bd7d5866b8ca2b619b5c4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906583, "uuid": "c148d022-e1d8-4a8a-94c1-aeeea81c8070", "value": "T17B9318A2FD41EF66F00B9A3A05C707246630FF660B931E2173577A669A763C47427F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906583, "uuid": "da21d831-2883-4c4e-a647-f1035fe2538b", "value": "1536:i4sH1dP3FvUaiomX8GehkhBqXowiUz+E4TpbNw7ybX8sHV3IHUIN:i4sVdPVNmgQBqYwDWbNw7ybZHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639906583, "uuid": "f86bdd60-3b7e-46bd-baf1-7ec98f6b2d7e", "value": 89349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639906583, "uuid": "c062cddf-ad92-4908-bbea-da0fec0c844c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906583, "uuid": "27e2026c-973c-4d6f-9bd0-41ac17618e42", "value": "8a568adb6c483eec90c73fe98a6e976b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41acea1a-6083-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887740, "uuid": "4d908528-b769-4636-9ae5-866457527074", "comment": "Malware payload (RedLineStealer)", "value": "59cfd523772d3e05713ee4ab0c5c1671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887740, "uuid": "55d8e611-097d-4c1c-935d-6b1ea9af5e71", "comment": "Malware payload (RedLineStealer)", "value": "3797da35c19a46cec3aee8ed773b73c52e3bfd6ea0c0f09bd05e1262cdf1f0bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887740, "uuid": "40ef4704-37a0-47c9-9c4d-a4df3dc71831", "comment": "Malware payload (RedLineStealer)", "value": "7aa9b046c9ebd8a5b25c2fad00a90c2e3c7ea19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887740, "uuid": "0d03ab3d-0b8e-48c6-9168-f03f4e7693fa", "comment": "Malware payload (RedLineStealer)", "value": "ba5d1deafab7f57469780e1a40d36e2e7bdc8a385b35d43617334f2a8c0194ddc32746dc55a01da072129a6167913092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887740, "uuid": "b977c20d-5c85-488f-990d-de76d9bf8534", "value": "T1A3549E10A7A0D436F1BB52F489B993BC793F79A1AB3490CB61C117EA56386E0DC7035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887740, "uuid": "063ce3a7-7366-4679-b4ab-963b6467cb07", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887740, "uuid": "bf14ac62-f86e-4df1-8d55-4505b50a70d4", "value": "6144:XQDyiKVhDP1Q/HzVnR+mJzqar3Sq0BqscjDBEv3P7hhT:XNnVNP2/zVnR+SzqarSO6v3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887740, "uuid": "3a485bb2-f5a7-4d38-879e-41c63cd9f3e3", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887740, "uuid": "cbaa10e2-fefe-4314-a2f7-f9ac12a1b055", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887740, "uuid": "69bb6b7f-bcbd-43bb-9ad0-6ef17f4b3eb0", "value": "59cfd523772d3e05713ee4ab0c5c1671.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae56a4a-60e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639929631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929631, "uuid": "aea40ba5-9f56-4b57-a6bb-e9a051d98279", "comment": "Malware payload (Gafgyt)", "value": "020281545a592ea767b4f0e3705d0939", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929631, "uuid": "c355d890-c30e-47c7-92cc-38af7e9647bc", "comment": "Malware payload (Gafgyt)", "value": "37ad2b2f706004964a1da9b6ce0df83f95e9a38dbaaaf87e757bcfbd202c6213", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929631, "uuid": "247a435f-b7d8-4fc5-aba0-7052348df380", "comment": "Malware payload (Gafgyt)", "value": "ac085e95a83c540c56cf4cf963068c7bffdbad9d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929631, "uuid": "fcb7a4df-5aa9-4574-a0c2-a3282861f8a0", "comment": "Malware payload (Gafgyt)", "value": "12ea58f92b574c5403f050a2d64a06ef15894ccc64a1ab26ebb471994026da2edb92a856a4ac805f7164b7ea37c5d044", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929631, "uuid": "1d001943-da14-4afe-a092-94c74c2eb1f1", "value": "T13EA33A33A753D6BAC09322F417DB9675A823B47C0B32312B33D86DE56B06DE91E5A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929631, "uuid": "a4969b2f-84e4-4261-b90f-230835c9067f", "value": "3072:2K5ejA4jB4h89HOPQzM9FqVyF9W9vmrYuOHy+ZNzX:sHjBzuPQQ3k9vmrYuOHy+ZNzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639929631, "uuid": "9003c9df-3caa-4665-be0b-805ca1fa9efb", "value": 99332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639929631, "uuid": "4d747041-0393-4d9f-9cf3-bd7f18388c83", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929631, "uuid": "e93376db-9176-4558-8b00-9b9eff90093d", "value": "020281545a592ea767b4f0e3705d0939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1871c1-60a6-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639903009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903009, "uuid": "ff88c1b6-81a0-49d9-8e46-82eb61b9ffa5", "comment": "Malware payload (AsyncRAT)", "value": "ad83afe771466b7802c533aa466996a3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903009, "uuid": "c1d08ac0-4ffb-42fe-aeaf-fc0ff88d46d4", "comment": "Malware payload (AsyncRAT)", "value": "37bf8bec836eb65e370ee16af46269fef53464a6ecd0cc4fcfa95b556dbee514", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903009, "uuid": "43658b9d-797f-4e0e-ae4e-d03d5e02f3d5", "comment": "Malware payload (AsyncRAT)", "value": "4ff76c80146bc5bd01b5ba4a13ee8a823c17f905", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903009, "uuid": "19c8c181-c28e-43f2-81c9-ae931e778716", "comment": "Malware payload (AsyncRAT)", "value": "2756eefa4eb54ad356340687986871e6d110c6d54d7d86cf1b62f8d66b21914b1057d2a0d3cdb302ee863cc0442e9fc2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903009, "uuid": "d1684dc2-c13e-427b-bfcb-f2dc8c6d1952", "value": "T12D233B003BE9852BF2BE4F74ACF221458576B2633603DA4E2CC451975623FC29A525FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903009, "uuid": "02a7f0b5-a659-42ab-bbed-0af644da13a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903009, "uuid": "9a55a71f-a037-464e-8cbd-55a2274e2ebf", "value": "768:6u/6ZTgoiziWUUM9rmo2qrZUJBKblPIPOZc0bntBpi5YJNkfCvBDZcx:6u/6ZTgle2RK2POpbnti2wfCZdcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903009, "uuid": "5ecf0186-7b1b-44e9-b320-2111870f910f", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903009, "uuid": "eb6b6f94-cef7-4e9c-b3ed-2e1e2af2a159", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903009, "uuid": "e246d95f-d7a0-4f28-975f-58020101a4fa", "value": "ad83afe771466b7802c533aa466996a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d22470-60b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639907205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907205, "uuid": "57313c29-dfd7-4193-b13f-a2bf9d5e7d1d", "comment": "Malware payload (Gafgyt)", "value": "1175d7bb78bdc22f9ed78a502f9140a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907205, "uuid": "bc97c175-40a6-459b-8453-4767c2c3ca74", "comment": "Malware payload (Gafgyt)", "value": "38a7381c2355cc057ca582737e9acdcdf99f3e2e86434bc4096d8b4e8419a639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907205, "uuid": "7dc2e47c-20ee-4151-a13c-44ed21888373", "comment": "Malware payload (Gafgyt)", "value": "e520d0185e6e46a9a560ebdbb3fc74b7677ff937", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907205, "uuid": "cb494963-5a23-4096-b2c1-c17870ef8611", "comment": "Malware payload (Gafgyt)", "value": "1bbcff849414200bdc870575fdf1cafde16e708a3469d3488ff04e07fa11942f626411c6e41fb46807c4098dcbe42031", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907205, "uuid": "db7fe99f-ee46-4703-9076-0110fe370ee9", "value": "T1F6B30805D9905737C2D22BBEF79A82CE73221F989797331196287BF41BE1B9D1E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907205, "uuid": "d91082ce-9b35-42ae-ae57-22f813299745", "value": "3072:D6z1ZqLgV4ZQGBcD3i/lMpaLhmVAw/iYMna3sHUxglgeYlar+RbYa3J2W:jjna3sHUxar+N3Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639907205, "uuid": "8ef99e71-a1fb-4521-bd9e-5e7fbaeb2ef3", "value": 117409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639907205, "uuid": "555f1261-507a-45f6-9a57-6b4044e8e209", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907205, "uuid": "7c1206f9-9bbd-4228-a89f-c64ea3c4bf1d", "value": "1175d7bb78bdc22f9ed78a502f9140a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7f766e-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639923619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923619, "uuid": "e437454b-9285-4af3-8b28-4f55045cf702", "comment": "Malware payload (RedLineStealer)", "value": "932c51166041c367e743ba5cfceaeb8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923619, "uuid": "bc8ddd36-f80a-420b-ad31-15216f5d764f", "comment": "Malware payload (RedLineStealer)", "value": "3c849266011821a8c1ae2038a9c97d0bc7cd72258256ae1d644e585e6e8658b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923619, "uuid": "c73ae23f-243e-4f53-ad1c-a07668c46478", "comment": "Malware payload (RedLineStealer)", "value": "69dcda6e5508949ad1d7d422625beefc8efb688d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923619, "uuid": "efdd8cc8-bf07-4617-9f1a-81e0585e708d", "comment": "Malware payload (RedLineStealer)", "value": "28d696f7b1baf6fe670bcfa696704becdfa71432c426ae1909fc383762edc62cd9183dad65407a3c030a36c911e69774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923619, "uuid": "304c048b-c1b7-4799-b3d1-e7a3cdf65b9e", "value": "T17884BF10B7A0C034F4B616F88DB9D7A96A3E7DA16B7490CB71D536EA96346D0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923619, "uuid": "be2ffa7c-a4ca-48ad-a2a3-70a087b64046", "value": "5f124a733ee23e7a763027f872397aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923619, "uuid": "5af8cfcb-ea3a-48c1-abad-de18203c529a", "value": "12288:ZErznDitj93ZSKoO7itLjhw0Z+x/lssTg:mS6zOGpj5i/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923619, "uuid": "7fb61206-4b74-4f60-b270-6a465639892a", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923619, "uuid": "977ebb8f-9754-4596-9633-3ed36b657281", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923619, "uuid": "97c831ef-e25f-4679-9f25-d14f168b6a88", "value": "3c849266011821a8c1ae2038a9c97d0bc7cd72258256a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0364a3f-6115-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639950605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950605, "uuid": "2ad7ca63-3177-403d-8141-540fe8250e41", "comment": "Malware payload (Mirai)", "value": "c57459c6bd4c5e699e936225ef064330", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950605, "uuid": "4424c052-864c-477f-bb0e-1f528c9789e5", "comment": "Malware payload (Mirai)", "value": "40258a6ba719605c38e01f171749650b794caad8748265bfaa9da97f207c047c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950605, "uuid": "0ff62564-307b-4e7f-ab76-ecab9a9aaadc", "comment": "Malware payload (Mirai)", "value": "5cee42f9ce09b08abe908526b1996f2a915ba87d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950605, "uuid": "c9b70d1e-c974-4612-8186-cc04d37c3fe6", "comment": "Malware payload (Mirai)", "value": "a8e66116c5c45d70ec1f11eb1e483f43033ac6f943e590b23272aa41f56abf6e6ab28bca3ead0ba9410f910998ecdb96", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950605, "uuid": "f63f9b82-7270-4a3a-a74d-51b71dae7374", "value": "T16113F1910307B632D5B068F2D71C83DBB3954AFE6ADEF1D33694089A62C899318F9165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950605, "uuid": "626ba59a-700f-454f-b3ca-c79ecd253fcf", "value": "768:ScjA4gstbVyapPnfC/sV0T7bH9Bu0FZE7ipfEC2P5ftzGAMjFSprM/Xehnjs3UoE:SF4gstbVjfkse7BW7iFgBfVG1SprMGhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950605, "uuid": "52499451-5e7a-4ea0-a153-339d5a6ce6a9", "value": 43992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950605, "uuid": "cf6567c6-3605-4171-83f4-3ab048cf93c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950605, "uuid": "30cdaca0-08f1-4101-849a-295cfc3e64e7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2a1244-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923670, "uuid": "7802da81-55b1-416e-8efa-40211122a933", "comment": "Malware payload (Mirai)", "value": "dc1533e4d920f2bdac8bdd38c4c1fff5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923670, "uuid": "cdea5152-e542-4a47-a1e0-23ed00de73e4", "comment": "Malware payload (Mirai)", "value": "4045daa3434f97de39978ff34c2c5d02b579a9b3080afc22acb56087f06aede4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923670, "uuid": "11b53bc1-dbff-499f-810e-641d1f557d12", "comment": "Malware payload (Mirai)", "value": "b1df1d70ec0fabb085ae81fba06a91103ff993a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923670, "uuid": "ffc702a3-d87f-4fb4-9c1b-df3f8e68e600", "comment": "Malware payload (Mirai)", "value": "67af2a269f2342f18ceec8ac575011ff4831bebdfc07d3514113bd91a1134edc7de87bebf8bfb677258e5d659325d35e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923670, "uuid": "975a0140-c8c3-4587-8f0f-a3a559a05aee", "value": "T1A2833C02E743C6B3CC830BB2029BAA665931BDAA1E26DF49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923670, "uuid": "2a13cd14-3bf6-4b1d-9b40-624c1b65da04", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8L7WDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YX2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923670, "uuid": "2e8cb7da-a0bb-408c-b968-9d20c7292834", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923670, "uuid": "4006fb47-0ce7-47fe-b8a6-9ea1e844d96f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923670, "uuid": "c2114656-744d-48e9-aac4-7cbdb7e53c8e", "value": "dc1533e4d920f2bdac8bdd38c4c1fff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9cfdcf-6107-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1639944665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944665, "uuid": "b320b433-0082-4cdd-b209-5de625702ea7", "comment": "Malware payload (AZORult)", "value": "5918b91ac2931af0267e4af06f3fd2e2", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944665, "uuid": "a3774fa6-fff2-4a1c-ab3b-e5320e6e8e13", "comment": "Malware payload (AZORult)", "value": "41acb7b14d4167374da9039e1324caac71b397bf246abb50cb9ae1ca197b3cc1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944665, "uuid": "e5b2cef1-0a52-4e64-9df0-1848c52e4ce2", "comment": "Malware payload (AZORult)", "value": "1ce7cccf52a0a569d013c0a91efb4f808c3c6194", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944665, "uuid": "2fec6ee4-713d-48ce-a832-7d853c4ab76e", "comment": "Malware payload (AZORult)", "value": "2811338b1c74251c5c0268c3f5215f94fe66aff90e7aa9675f5c324ced019661e1952678232e41e958ac7b2af9c53060", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944665, "uuid": "fc2f4d3c-53c4-4dae-9a57-cd339633e54e", "value": "T188A3161FA5B41426E5FBDFF32C27772129256C2008DF0A07715D6E981FB0F8A67A063A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944665, "uuid": "fd127c28-2360-43a6-80be-3f2e4f28280e", "value": "489d1d3cb87fc8295d24d8f992f96304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944665, "uuid": "f2e29084-24d3-463e-8280-81e3be684e6b", "value": "3072:ZaIH38JFPi5C0C02y1uewWxEPpcPLnnpt7:jH38765C0D2y0ewWiyPLnnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639944665, "uuid": "55cf5cc2-17c5-4e60-b466-b0f26076974e", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639944665, "uuid": "260a9bb2-f8e6-4dd1-ac6b-ffb72eea3dfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944665, "uuid": "a8b46eec-85da-4835-92d6-cd95eff19492", "value": "5918b91ac2931af0267e4af06f3fd2e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46964ab8-60a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639900203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "01bc0722-2478-4441-afe7-d97c8df0174b", "comment": "Malware payload (Mirai)", "value": "38582c5bb0952ba66825fa180085b2c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "3f759927-1d0b-4406-a411-6608247c8a3b", "comment": "Malware payload (Mirai)", "value": "422f2fd4feaedd2e2e8e439d3e4a0df93c156962bf7497d3c0c7ba67d66cb545", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "3038dd7b-a52f-456c-b874-08ce360b84af", "comment": "Malware payload (Mirai)", "value": "0455a6302f44d6833dbe36a43cc3ea7d685c0a94", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "6621eb2b-18a5-4898-8fad-7f09301e63de", "comment": "Malware payload (Mirai)", "value": "ac47d744ba79426aaef8583097266896504881627a9779bbd7a24f6b61342f1f838d1385aa1711f67690b9fcde6b7207", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900203, "uuid": "6798cba3-877b-433a-8db3-a1774fcfdf2f", "value": "T194633A07AD8085EDC089E1B802BF7275C066F1BC2775B1CB6BD4FF2B2A15E601F69949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900203, "uuid": "68e942c7-f459-4f76-83f9-c16a7f5d8ee4", "value": "1536:T/u7iGGEUDUmclqukZVteKDkGM1bjmRU07YvpgxU1j:at1UDUXlqVkUkGMBazkvUU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639900203, "uuid": "67157616-84b5-4889-9762-807298bcb655", "value": 68544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639900203, "uuid": "2de8cfa3-94b4-4a12-918f-c00d6646f311", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900203, "uuid": "ab174926-1e39-4874-b31b-55dc8b8a773f", "value": "KKveTTgaAAsecNNaaaa.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066a19cb-606e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639878621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878621, "uuid": "46fc2182-3e2b-41e0-a7cf-989861ece0eb", "comment": "Malware payload (RedLineStealer)", "value": "3211d985ee354287b4e9d8c65147004d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878621, "uuid": "cb2f3daa-145f-489e-a1bd-c592f2caea6a", "comment": "Malware payload (RedLineStealer)", "value": "450f58cd4e9bbf4d678f1665b953cdb43ab6cd71e533c24596df5bfd42b9345e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878621, "uuid": "bb2867de-fab5-4d39-9818-b9995537e37b", "comment": "Malware payload (RedLineStealer)", "value": "c90a48a6f3ef9b46c3678ea5788f3f3fa7169724", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878621, "uuid": "2d24157d-8c1b-456a-b292-7742e6db7fa6", "comment": "Malware payload (RedLineStealer)", "value": "ed3e9ceb55114dc5de32f61e0abff7f739b1cf38dcdb396db11a052bac5f827df70f9ac22f2aede39a5f0293e882c52e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878621, "uuid": "8aa8e795-e73c-45a6-bddb-1651678a6b43", "value": "T1C5B35D6073CC9614E6BE4F75B8F1529843F0F0532411EB4F6EC664ED1EA2B80AA11AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878621, "uuid": "a7c343c2-02f1-4875-9b79-5ebaf44d1268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878621, "uuid": "c7329401-bef6-4506-b374-66a6dec78d3a", "value": "1536:3WRG0AV6OHDI+BTfoKmwLAGhBTQA2bZDKG/0jGsbx4J9BA00Ruj6:3WRLAfHDtBbzLrA7hqfsYfuj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639878621, "uuid": "0ef1295c-5ef1-4eaf-b65f-c1b9495a15a0", "value": 108752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639878621, "uuid": "2475fdda-6c80-488e-8850-f1f46e7b9e0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878621, "uuid": "143f82d9-17bc-408b-b8b1-3e3ae3ae320b", "value": "3211d985ee354287b4e9d8c65147004d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc43f67-60d1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639921532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639921532, "uuid": "bd1fc743-da74-4fe0-960f-e83a025f232e", "comment": "Malware payload (RedLineStealer)", "value": "b59f70fefc7409ad33e9314fe271d0fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639921532, "uuid": "7c9ffe28-ee58-4c7b-a6f5-0d2cfd0ca374", "comment": "Malware payload (RedLineStealer)", "value": "453b6adec038fedeabe12270e384a05a91d5bf6cf9b660765999402e4433adae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639921532, "uuid": "b959e264-066d-411b-9f15-95ce83566649", "comment": "Malware payload (RedLineStealer)", "value": "6edec36a0cad13924092df9f72f69ee46e0adbd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639921532, "uuid": "0e9f0854-d97b-47fb-910b-b2eeae219048", "comment": "Malware payload (RedLineStealer)", "value": "dd05fd68c8dff96f20cb7291e1fff9bd461b0d4dbb808dfc3ab68ddb2313061ea31a88e3222b9f1aa536b60e3b1deb32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639921532, "uuid": "db6a25bc-b8cb-4ee0-81f6-effd534c1d04", "value": "T15D15871BEEC387B9E943077645F3AB047BB550D90F2B03D89307A5F16A891E1AF02B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639921532, "uuid": "ba155c96-46a8-409f-bbb7-ee5e2c6cad3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639921532, "uuid": "73b53304-5387-4756-90d1-c70825c56e56", "value": "12288:5Fpr2xs0zWkBSq6LpfNSm8OVpksQXWr6tXXg:L3ZLpYm5BJOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639921532, "uuid": "e524860e-46f3-4f8d-88ae-b065b622d44e", "value": 951176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639921532, "uuid": "170af926-a44e-4773-8424-19f05bab3663", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639921532, "uuid": "94a2a982-bab9-4729-9ea8-70585f51afc6", "value": "b59f70fefc7409ad33e9314fe271d0fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dddd1aa-60a8-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639903786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903786, "uuid": "4e0e69d2-3199-48e4-9b6d-ffa337e94544", "comment": "Malware payload (SnakeKeylogger)", "value": "8a48683d52c1edc87d16fa144b337e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903786, "uuid": "a307a3fb-3a27-43f9-b945-48edc7474881", "comment": "Malware payload (SnakeKeylogger)", "value": "46323a15fcb7481028dbcbe41ab32f012c8d49fc59fce3b360b908b71c8c18df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903786, "uuid": "ac4d89eb-f4ea-4f10-bd9f-235c384b5049", "comment": "Malware payload (SnakeKeylogger)", "value": "bcfb14ce47e04faaf77a8f7128cddf5f2602ebce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903786, "uuid": "ea76f96e-4ad9-4729-b9b7-f2ecb119a0eb", "comment": "Malware payload (SnakeKeylogger)", "value": "4225e538b15ed2d322ef2094b2b4ddbcbfa608dddad2d0a907af261f348c887b26b22002bbfc2efccf9dc6236ed61c02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903786, "uuid": "1b0b5455-873b-45dd-aafd-f0402e7b3a6d", "value": "T108E45A9238004FF2EB67D57BF40C83E042960FB99C834615A59FF6B3DBD9A177999220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903786, "uuid": "36d16cf9-84e1-4859-a3bc-bfd157da32f0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903786, "uuid": "66ea37fa-8cf9-4948-8a46-1d1d0b391ab1", "value": "12288:S+q2PJLJcFqqdfQ4K17XV/4KZG0EpHH2HqRE1k5zPc:S+q4JLeFqUCXdy5nREyFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903786, "uuid": "dc37be7e-8cde-49d1-9ff1-c1f35456f2ef", "value": 657468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903786, "uuid": "cf2382c6-5033-4541-ac5f-1961bf83457e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903786, "uuid": "705629be-4b3f-434a-8fef-6247bc4ad55f", "value": "8a48683d52c1edc87d16fa144b337e87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f42722-60b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639907188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907188, "uuid": "d3d22f71-d64f-447c-af48-a5293037aa9a", "comment": "Malware payload (Mirai)", "value": "ab278a9a2aac8a7087045d0e46b6f4b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907188, "uuid": "ed88b7cf-010d-4859-9c25-42aba34d315f", "comment": "Malware payload (Mirai)", "value": "46d7b7bd890fd6d510565bcaa57ed9eeef1c412a59c9e6946a8fa4c4161f603f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907188, "uuid": "b7aed78a-06b2-48d5-b1a1-a74bbf6fc9ee", "comment": "Malware payload (Mirai)", "value": "cbaa94bd50e7af69ae029f74408df62ade54344b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907188, "uuid": "b756bb1e-dbee-42a0-a0e6-35428737d5af", "comment": "Malware payload (Mirai)", "value": "a7c531e6aeeafef6897196aea76b221f4801a960539c1a2cffa9fb335b6b42bfd98383e74062dd3f3037ec9c39c346b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907188, "uuid": "abdb9094-13fc-4d12-af61-1e324353fd06", "value": "T179735B45A680D6F7D14306F1069BAFA8033AFD3A1ABBEE85F3587CF48B710847925719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907188, "uuid": "d08b3f23-e16f-431f-88a3-f8881aa1c79c", "value": "1536:Us4bw/gy6stOSV9zyjeYwMcpcWLfKBsRT2T/q/sIw26YBKLZ5:Usxgx+R9zyjeYwMcnLfauTu/DIw2DBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639907188, "uuid": "7f1a7724-2554-4bc5-845b-4ccc776a9877", "value": 74492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639907188, "uuid": "f819b8bf-9f4b-4ae7-a345-5645264e5f79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907188, "uuid": "a0fb6d9b-70d1-4ab3-ae96-31e74c3ae425", "value": "ab278a9a2aac8a7087045d0e46b6f4b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6e7a7d-60e4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639929639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929639, "uuid": "08f328fe-b211-4b5f-bafb-6a5f82bc8ae4", "comment": "Malware payload", "value": "cb179b77c015ef2838002a98cbe373b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929639, "uuid": "106cdb57-b717-46a9-92a0-0cbdf92d57ec", "comment": "Malware payload", "value": "47e290aa8cc3f5944f40be20249a79d824b120b1f5f39e3a125126b8a1be6545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929639, "uuid": "f52099ce-41fc-4b87-b9a9-2cbdd49062ed", "comment": "Malware payload", "value": "ef95dcf7ebcf5ad36986055bed96f6d7e37d0f78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929639, "uuid": "1c63b46b-5522-47b0-b7d3-547354d54dfe", "comment": "Malware payload", "value": "90ac08abd4ba69f368311956cae0ab1f982188ac05b83afe2778bfbae5b43e7c7e999e36d31f7705354c9bfc6103075f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929639, "uuid": "e9107148-20c3-4564-8b3a-1edba456d88d", "value": "T120A33943A72D0F83C4DB99B12DB72BF1876DB97112A361C1690BEE9003739B81517FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929639, "uuid": "f3662aa5-2788-478e-833d-c88e2e0144b7", "value": "1536:7QQfckMzQzgv9OtAC0QptczD3z+FavghTXvEmL49VqFjtUfkjX:7xH/JFDtczD3mX7vEmU9VqFBUfkjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639929639, "uuid": "8427b0ff-5a40-4a15-93d7-22939365d27d", "value": 99023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639929639, "uuid": "09cb57b2-ff34-4250-905e-b0b5c6dba631", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929639, "uuid": "ea11247a-fe24-40c9-8ea6-01b82dc33887", "value": "cb179b77c015ef2838002a98cbe373b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c25261-60a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639900205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900205, "uuid": "eb97e136-7383-41ba-8a64-8082f3b60517", "comment": "Malware payload (Mirai)", "value": "cdd0499a468b8b07178a6759301201b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900205, "uuid": "f02905f4-dc55-4f26-be13-45d26a3be6ba", "comment": "Malware payload (Mirai)", "value": "4b0978d53f8870ca199527f89cafc2b9eaadb156cd494b36df4b37a2d560b566", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900205, "uuid": "eb8c767c-095f-47fd-ad27-3fafd403f0fc", "comment": "Malware payload (Mirai)", "value": "d96776d8cb763ce617adf3b0b5c6715acca34bd5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900205, "uuid": "bc23db7d-b0ea-427c-b52a-ac54686db9c1", "comment": "Malware payload (Mirai)", "value": "cdf17c55f3b316bda176f0e4c5142cd7e019f99a2a368c163c7432ab25fd96d348d4f36ca4206419eff9f975aef9be63", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900205, "uuid": "71406a8d-2255-4e64-aa4f-7e60b4aa379c", "value": "T14A630782BC80E616C7C01677FA1F519E3315A7D9E1DA3242DD261FA07ACEC1B0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900205, "uuid": "ccf0c84f-2b68-4fe8-a8b1-cb4ad53943f5", "value": "1536:b4blEKw06Z1XjuxfEQcqm5YB8t46zHMSksJM3:b4bllw0We0484EHvksJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639900205, "uuid": "c3e3d7f0-52e9-4386-8d4c-5631d04d694a", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639900205, "uuid": "cad0ad2a-dfc2-4890-96fc-e55b9f37dbef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900205, "uuid": "f2b0be4c-59ee-4599-b426-663c74f3bfcf", "value": "KKveTTgaAAsecNNaaaa.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375a779a-6115-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639950429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950429, "uuid": "5cda0421-d801-44da-92d4-28bfc674d15e", "comment": "Malware payload", "value": "81e97cb9f0890fbeab86a9949ba4512a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950429, "uuid": "c15b52ab-33d6-4af3-9697-37147c97537d", "comment": "Malware payload", "value": "4bf5fec091ea8cfe9a467970c2acfc55e11bcc90fac4c38ae10bb99b5a8fa51b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950429, "uuid": "8d9a818e-658c-4e2c-ba7d-7b9679a6aef7", "comment": "Malware payload", "value": "ca92efacbf239c6eecf7fccd8a9b98a90d3e47dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950429, "uuid": "72a49d5b-2452-4a4e-abeb-e10552298232", "comment": "Malware payload", "value": "f93a774a0b7223806db64149c44c678db99495f5674eee56c7601032666a868dce7252b67ef355fe969a7adb21f2bb61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950429, "uuid": "f09f8e16-e05b-45a3-a67a-9a07b89ee61b", "value": "T12C937D95892D8D61C18C05B466E64B36F707A4318047EF7FD14DFB19AC4BA8EB2C73A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950429, "uuid": "d61c9384-a6e0-4b6b-b8b6-abc281254e1d", "value": "1536:AUEFyDIr7IPjBQbGMiqII4T9KfhsK/NUAWCYuaVvv4:Ey8r0P6bGMCbkfXNUAWXVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950429, "uuid": "b08f9a88-b802-40ad-a4f6-193df5a88983", "value": 91800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950429, "uuid": "41bd9fd0-aab4-4954-80b0-55578849cbfa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950429, "uuid": "16a123b3-d9ec-4f49-b230-38c61c8bc325", "value": "81e97cb9f0890fbeab86a9949ba4512a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac2739e-605e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639872078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639872078, "uuid": "c13e664a-b084-4b30-a2aa-939942bc2bf7", "comment": "Malware payload (RedLineStealer)", "value": "b08fe9a084cf378d8b32286658aefc19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639872078, "uuid": "eed15d86-97b4-4f00-983f-c2a5456f388a", "comment": "Malware payload (RedLineStealer)", "value": "4cb83b9e693e53ce2f51e9875b90bdde23f274d48ebe0aafddd32ada5f03b766", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639872078, "uuid": "e6dfe82c-b8c8-46b7-bb07-71ec7f372bd6", "comment": "Malware payload (RedLineStealer)", "value": "2ec2f598f692c4064192ee33b64d7e801bc0e3cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639872078, "uuid": "cefbc2ed-c174-4ff4-a3a0-bd1deec0723e", "comment": "Malware payload (RedLineStealer)", "value": "7316f47f6e620774e251e1874819cf489e2b6e668a7af76db75a270caea02668aac865782ab921447391c612dd874bd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639872078, "uuid": "44d7feae-c5b2-49bf-9cfa-35f2df92ec1b", "value": "T15D84D000B7E0D034F1B752F44DB6D3AC7A3E79A26B24A4CB22D516EA5A746E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639872078, "uuid": "a981f6b4-caa9-4eee-99b1-ad0467b934b2", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639872078, "uuid": "7ac0d713-0221-4436-b9e5-e5df6a5388ef", "value": "6144:KzshTve85lg2KTzLkvdq0nTUZKz9tyR4kS3K9RKElse+zTMwnqXOjhiEjrFPxoxB:P56uq0nAutyR0K9RK0se+X9PjrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639872078, "uuid": "e98ba85b-e28c-47f8-a9e3-799d32f41508", "value": 406529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639872078, "uuid": "c6ec72a2-aae0-4499-b4ca-dd282b77c6b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639872078, "uuid": "bf3e44af-26bd-4176-9ec4-a676d8f676d0", "value": "b08fe9a084cf378d8b32286658aefc19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9782e2-60ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639920025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639920025, "uuid": "ec862ea0-e5aa-4396-985c-5095b44df209", "comment": "Malware payload (Heodo)", "value": "d1b00bf19e06b4f928eba18a94157817", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639920025, "uuid": "aba70968-719b-461b-b44c-7d095d6f2480", "comment": "Malware payload (Heodo)", "value": "4dc941bc6eaf11e18b0a8210cb7413b1d6d93df0e6b0599352bbffc9e3bfeaa4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639920025, "uuid": "47f7f82c-1c92-4574-87cb-d22e1bc5e3fb", "comment": "Malware payload (Heodo)", "value": "d97d4c3a2b24d578fdbeecd34b07517c642b49cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639920025, "uuid": "f268b0e9-57e6-4461-80e4-f7da49dc3bc2", "comment": "Malware payload (Heodo)", "value": "79e61eeb6c9c518c1e523e75629b2d7fee5f3573d26a6fe7db7de9dcc4007a2e6f1cbd27437e9f413ec3e6e4c8885761", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639920025, "uuid": "9f5c98a8-0021-4840-bc18-e3bef9d46891", "value": "T133C44A00E711F03AEAD700FBCAFB88AD95A9AB20139519CF56D86DE5DB590D03D3261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639920025, "uuid": "bae6b19e-687f-44fe-8e40-13b691853a95", "value": "12288:5e62IbUp6cgHVysjTEs0auETHl4GbOX4NNVjmFuu4I7Sk4Bwht:5e6T06hHXEYHl4GbOX4NN0V777", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639920025, "uuid": "cdec7da0-c034-4604-a792-0d3520652a7d", "value": 591728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639920025, "uuid": "7b27f670-9e40-48c3-b21b-296085941368", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639920025, "uuid": "44a15880-1af7-4a8c-9a0d-ce08584381ba", "value": "emotet_exe_e4_4dc941bc6eaf11e18b0a8210cb7413b1d6d93df0e6b0599352bbffc9e3bfeaa4_2021-12-19__132020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faadb385-60b3-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639908666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639908666, "uuid": "00969a54-0849-4634-8e1a-589b60482285", "comment": "Malware payload (ArkeiStealer)", "value": "668b6f1c8b9e78af02c446ffe6336324", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639908666, "uuid": "6eb1d5cc-4db2-4d28-8338-490d94b7fc21", "comment": "Malware payload (ArkeiStealer)", "value": "4e60f67686d1d41dfc98cd14950fdd79bf9aff875b2370ef73658bbbe4facc4c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639908666, "uuid": "a73e5220-bbdb-4288-b0c3-bae323203610", "comment": "Malware payload (ArkeiStealer)", "value": "8c0d0e6260161e63ff3af0e6af6b45b400e1ff25", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639908666, "uuid": "e35fe386-1d18-4796-8573-188f7cbd08be", "comment": "Malware payload (ArkeiStealer)", "value": "d5e6a28e2579c62ad76e8a56ca7604e37748914be235dcc13c6695970264736e45f7d4ffed96b15f4ffaa34f6048763e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639908666, "uuid": "c6f0088a-f8b7-4809-97e3-745e3b1e10db", "value": "T107F4F100A6E0C038F1B765B8593DD3B9A53FBDE2676491CB62D56BEA16746E0DC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639908666, "uuid": "acf4240e-f337-476a-b84a-39817673502b", "value": "0026c8a1c807441cd486cacd7ab1065f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639908666, "uuid": "94256265-da26-4553-bd5b-c9975f595858", "value": "12288:a8ZW9IUPNj8MQAJSgpqez0BEojzhkTxXUb02NVvfpZc2rVruRcct:RZMNjdVQG09fhk1AphVrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639908666, "uuid": "1d4a033a-1c78-4bbf-9c60-b7b19adf3472", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639908666, "uuid": "1b1f2d8f-10a2-4f4c-94cd-c070364fdcf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639908666, "uuid": "7fccd1ec-6b0e-4126-9499-fb4377775c6f", "value": "668b6f1c8b9e78af02c446ffe6336324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8488dc-611d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639953873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953873, "uuid": "4e2f41e2-24b9-4d37-8237-628215a403ba", "comment": "Malware payload", "value": "315333f0fbec3899283c1f9b60d38021", "object_relation": "md5", "Tag": [ { "name": "contains-exe", "colour": "#6BD70C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953873, "uuid": "7cda4f5a-5de0-41ff-bab2-3e08e2318817", "comment": "Malware payload", "value": "4f4376563cfc35d3fb0b4f857674729727b5f959235fe39daa928a1d4a28649a", "object_relation": "sha256", "Tag": [ { "name": "contains-exe", "colour": "#6BD70C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953873, "uuid": "b9dde4dc-4c92-46fa-b1f2-6f544dea0193", "comment": "Malware payload", "value": "ed2f8f6fdc3fbbc9ed76952aa08668f023813816", "object_relation": "sha1", "Tag": [ { "name": "contains-exe", "colour": "#6BD70C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953873, "uuid": "39c6fc0b-5012-48a7-9749-fdf68f1bf497", "comment": "Malware payload", "value": "4dc6ecc1c1f77796f87532a4ef7451417de8b5486b4c9866ad56af842093d00b48a982b781af783125e6ef1873e1c96e", "object_relation": "sha3-384", "Tag": [ { "name": "contains-exe", "colour": "#6BD70C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953873, "uuid": "221593dc-c9fd-4bc2-92b6-ecef0c371961", "value": "T181C4234542E12FF17361A2DB5C1B12E21E5CBCF6A7C04778A87237A9215627C2CED6EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953873, "uuid": "b21dbcce-9ead-472d-8887-846dea1867b0", "value": "12288:ndLD+sDJWiCDguunXzGhUeYr0L7SdBeTZXKU/gK/jiikDT/NlPF2yDy5rFJW:dvJ8igguunXCUemm2ENjbi/jd2w4xJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639953873, "uuid": "3a272baf-ba1c-4c52-9980-cea7c222ca90", "value": 582124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639953873, "uuid": "9c11b7c2-7078-4522-a850-bd9bca09876c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953873, "uuid": "4c195f64-2c89-4683-92b5-5bb746eeac8c", "value": "Password___1234___....Setup-is-here.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cf7300-60d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639924113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924113, "uuid": "78f98c91-cfba-4abd-8ff5-4716c2fb3ea9", "comment": "Malware payload (Mirai)", "value": "985ae8eb75576328f9cfde2c2b86cc57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924113, "uuid": "5f627d0c-9af4-46bf-82b9-676f6b35fd85", "comment": "Malware payload (Mirai)", "value": "4fa80a2a0b286d0faf772a62fcbbce06739909f28c0f2f53522b6ebb60f2da5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924113, "uuid": "27c12c21-9a7c-45e5-bba9-4fe69f3f2bca", "comment": "Malware payload (Mirai)", "value": "24e8820a4d758340d27e7d8b1494ba472d6ef181", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924113, "uuid": "368e4263-adea-4f82-b288-e04b0f201256", "comment": "Malware payload (Mirai)", "value": "3f0b2ac7aa5b7e565b39f6196556b9453981b893e4143c97f8ad7d686174240d86e074760321603b0965c475c0558b86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924113, "uuid": "2fd5ccdb-fc61-4be6-838a-7c7fdc4e98cd", "value": "T1BE933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924113, "uuid": "8617992c-acdc-493b-8579-c41af2597af6", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Ol4umXxVqDrstKfz9e:Q97vk51RcG7Agl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639924113, "uuid": "88e1f681-8436-42cb-b0a6-f0f5bb91a71b", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639924113, "uuid": "0bb4a411-e6df-43d8-934d-18c26221b67c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924113, "uuid": "26087681-c392-4289-8183-9e3ece77847f", "value": "985ae8eb75576328f9cfde2c2b86cc57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cadac2-60b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639907200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907200, "uuid": "f2d51104-18b2-4a65-a58c-16dad8dcec6c", "comment": "Malware payload (Mirai)", "value": "1471965291bf4133627ae836f5cd8e9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907200, "uuid": "322f13f7-9dd9-4269-bc0f-c9e38604cdd7", "comment": "Malware payload (Mirai)", "value": "50a774bcef9b04b8211be39e5fa17ee1e07f6e848f37209277448c8415791499", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907200, "uuid": "6f13f0a7-1070-41c4-83a3-22473d7003b1", "comment": "Malware payload (Mirai)", "value": "3c2eba16faccbd462513469d06207a169e1442db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907200, "uuid": "cfc03eab-5a21-43df-b6fe-1f498e9af208", "comment": "Malware payload (Mirai)", "value": "71410b950ec59d2f88e25cdc7df903d98da2b6f14eab6982e5f4a6e677bda790148d73742adc73f77bdf41e1485e84b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907200, "uuid": "ec551aa3-1075-4d38-be59-a0f15c418c5e", "value": "T1C0B30904E8418B23C2D26BBBEB9E478F7B3557986F9B332256295DB02BC17483E3D550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907200, "uuid": "1d1ee7ca-f878-4c39-96f7-718d2c3dd2ab", "value": "3072:DHr8zVS/eYe5S0LI2RrRPdjYfjjSIc5hGBeUuxUPeiC8NpoQA3llEShM:jr6BjOjXc5hGBe7v8NpoQA3llEShM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639907200, "uuid": "c1cfc262-dc16-4087-82c6-7c2dce242331", "value": 117464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639907200, "uuid": "1b4b355e-811c-4d5b-8b10-6ba056d65f24", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907200, "uuid": "45618b93-2063-435a-aff7-65919bf2625b", "value": "1471965291bf4133627ae836f5cd8e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a58d0b2-6100-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639941361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639941361, "uuid": "06d36ca6-2244-482d-b3d0-fd70812352c9", "comment": "Malware payload (ArkeiStealer)", "value": "c1b9c29cf6b85bf3ad77437ef534194f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639941361, "uuid": "4562696c-faf8-4df4-8958-9bcda677cf95", "comment": "Malware payload (ArkeiStealer)", "value": "5170879076e0b453a42f8c2bfd3d2e80aa8e1ae5559563585f0dacb65a0880aa", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639941361, "uuid": "629a4816-f84c-4282-a30b-a9cb05f64b6c", "comment": "Malware payload (ArkeiStealer)", "value": "f14e1bd502da63072024c304e9a291f703ac2d9f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639941361, "uuid": "8178000e-b977-43a7-a233-98766bb01ac0", "comment": "Malware payload (ArkeiStealer)", "value": "a98cc424e8962bb6b7b1c0e51705579744683ecb5aa1a16c4e0718130b4c8cc3df398b4b93faffadff94664baa14c71b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639941361, "uuid": "1eab7bd5-af46-47eb-a850-04bae3c20b1a", "value": "T192F40110B6A0C035F5B716F85A7597B9AA3E3CE15B2954CF22E12AEE47356E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639941361, "uuid": "e1f7f6a9-56b5-48e7-b7bf-16681f65af02", "value": "9b5e0e93b958d7de96d2eb171562e213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639941361, "uuid": "998a9807-f4a1-4d35-8e5f-999805a7ed99", "value": "12288:Pxy1YQ/+hUP5kjb8JKi6/WDj+qax1hEKCAY6pE1lfv30QH+lw9HtZPTtEXTgF/H:PVTiP6jQJw/WXTsIvAFK9lvFEX+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639941361, "uuid": "2fdd74d7-ab61-4ffe-911f-3a3865df7b0f", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639941361, "uuid": "66a7e36e-6331-43fe-a4cc-595a2dbf9706", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639941361, "uuid": "d6839ac3-c607-49e9-b337-eb4471cef6e5", "value": "c1b9c29cf6b85bf3ad77437ef534194f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3589b2e5-60f7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639937541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937541, "uuid": "1aff38fa-0258-4ec1-b441-046f10c69edb", "comment": "Malware payload", "value": "d681eca9907a0c76efc4b5d4c465c149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937541, "uuid": "6ab64a07-dae0-4907-b8ce-3fe0669a620f", "comment": "Malware payload", "value": "52d963bc9d40201fa94408796cdeebd16c7ead1742d59d90e1a0aec0c469ee0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937541, "uuid": "68fabb65-d05d-4459-a300-f551ed509781", "comment": "Malware payload", "value": "82f173eedfe26526169bdee16aa28485544bf3ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937541, "uuid": "02b960f9-dfa0-46a1-abba-b2a56c3345ea", "comment": "Malware payload", "value": "cad7b92f8c04415b47add2f77bd2f276596f081295d6abc4b3bdda978b91b847d895a03cb32b4b3d19c50457213bd078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937541, "uuid": "d151492e-10f2-413f-acd3-977acb81b8ee", "value": "T1DFF523B7F98FAFFCD1025872D8556220695F66330AF79896835D930E31E3622128FF49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937541, "uuid": "428439f2-26d5-4871-a34e-d6c246108b26", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937541, "uuid": "21210419-d4d3-4f7c-bfde-201b38b8fc65", "value": "49152:3R9mQ7oKQJx4caW8Wp5/zodT39vmCCwVx3I1S3kbdx8kl6FXZ5728/nY4XBf6SJr:3R9mQMKIduWp57O3tXxLkBUjPY9/xEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639937541, "uuid": "80873d9e-982f-40cb-a4c6-4891625cf21d", "value": 3334144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639937541, "uuid": "ac9a3188-10fc-46f3-af54-45afac01d72f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937541, "uuid": "5ce18a5b-832f-49b0-a43d-d9a0ce7eb31e", "value": "SecuriteInfo.com.Trojan.GenericKD.38251085.1377.22943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8710c9c5-6084-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639888285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888285, "uuid": "62f49561-6c49-4afa-96be-5d9da213f01d", "comment": "Malware payload (RedLineStealer)", "value": "a8189f9faac3bd2f1b8ef9de7138ec33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888285, "uuid": "11689c33-614e-4217-812c-edbafc36c136", "comment": "Malware payload (RedLineStealer)", "value": "530e0002c120d13962f54641655060f420625a3ee39b740dac62a644bda96ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888285, "uuid": "1dfd55ea-f653-4b3a-b19a-b342c0d65dc4", "comment": "Malware payload (RedLineStealer)", "value": "21003f104ad009faeacad105d55901c44bf173c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888285, "uuid": "e4932e8c-710a-4018-9ca9-3d1f4d82585f", "comment": "Malware payload (RedLineStealer)", "value": "0de8942c27aea32bc12a3f0649888af4e53445af9eac5df0de0ef73d0f3a198e6b567f15074d22aa312026289f7a14c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888285, "uuid": "19b5ccd9-3f0f-48ff-914b-73893c765266", "value": "T1136633543D98D1FEE7450D30DF84DA72A4F88A989760EEE3E7C178886F74296202E5C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888285, "uuid": "e702b5ea-a836-46bf-a50f-28295e5e17be", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888285, "uuid": "66d3dfae-3580-4d58-b5f3-7c1a99975748", "value": "196608:xKLUCga8PB48QZRb0dC6x8n3RFOymHq1qr6Xkqo8gQXogOPD:xKdgaS68sY/GhFOTK1HkqobQXogeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639888285, "uuid": "9abcadad-f622-4a8a-9200-3f6a5bf77413", "value": 6812989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639888285, "uuid": "70c0b1ad-81fa-46a0-ab05-98a568a7f62f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888285, "uuid": "43f6561a-9e7d-4a50-9b3e-4f1efc19236c", "value": "a8189f9faac3bd2f1b8ef9de7138ec33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2b1e20-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639923541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923541, "uuid": "f1080f5d-7f0b-4e5e-8fc2-361d4fd284e8", "comment": "Malware payload (RedLineStealer)", "value": "4bae0bd941e63df1ffcba8871f948fb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923541, "uuid": "19a440d4-8ec6-42c5-a811-498567726fa7", "comment": "Malware payload (RedLineStealer)", "value": "535b5d8da976e181c1867639063a6a375601de451b46822ff37cd9f19bc82150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923541, "uuid": "87bd486b-53d7-4f51-9ca4-064dec7a60df", "comment": "Malware payload (RedLineStealer)", "value": "814e65366d3ac8203356686a8903b0fceb536032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923541, "uuid": "80f742e1-59db-469c-ad6d-635853246ce8", "comment": "Malware payload (RedLineStealer)", "value": "2daec02aa15d3369da3cfa705d86d1ccc1677a8526c6fcf63abb2e494c70e8c4fb11db6dfe6c1971f65e3c44bdc1ca76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923541, "uuid": "2c7a8e1a-b587-46b8-9bee-bcf5fde45687", "value": "T1F584CF10B7A0D034F4B726F44E7AD3A8653F7DE1AB2495CB62D42AEA56346E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923541, "uuid": "48bd0b40-f95b-43f1-bb0c-2c1fbe856a2f", "value": "18f86aab7a3779fc3e6eb84d32d1d0ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923541, "uuid": "d6074161-30c9-4b45-8580-16abcc594f55", "value": "6144:lPi6qmtILCIkpkM6TocNPoK6PoeZWubwJzOPajIJ+ZMabu0xJMan11zA:l6UWLHkp5In8wJkajQ+eVIJMaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923541, "uuid": "e5b3785d-2d6f-4c48-adf0-7f30649cb158", "value": 403515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923541, "uuid": "bcff038e-be78-453a-bc11-32eb91c63118", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923541, "uuid": "240f24bb-2c39-48cb-9135-887c9d76f6c0", "value": "SecuriteInfo.com.W32.AIDetect.malware1.31854.18977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df58810-60aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639904403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "1208913b-24d2-4a1f-a363-323c875c2ba7", "comment": "Malware payload (Mirai)", "value": "8e6811747eb2254651f8eb8fef5acb49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "e2b283d2-a4a1-4976-95f1-5f6162cd16a6", "comment": "Malware payload (Mirai)", "value": "53ed1c8d2317267c20647a93716247b6df91d72f2d1d0af3ce62317dfaa895b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "e902a16a-1cd4-4492-9233-b496c798204b", "comment": "Malware payload (Mirai)", "value": "46c83b13d0727ca865aedc552bb139d10dd1dfb7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "6fc57a4a-0c17-4176-a099-1df438a1690b", "comment": "Malware payload (Mirai)", "value": "03062ddbcd716c6f99df7c17daff45e326a445ed72b9c95e3efe2407147f557b1a8d63b8c2f0549322763dbdaaa40354", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904403, "uuid": "06eb48b8-62a0-413b-a889-ea02c2bb77ac", "value": "T19FC2D1F8D94B85D9C09EB4B1C3B81B943FA48B265A43EC9A1FDED586DC067E431826C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904403, "uuid": "95c73317-3679-4fc5-8d95-014fd6c5064d", "value": "768:g8kbmEOt3oOmSQxJUdvwte/QC5JgGlzDpbuR1Jst:fkbmEOt49SiCdoiXVJuat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639904403, "uuid": "ec0d877a-247e-4ddc-a01f-0dfdfb753622", "value": 26176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639904403, "uuid": "636a4ea9-1948-47f3-9616-cd5a66e2bf85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904403, "uuid": "9820c134-5b62-451c-ad12-716504f61d2b", "value": "phantom.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a8cde9-6115-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639950423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950423, "uuid": "e6ee3773-fcbe-4e80-b1a4-bf139b2331f5", "comment": "Malware payload", "value": "41d54353613e50c2fa20ce88db60154d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950423, "uuid": "44a8b4f7-e710-4c5f-bf25-5ed83afcf8d4", "comment": "Malware payload", "value": "55e0c318a9736232bd9d04659e89dc6b3a1adc231471b4c03851280038b90f39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950423, "uuid": "db0a2d17-ca25-4cbe-8a7e-c0d8fb5cc703", "comment": "Malware payload", "value": "caafc61c1e07f9894cf28f8f42922c65c474a0e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950423, "uuid": "f127c2c5-2a37-4bc8-91fc-20f3e57066ce", "comment": "Malware payload", "value": "afba49eaa803b038050036142140374f334baa87d5dd8463052cce2fb3883eafd7e3da3efc8a314ca7a789d32aadd1cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950423, "uuid": "31d18a73-07b4-4c19-bada-532ea5604e96", "value": "T145D3943EAD314F6EFAAC8334A7B35AB1A665229A33D5C34CC16DF9103DD0689544F3A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950423, "uuid": "7870e95f-d366-4d46-a5a4-cf5d42a89259", "value": "1536:sSFdccdtcdgdTdYcdDDzxsN3e30uCGhJ2V9btzFjzGS8iB7k4kWoe07Zvune:1xsEENrLtzF3GS/B7k4HQZee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950423, "uuid": "0a8e4b37-3cf6-414d-a404-c42070aa20e9", "value": 134108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950423, "uuid": "770e4ad0-8358-4edb-ae54-54afca6fc765", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950423, "uuid": "9993e94d-eb00-42e0-917d-9d2318c18416", "value": "41d54353613e50c2fa20ce88db60154d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507cbdf9-6114-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639950041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950041, "uuid": "856385e2-b9dc-49cc-9d32-22bf3d828843", "comment": "Malware payload (Mirai)", "value": "7a698076e06bad0e2f0aa75e0fbdf667", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950041, "uuid": "9e6eb028-9d12-497d-84b7-f207678635b9", "comment": "Malware payload (Mirai)", "value": "5e03dc468507d07d53521b742010192793b459a92dee0a768204feef84e16a54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950041, "uuid": "1b4047a4-b87d-483d-ba6c-a930c340ecb1", "comment": "Malware payload (Mirai)", "value": "e6f82bf530dacc2d09c9ce88979761739bf7748c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950041, "uuid": "27e5e4c4-c72a-47fe-a659-b48bf4240cae", "comment": "Malware payload (Mirai)", "value": "7c05442eb36376fe2f643fe7f01a12bd319ec05c2acc26a34d3e020febe74614aca480b89a2e8f92bfe9ad0b3efba1ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950041, "uuid": "d1a860bc-8766-4592-8597-d011e54d602b", "value": "T17A93C547FB4786F6EC874934296AE33F9732A5181533E349FB1CAA36D92B3465012788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950041, "uuid": "029415dc-1948-4e75-b3d7-4bf421b80340", "value": "1536:R+oTSv4+I6gDo+gLQF+Ljqv+JvqF+Bn6g69hPp291AqLrONgzVMWsXxKMmeC5fBI:Rmv4MgDoZQFSqvAqFw6g6DPw91AqLSCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950041, "uuid": "970013a8-2d82-49c9-b04c-3394754f6af7", "value": 95664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950041, "uuid": "50d87bbb-86e8-4fac-b2f0-21cb19670add", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950041, "uuid": "b0f0ceb7-abd7-4922-9439-c79f99d01551", "value": "7a698076e06bad0e2f0aa75e0fbdf667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0939e94-6084-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639888355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888355, "uuid": "7b70838d-dc90-48e3-84a1-6cf2ab2e0af1", "comment": "Malware payload (DCRat)", "value": "ca8d671c28df5f94a679a587e65dfcb3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888355, "uuid": "e18f2dd1-eb91-4f1b-96a6-452f1b778a03", "comment": "Malware payload (DCRat)", "value": "6f06dc78d8c3a807688264335ead5fef00be7a03273ac0cc6e033a82113f6abd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888355, "uuid": "c99303ba-d6ae-489d-9afa-78d742d930ee", "comment": "Malware payload (DCRat)", "value": "c2d39af5c51048c863ed44d36cb39ebe7e1e12c8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888355, "uuid": "bd62b2e0-e231-41c5-b8ff-13d89c4ebc36", "comment": "Malware payload (DCRat)", "value": "43b5eaac478e19d4cfb5c8e2dae9286ff8138081106f9905ce5195e7265f010c849d7abb59afdfe428e4aa7abfcaac6a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888355, "uuid": "3b0f57fe-d1c8-4b73-9a0c-6b78faf07aff", "value": "T142548D00A7A0D435F1B762F849B993AD753E79A1AB35A0CF62C517EE1634AE0EC70347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888355, "uuid": "595df952-40f6-4aa5-899a-fa078cf4177e", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888355, "uuid": "bd03bc45-6b4e-45eb-8a6f-5f2970130a72", "value": "6144:Wdapdp8Dp5JhULqKDUiTVaNoYWY0AdBfUiA2rlvh:Wdav+KD3TVaCYXHfUiVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639888355, "uuid": "32624660-6dd9-4e32-a39b-3bb7b28d3308", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639888355, "uuid": "141cd136-49d2-4be8-a420-0ce1f2adecfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888355, "uuid": "d84d2c16-c230-40b6-9ebb-9676aaf69a1e", "value": "ca8d671c28df5f94a679a587e65dfcb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028a96e4-6081-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639886775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886775, "uuid": "062502da-cd49-4000-888c-c557bf26f1a2", "comment": "Malware payload (RedLineStealer)", "value": "5a86a40bdbafbb0633b8ec321f23cc91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886775, "uuid": "ac2443e8-afc3-4aec-9329-bb1981ec17c8", "comment": "Malware payload (RedLineStealer)", "value": "7005c3f7cca6fc6c7f325f8df402509fe250698c348f0fb89993d25836792780", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886775, "uuid": "4250f93a-a692-4252-a68e-c7621617cc52", "comment": "Malware payload (RedLineStealer)", "value": "8ee1d859895ed04f2dda3014c9972c2d80987d9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886775, "uuid": "caa6465c-5e02-4bcb-b6ae-db46b9afcedd", "comment": "Malware payload (RedLineStealer)", "value": "e340d6723513427e5ce469a3564ff460c056e6bf080ca1c02e046acfe16bf59e8c62467a91a8449e1a5da06d73c2445a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886775, "uuid": "7a30aa03-0b29-4189-8c9e-746e33a37c80", "value": "T11684DF00B7A0C034F5B752F84A79D3AC793E79A15B74E0CB12D12AEA5674AE0ED7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886775, "uuid": "c8825ffd-0b70-43e3-8c6b-4d0e1b99cbc0", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886775, "uuid": "17ff4a0e-1880-4826-a3ec-2bab24941c23", "value": "6144:1uNMy3+hrU4j0x1LHQ3be3WYeP2TG++3voiKj4B23HyqXM:1uey+r9yMS3NePEG++fO823H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886775, "uuid": "fd6385e8-2eb4-4a48-acbf-5363f7cf2df4", "value": 406562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886775, "uuid": "965828da-6995-4431-8ad2-7a5d35ad2ab8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886775, "uuid": "0c99978a-d1ec-4241-9539-e3a3f60aaea6", "value": "5a86a40bdbafbb0633b8ec321f23cc91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2cad3f-60b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639907194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907194, "uuid": "b051abd7-c1c5-41a8-bec2-90082a0bae52", "comment": "Malware payload (Gafgyt)", "value": "2df46b4e165bd9f3015ab7d942062104", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907194, "uuid": "34c2bcd6-0994-4365-9f7c-f486413838a2", "comment": "Malware payload (Gafgyt)", "value": "70774a94bfdfb136d0cb78ec626c2c8a8da5a3e37db103731962c38f3dcba1ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907194, "uuid": "f8a45a57-7888-471c-88d6-01cf7465f221", "comment": "Malware payload (Gafgyt)", "value": "3caf19195783480f1445652bb463d65386f3a30e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907194, "uuid": "011236e8-577a-4404-8a44-6ea743a35e37", "comment": "Malware payload (Gafgyt)", "value": "12fbf41814793df6124fffaa3aa63e11010fc4942c7db7542caa5a27e9a3fe8725bb35155cf62d588117e7d2c18365b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907194, "uuid": "6dab5d20-e95b-40e1-bbfe-8ccb8df5e1ba", "value": "T13183F99BB61D0BABC5975BB12CB737F18B6DED6002B21184910EFF9007B29742532F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907194, "uuid": "fe5ecb6a-1196-45b7-bc0d-6f481d5e3719", "value": "1536:bhUN3ApZfPi+ZJKST9b7KqRFIz/Uv7dAktwHUIe:l2wbHuST9bOmQUKktl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639907194, "uuid": "ef6643cc-b45d-48c6-8661-12f05ee4be9c", "value": 88543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639907194, "uuid": "9b837b89-6daf-4599-afc5-f4f13ac4c59f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907194, "uuid": "6a8b409e-5a8f-4e2e-ac16-cd320b895f31", "value": "2df46b4e165bd9f3015ab7d942062104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17315386-60af-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639906566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906566, "uuid": "e3cecccc-d831-495e-85c0-4890cbb756c1", "comment": "Malware payload (Gafgyt)", "value": "8c1945b48ac2018eb334532f05e8e680", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906566, "uuid": "ff9bfa33-11f9-414b-b83d-83c022237fe7", "comment": "Malware payload (Gafgyt)", "value": "71b3d57e442761e40235542cc64da687f2ae11ff4892779abc7b749b1e8d69a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906566, "uuid": "d0cf6b21-aee1-44be-92c5-3c8f0b4d778b", "comment": "Malware payload (Gafgyt)", "value": "d3078083e162ae2a8a1857670321e3c3117d3891", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906566, "uuid": "80f0ae2f-f6a6-415e-b0ab-91995a96a60e", "comment": "Malware payload (Gafgyt)", "value": "1406073a4109b547649d763312909aa97ca3aa29632dd2c20ae1657eada7e85060d8b45f3fc3d66b64f51eb73f34b742", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906566, "uuid": "8c38958a-1d77-4599-aa59-6619d34f7f0a", "value": "T16D93D604ED505737C2D23BFAF79A42CE77351F986B97334196283AF41BE5B982A39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906566, "uuid": "068f4e80-b2a7-4131-9b9e-a93aa54c534f", "value": "1536:5WTWHwbRdW1i4sB9xQMOvA9dHB1WoAgqyhQjar4i0Bk5Ui74P3n8fIuoV0SnDaen:/wbRdW1i4sB9xQMOvA9dHB1WoAgqyhQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639906566, "uuid": "3650834d-e553-4f48-b02f-4b65d71f8fa3", "value": 95105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639906566, "uuid": "f013bbaa-eb24-4f3e-9d19-5e9d418d000f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906566, "uuid": "c459f644-1ddb-473c-a3bf-93d509790668", "value": "8c1945b48ac2018eb334532f05e8e680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffc2dcd-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923627, "uuid": "9e92b1fe-9870-43ca-8eec-925d86dbbe93", "comment": "Malware payload (Mirai)", "value": "d84276d7783a3760e9fd8887028a1f19", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923627, "uuid": "4749f360-66ac-4b6a-9337-1ec8a7db854d", "comment": "Malware payload (Mirai)", "value": "75d40d8af7f6fb6decf7be8335d549ebaa8bddb87c50399b149ca2209a582e34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923627, "uuid": "46b6232e-4c57-4ac8-b395-a3e349a7a4d1", "comment": "Malware payload (Mirai)", "value": "3e1d595ec86b00c8d190c48a40ad348f38325407", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923627, "uuid": "ad685634-7a06-48a9-8015-9d276d4d9b90", "comment": "Malware payload (Mirai)", "value": "37e5dae9baa12f791fa583d7a27977258a5ddb0e8f6de86b7c3a1afbd7f3855f8ec2db9d4ac1978b76b938d0dc947e54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923627, "uuid": "9d37ea97-84dc-43ec-a7ec-5d3beb0bfacd", "value": "T103F2E1CF60915BA9DF4F6EBD204E13200915F58350A857098B50ED9EF8EFD82B89F435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923627, "uuid": "e8f0dce5-e2d3-43d7-b6b5-5ef8a1fad4ef", "value": "768:2ymvIE+AtjjP8hXlChLIgTC3JG1r9cFc5SGWMWWl:KvR+AmhXlChLIsC3I4+5Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923627, "uuid": "e0edfe12-6d0e-4505-bd2d-5a5a54a5f74b", "value": 36320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923627, "uuid": "aa59f2cc-a964-4dde-9e57-d7afd86febd2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923627, "uuid": "80eed8d7-587a-4ffa-babf-d749930a5e5f", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b35cfc6-6085-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639888615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888615, "uuid": "77448c93-626a-4686-8d73-16f689e58410", "comment": "Malware payload (RedLineStealer)", "value": "d25a3970868627b89ef1fa049a4f6553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888615, "uuid": "e2263ae1-af30-4ec7-a045-faa6526090f4", "comment": "Malware payload (RedLineStealer)", "value": "7696d509579295a7ef963d21ed8c0a468160eed452e6286eb16d4a3d5223a99f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888615, "uuid": "1e7b6627-d1ed-4a9c-be6f-c234d200c4e5", "comment": "Malware payload (RedLineStealer)", "value": "62aaa650a42ea9ba949c6219b62fbd8ffb23d666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888615, "uuid": "4d5ad7b9-2eab-4c10-901c-8ce8b0c9376b", "comment": "Malware payload (RedLineStealer)", "value": "591ecc6cab7a46f6c707ebe508fd1a125700aabed7dbefd39b9a00c42de208bdddba14a93613488aabb5dd1c7daecbbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888615, "uuid": "6b0c627c-70fe-494d-8e2f-986083fb6cf4", "value": "T1B894CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888615, "uuid": "da50e665-24dc-493d-b792-1e3cd0650365", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888615, "uuid": "4e721acd-fa51-47d9-84ab-6f57a7c0a0d5", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639888615, "uuid": "d8cf1b18-27ef-4d77-80a8-cd7ec2803b53", "value": 411151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639888615, "uuid": "2886dc84-0796-4093-a93c-e910f03f4fc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888615, "uuid": "213a2ef6-5d93-474d-88dd-21e27df2bf91", "value": "d25a3970868627b89ef1fa049a4f6553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f69aaba-60a8-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639903788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903788, "uuid": "de678f59-e520-4085-8dc9-e3bf01021708", "comment": "Malware payload (SnakeKeylogger)", "value": "93735fb72cdada38493b8a1c66155c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903788, "uuid": "02e680ec-704b-42e7-a7c0-3d0f4be70365", "comment": "Malware payload (SnakeKeylogger)", "value": "7de01b70e3fcba23ebbb360c4dd6b1beb74b81e51468df6c6d6c4a423abcc22c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903788, "uuid": "b7cebe26-fc7c-4ae7-8c1f-44fb92d6a575", "comment": "Malware payload (SnakeKeylogger)", "value": "f7e3f89b0dd18a586d6ba7bc75893b1651d7d142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903788, "uuid": "ceebf8a9-b8d4-4ede-8846-3baa291c7d43", "comment": "Malware payload (SnakeKeylogger)", "value": "32a528a6fa8de2bbbc31cbae5659371337668fb5c30744e4956b98318cd8236c23b17089c1d7e3d81e1a7ff8e8573ffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903788, "uuid": "e490213d-0b70-4061-9487-e52ec23998ca", "value": "T11C55222D3A8B5AEEC4A913B93738847453B6AD35880BE3C8F9D5329B4D337047963527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903788, "uuid": "a3f021bc-315e-45cb-a335-498497407756", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903788, "uuid": "07a5d470-abda-4019-952f-d874403bdbf9", "value": "24576:moqYxY+WjQqKlMEIWXlY9hVu8KtKMobaY9:TrsjQXlMEIJu8K4MP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903788, "uuid": "ff721625-ebd6-46fd-bdc1-542db84e8d26", "value": 1305088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903788, "uuid": "5c5abf39-9917-4415-b60d-f5fd3d3a26ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903788, "uuid": "0ff2b7cf-8a5d-4ecf-854e-3ca7cf5e7537", "value": "93735fb72cdada38493b8a1c66155c5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e767a24-6080-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639886473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886473, "uuid": "a4f2d193-8f50-4276-b5fd-5fba4dcea535", "comment": "Malware payload (RedLineStealer)", "value": "044dbbdf01855216e3e5ab846c37404f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886473, "uuid": "f17bd2d4-9f0c-44e4-83c0-006f8e4a4842", "comment": "Malware payload (RedLineStealer)", "value": "7fb2c941ea70e0e1f4b31a601355f0d53ee0d9db8f2adedab21437d7cb8dbc78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886473, "uuid": "d98512bb-b190-4bb8-8d5f-50291a61f4b5", "comment": "Malware payload (RedLineStealer)", "value": "2d19ae48d6a5b0871248aecc6c88011dad496d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886473, "uuid": "7ee20918-ca1a-40fe-bf69-6c8d686d14ee", "comment": "Malware payload (RedLineStealer)", "value": "321c8d75f8826a807b35fd3eb3f7b37183ee4df3826dab1e596dfc9338771b9089c245f71196b5adbd2e18d0d65a0509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886473, "uuid": "c32362d0-a84d-4b4f-8237-5269742b49b0", "value": "T1C994CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886473, "uuid": "6d86ed42-3f20-4256-87b4-fba4effeb22d", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886473, "uuid": "cf25985d-f731-45ba-8291-3be2952dc451", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886473, "uuid": "212417a3-b2df-4b7d-8cd9-b097acbac5b1", "value": 411161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886473, "uuid": "63b29de5-d4ae-479a-b2a3-d8bbbdf3d2e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886473, "uuid": "34ed57fb-2446-46fb-954d-6a1c87a7be72", "value": "044dbbdf01855216e3e5ab846c37404f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3305f848-60f7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639937537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937537, "uuid": "56ebcd14-e046-42e0-8c8b-a46ebbfab154", "comment": "Malware payload", "value": "e2f46844e2ce6a3b81faf309f7b06147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937537, "uuid": "f7e3266f-2133-4eae-89ff-010cbfafd46e", "comment": "Malware payload", "value": "847afedd774aec96c8381c8ec6be2945543150595972038e2d8ee1def596bde8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937537, "uuid": "890b5e08-eda6-4585-b809-9e9704ce3eb8", "comment": "Malware payload", "value": "0480a078c60e491a3e28724018c8ef1477f54a40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937537, "uuid": "308f6d53-3ea2-460e-a0db-d3286b35d124", "comment": "Malware payload", "value": "d484050f4623dd393e10d5a534ea8b9a0fc63c9fc7f71ba6cf38f16c7f3b7ae6f11f22bdab31d39cbf3a304d3ddf23d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937537, "uuid": "20c32065-b83d-4f2b-8e57-fe2d04bc2644", "value": "T12665334BB4117914C24C82B6ECFF6AC2E0371DDEE4D888A399D21A9BD110569F3F8797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937537, "uuid": "6a7fa36d-d954-4e52-925b-2ab99ae29bf6", "value": "e7bf5da515a7709b3cd42808b030cb1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937537, "uuid": "353cca94-d739-4bf7-a379-ecd8c541e315", "value": "24576:/738VGFOu57jGcP6JvZ8KQ4BbNEEx1V8Fyn9k8dlaLOPjPk6swlZaVapTkEaHNYi:zdR1MvLBpEEr9kQlaLOaVeTNaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639937537, "uuid": "cad697ca-9a6f-4548-910c-80624548c34a", "value": 1414656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639937537, "uuid": "09c04cfc-e3e1-48ed-81af-e6974e111787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937537, "uuid": "f8bd9acb-e7a4-4ad5-b233-7969b66c2e19", "value": "SecuriteInfo.com.Trojan.DownLoader44.10481.1735.29828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba66df7-60a8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639903675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903675, "uuid": "f36bf4fd-d629-4aff-826f-9baf647120a3", "comment": "Malware payload (RedLineStealer)", "value": "d3210aca4a80b6cc0d2f3ed937a89bbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903675, "uuid": "b15f2d6e-88c7-4250-a557-87fe6e5eadd5", "comment": "Malware payload (RedLineStealer)", "value": "84e801ab982341076d4aa8ee0e97fbe75cd1278652c20ca8b5901145b073ee49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903675, "uuid": "e4af00ae-ae96-434a-92ba-941b3397c863", "comment": "Malware payload (RedLineStealer)", "value": "21b1002d8525acbfa55c8c05789a5b9efd690b7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903675, "uuid": "67034b2e-0d35-4a94-8298-12e10aff4382", "comment": "Malware payload (RedLineStealer)", "value": "dbfb31a734648b96df2febaafe87e80b374c9e00b6061b2efc3b45966364857d66d7c74a8f844fbb13f80fe7c72ffbf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903675, "uuid": "2d24515e-9939-430a-9bbe-b093c1a902ac", "value": "T1A325CE1FEFCE8658EA8207B6C6F3BF004B7DD0D50F274BD89325E5E18ACA1611B12965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903675, "uuid": "c233565f-9006-49d3-b97c-4c6698b0e583", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903675, "uuid": "4f27582d-be42-4c8c-a12f-7af27fba4467", "value": "12288:+xHwQES95AC5rryRcwJmFBaaxIgwRXTwdyIn8H0:2F7W2ymFBEz1H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903675, "uuid": "a02569ea-6def-456d-af1a-cfa377027ea5", "value": 984456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903675, "uuid": "e13c91b5-9483-41d3-ba18-81873f37bf97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903675, "uuid": "41edc5ee-6ff3-47b0-aafe-dfff13684140", "value": "d3210aca4a80b6cc0d2f3ed937a89bbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61719661-6114-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639950070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950070, "uuid": "e4ef2338-d55b-4c96-a758-2beb49c7c071", "comment": "Malware payload", "value": "fc17beb353220928d83c2b5a175d8e71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950070, "uuid": "12d593f2-db5d-4372-8373-bdd8a225a8f0", "comment": "Malware payload", "value": "878d2382639f02005a0362c2beaaa890622dea9dc53e339183717a448bbdd478", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950070, "uuid": "d7da0dda-87eb-4048-aa65-58070dd0670e", "comment": "Malware payload", "value": "63dd32ef19d8e2d2b53907c01b70ca69b8ca0cc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950070, "uuid": "a4e5367b-086a-4435-a9d6-1fd9450d182d", "comment": "Malware payload", "value": "5b73ac2f3bdf5f7de7f345cb71b63dbec9c57142daee370909fa3defbb0e81f20c2e612eb3774908f8c861132fbaab5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950070, "uuid": "314ff9f1-7475-4c84-a20a-d4b34f794fde", "value": "T141A3D44BF8915952C9D0937BFA1E23C8335B73A4D2D97203C9884F30779E8692D9E6D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950070, "uuid": "d8bcd9fd-710b-43e9-a0a1-1fa58d6fd2fa", "value": "3072:ZgJbISWOwvX5OKjEHM22lRrVd+mv5Z2egjB0V0ZZZZZZZZZZZZZZ0LZZZZZZXZZx:qtUl4nfUamX2eE0V0ZZZZZZZZZZZZZZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950070, "uuid": "2ce942fc-3fe6-4617-bc97-9cc6dfbb9f59", "value": 104796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950070, "uuid": "a66d903d-f435-42ab-9cb6-75a632e2425a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950070, "uuid": "d425677d-6cb8-4ec6-b772-12d79db40d1f", "value": "fc17beb353220928d83c2b5a175d8e71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294b95b8-60eb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639932366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639932366, "uuid": "c6ff0050-3299-4a33-9da4-be6a24e0f93f", "comment": "Malware payload (RedLineStealer)", "value": "b81fabc34182e250fb47dc276e11f47c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639932366, "uuid": "eebbb414-1d67-4821-8093-f2984d94a0e4", "comment": "Malware payload (RedLineStealer)", "value": "87dd4fa7e096ffff1e55afabb827698222f2385a4688a8f43c731ce9ba6e23b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639932366, "uuid": "b3645d2d-f0dc-4180-84b2-a502efdd786c", "comment": "Malware payload (RedLineStealer)", "value": "c2af636bd1f45427a54b2db337f49c45023c676f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639932366, "uuid": "2a79b941-a7ad-4922-aa2a-a92d332e32b7", "comment": "Malware payload (RedLineStealer)", "value": "ab003d50c7c4531f3170295f050b8482a2062328065b773e2afd521a0ca03f7622625cbd814dd0943729a0edcb9fd782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639932366, "uuid": "71024a11-7f50-492e-bd26-152636f42203", "value": "T1BD54F2317EFCC872C9A30A7549248E91497A7521B760924B2B6516AEEF60FCC0FF631D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639932366, "uuid": "0b780020-0a99-4edf-bb88-2f2d4fe76104", "value": "254f2d7d316c651aeb3e2ff6fd4504f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639932366, "uuid": "4bf008bf-5243-4f51-8c7f-933dfe34b017", "value": "6144:HaiUL81zFA4AOySEj68a98642mTlXlIiO87uzbgwu+xoB:K+zFfAlzjxa98QmTzIiOounna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639932366, "uuid": "06128b2a-5e11-4671-9dca-bc8881c85b42", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639932366, "uuid": "3e94e8ad-8257-40bd-b416-e3284a5b2eb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639932366, "uuid": "37cd78b5-c81e-41e5-8e8b-6b3b1aa1f632", "value": "b81fabc34182e250fb47dc276e11f47c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc416c4a-60d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639924130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924130, "uuid": "91fc0326-4d35-4699-bc34-9a7524992aa3", "comment": "Malware payload (Mirai)", "value": "98f75b0785a5ade00c08d27358a8160e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924130, "uuid": "56246f93-4cc3-4ca1-acfb-2d7fed258ab2", "comment": "Malware payload (Mirai)", "value": "8816ac861ce2b38777eed1480ba8be0fed684d56f962076d6004c67c6ac0319e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924130, "uuid": "d5f07afc-0795-48f5-9692-02688bfad62f", "comment": "Malware payload (Mirai)", "value": "b30255e0067244b8d82ea0fe96ecc567bc99756c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924130, "uuid": "e58ee762-5ea7-4074-8f26-5ecc5af4aad6", "comment": "Malware payload (Mirai)", "value": "41fcb5f2d5d095d4060b255f7e5200f8e0d56d5c78a50752deae4e9ba444773485e8a6a4b4f8274abd9c454ff8c8eed5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924130, "uuid": "53fcbd1a-3fae-4cc3-b879-de26873a4402", "value": "T150935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924130, "uuid": "69a87bdc-b95b-46a0-9a2c-bd60ff04fdee", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3UyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKkifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639924130, "uuid": "8a685602-1764-4db6-a2e0-d06480c5392b", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639924130, "uuid": "ef5c54a6-7a25-47db-a85a-e61c8a2c8bb6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924130, "uuid": "d6c5d870-41df-4a1e-9734-78a24f4967a1", "value": "98f75b0785a5ade00c08d27358a8160e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffc0ab0-6106-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639944135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944135, "uuid": "1346287c-c54c-4b15-9e1a-b213374c43da", "comment": "Malware payload", "value": "53f213344e7c36c70d465849406284dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944135, "uuid": "1ab84882-14d4-426e-863e-a0ee33ee3ae6", "comment": "Malware payload", "value": "891b1a47e355fdcc857e6677b32b40b6b134d89cfc7e68a859937b70f41671fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944135, "uuid": "9b42f197-d2db-4e2f-9451-8dc8f41469ce", "comment": "Malware payload", "value": "b59e188bc3e806c859631fd6349f8eb91c33e696", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944135, "uuid": "dbc44fcf-a8d4-4ee6-85a4-2a245d1a220a", "comment": "Malware payload", "value": "967b7951cf3345a00e4ea56d89acac14bedac49e923cdd29c4e65b751492f61abd20db5cd61990c9e416bf29270a3190", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944135, "uuid": "f45dcdda-ce2d-4a3c-b70a-e4424669e8bf", "value": "T17CF40110B790D038F5B716B84979A7B9E63E7DF25B2494DF61C86ADA9930AD0DC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944135, "uuid": "fc69f018-43b3-4cca-9fd3-f597ba910417", "value": "5f124a733ee23e7a763027f872397aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944135, "uuid": "64aeae9a-5058-412e-b2c3-9dbba96676dd", "value": "12288:KR0yk4RAHmxT5/onOKSoku1DOMVFfUG7lNArbnsu7qIKrn8M2wpgzIgW:Kx9RPxTE8nuh7/NHoCpgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639944135, "uuid": "2017f356-e823-4583-8071-64d140c5151d", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639944135, "uuid": "d2dfab17-980a-4fe6-9ed7-183fc21167f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944135, "uuid": "62d5b9eb-3687-419d-b1f6-c0d4cada1a20", "value": "53f213344e7c36c70d465849406284dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc5abb6-60de-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639927002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639927002, "uuid": "83525f9d-0555-4542-8dea-69dab91deac7", "comment": "Malware payload (AgentTesla)", "value": "42a2d7ae16f4cf39337e6dd4e60abdd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639927002, "uuid": "98de8f07-ef57-45a9-a2f2-6e635b9935f5", "comment": "Malware payload (AgentTesla)", "value": "8ac0c1b42c4ddc71c5f4d2d023bd6305c29a45de997103f2218989d42460253b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639927002, "uuid": "0b2fd256-12e7-4d81-996c-12749c19d8bf", "comment": "Malware payload (AgentTesla)", "value": "82c350e152654cf342f7b0d513079fe40f931fa8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639927002, "uuid": "d578979a-a20e-45d6-af81-43abad9cf02b", "comment": "Malware payload (AgentTesla)", "value": "652e7bfd7fcd19c13569aeed7de66260d2e6976a9ebb47e82d82ba529450580d6612a8132521c04957b806f8b4b1244e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639927002, "uuid": "0fe1ae11-94cd-4c3c-ab89-45ea5e29f0f8", "value": "T11CC4BD0D34D7E2DCF87BD7B13FB4649802A9BDF5E543E0DEE899314B9463A403A22661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639927002, "uuid": "308a9d44-cec5-490f-8125-d455a2e4efe0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639927002, "uuid": "fdfdba8d-fdc0-4a70-a838-9fba80847fbd", "value": "12288:qjU2iN5+RpGFH6V3Jb9AUqq6glXr+Y2u4Zj:qA1r+fGFmHjnlXr+Y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639927002, "uuid": "578a7ec7-1402-44aa-be42-5716d6e82d7c", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639927002, "uuid": "648643a0-36af-432b-8d95-9192260aefcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639927002, "uuid": "fcad9946-de2a-4265-9a40-203ce6f1c896", "value": "INCORRECT IBAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5462e2-6119-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639952209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639952209, "uuid": "c25ac464-a455-459b-b861-99a41d0801f4", "comment": "Malware payload", "value": "fe8f6ef45a87a9819d6e0ef206ae52dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639952209, "uuid": "74cd0d14-a745-4b47-b809-651dbc06f6ed", "comment": "Malware payload", "value": "8c324ae28916d1fa2212f49fd7eebde3606f428d30a122109570070a455a8b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639952209, "uuid": "39fdea3e-751c-4f42-9ae0-933ce4d3c687", "comment": "Malware payload", "value": "1a0528c6e8d7b53ff1769a10d5cf5fa74cff3f06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639952209, "uuid": "927db68c-0727-4a30-b319-32bc8618ed6f", "comment": "Malware payload", "value": "4067ca7dde684c0bafd7bf02dfe39071932221610fb992a704f6f05fc56aaadf1eaf8109aabacf9f2de8347093d82123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639952209, "uuid": "2b60cb5f-837e-45b6-8e4d-f93930f995ef", "value": "T1ECA423D480C9589BE562073B1A7F5FAB76F382E4026B1F2F13582EAF3476E0B4644536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639952209, "uuid": "acf50e7e-be7e-406f-8396-e9426f153a11", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639952209, "uuid": "096cc7dc-df7a-494a-b1ca-68d04e5f29f9", "value": "12288:7dKErHAyCCQTKAvVsH9W6Q8V6IuoMv56pKcfsF:xKEUZCWNaU1kg6wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639952209, "uuid": "5858b385-c753-4eae-8a9e-ad9136234f8b", "value": 472376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639952209, "uuid": "1a8d0694-e595-47cb-ac9f-d228ce2f6845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639952209, "uuid": "ae0e14ea-9a0e-48dc-8020-ac25380badab", "value": "Scan_Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e471e627-60c3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639915500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639915500, "uuid": "88670a85-8254-43b0-bdd6-5f1cf72920cf", "comment": "Malware payload (RedLineStealer)", "value": "e416446ea7e31b254390854bf43384e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639915500, "uuid": "7ccf1a08-2b49-4390-8586-a17157025531", "comment": "Malware payload (RedLineStealer)", "value": "8cfeaae8703d68db39893bfe98c8465ce7e295403fb9c0abdb6442c32200b79c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639915500, "uuid": "785237bc-2e05-4474-a33a-b00f2315f2df", "comment": "Malware payload (RedLineStealer)", "value": "091629ee4d02d2990ec0211357c0b6096f333f2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639915500, "uuid": "b325f5e0-5d8c-44b1-b059-33069d49268e", "comment": "Malware payload (RedLineStealer)", "value": "af2ddf4f774c99bc2c120403d5ffd2c108c872d88dd280b99b0c65580734eea350197dac084f1704023e46b8f9443bf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639915500, "uuid": "88613020-a407-4a58-8109-4a6dd2df8df8", "value": "T1E2159E036E584839DCA0E835DC768F52BF765C34C6EF532EC1943D068B77EA126B6292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639915500, "uuid": "fc53b22e-6fd0-4c22-ab54-3032f4b29065", "value": "87c85ca551149fdbc03c81bd9073fdc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639915500, "uuid": "a33a3c01-932f-490b-a060-819d2bb9622d", "value": "24576:9ssssssssssss7sssssssssss/ssssssssssssssLsssssssssssssDssssssssO:9ssssssssssss7sssssssssss/sssssa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639915500, "uuid": "8f079c0e-d1cb-4726-8e8c-a91c2c31dff4", "value": 915184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639915500, "uuid": "8b6e1bbb-587b-4be3-a327-b3e9050fd37e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639915500, "uuid": "ae350f67-9bb8-4365-93f4-084ef4dac3cf", "value": "e416446ea7e31b254390854bf43384e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da80369-60b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639907221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907221, "uuid": "ceec66fb-6893-4655-b1eb-e207e57d803b", "comment": "Malware payload (Gafgyt)", "value": "aef1c76c452ed4d83c8bb8b4ebc00b97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907221, "uuid": "8f78787a-ddba-469b-9b4e-0de39142ca92", "comment": "Malware payload (Gafgyt)", "value": "8d16492e35bc2562bba2e65e0b5501bc23a3b26584a141836289642be2dba7fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907221, "uuid": "18aa77d5-1a6e-4efd-8bbc-cdb560d1367f", "comment": "Malware payload (Gafgyt)", "value": "d526fdc3ebffd0c08cb5fa191094c8993bbb502a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907221, "uuid": "a0a9cade-7569-46f5-ae81-afd347fd78e9", "comment": "Malware payload (Gafgyt)", "value": "30f0607f531dcf3b2b7d97233440f01f737c23e9568802bb812002b73af2ef364b11ee0302b4835584c0282ce41f27dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907221, "uuid": "018a2e60-7bf0-4482-9b63-484a10d989d3", "value": "T11BC3835AA761CEB7D84ECE37069A460110CD9D4A02DD6F2FB2B0F61CE7AB88E45D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907221, "uuid": "8e082eca-4d9e-438e-ac82-77fd5d150a2e", "value": "1536:SSCYeTwEtSJcqOPdPuhupyLZnOFCKgorII8xHv+vg8:SXtSmPuhupG7al8xP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639907221, "uuid": "fddf5213-40d6-4478-96bc-d4366dbcd855", "value": 119151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639907221, "uuid": "1ad9d089-2357-4cbd-a23c-c362585a1654", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907221, "uuid": "e5c5ddb2-8681-4d52-9e98-2a9d10c4b6d3", "value": "aef1c76c452ed4d83c8bb8b4ebc00b97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469d6bc2-60a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639900203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "7339923f-d14f-49aa-8c87-b0e871f1d276", "comment": "Malware payload (Mirai)", "value": "4d5bb60fd0655919b9e9412f1eeb5a3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "b458bdc1-edfd-442c-a8cc-4e8266d3af9f", "comment": "Malware payload (Mirai)", "value": "8f1fb8d9fd7f3bc6f35a7c0e4cdd3fee35e86982bc61b443ccbfebc69982faa7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "3c17302f-231c-4ed0-8cc2-8002805cbd0f", "comment": "Malware payload (Mirai)", "value": "749ff6bbac23591433c62cffe1ed33d563a131e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "1c6dc7b4-228e-4b18-9a8c-29aef563fcfd", "comment": "Malware payload (Mirai)", "value": "15a577b5641e634c96a75c44e22812d5be06570d3fc2f6943252afe857877b86ea0321df72a8996e9c49018e91963449", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900203, "uuid": "03e1ef45-5ae9-4481-b955-b75bcdd936a6", "value": "T1D493741AAFA05EF7E8AFDC3346A91B4524CE5416258CBF75BD30D918F20A24F15E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900203, "uuid": "74a8a3ef-1df6-4a79-8cb7-7dc71ec4ee18", "value": "1536:GRWuNskH9ZBLPtScRop6/RtmaCx5E8FjxwFudiZCrHSY:iWuNskH9fPtjap607i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639900203, "uuid": "cb009d84-61fd-4941-a15d-deaa86117e2a", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639900203, "uuid": "5b72b834-950e-42a4-9f70-978e870e62ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900203, "uuid": "52d99127-bdc5-404a-bafe-043502ec7cc2", "value": "KKveTTgaAAsecNNaaaa.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61bdf49-60d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639924120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924120, "uuid": "b54dba10-c4f5-4fd9-8b1d-f676ff22cb73", "comment": "Malware payload (Mirai)", "value": "57cc84ada16a97a41e6b0d5de4132164", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924120, "uuid": "d5717b3b-a3a4-457e-b67c-52c715307d55", "comment": "Malware payload (Mirai)", "value": "909542e714cde7928d1773a1e19f9f54dcc981a06edb31ac5f5356302d2cb2fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924120, "uuid": "75058dfd-6311-4621-a919-65acef1626af", "comment": "Malware payload (Mirai)", "value": "00a4b9c41002dabb975390e7b66e6f854fe06c8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924120, "uuid": "5696ac7d-df6f-4b46-a9cb-9820d4cfb901", "comment": "Malware payload (Mirai)", "value": "66b70678f3de02b8fe5d4683694199cdf5944c0586b28cfb02ebdfc592fe783ce8fa40a9a3089e8641d641a981547ed9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924120, "uuid": "1eb70490-26f7-4f22-9cf6-48244f3cd802", "value": "T11A833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924120, "uuid": "318c661c-35ab-4b15-b1bc-d4d03d114381", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCmdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3J9BQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639924120, "uuid": "e6c9a811-d4fb-4596-ae7c-dbbacba81af1", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639924120, "uuid": "06f2448d-61f4-4603-9bb5-c69f972056f2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924120, "uuid": "3030bf5c-3176-4efb-9522-a3519d7a1fc7", "value": "57cc84ada16a97a41e6b0d5de4132164", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bd5418-60a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639900205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900205, "uuid": "1ecca27a-423e-4a15-be6a-ce917ed78a89", "comment": "Malware payload (Mirai)", "value": "b13cb403f4e98d1a5b1030594522b67b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900205, "uuid": "eb67ad91-0c84-4ffb-9f98-1d0266d7b7c8", "comment": "Malware payload (Mirai)", "value": "9155996f59abb6e76c2e5a69d4e11d5507e7e6cb21eef3a25b81065d9ff3b32b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900205, "uuid": "54a13591-5476-4723-b944-bdfefbaa9702", "comment": "Malware payload (Mirai)", "value": "e8e2fa19f47863f7ea15e1b5be2a9f70eb82805c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900205, "uuid": "bb92b3c5-5f6d-4895-8b09-e69ed3a62d39", "comment": "Malware payload (Mirai)", "value": "ff9ab5144096cd1f3ec9d685bf380ab00d30697f1ffe2a89095acce4bb98c13c30f73d8835d92d88add2b455c011ddbf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900205, "uuid": "1e0b4f71-7221-4d0d-87a7-141903db578e", "value": "T1E453E682BC50A629C7C04677EE6F509E3311BBDDD0DA3742DC250BA47A9AD0F0D67B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900205, "uuid": "1c211426-a7f0-425a-82ce-8ce47057248f", "value": "1536:vJ8Y/76zkvfRbSzT0yqvG/vRB8t46Sv+B7i:vud0fsnT84FvOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639900205, "uuid": "190d5453-3fd8-4a4d-bb4d-0c769cb3317f", "value": 61220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639900205, "uuid": "26b19a26-15d3-4291-b8ca-e7c6f1a5f2d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900205, "uuid": "ba0e9422-6143-419f-b75e-c9189dc41aa7", "value": "KKveTTgaAAsecNNaaaa.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd3949d-607f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639886307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886307, "uuid": "7003ac63-f4c2-4a89-8263-7003c94b7159", "comment": "Malware payload (RedLineStealer)", "value": "4d9b5b5b6e8bbb375a77fc1f658f36ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886307, "uuid": "75358204-eac8-4299-b3c0-4b75641e4855", "comment": "Malware payload (RedLineStealer)", "value": "91af9931eda2a03996c6641fcbc72ec0507565df10d6738eceaf3da08ef608e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886307, "uuid": "4888d1be-3811-44d4-aed9-4acd1cda89a4", "comment": "Malware payload (RedLineStealer)", "value": "0b090c8cd1bc63443b0c1a1ee9f31a0bc6e57aac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886307, "uuid": "967befa0-bee6-4416-b54a-c43bf936719c", "comment": "Malware payload (RedLineStealer)", "value": "3fa306821e1d1f3f79c58beb0346b06eecb57b232574ab240c79b77bbe41c2331be6032ccdf7b5787aa38151ad2c07fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886307, "uuid": "a009f855-70d6-4e3c-9b53-cf8cc047b8f9", "value": "T14354F1313AFDC472C29716B448A19BD69E3B74230B65814F2B28166E6F70EDC89F531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886307, "uuid": "cf462c56-785a-45ea-b0ba-cf002f3c4614", "value": "254f2d7d316c651aeb3e2ff6fd4504f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886307, "uuid": "28d9ec47-dbff-4be8-ac5a-ed906cfe35c1", "value": "6144:fnikLFHVoxCGDDevz9I03dk58EVfTdT1RbWlpz7/r4PuzbgwuHhvB:P51oMG3eBDtk5Bh1RbWlp7D4unnUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886307, "uuid": "de0d32dd-9df2-45ee-9b76-a70ad5dae7c5", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886307, "uuid": "cbf61e62-f785-4d3b-a9f7-da00215db5de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886307, "uuid": "fb140e4b-6656-4d7f-93a3-76dfb44db1b0", "value": "4d9b5b5b6e8bbb375a77fc1f658f36ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b92df7-60ca-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639918133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639918133, "uuid": "e7dc3940-3914-4f69-8d6c-40a702b93232", "comment": "Malware payload (RedLineStealer)", "value": "4cc4c5907863ebe08d2be78f231ef585", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639918133, "uuid": "d325a6b4-7f42-4da8-8e49-e7cee76c7e43", "comment": "Malware payload (RedLineStealer)", "value": "935f6f03303b13df2b51af0b9e2b9f6ce5cd20cfc4ba431103af128dadd6a576", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639918133, "uuid": "93c9ad8f-48a8-496b-a734-7dc1751182a4", "comment": "Malware payload (RedLineStealer)", "value": "a345000075d61ddc9e18ea5d863dccec13384cc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639918133, "uuid": "4957d72b-b2d7-4829-b1f6-8005119bb235", "comment": "Malware payload (RedLineStealer)", "value": "4396852435ddcadb1b00f095a1cef244166fc0d9d20aa2860be017f31c6c788a9630c29d9992a7c8421c8db9ab5b6e65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639918133, "uuid": "59ef8bcb-08b2-4714-b2d7-8bef48dda646", "value": "T11A84CF00A7A0D034F5B726B54A79D3A8A93FBDE16B3491CB62D53BEA56346E0DC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639918133, "uuid": "ecb3683a-668b-4f83-bf58-c9a6e33e4c47", "value": "5f124a733ee23e7a763027f872397aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639918133, "uuid": "252069e9-656f-4afd-ac64-0fa2135b41ce", "value": "6144:JvY/hfaNsYeaDDHBYolh5nkRAnlEJa7xwZ124+JXerMchss+x1UkUV:iht/a3HuUMRu7xw7f+h/wss+ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639918133, "uuid": "59fab465-3bcf-4ea1-a305-5a154ae0a087", "value": 403980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639918133, "uuid": "e1872e08-4fa6-4fdd-9e63-905cbc51019e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639918133, "uuid": "ec7a1537-069a-480a-a71c-46189d5adac0", "value": "4cc4c5907863ebe08d2be78f231ef585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d064ad5a-60a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639903441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903441, "uuid": "3ea620b7-011b-4386-9db2-ddb97e3a772b", "comment": "Malware payload", "value": "664bfa141b6f4b457303edeed4771b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903441, "uuid": "7b7041ce-c030-4741-a322-e419cce9f205", "comment": "Malware payload", "value": "93d441b3d43e332b602d66f6313c6a94004384bb300bae3f6cef9f579629c30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903441, "uuid": "cac80d84-bcb8-4c24-b5b1-c02a95e89521", "comment": "Malware payload", "value": "c62da714cf7234667fb5c2b7c856ce95f40ac483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903441, "uuid": "0403571b-ee5f-4f6d-9d55-9f09dd684658", "comment": "Malware payload", "value": "0ee00c605a0da75933f74fdfec767411e4549d2876239775339b0b3184ec0a088d670e584f9acd14920c7b847fe95254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903441, "uuid": "ae538c09-2858-4dae-86fb-d0bb64001944", "value": "T110069197C6B95290C8B3C0389262AA14D5F6B4148221AFB783C7BCF60F735B165ED7D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903441, "uuid": "9048125d-e351-4302-a66e-52538298e04e", "value": "4bde4f08c217ad48a6baa148956a6236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903441, "uuid": "72d35366-72d9-4441-a58c-e41d2ea81542", "value": "49152:aEdS4hMA6e648806YyGTRgUFuK7EErV01L1:anH3e6FpP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903441, "uuid": "c0f5e7c1-3431-4982-9a56-4b1506cb7935", "value": 3795968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903441, "uuid": "8aaf4e4d-184b-4c59-bf22-1323d028500b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903441, "uuid": "d0b9ddb2-fad0-4725-8495-4c87dc942623", "value": "664bfa141b6f4b457303edeed4771b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf71dc13-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923626, "uuid": "3d9b3a03-d0b3-48a8-8fa1-a59cb287efe1", "comment": "Malware payload (Mirai)", "value": "9bf5cb3bb07e237406780d6fb7f69ad1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923626, "uuid": "d8de4984-dd4d-4a05-97a5-c8e12c7e5c04", "comment": "Malware payload (Mirai)", "value": "976e62999d919c82fc0beb3045b27551d84f1d830a6aa7d07a44ace4b1c3ebbd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923626, "uuid": "5acd8cf8-63e1-4fbf-9889-6a8928746322", "comment": "Malware payload (Mirai)", "value": "ada0a010d0eb70aef542be8763026d10a4bb6caf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923626, "uuid": "23592fd2-0bf6-481e-bb55-b33e3ef31cc9", "comment": "Malware payload (Mirai)", "value": "ba42bc1c18b97a16261a4fb68b847ce85249e0acde25977eadb178f6b4afba9a8770f8298d4f1ee6eb33a42995005ce6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923626, "uuid": "e4bdcb34-c91a-44d4-8569-b661db6001ad", "value": "T13DF2E17CA30059ACD82E647172DE27F82D5009BBA2916C0B61A4DA73DE2716CF4937F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923626, "uuid": "03980f9e-a9be-4fb6-81a9-c5289ae1044b", "value": "768:poCNWYdyDMklX/jhPiVJJ0+ZSgyztjkPISZPxjJ/qBJgGlzDpUYsZp:pDFdaMaXMm+gRdkPISPuVqYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923626, "uuid": "d9e37706-4383-40c0-81c5-448e75b82453", "value": 35052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923626, "uuid": "37bfa93c-a49c-498f-8f5e-6bcb699c893c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923626, "uuid": "c5d503e3-bbc6-49a4-ac35-bc0bf2cae12d", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f96d016-606e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639878636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878636, "uuid": "0e8ae907-d8f9-4b4e-aa02-e7d65dca3c43", "comment": "Malware payload (RedLineStealer)", "value": "46bef7f6fdcb65e2e6009197f0f11229", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878636, "uuid": "1cddd5a1-c736-4b4a-90ae-9cf76bcf98ad", "comment": "Malware payload (RedLineStealer)", "value": "977c68b28f92df1f9cb32d67323dc5c13ee2da192f8007dbf893338529bd88e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878636, "uuid": "0e6b7c4a-5744-4877-946e-5bdce7693b1d", "comment": "Malware payload (RedLineStealer)", "value": "f5ccf3aad57281845abc8e0ba1d173c5c9ff8b1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878636, "uuid": "35e1b72e-13e6-4d4f-a8ac-f6adc878889c", "comment": "Malware payload (RedLineStealer)", "value": "75234e03efe42eeba461887a9c4cf6ca4f80f2a7902bb8f0939c017851ee6f763eaa190fc54cb7d441c4fd62752712e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878636, "uuid": "83d79878-78e9-4271-9803-3f69b5347aae", "value": "T1C01633FE85CDA2EDD18237BC7E15E9456B4AF81439583350B39282AB0519FCC9BB427C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878636, "uuid": "bdaab6cd-dfc7-4376-82a7-efa597140189", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878636, "uuid": "49e382c6-a323-4af7-ba0e-4984dabe38e4", "value": "98304:tK1b/nrAqZLJTB+LmCS64TwB3s4MOU7U2v/G0GpJzaPQX:I1b/nrZN3WrSr6JTU7UM/GnpxaPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639878636, "uuid": "fd065700-edd0-4bf2-88a1-ce6062df93ac", "value": 4363264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639878636, "uuid": "aea26a47-2c8d-43c8-a05a-7a628f2ea32d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878636, "uuid": "06b5c7b6-895f-4509-beb0-021b6543b3e0", "value": "46bef7f6fdcb65e2e6009197f0f11229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653d4b76-6126-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639957807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957807, "uuid": "bd54a832-5951-4bcc-9db0-3aa30a21d95f", "comment": "Malware payload (Mirai)", "value": "8a0bc2f37a90302c1519c830ea583d10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957807, "uuid": "661965f4-e072-4cdc-a7d4-e60c0d0d64db", "comment": "Malware payload (Mirai)", "value": "9832ed5a0b71f489f8a9186352d6d55ca3a194ca702032bf86e43f27d641b2ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957807, "uuid": "395da060-ad29-4b1d-aeec-c8300b306d28", "comment": "Malware payload (Mirai)", "value": "433b15febc0b3796072da6036f3ef7761ed04dbe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957807, "uuid": "05e03c20-e403-4918-956b-cf8766b3cc64", "comment": "Malware payload (Mirai)", "value": "4a53b9daf5402c8f2a92ac8148cd49644c08350ed90eadb47ac21db3f06466a3a29c17ac35a518b722fd15f76ff3e426", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957807, "uuid": "76cf843b-28b8-4d5c-8fa4-5661a9cef69e", "value": "T1E7B32982FC51EA12C7C206B7FA6F118E331513A9E2EE3202DD155F6437CB95B0E6B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957807, "uuid": "aaaf2932-b88c-48d9-b4de-17d9a040a997", "value": "1536:Mh98yZM5DInLUi/IscsAIFEp8OSP8t46ta/trlmO8TZTQerEiNiO8uvaitrTsa:Mh984+DIn/Bg8Oc84O0r2lei1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639957807, "uuid": "280e57a8-b35e-404b-a6c7-9fc4710747bd", "value": 116192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639957807, "uuid": "9dc5d37b-e1a3-4a1b-a8ad-7b868d998871", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957807, "uuid": "0d977641-17cb-431f-b84e-5b7416cdf923", "value": "00100001010001001000001001.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9279cfb4-6113-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639949723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949723, "uuid": "1f3c2542-b4df-4a22-a64e-75c2d4429fbb", "comment": "Malware payload (Mirai)", "value": "d07d960645af41ea9cb9d32df97b26b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949723, "uuid": "19ed7d64-523d-4799-b915-53a0c5127dbe", "comment": "Malware payload (Mirai)", "value": "9a26c78fac0218150c2a53f9529deab9582195e1d09752df395aa6bf6b5e3ced", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949723, "uuid": "8b5d40e0-1be3-4bb5-b4ff-06fff5ee6316", "comment": "Malware payload (Mirai)", "value": "dce131edd49c0df661a234d06e7c4e2db9764af2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949723, "uuid": "25a356de-dda5-4c3a-922f-df41d6f21a3f", "comment": "Malware payload (Mirai)", "value": "6593ec3bb36787c6972407d76a1239099e7bd7838c258e82a8235e4adb571da750f89ad4fa31b370f6f0d21dac4e115f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949723, "uuid": "fb92d75d-4c90-4405-a0b5-a5869d0e9eea", "value": "T10123F1DFF296D707E3B5193E2BAB0B66DD8D3A9437DC06A84220040D721A1DEEB1CE11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949723, "uuid": "adba1aa5-4a2e-4bcc-b56e-151336c79fff", "value": "768:+zVZHXaHTmnpMbRlRx2oBbt6jdMAKYn3BnWacW/3W1E:+jKHTmpMbRlRxxEBjlnWacXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639949723, "uuid": "a72641d5-8cc5-4f27-9d28-5357d75a04a9", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639949723, "uuid": "1e58b804-7a0e-4a3d-8cd2-0c2880e31bd2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949723, "uuid": "66def932-950c-43fa-8637-4266dec239c5", "value": "d07d960645af41ea9cb9d32df97b26b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597433eb-6114-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639950056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950056, "uuid": "90820602-bd72-45f6-b78b-c0d2b5c73659", "comment": "Malware payload (Mirai)", "value": "f53a457b81898621d1ec7bdfe3ab0fbc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950056, "uuid": "ccb58909-2198-4c81-ab22-dd8b51a84c72", "comment": "Malware payload (Mirai)", "value": "9a5b1656e4e9437e698eeddcc417dfcc82795bd32ea7f6e3afa8a8f305b9ec62", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950056, "uuid": "fa642a25-b3d5-4765-8298-8ec4b9ded399", "comment": "Malware payload (Mirai)", "value": "80e77e52a8e1ea29bc24445dfd1fa229934ec93f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950056, "uuid": "bb4f2439-3945-407b-a211-bb1c413300a4", "comment": "Malware payload (Mirai)", "value": "d56d28a6589b3de6ec9fe4e984db29fd868056a31b06e30816ebb3d09c981ae7be1c0835bf47db7a52b21c291db305d4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950056, "uuid": "489baf10-4e11-46c2-bd5d-1bf86f01f03c", "value": "T16493F805A9E554FCED1CC2303A37D93993E4F11E0331A35DBB66FF940E8A958229FA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950056, "uuid": "6ed09fda-8d9d-42ee-a314-9947b714ff6a", "value": "1536:/8ldIs5rejnbC6UUM2BEGI5Rh4ZThT4J9JMOpnAiKyqJ49IJOw0hVlCBoV60:kldIs5rejnbC6UUMEEGI5AThsJ9J9BAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950056, "uuid": "37ed40f5-d7fb-46ed-87b4-12c0fdc47e7b", "value": 97536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950056, "uuid": "3f8d33d2-a6c3-41d4-942f-4f4c05934c99", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950056, "uuid": "dc59ca64-588a-43af-8496-da4a96d20351", "value": "f53a457b81898621d1ec7bdfe3ab0fbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4eece5-6112-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639949472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949472, "uuid": "1a58a169-4eba-4d05-ad08-0bc67c316543", "comment": "Malware payload (RedLineStealer)", "value": "9b0502ac06fc5fd02e45788ab90d53ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949472, "uuid": "f671b280-82f7-42b0-86f7-b1a5ba4a0b6e", "comment": "Malware payload (RedLineStealer)", "value": "9ce5757dca343254bda9d84423208891a063795a867717ba58ec9efd180b8f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949472, "uuid": "93ed33b9-db30-4785-bdff-79fda73f0632", "comment": "Malware payload (RedLineStealer)", "value": "a3805c4bfe03aa9b4dccea3a0db88d15a2e9b90b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949472, "uuid": "5ec4bc65-e527-45e2-8491-75cb48e5439c", "comment": "Malware payload (RedLineStealer)", "value": "253b648f9e3804a1ae258e23dd37c79480945b957522494497245f2f1e158a4d55c2fa597d404d4e4e67346eb5eadc49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949472, "uuid": "2cd63b69-2259-4ec6-85e7-53e4c4968a71", "value": "T1D3E42372EB02CC93D51042B9AB07D77E7461ECBD0EA451D2608AB56F64B436378372BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949472, "uuid": "db07ef98-153f-4ef9-b92f-3fa810d9d316", "value": "e173696583a7b3ed6093e8dbbe166b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949472, "uuid": "660cedbc-8d79-4a74-894a-9e332e9c5a50", "value": "12288:RWMriTUVtbFA+aIJEY9brdhHUlMOhw0jTC85FKsV6re7oenaq8Wu:RjriTGVrJEIbrPHy5fjTC8gre7HHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639949472, "uuid": "425272c8-c8ac-4e01-a46a-9e8af3a323c5", "value": 715232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639949472, "uuid": "a9cac56f-1c51-4d51-a0aa-6823425ca8f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949472, "uuid": "5073d788-af66-4c72-9115-90e40e11e849", "value": "9CE5757DCA343254BDA9D84423208891A063795A86771.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969d6740-60b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639907209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907209, "uuid": "36e8db9c-8b17-4e48-a168-1af8401d3b01", "comment": "Malware payload (Gafgyt)", "value": "28770017c74292c1585219e61fb50863", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907209, "uuid": "46ebffca-2abd-4218-8377-8ac4e84fe56c", "comment": "Malware payload (Gafgyt)", "value": "9e42027a13572ad74bb7690d4a8c9513e315cb9e0e6973af093365f47b1f3a9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907209, "uuid": "7bacc12e-3221-4eba-b580-f46f4d743d3e", "comment": "Malware payload (Gafgyt)", "value": "ccb3c901a09c58c8a17cb30eca988269a4c46a4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639907209, "uuid": "5c2b536f-9a3b-4776-886c-d2d653b7391a", "comment": "Malware payload (Gafgyt)", "value": "9c11322a596130ed5a987f2097fe651687b59b07996d861c83e5773a163442b770f59ed397d00e6989f1be0f0ccc696f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907209, "uuid": "1b1f162a-9045-4690-af96-e32cb932f19e", "value": "T13683284754A25FB7D04A6AB92DBB45B0075BAE510F0F1A9B627CB6B4033F8CDB40E724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907209, "uuid": "4347b1ca-55b8-4b7a-8931-10628c25a8b2", "value": "1536:Aq9bsPTe2MP51b3KNvU8mk9KJpArvXqin/oCnOOoHUJa:R9AoL3dJYXqookO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639907209, "uuid": "87e41c29-9fce-45e7-96ed-cd923bc28511", "value": 82832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639907209, "uuid": "28a8f230-1e6d-46e7-b693-0dc9e642907b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639907209, "uuid": "09d7d9c6-e687-4659-8fec-5e219d8a5768", "value": "28770017c74292c1585219e61fb50863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af88ef86-6081-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887065, "uuid": "71fd007a-016b-49fb-ba76-d0111f319574", "comment": "Malware payload (RedLineStealer)", "value": "7c4d61a5b3d4b11b1292790ede14a60f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887065, "uuid": "e4c9c0fe-2140-4164-b622-b64f170cb0ee", "comment": "Malware payload (RedLineStealer)", "value": "9ee2d9830b8d71d22299f6b0ad5a968a85267169732faf8aef970539031f1708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887065, "uuid": "fa3224c0-c1af-4119-945e-14f4ccfa7245", "comment": "Malware payload (RedLineStealer)", "value": "c3b822bf9e2c59c9940ce5673dd1888ec509ff6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887065, "uuid": "8accc7ab-d2f4-456d-94e5-00563e4034f9", "comment": "Malware payload (RedLineStealer)", "value": "5ce8176bfd7ada77445b7ed1866f12cb71ad408407a3af6a7f100178afb274d38c88baa578d733c037585286a7b67158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887065, "uuid": "cd703164-f656-41aa-8388-c500a577a000", "value": "T13F94CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887065, "uuid": "abf97b64-79d1-4266-9607-9294c4641286", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887065, "uuid": "14fa264d-3bc1-45e0-b0a6-97fe171d92f7", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887065, "uuid": "3fd10804-1bb8-4574-9a0a-315b2a148663", "value": 411162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887065, "uuid": "93801e6c-b6b9-4abd-9be5-6b639bea7f80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887065, "uuid": "27f28572-d8f7-4272-9684-e7157cefad39", "value": "7c4d61a5b3d4b11b1292790ede14a60f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce299b82-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923623, "uuid": "b063da3a-bc6c-4549-9898-a7fcaec4d64c", "comment": "Malware payload (Mirai)", "value": "23abe879b792a2123724ba6d0ba79fb4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923623, "uuid": "c6b0983a-367a-4ac1-a90e-f445739b5732", "comment": "Malware payload (Mirai)", "value": "9f7197266731ef2f7674fb549a20e342e4001b3c1c2a7677471fa1fc1296470b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923623, "uuid": "86415982-4739-4e0d-bcb5-0b09f9a25b1b", "comment": "Malware payload (Mirai)", "value": "820c6c3eeec83c4d12b49aa68cacb5b355c90109", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923623, "uuid": "db2b907d-746a-4ce8-b39f-714099448a26", "comment": "Malware payload (Mirai)", "value": "0cc8e8527f3e8d83501b86c87465ba4853bd030c001ee1253080b47f51b7d8ae243f7c7ff60fd0186b805971c70984b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923623, "uuid": "fbd5577f-5b86-4fbd-8b61-0e6834fcf547", "value": "T187E2E063518CC918C0E0193BD57B85E27158FCFDF5E7702B65484BBEBE9200B4A75A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923623, "uuid": "8adca6e8-3f6e-4235-b2d3-38aee618fedb", "value": "768:DMTEg4yQxJfBvMNz9cMVQQqW9+5wvNbDC6+CdT5WGgQafWIfp3UX:I4g4RxvvMB9ht9+yvpOs4Gwf1fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923623, "uuid": "51292924-599f-4dad-83c2-9d4a6e80d862", "value": 33492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923623, "uuid": "2c9a882e-f94c-466c-bf2b-5b06cfa61350", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923623, "uuid": "636e204f-54e7-4dcc-87cf-7bb527ef1fe4", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00db3f68-60ca-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639918125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639918125, "uuid": "59ffbd12-0e00-460d-8704-f7a38c4822d2", "comment": "Malware payload (DCRat)", "value": "4761345edbad112ad203ef2f1846ddd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639918125, "uuid": "a4b26d16-898d-4471-a0f7-9a04104bb2fb", "comment": "Malware payload (DCRat)", "value": "a0c8e08ec9c9eb72e4e756f7774abc75abafcedff735c7177946ee84f3889e96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639918125, "uuid": "afe7452f-65f6-4dd6-b99d-bd28aa146f6e", "comment": "Malware payload (DCRat)", "value": "8b582866d3bcfdd0b64220d9b34f09bad1c75345", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639918125, "uuid": "da129dd9-6622-4e57-9cd3-e23e3e1ee288", "comment": "Malware payload (DCRat)", "value": "06bf022b3f04e290f6c0abff6f9a7cfadeabd176fa3d48a4390fb718aa646744b07584c540e0413aecb31790c47829ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639918125, "uuid": "3e5433b1-6345-4372-a0b8-adac36967ba6", "value": "T1CEA53338A332194DF4A58A78A43DF86A9FD14D234163603CAAD9AE73D800737BF9D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639918125, "uuid": "25df1a66-cbd6-494f-b6f4-53e49bbd025f", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639918125, "uuid": "1e0b164a-dc79-47ae-9e6a-1fa1764021ee", "value": "49152:U5c4nyq/XR0x5Nsfhz1UqLHlynxXEmhPUj8JVzIzrUPqhj/Wml+sWwl6/b:U5c4y4STsfhzGcsnxXEmhPUj8JVESakf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639918125, "uuid": "b9194e4d-e0e4-4e66-a44b-7e1ee040ece3", "value": 2223104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639918125, "uuid": "5ae1184d-24ef-48f1-825f-daf428ccd079", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639918125, "uuid": "480cbccc-54bb-421e-ae15-abc5a261e2c6", "value": "4761345edbad112ad203ef2f1846ddd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedd2ee3-60f9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639938738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938738, "uuid": "2090c2b3-e1b6-47ad-a4e1-a1e886e85fa7", "comment": "Malware payload", "value": "50aaeda216f7f405618eff9830e5241f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938738, "uuid": "873de897-cca8-4124-8784-21f88f5c99e3", "comment": "Malware payload", "value": "a0d45da423f48b84b516c360a3ee501c793340a15fb2ca27c5d5e51a6c2da50c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938738, "uuid": "25a63a10-4b1e-4524-a8c8-844fbb670012", "comment": "Malware payload", "value": "1b22291d5c08b98acd7e768f11b5b63da2600f91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938738, "uuid": "484629c2-75df-44b3-bf12-727353960537", "comment": "Malware payload", "value": "c9d408ddfb8b0290e92adf5e70727064bb7910f5e794210318176cd208573518ddfde41cf37d5951a97506f669b8e18b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639938738, "uuid": "e8dc1bec-27f2-4eb1-a674-993188781a85", "value": "T149F43949FD814F51C5C12ABAF61F8398736B4398D7EAF306691847242FCB99E0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639938738, "uuid": "da3ce5eb-8d7a-4f4c-966e-f3da057622c8", "value": "12288:BT88nNzKOrU5wIQGq6JvWIvnmZajby5LjvzyKhGQ8hX5e6rJb17x90p:F8C9KO4lHq6JedZajbgLjHLU5ZJbxxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639938738, "uuid": "b9d681fe-7eba-4431-8c45-10e03751f5a0", "value": 748716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639938738, "uuid": "ec8457e8-de47-4120-b368-0556283c620e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639938738, "uuid": "cab3c8c5-2f40-4852-a60f-ffead3c8cb0d", "value": "50aaeda216f7f405618eff9830e5241f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556df0b8-6114-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639950050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950050, "uuid": "9acf8ef1-6786-41f0-8c09-4da853d8fb74", "comment": "Malware payload", "value": "598c7f0d859909308d77957899761752", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950050, "uuid": "70ca7051-7927-41c1-a916-55140168e8dc", "comment": "Malware payload", "value": "a1250e10e8a41ac5715e175a9b714adc1539190c471865c7567abcd6ca77a9c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950050, "uuid": "ff715130-17ea-45a8-8c86-e9c9b4f0f4c5", "comment": "Malware payload", "value": "580e89183dceb28330107aa822f1d9e4b8cf662e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950050, "uuid": "d30ad972-020c-46bc-98df-6f4a4f59ef14", "comment": "Malware payload", "value": "7508ef450526a14a5cf884f89329f0732b9a67d4dff831455b1cb1761a266ee62e94d7b6b99e080871491070084da90e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950050, "uuid": "6f5a99fd-cce7-480e-bb32-3bf7d0e4af45", "value": "T184D39109AF601FABD82BCC36459D0B8570FC175611AE2B56FE38D614F7DA6CB01E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950050, "uuid": "3162872a-c926-494d-9ea4-ea4ec37d573a", "value": "1536:voUciBsrs7KPOFZfyq42kB5t3BgY0KZwCRTfhiAQv5e1vT4HTTTTTTTTTTTTfvcH:vvciBsrYFZJcBgNKADY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950050, "uuid": "b854fc4c-6999-4ced-b9c6-5907ad31e31f", "value": 138204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950050, "uuid": "7c19ccab-42d5-4e70-8ef4-8394a6c355f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950050, "uuid": "0f00052e-9620-4d16-af57-a785431afd3d", "value": "598c7f0d859909308d77957899761752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0091cd-6082-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887379, "uuid": "eb7dace6-c366-4287-be2f-607b833b1a9c", "comment": "Malware payload (RedLineStealer)", "value": "a7800694cd4d70618629b5464224dd9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887379, "uuid": "d484055c-9414-48d7-ad1e-fb3b1677f100", "comment": "Malware payload (RedLineStealer)", "value": "a3984b0c19f6c36bef384a91166c0d752ace42364361bb5caa6f9ad126aa7bb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887379, "uuid": "7a029d69-ae06-4132-9b63-7b6516e435e6", "comment": "Malware payload (RedLineStealer)", "value": "afe7c82b71e13afbf72066009731c472110ccfe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887379, "uuid": "e2b450ba-c2b0-400b-85e3-6a4165512f77", "comment": "Malware payload (RedLineStealer)", "value": "110dcaf498df1ef404604b6794ca2f7a27326f58bd047315bf33b22e4ee0641d26f1bb665e12969ef78fe34628b2a697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887379, "uuid": "7b896b35-96f7-438e-a39c-90d6f11ba9a9", "value": "T1D694CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887379, "uuid": "9ecf9b14-d64c-45f0-bc78-abf0cbeb7137", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887379, "uuid": "64c2998c-8dbd-4783-ae6d-faa9b12efb15", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887379, "uuid": "1c62cdac-c8ad-4b97-8d7d-af175458f726", "value": 411174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887379, "uuid": "19c883d3-8905-4bfb-9934-c29e51f53256", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887379, "uuid": "bebe363f-6bc0-427a-a352-d674028ebefd", "value": "a7800694cd4d70618629b5464224dd9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbae6cb7-6083-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639888052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888052, "uuid": "533eb0af-b40a-4585-a493-520b359a5c03", "comment": "Malware payload (RedLineStealer)", "value": "b9b5de3f220b74542f67ace04ed495b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888052, "uuid": "c2c8aba5-7cc0-4808-99ac-b18a5f0928c7", "comment": "Malware payload (RedLineStealer)", "value": "a3d6c491d32262a758c8a3e8f84bb13a6cec54855cff1976a9c0b7edb81766d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888052, "uuid": "9f278750-3028-499a-89ed-45e3f398b09d", "comment": "Malware payload (RedLineStealer)", "value": "8e88db5ab35f5e6c23c0a96bf27ca24dd176a103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639888052, "uuid": "ac664cf2-6e62-4ebb-bb6e-b62277add348", "comment": "Malware payload (RedLineStealer)", "value": "08bb073a575af8517ab0f6a2c8a13994ea2e9a336e641b77570005fdc8df24fac61d15ca1e58065d6c154a51d9ba2e1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888052, "uuid": "6568c942-c782-4754-a544-1c510d96f682", "value": "T11D549D10A7A0D435F0B712F859B993BDB53E79A16B34D1CF22C516EA5A34AE0EC7034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888052, "uuid": "b5b76f4c-c8e5-410f-a40e-b9538ae90a1d", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888052, "uuid": "f1a2627f-20f0-46f4-968c-deffab7d0d39", "value": "6144:15ogZrjg5Xt01fUSMOaVJYWAqDRBikHrIp:I0gn01fjMOanYS7ikH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639888052, "uuid": "f0e6a199-6b77-48f1-9183-4cfe0235d485", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639888052, "uuid": "a6073555-fa16-40ec-a912-b9266b59510e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639888052, "uuid": "5b106c92-5e4b-4752-9312-03202a777929", "value": "b9b5de3f220b74542f67ace04ed495b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51584f23-60df-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639927280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639927280, "uuid": "ef07b102-946c-4b35-b258-ddf0c29d0054", "comment": "Malware payload (ArkeiStealer)", "value": "6edaa87ac2399d1853881eb668b8a924", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639927280, "uuid": "9e827064-c87d-4c48-a6e5-f4be7ee39644", "comment": "Malware payload (ArkeiStealer)", "value": "a516e2a6b61314a643103f8b2a10135b40febd2169a852dce2b2034bfb3610f0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639927280, "uuid": "659d0c84-f165-442c-9bfa-20fb9d9879d0", "comment": "Malware payload (ArkeiStealer)", "value": "9e83b938595e35850e56dc503b959a51be50e83c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639927280, "uuid": "c6b46a6c-a5dc-4911-9b31-1b328ee56a7e", "comment": "Malware payload (ArkeiStealer)", "value": "9c9f245f501531dae18de4749802bb6041a3acce958ce99adf71af8f22a811f0fab62ac142a12837dfcf493f80de6314", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639927280, "uuid": "85c1a548-8757-4f84-b941-49a6ac76c7a3", "value": "T15AF4F1106BD0C035F1B306F85AB5A369A93E7EE1AB7498CB12D92ADE57355D0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639927280, "uuid": "a5080dd9-4aa6-468f-8c6a-59b56eb20a14", "value": "68c1487a455763e144d638a4e16aac95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639927280, "uuid": "c366d3a6-f1ea-4aa7-b7a2-04a95823d831", "value": "12288:CRWOxpvZo2P4WSPI/r75XlX6k+wFmrnUZClS7yV1Vv6gHDeTPG/Gr9cp:odxDQPIT9QbhiUSmV1VR3Gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639927280, "uuid": "80658a34-0e04-4bae-98e6-f1e691d04b71", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639927280, "uuid": "7fda77de-d2b6-46cf-9a0b-640cd8a58448", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639927280, "uuid": "ef819e2c-84ef-4309-902f-f0534e182d50", "value": "6edaa87ac2399d1853881eb668b8a924.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf41132-6080-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639886762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886762, "uuid": "7dc935de-2d9d-4d29-90e9-6584a5ee10fc", "comment": "Malware payload (RaccoonStealer)", "value": "9100a533fc62f65efba1b86d2c83a5be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886762, "uuid": "2ba9fb8e-6b86-4261-8539-e144ce6a2c0c", "comment": "Malware payload (RaccoonStealer)", "value": "a5bc0b147e9bacda1b3d5c8ba9fcfffc3fc4776c17763463d5a21e51b8bc811a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886762, "uuid": "fa3839ad-2eb0-4d5e-967c-84e38a50c1dd", "comment": "Malware payload (RaccoonStealer)", "value": "d9a58768537b9fee5c7f44fe297f953d44ffb196", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886762, "uuid": "4c2394f7-83ae-4e38-b43c-25674421b39d", "comment": "Malware payload (RaccoonStealer)", "value": "fbc641d6002847e2a17db6880443aeaf56df0877710193feb455192723bc18fc796d91da18db1824fe22b620a8575b87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886762, "uuid": "93358564-04ba-4d65-b556-e1c9256d1bd3", "value": "T1FE15234013CB9729E5BF3774E93156A087B0F8A56C38D55EBD819CEE203A7844F9236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886762, "uuid": "815864d9-042a-467f-8605-742253664efe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886762, "uuid": "649a0e4a-748c-4f1c-a6d6-f5128532a5d7", "value": "24576:UbkpCRDALJmt2bOfrv1MsBdUzmbetEQ0POP:U4wRDUJsbjdMwmyKEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886762, "uuid": "da53c3b6-48d4-48ad-9a61-999f52c02871", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886762, "uuid": "77456374-01ff-44ba-87cf-13a9bb7913f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886762, "uuid": "80c034cb-9228-4b7a-b8f9-4e4534051263", "value": "9100a533fc62f65efba1b86d2c83a5be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a887aa-6116-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639950802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950802, "uuid": "a3b8e4fb-2124-4d1f-b54e-e6117974b73f", "comment": "Malware payload (Mirai)", "value": "19983619e734915e2c9ee4d4b9306720", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950802, "uuid": "2a0619ed-944a-478f-9e3c-6bebf0939576", "comment": "Malware payload (Mirai)", "value": "a78e3ee74f54f44fdefc7d9ec8c804bbb3d4271eb7fdbee046f38608ad60355b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950802, "uuid": "8e3a4c3d-655a-4848-838e-5c6ce3207d8c", "comment": "Malware payload (Mirai)", "value": "d110cea903feb3c8b62d36215577699443cf1573", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950802, "uuid": "c2a601a9-5f97-47af-8ac7-01ee658b2e23", "comment": "Malware payload (Mirai)", "value": "9db761723e7fa68e5339e6b624d5c2227ce2634bff53baa98f230ae27ed7c32c4a58d74c33bc6ff26c3d042743a586c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950802, "uuid": "39ff6846-0dfb-43b1-a883-d043283057e3", "value": "T19F93BE23C9342D24C1058AB171F5EA369323951691CB3EFAD585CB6D6843DEEF226BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950802, "uuid": "0d12e110-c553-4ce1-b9dd-df4f561651e8", "value": "1536:4PxmkLbgX0FC5+CgCd1yTd4+2XyqOiPAqPwyCfwJhKVaw54JAaZ5hrs:K3bSJYPsyTd4Cq/7PwyaVOAY5hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950802, "uuid": "1a66adc3-9ad2-4819-a3cd-2d8535dec4b0", "value": 91508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950802, "uuid": "2cd5b481-44b8-4111-b07f-05640f4aa063", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950802, "uuid": "8fd62484-d78d-45cc-b771-7e048b1ac013", "value": "19983619e734915e2c9ee4d4b9306720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2cbde3-60f7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639937549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937549, "uuid": "ab6a683a-8993-4a1d-94a7-45d854fdf6d4", "comment": "Malware payload", "value": "b80c821bc61b130cbde4e3c199554b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937549, "uuid": "2755b854-bfd6-4ffe-ab4d-2a783f08d2e9", "comment": "Malware payload", "value": "a7f9b4149a408b1c01607312259cc2562a2ef43f8584a876741195ee16416e71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937549, "uuid": "74221c47-e332-437c-9f70-241f5581967d", "comment": "Malware payload", "value": "1fa0506dae27382393884a0c4306203083a5e97f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937549, "uuid": "5ab89017-1c77-4f1c-b534-7d96a420bfb0", "comment": "Malware payload", "value": "68f2df057211d4b1c58c7b8763901b9f78bfdf00931660dfddf5e35b197401cb65c39ceefd7c0ebefb804b19988e05c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937549, "uuid": "ff303b50-1a3c-4c8a-8afd-39d4096e8983", "value": "T13E56226F6249336CC01EC570D423FD4AB2F6662E0AE5A96E71D7FAD077AE420D901F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937549, "uuid": "9bdcfba1-2320-421c-b1c1-832f9e6f90b0", "value": "ab2ba2cd627342a99318bbdfb697241c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937549, "uuid": "f5162a97-99d2-4e87-890b-fb0e77f07e2b", "value": "98304:eNjDAkOc9aO5cFrqaj1SHsVsdf11jyIP2BGi6/2btCMN3tbt+xOh44xCL890K:eNjDJOCBSVqw1us2LfGGh/2xCMttbWg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639937549, "uuid": "6247bf65-7dfd-419c-b913-d8e975386135", "value": 6223872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639937549, "uuid": "6c9bfba0-b637-4826-9469-7affe81f183b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937549, "uuid": "3d8f38fc-e437-473f-acbf-ec939d04ae8d", "value": "SecuriteInfo.com.Variant.Bulz.475950.2652.22951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a6c29f-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923629, "uuid": "5d81783d-d810-49c1-a785-a7276a63f65d", "comment": "Malware payload (Mirai)", "value": "a28b9cae34bdfe8155580a625fd03d72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923629, "uuid": "64fc9d22-031a-4845-a1c6-3c6847b1a66d", "comment": "Malware payload (Mirai)", "value": "aba4488c06495428d85679fda5b788ce7c0b523c388345b613a31eec7abf0339", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923629, "uuid": "6f416aaf-56ae-4a32-827f-05bde218605d", "comment": "Malware payload (Mirai)", "value": "6da813b1b37e2a28139a1a6e9b40af90c973cf02", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923629, "uuid": "8ec77121-a57f-4c36-ae27-3c772df9e642", "comment": "Malware payload (Mirai)", "value": "a53abd8dc4c3d52874007723020d3b5913159561e79260eb7d2a8152da3ecd6d139d005cce48216a5bec7d14d4945f31", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923629, "uuid": "c1cace4e-5ec3-4dbf-8308-ea9b94258849", "value": "T198F2D0B4C0826A27DF7D40B609BD7F8F04A1571BD1CD2752EFC561AA84E2E391D0BB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923629, "uuid": "1d205862-6948-40ba-a407-7887a2028f1b", "value": "768:TvoAuzF4QbiZEtvz0kBg1gVlIokhqIohcCnbcuyD7Ufyqe:TAAaF4rZoYkBgmDnkhdAcCnouy8qqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923629, "uuid": "f39afb5d-7e0d-451a-8b38-0fcabb718f7b", "value": 34880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923629, "uuid": "dbc7ab36-1a74-4677-9e53-9d15fad68361", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923629, "uuid": "8c644e5d-171f-4c9d-bd19-0ad122d99ff9", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eab1055-6113-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639949716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949716, "uuid": "5e1942d2-1dac-4d24-9823-d5b41943e6cd", "comment": "Malware payload (Mirai)", "value": "d47d00bb913dd9ec4294f400d7e37d6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949716, "uuid": "1896ff69-1937-4cab-badb-d60210de8ef4", "comment": "Malware payload (Mirai)", "value": "abfbb9b765a6e1acca6069b35eba286485177bdccfa1acf0ad5d2ac07e5a5387", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949716, "uuid": "10527bd9-1acb-4af9-8a58-92ac6766d229", "comment": "Malware payload (Mirai)", "value": "284976189704f3dc3e5713e0934e224b18d52ef7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949716, "uuid": "aa7894e3-376e-473e-87e9-d94873b61b0a", "comment": "Malware payload (Mirai)", "value": "f0ea5fe5470b428bad2fc2d7b2fe9bf280c8f85459ce72b249fd1be0d8f93701c399265385a035e723e9c4929a053502", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949716, "uuid": "bb5b0acf-5f62-48c4-8741-58d7033b8dd7", "value": "T1B023F266CF776027EAA0547BEB95C6430B274AACD8FA0913461509DCE4D3F4B52F14E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949716, "uuid": "a8741cc8-1884-43d5-acf6-0c06ebe9e03e", "value": "768:B4Ko8NPcUbSLAYPe7sR6h4I6Yw013k/Laclit+Ua/WF2XB8BmoXv2RihW0d9q3UK:BWZxL3PuAS4/Yf6TjK+h/WF2X6v2GwLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639949716, "uuid": "a9de49ba-b3ca-481e-a60d-c99e6a871541", "value": 48388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639949716, "uuid": "50eb8775-264c-453f-a2c2-98c9389e14b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949716, "uuid": "2e42fa29-36b8-49e6-abf9-78397660f163", "value": "d47d00bb913dd9ec4294f400d7e37d6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fe12ee-60a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639903447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903447, "uuid": "0517b597-5132-42f0-bf9c-647766be7971", "comment": "Malware payload", "value": "87da0c1141fa87e8643c1f983d567750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903447, "uuid": "c2aa1f38-745e-466d-8fdf-19314c5d66eb", "comment": "Malware payload", "value": "ac89e4bd9d529be905e2fcb6e4d586f4b4c92b8c953e46265d0521e2d4ce1b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903447, "uuid": "58500394-9567-4762-8e91-673dd99407f3", "comment": "Malware payload", "value": "cd1546eebf8790af8b59dedefb2ebcb574799cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903447, "uuid": "82d9f3c5-731c-4b65-b648-59c938591cf3", "comment": "Malware payload", "value": "daea1ebf630ba131afe194732d2f1285bc0f597ccf0344bac2ba8005b8db8b8f324a88978f3b7b96095415bea9e584f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903447, "uuid": "c3e62be4-9094-44f3-88be-e101912af236", "value": "T16206A157CAB95290C8B3C03892626A54D5F6B8148221AFB783C7BCF60F735B161ED7D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903447, "uuid": "7ac438b9-beae-47cb-8b3f-6e83ccafba5d", "value": "4bde4f08c217ad48a6baa148956a6236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903447, "uuid": "21a2320f-624d-44b4-8131-ede86f19239d", "value": "49152:LltNV+maQqXDkRL+i6OmpTKDOf2GE+LqopQ50Fsv588+UXgy:5fBKViA2H50w58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903447, "uuid": "2a648498-aa12-40ff-bcdf-6ad4306ad5e2", "value": 3834880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903447, "uuid": "8b5a04ca-cc20-4c38-bc37-af249fc5ebd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903447, "uuid": "638a754f-6f54-4f89-a7f1-5748aea3739f", "value": "87da0c1141fa87e8643c1f983d567750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46503ba1-60c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639916953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639916953, "uuid": "eb9bb1dc-136f-4116-8ce0-1162c21b5c70", "comment": "Malware payload", "value": "1d2d9e3fd2706a2cebcb820e8fe2d1e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639916953, "uuid": "469b488f-aed3-4c6c-be46-36e633b47abc", "comment": "Malware payload", "value": "ad21bb1b49346ce268f2a832a96ed91a90946b41898e224d689d33815d834209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639916953, "uuid": "a5ea5538-1f3d-4f0c-8d94-59ee7b499e5c", "comment": "Malware payload", "value": "189ac90b79713ae1344f13f44890d4335b0f8037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639916953, "uuid": "77b39bef-1ca1-480b-887a-4bd2845b3553", "comment": "Malware payload", "value": "1d0f0345916207da77d112903ddb0bf2569cf6f9e03298f0bcf3bb961dd2cb87a3efece47e06c070f8e25927468a93eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639916953, "uuid": "f7f87b32-329d-4dcb-a0bd-6c7155fb28cc", "value": "T132936D1275D1C871E5771A3214B4DAF18A3FF9205E619EAB3788173E4F302D19E22DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639916953, "uuid": "78567bae-1e14-4dd4-bc62-5710eeea91cd", "value": "30ed42acc0dcd779c77236c6b7c84152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639916953, "uuid": "77d78ab8-d6fd-48a3-a9b6-4d38b6bbc66a", "value": "1536:krvIBgfU0WSE8jKlbeYW6meefd3Pvz8DPRc9LLYuzRVDpa0AZVsWqcdf0QpPEwGC:krp80tWFeY63Pvz8DPRcyuzRW0ANf0Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639916953, "uuid": "d47983d6-12b9-4667-a0a3-c0a4b3307190", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639916953, "uuid": "5bf4d212-977d-45b6-ac6d-b212e8ffa8fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639916953, "uuid": "a80b8da8-3d3c-4313-9d97-21f127d14542", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e80ebe-6081-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887067, "uuid": "50357ef1-d58e-415a-aa59-bf2cdb0c13e0", "comment": "Malware payload (RedLineStealer)", "value": "1639b71c3c57944afb81de6e2c836f66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887067, "uuid": "b435b1ee-2d4e-4b40-8085-14d35fbdbe32", "comment": "Malware payload (RedLineStealer)", "value": "ad36a46ed1377d11560211f01783cf647357944b60f8ee5e9bec3b6517fbc5f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887067, "uuid": "069c2333-d9e9-4d3f-91c1-a3b001b22fee", "comment": "Malware payload (RedLineStealer)", "value": "b2d4a689132ca10d7e6ae8712dfa073edc7374b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887067, "uuid": "9f4dc07f-aa77-488b-b37d-ac00314227da", "comment": "Malware payload (RedLineStealer)", "value": "b0e20a4e48eaf098bb091fcee6c445890005d0a048b354a0b8b23bc35aa29a5af1d2f5b6aba3bc5b1dea0da4641ace06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887067, "uuid": "58c8080e-d572-479a-89cd-a915f736020f", "value": "T11C94CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887067, "uuid": "78719007-3ec0-4bbf-b80d-0d3a6367f708", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887067, "uuid": "11274fbb-48a1-4bf6-b583-6a9f96ed59e3", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887067, "uuid": "f429abd8-58bc-4a0a-a275-1d3a25421644", "value": 411138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887067, "uuid": "8f6cdbbc-b0f7-4217-9e68-78df6008ca6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887067, "uuid": "4c097afd-1380-4d9d-970c-b583caee260d", "value": "1639b71c3c57944afb81de6e2c836f66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede9746e-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923677, "uuid": "883b8112-f4cb-4197-a5d1-27287b9e58b2", "comment": "Malware payload (Mirai)", "value": "c4e62b64eccec292a4abd568900c51b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923677, "uuid": "72ee323d-16c3-425c-ac5f-77bc1bfd45e9", "comment": "Malware payload (Mirai)", "value": "ae27b8e2010f5eee31ae4914fe48299baeeed67732f6b67509653ec71e992b13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923677, "uuid": "a1d9e668-6968-4e5b-ad7f-7574ec4aada9", "comment": "Malware payload (Mirai)", "value": "261cce2d95829f4370395614e0a60aac1d7e4174", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923677, "uuid": "69a692b1-d616-433b-b583-c406178c025b", "comment": "Malware payload (Mirai)", "value": "fb0eaaeb20e40b512b885656eed9f49152f672efe73aa2f84e15b6a6895e5041cdcfaff9b1805c7ae73f5b50aaf8219d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923677, "uuid": "990221c8-6680-4f8a-ac91-230a5b421c30", "value": "T1E3C32A85BC419621CBD212B7FE6F118E331553DCE3EA72039D245B7836CB95A0E3BA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923677, "uuid": "5d020fd7-c453-472e-9857-cfb9e01fdcac", "value": "3072:TdGTiIqJ0P3PORcRWUuNPwwbo2MlVpY5Y:0iIq+3PpuZ1MlVpUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923677, "uuid": "e893964b-17ff-4925-8b94-70e2275dba02", "value": 121760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923677, "uuid": "0c61c48d-b247-42cb-a989-83d551578e0c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923677, "uuid": "8b729f7d-28fc-4a51-acd1-928ef0749e8d", "value": "c4e62b64eccec292a4abd568900c51b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cca577-6114-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639950079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950079, "uuid": "89b7a24d-3858-4f3a-8908-93b4cc3d76e0", "comment": "Malware payload", "value": "05372386b75b95cdf2f81c3631fe053f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950079, "uuid": "17d5341f-4d15-4f64-a448-c2c2b8b6e89d", "comment": "Malware payload", "value": "af6f76d6aa2aff298190c3242e2b8d1de54522ac25d4f55911e50d751c74c560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950079, "uuid": "908027f3-f6fb-4993-8987-2754eeed61df", "comment": "Malware payload", "value": "851e7619e1f28060a1f6d12f6f9f4c3ec3bccb17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950079, "uuid": "31c029bf-ee11-4709-ad24-082a5ffc5b77", "comment": "Malware payload", "value": "d1a00128f02715505be8b81d41c6b0b1b7fd8445894e6e9af9195f314b3984521fc2e539dd7ce2df3b834f5aa2538166", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950079, "uuid": "db32af04-68d3-460f-b35b-29619049181f", "value": "T180A319C1771D0D93E0EE2AB0352F2FDEA3DBAB4022A5A54C560CFE159571C72068FE96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950079, "uuid": "b1cde48e-06fe-4199-b470-aa7e68b65872", "value": "1536:ylOTRpWd7szIrd4hq3QFE8Fjr7izN8uvZsdr:ylOTRpc7szIrdrQqkn7kN1C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950079, "uuid": "2b193ca3-2a46-4298-a2f1-a155497bf65f", "value": 100932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950079, "uuid": "c4651635-f941-46c2-859a-7a011db19b8b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950079, "uuid": "ad097659-e539-48b9-9f43-344936a2bff3", "value": "05372386b75b95cdf2f81c3631fe053f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3bd948-6125-11ec-9275-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1639957254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957254, "uuid": "65727011-5966-4d58-874d-cc294d198561", "comment": "Malware payload (Stop)", "value": "a2f33095ef25b4d5b061eb53a7fe6548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957254, "uuid": "90e0b71e-383a-4b78-a88c-0e901814978e", "comment": "Malware payload (Stop)", "value": "b0d41e9b8c941d207a0958b92f57083dd9b9246958bd32e2e6e90c4ee0e12419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957254, "uuid": "32be224f-cd37-4325-8be6-3d2b1543ef31", "comment": "Malware payload (Stop)", "value": "b38a8cb06507adb966dfdb809403f8f7f64ca534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957254, "uuid": "5ffb36b0-c7af-44bd-a420-3d449bf2e93a", "comment": "Malware payload (Stop)", "value": "67204f449b35dad3cad036c20f4e52a0da4b4578b777f63aec23f00038cb583dae96abae8c450a59f6c5a8e81f04d6db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957254, "uuid": "16cf58af-b6a8-4390-ab56-10fabbe46700", "value": "T1BA55E024B72060ACD13B5E7835D5BE949C2836A02317A3CF59DB299A02EC7F7867075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957254, "uuid": "c60bc5bb-a121-46ee-b234-f01aa06540e3", "value": "3040a3f994ad1131d3dcde9e0c84e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957254, "uuid": "2bae8d93-e2df-49d8-a83b-9c0b526aadc2", "value": "24576:sHMFgBanP6wJlYixpC9gbYstRiNhmREhf4gnlzY1hcP0GeN53U:sHmgq1sUJOLlucev3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639957254, "uuid": "0632585e-e29b-434c-8566-110cf56f0bb0", "value": 1280512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639957254, "uuid": "a2b61af1-8811-499c-8b78-ee8ae6434596", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957254, "uuid": "39c84c94-d041-458e-ade9-f90b14c76d52", "value": "a2f33095ef25b4d5b061eb53a7fe6548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256b1b86-60af-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639906590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906590, "uuid": "69082d53-e6e7-4e0c-af70-5ec6aef1e945", "comment": "Malware payload (Gafgyt)", "value": "f18e81c3d965c6344bf927cd195f6196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906590, "uuid": "64301a32-f98b-4ed1-a56d-810c791ad678", "comment": "Malware payload (Gafgyt)", "value": "b138bc4329fa5e73dd7266e614dbd7b52da8afbfcdbf3beea8dd543bf90bc293", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906590, "uuid": "94ff5538-c684-4ea3-8f63-651d689b69b4", "comment": "Malware payload (Gafgyt)", "value": "98c7dd79a64d73930800972c9bf9c08775747dab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906590, "uuid": "ecd7dfcf-5d4c-4092-bf12-81ab51b1bd49", "comment": "Malware payload (Gafgyt)", "value": "bec83ce0f78be379da11634dfc12fa50599081c1aa8c09f7b43fac37f00226c8158562794a8a21bb4ff92872a65a0fd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906590, "uuid": "f07591f5-16cf-4bdf-9cc3-ca517ee2507c", "value": "T1F2A3B53737271E63C0CA547101EB1331ABA9DE4438B94BD7A9917DA83F36E8834593DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906590, "uuid": "824a67b9-1fb9-4b44-a922-117e44120adc", "value": "1536:eku3ZD2j2C2TSo95G3jtftFso8jnjzUI8:IDoESoPchQno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639906590, "uuid": "71caab0e-43ef-4e93-96ca-f4f58e8d4e38", "value": 102930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639906590, "uuid": "ffe95ca3-8f82-48d1-84d2-0f059c3839dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906590, "uuid": "ed5abca2-eb26-40d3-86b3-150d961cb869", "value": "f18e81c3d965c6344bf927cd195f6196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05298952-611b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639952922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639952922, "uuid": "9c071f05-4063-4e35-8c69-2c29740aa505", "comment": "Malware payload", "value": "fe5177cbcb78d1aaac9e5adbb9928a74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639952922, "uuid": "02685552-2f5e-467d-871e-3c7cf2768824", "comment": "Malware payload", "value": "b30702b6432c4a5ca65ebc060b72f28ba71f60b20bb38b6f858af5e6aa61896f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639952922, "uuid": "cdf0f84b-e5c1-4a02-aadc-41973ff35a1a", "comment": "Malware payload", "value": "ca78abb998f6a1a2e6e6462cd9e01e44f790f815", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639952922, "uuid": "bf9482ac-9c90-4997-b9da-a0525fafd5e8", "comment": "Malware payload", "value": "ae6a2aed5d1f48d3c9b1b47a891fe84d84612ea7ffb33667a2953776735faaba2297e433a8c37e58cc04aa05a0ec4958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639952922, "uuid": "bd530287-102a-4117-8a55-f0ce28d5ca3f", "value": "T1BD13F18967AB5DEAD04925B63CEC24EF8BAC90465EBCA5CA32AD1C1741F5134C1BDCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639952922, "uuid": "edde5dac-f35f-480a-9d46-40cc063fee9d", "value": "768:Q9Tk9P23xGPDvLOnXsYDV/JFUiXbQL5bsoJGfhHE9mMMIAPeM5wL7LmBTRwiNwJh:gTk9AxGPjUDV/z9k5JKhHwNMIAWewL7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639952922, "uuid": "3500c468-02c0-437e-910e-df84a4212f22", "value": 44868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639952922, "uuid": "279ef3d4-7b18-49ed-9b31-8f910b26ca6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639952922, "uuid": "dd5b07a9-c1dd-4863-900d-3268f6b9dac7", "value": "pty4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b22f2b-60f7-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639937546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937546, "uuid": "4c791909-69f0-4301-b504-2d14ca9d88df", "comment": "Malware payload (RemcosRAT)", "value": "fcf0df6693a893ea913f9890504e3734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937546, "uuid": "bd6b88e3-2dc7-49c6-aaff-b543888af8bd", "comment": "Malware payload (RemcosRAT)", "value": "b4c41d9e7b126f324d7f408389c3f250631afcfc72554aca4721338e4484081a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937546, "uuid": "85e09549-1b2b-4811-ab9b-68de292004c2", "comment": "Malware payload (RemcosRAT)", "value": "99421b379d9854a340d1f74b545900665dd16ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639937546, "uuid": "f45e2110-b84c-449f-ba2f-a1d887eaff11", "comment": "Malware payload (RemcosRAT)", "value": "587037f98427f05ec9a4e8ded2a7b8bc819e3fda808117737172c0892f27f53aaa0c24a5bb1db1dfedb0852f4021429a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937546, "uuid": "e2765f5a-7277-4ad7-a44a-186ea48e5560", "value": "T1F1F4839C325172DEF877C5729EA81C64EA507CFB830B9247D02325AE9A5E897DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937546, "uuid": "afe862d6-5282-4647-9fe9-6ee58c671071", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937546, "uuid": "70e62064-e749-439d-b1e9-d1365fdc4025", "value": "12288:AsI0NFmOjjqoiWyEHyGLJbfQVi9Jmd1IU8Q0K4K1DJKfdTG1WqgrLOhWHRgg+87J:Al0rjtHLJbQVi3K1I5Q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639937546, "uuid": "f647c41e-4698-4fd9-8b4f-791838144029", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639937546, "uuid": "c42b01a3-ccda-4b56-ac1d-cbba96d0bcf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639937546, "uuid": "a73132b9-2ad1-4d1e-a46b-2955816d0457", "value": "SecuriteInfo.com.Trojan.GenericKD.47623775.26660.14560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4440145-60d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639921057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639921057, "uuid": "53d5a271-6106-4106-a9cb-d8b8b48986e9", "comment": "Malware payload (Loki)", "value": "295089f37f169c57b841556f0fb4b97d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639921057, "uuid": "88224d45-9a41-443f-ae3f-54b1b7dd892e", "comment": "Malware payload (Loki)", "value": "b5df49763748b699b465bc98218ce4f0475787b44347ed401aff379bacfbe543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639921057, "uuid": "a4de87cb-d61d-4b45-be4b-f340f4616190", "comment": "Malware payload (Loki)", "value": "0ebe824c4560ec9377d70a670d2b539b75812711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639921057, "uuid": "4325911c-1157-45ee-ba1f-b81d8999bb1a", "comment": "Malware payload (Loki)", "value": "0f80e01c231732d259555522441604dfe805ca0b55a7ac6f20adaa8d59011494335d441dc8ac289db6d9c7020c938d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639921057, "uuid": "51f8ee8c-f8d0-4024-a24b-57b2c2fbbf78", "value": "T196D4124430D091A2C7E178718F6ECABA23668E4E4441894BB3FDBF1F35FD583971A25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639921057, "uuid": "a980a5f7-3735-442d-90a3-86bc89ddc449", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639921057, "uuid": "618c6159-465c-40ec-900f-183bd045efda", "value": "12288:UfJ4wdFqiyTiaPV//Vt89rd7Uuq4WsZ/0:UfJ1p+p/fIrA4WsZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639921057, "uuid": "c0840458-80db-4713-9055-b1b5104dbc1d", "value": 621837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639921057, "uuid": "8ea65fbb-e0fd-4e81-b57c-5d9d62841235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639921057, "uuid": "2e6d6ea1-1de0-4fe7-b3cd-887314e348de", "value": "2020 MV PRICE LIST-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c13bd5-6063-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639874209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639874209, "uuid": "87e2a543-d6d5-4030-bfdf-df067129f49b", "comment": "Malware payload (RedLineStealer)", "value": "a8091faab10c6add4ab1b2866da99e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639874209, "uuid": "d1ddc4a7-0bb8-47be-be5f-af435ed659a8", "comment": "Malware payload (RedLineStealer)", "value": "b7c5bbe019fff36eaab954e3e158432eba1276bf03350fa8d5403d0b34dac199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639874209, "uuid": "4fadf0a7-60b7-466b-bf7e-09224b234805", "comment": "Malware payload (RedLineStealer)", "value": "af13c50253eaf0b0e3ca010c31fe1c79ba98a071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639874209, "uuid": "62bd3ec3-0178-488f-bdf4-74b91b2e8441", "comment": "Malware payload (RedLineStealer)", "value": "4097074c99b49e709a3ae593ea4eb4b3d59c99ece7ed518612b382b986a5ce7fe45f8ea556280932a448f3a1c7f36bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639874209, "uuid": "ce792bbd-b824-4d09-a7df-bb7fbe5ac2ae", "value": "T16E476CB1DDC96BC8D0D748FB0311F1B28AE64CA58292D1B244EE7CBFB53D3554AC9826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639874209, "uuid": "06765e34-902e-48a4-998a-6924ed914ab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639874209, "uuid": "62a54b01-b537-4a1f-bc3b-f365315229e1", "value": "24576:NnQ8ZCJu/bVOKdPgMm0MsQcumtQpUYPW1:ODkVOKdnmXVcnQpHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639874209, "uuid": "2bbbd8d7-451e-4e17-9b5b-21acf1f01b1d", "value": 26932800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639874209, "uuid": "a80e8a7a-1727-4e2e-913d-6a6eaea70186", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639874209, "uuid": "3bf81c58-196f-451f-9538-cfdf7a832f72", "value": "a8091faab10c6add4ab1b2866da99e58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1ac16f-606e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639878629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878629, "uuid": "69bc6c89-7c00-45c2-a084-9442a77f7fdc", "comment": "Malware payload (RedLineStealer)", "value": "8bb16c3f78dfc1987c93324f325bcfe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878629, "uuid": "d598fe1b-83ab-4765-b42c-e05dcfbabddc", "comment": "Malware payload (RedLineStealer)", "value": "b7ee427e5f6eceef34401300d735f1bf456823abb23059cc53d4bd0320c9f712", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878629, "uuid": "17783a5d-2423-40ed-9c87-121b7afea93a", "comment": "Malware payload (RedLineStealer)", "value": "57be35840a20bc79e04e418b6c321f445795ea25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639878629, "uuid": "39a037ad-e62c-4c75-8293-3d6400990cd1", "comment": "Malware payload (RedLineStealer)", "value": "3f8ae8ea66b73ea90d6b1c1da6a2f343295a2f6549539109ab794a753f08ed70af864ac10f7880531c32dfb98ad06ec6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878629, "uuid": "2c1f0cdd-deae-40e2-bf77-e6b0c7ea6ce6", "value": "T19F15BEEFEDC28698E94F07B647F3BB004F7550D98F6B07FA9315A5F04A8A1601B02B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878629, "uuid": "bfbf35a7-3009-48a1-900f-e24a0e8fe957", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878629, "uuid": "8ccd4a91-9aca-4243-a0bf-a02d10d34477", "value": "12288:m/RCD68aY6qbD7fKuEQgS/gAXJJbzURqQSPECgmP+7GgwBjAzrs8lY:cCD1z7fKugAXJld9zZGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639878629, "uuid": "ee3c0405-685e-4d26-a768-ed0586f32204", "value": 943496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639878629, "uuid": "7b3871d5-16e5-410f-8089-d077f48b4e99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639878629, "uuid": "502e6098-4ca8-4e15-9cb2-f5c269ab2909", "value": "8bb16c3f78dfc1987c93324f325bcfe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d460b991-60e4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639929647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929647, "uuid": "2f213506-8264-4690-84cf-455dd9ea95b1", "comment": "Malware payload", "value": "abb77e5d23c351f58c06bf1d06f9446f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929647, "uuid": "35b1661f-4924-494e-a30f-2ea8b281e064", "comment": "Malware payload", "value": "ba8cbb0cb8ebcb0c00d2986f9ff3c7b37e0d35824d9d0570fc4aeb8289ee0d33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929647, "uuid": "335e6d0d-9e8c-411c-89a4-8d06d18e7a7f", "comment": "Malware payload", "value": "4c5935e1be50d43c8252ee17b413c392e6eee529", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929647, "uuid": "17344cce-120b-4b5f-b927-b1cc146bb7d3", "comment": "Malware payload", "value": "7e365a1101a9c3fa3f111d16283bf23554c6df26744130aa483e8bc84a8a4451a79535c2e4d0431ec4a24e8bcface447", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929647, "uuid": "edc503c2-6330-4912-b96b-28040248caf3", "value": "T17BA309A2F800DFA6F40AEB7604D74B24B630FB650F53562673173967AE762D42823F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929647, "uuid": "3122e7d7-c5e7-476d-b6f5-960bfc465d70", "value": "3072:b94m17Sx3Lp0qT3pobW5yqrIiTzmU9VqFyOfk/X:bV1Gx3LplT1yqlTzmU9VqFyOfk/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639929647, "uuid": "47434bf8-3483-4d8f-be0b-81b532db7495", "value": 101818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639929647, "uuid": "0ddb5ca4-9950-417f-ae3a-fd17151eea75", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929647, "uuid": "f41ca423-89f0-4ddf-96f9-3b34979adcba", "value": "abb77e5d23c351f58c06bf1d06f9446f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d42ed0a-6113-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639949741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949741, "uuid": "311bcc01-2997-4672-9cd8-df3024eef4b0", "comment": "Malware payload", "value": "6f5c1686a5e9fbd8968e99fe140d507f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949741, "uuid": "0c3a0c72-2888-4675-862d-a13dc7e9a4e0", "comment": "Malware payload", "value": "bb820360e911b9cbb2c2da96675a493e07d425d8becaf7804dc0b9eb0f0d94ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949741, "uuid": "edcbf1d5-3ca3-4898-9a24-e68645caaef0", "comment": "Malware payload", "value": "9680505c3c6bc79a6f0582dfc609299025e41056", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639949741, "uuid": "5b303af2-4a57-40fe-9bea-45b49f3d2fc1", "comment": "Malware payload", "value": "8a23ae9fa2cf56f17e156dc37be2a2bf439582bd6cbfc09782d99ba28702f118707e5bdab6e7a0b18f2769d2960a6e08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949741, "uuid": "f10e36bf-c9ec-44d9-94a9-9ef8fa7942a5", "value": "T167B33B63351329AFC5E3043779F70336E1E896F93BA5E2AFAF602D09BE24504614A7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949741, "uuid": "d24c47f1-50b6-41bf-bafb-73a1aaa919cc", "value": "768:f+5H08/BSP/Oia+i7d/Q9C9UP9e89UN9b9w9Q9UJ9UN9ULqwI9uSyZnb31lbSPNv:gH08/B2/OZ/ALk2D/bqqw5u6tAhtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639949741, "uuid": "9c806598-3b01-4fff-80b4-fe68fdf36b4b", "value": 108144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639949741, "uuid": "eff23352-30e1-42ba-bbd6-cbc00d7c0966", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639949741, "uuid": "ef52cb85-9642-4eee-81be-fadc4bd77dc0", "value": "6f5c1686a5e9fbd8968e99fe140d507f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5668263-60e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639929675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929675, "uuid": "fd61f516-55cb-4a7a-aeeb-a2b31c53d361", "comment": "Malware payload (Gafgyt)", "value": "64f07f465cfb4a18e10576ab706cf9f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929675, "uuid": "82d3fdb3-7d45-47c4-9da1-2104e3314e48", "comment": "Malware payload (Gafgyt)", "value": "bc07a649af8abc9ad8030a2df0702d3a05c8067834d7f9f22cc616cf3eac1d8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929675, "uuid": "e972145d-832f-46cc-87d2-5c1a11339454", "comment": "Malware payload (Gafgyt)", "value": "92101e4abdead731734390f907b55aa66af71d54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929675, "uuid": "fb9decc2-e86a-43ef-a5d5-37917ed65c5b", "comment": "Malware payload (Gafgyt)", "value": "ff215cc4014e84f4627f69060d654a62454089e2e831e19d74f813ec681cda8b2efcd12144943f158b7eca5781f8fba3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929675, "uuid": "4c3d53f7-4aea-4b5f-ba8d-de4a0ab3b85c", "value": "T1EEA31744F8448767C3D327FAE78E439D77351A6457DB33116A39AEB42BC2B982E29130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929675, "uuid": "a5f51996-32e4-4793-beca-c30192e1dd08", "value": "3072:Plf1jKRi/VYf84YPk7XTRUmpEqQ45vVXY0X:vjdVC7YPk7qmpEqQ45vVXY0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639929675, "uuid": "c276e2c7-00d5-4105-80e1-1f119542fabe", "value": 105111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639929675, "uuid": "7c7b91e0-7fa6-4f46-90ca-3f59d13073f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929675, "uuid": "e6cda597-02f5-418d-8860-7b53c19bb850", "value": "64f07f465cfb4a18e10576ab706cf9f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3011b3-60a8-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639903680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903680, "uuid": "0795d5f3-17cc-44a0-ae9e-78ace3f92b68", "comment": "Malware payload (ArkeiStealer)", "value": "125e3ae9b3e19f2fb976f9ca7daf75ac", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903680, "uuid": "ca572d07-0073-4815-8793-5132641fd19c", "comment": "Malware payload (ArkeiStealer)", "value": "bc37950b02e745f4abd3fcc10a98154cf9b87dfebb2f6f98f351a2212b65a6b1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903680, "uuid": "96cca1fa-a62f-452a-a641-6c1c6b2ca5ed", "comment": "Malware payload (ArkeiStealer)", "value": "fefb0607a67d05ed1ca7951d3ce7892262249cf2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903680, "uuid": "0704a9e1-48d8-4c12-9581-3bdb40b595ca", "comment": "Malware payload (ArkeiStealer)", "value": "69a110a881e141728f8e55b621129cd185fd34c146ea8d5cd97f49ad5a1b540fb252626987ab03b6a14795618a229439", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903680, "uuid": "d5fcdc5c-3ea9-4e52-938c-49e5843dec24", "value": "T12C64BF00ABA0C435F5B752F4497693ADB53EB9B16B35A1CF62C526EE06386E4EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903680, "uuid": "c1847f94-2075-45d8-b58d-7a017a3fba67", "value": "41c28fe7acb4d2c92a8bad32895fbc24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903680, "uuid": "83fefdcc-4253-416b-830a-907e6354b610", "value": "6144:uA5iHBWy9NISBMMp0hVSvF2L6sy85rUQNGn:Tih9IaMMp0hVSvFZsy85rvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903680, "uuid": "16d80673-cd1f-4dcd-a24e-7ca66eb8ee0b", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903680, "uuid": "26199bcf-9793-4097-8d42-d211c3bd7bf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903680, "uuid": "6f80fa8e-1926-4ab4-8be7-256ea4012677", "value": "125e3ae9b3e19f2fb976f9ca7daf75ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4410324-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923634, "uuid": "4cc6071d-eca9-4f45-8306-bc7f46b5910c", "comment": "Malware payload (Mirai)", "value": "dbe3906a07e6ac09147c696cb21d2962", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923634, "uuid": "8b35a71a-9d16-431f-8895-867210d1dbdb", "comment": "Malware payload (Mirai)", "value": "bccfced79fadd3f5d5e339d5a63a8392fd2f8686f1ee6873cb6c5d2e6abc7d9f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923634, "uuid": "9fa8ef54-c5cd-4443-8371-6388176c1336", "comment": "Malware payload (Mirai)", "value": "3cb956ebafbb8e4daa226ce52aaa0f61ef57efda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923634, "uuid": "d4e6db6f-aa35-4b6e-8a58-c5775c870e6b", "comment": "Malware payload (Mirai)", "value": "f1686483042bccb27e8e592ecd5a583d461c694845d82166da59b08b6daa21dcc04db641092ce1080596fb8d6b40e492", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923634, "uuid": "36125e74-535b-4bad-b43e-022593f1498e", "value": "T1CD43F160DE2EEBC0D1F04D25F84B0B5ED15D27784AA92349E61217D4770A78E8AFE413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923634, "uuid": "17995266-21a2-4942-a9ab-14398f1b4850", "value": "1536:Y5x4Bm+SPdjiz5lZY83d4R6xJRem/d3m53:Yh+SPl4gOHBzW53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923634, "uuid": "fed19989-9658-4961-8a00-e626bc0583f8", "value": 57956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923634, "uuid": "25b2a174-45ea-4065-8e81-34a5e6911bad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923634, "uuid": "1ab1351b-735e-447d-9074-7ddeb9d2d44b", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73071a49-60ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639920035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639920035, "uuid": "596cc391-e327-4b55-a415-e2a2836ea985", "comment": "Malware payload (Amadey)", "value": "b156923ff18735c83be0d62d7753e145", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639920035, "uuid": "ebdcfcc9-0f38-4d5d-89aa-15d337c49f5d", "comment": "Malware payload (Amadey)", "value": "bd30611f6322aef87e67bb24d53b4d12926d20b317b8d514201a8c442128e03b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639920035, "uuid": "5fcbb9c8-9647-45ed-9171-ce60c01cf48e", "comment": "Malware payload (Amadey)", "value": "d3f78ffd02235d87ad885aef2cec30d8499cbd0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639920035, "uuid": "59168aff-248e-49dc-8a9a-9ffcc5cf5878", "comment": "Malware payload (Amadey)", "value": "403186a28211aaca591ae5e2c1b4321190507c7da6a2ea2c014d3c21a63a2666cde35fe9760eae87179da736eb2013cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639920035, "uuid": "25b639b7-440a-488e-9938-2abb3abf74a0", "value": "T152549E00ABA0D039F1B712F45DB9E3686A3EBDE1A73491CB61D527EA5634AE0DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639920035, "uuid": "9bf5e677-06a4-43b1-846b-bb73ac4dd291", "value": "0026c8a1c807441cd486cacd7ab1065f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639920035, "uuid": "e0835ede-7186-4375-9704-4d4a28a3a1a5", "value": "6144:k1eo7Cm7f6daT8biFatU/kKkw0xNU8WAC:k1ee58bWa6/8wINU8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639920035, "uuid": "f24ce5ec-914b-45d5-8699-23e0ee348424", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639920035, "uuid": "13dac9a7-3758-483e-b131-ae21b5e1642b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639920035, "uuid": "c675d74c-0e70-4b5e-9dd6-a4a5db414f21", "value": "b156923ff18735c83be0d62d7753e145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fe4f42-6114-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639950084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950084, "uuid": "56ab5822-ae19-48fb-a1ff-4e45f6fdd9ca", "comment": "Malware payload", "value": "781fd2464c3b2db25b3325868cc9b7d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950084, "uuid": "be278316-fd3a-47ac-ba29-59c68ec58a29", "comment": "Malware payload", "value": "be2520139a5067945d055eca7f3167828de34d6d61391f8bfeca59343401c6f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950084, "uuid": "0721c203-9d42-478d-af73-7de289d6ebde", "comment": "Malware payload", "value": "d8eb82cbc1c179cbbaccf707136d653bf25f6e67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950084, "uuid": "efe0cc5a-98f3-4c20-bb82-0176e231a936", "comment": "Malware payload", "value": "32fa76cc08f4fb25948ce44eeceb2f6f5a771aaaddc20446b8e01b1992c06d86fcfac33b2199f6051b5ed449e4260e78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950084, "uuid": "af0faafe-8a25-42c6-8be9-9b9c05b36d99", "value": "T1BB14F707F5418A83C8D29736F65F12863363B750C3C7620789986FB43B4E69A2ECE6D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950084, "uuid": "6800579e-f998-4d3d-a084-96a1baa164fd", "value": "6144:MaAUkDS4714Hlu2Uqya5pczLFAXh8iofKEM/9WJlmO54G:MaAUkDD7OHlu2Uqya5pczLFAxdrV/Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950084, "uuid": "c3b0eb85-6440-400b-9d47-26650926c2e2", "value": 197003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950084, "uuid": "12904fcc-0be9-43b6-b95c-fd39b05706a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950084, "uuid": "f0e2b2c2-5e18-458e-a138-3fda2ecdfcb3", "value": "781fd2464c3b2db25b3325868cc9b7d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d524cb-611b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639953112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953112, "uuid": "5c788ae3-7d1a-472a-a5db-89063a8fff34", "comment": "Malware payload", "value": "c338233378d48b0dadda42c0a4fa2a31", "object_relation": "md5", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953112, "uuid": "e347c301-66f1-4284-b6bb-ab4fbe40bad6", "comment": "Malware payload", "value": "bf256b4766cddc34926d066d5ea089691d469251284669a8516f15db6806ba84", "object_relation": "sha256", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953112, "uuid": "ff2c6a4b-495f-4ac4-97bd-833704658d5d", "comment": "Malware payload", "value": "4cafe97d0daf3098bf81d1638d5c209a160c1065", "object_relation": "sha1", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953112, "uuid": "89369f24-96ef-47bf-ad6e-e01af3c6d5e2", "comment": "Malware payload", "value": "f39a514ffc1bc896c504371d62f50af25b868aad1110e7d797630abeb46a8a1487622222d144480db7d4b9a21980edad", "object_relation": "sha3-384", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953112, "uuid": "1a130642-3943-4f37-8ee6-9c543e383558", "value": "T14FA245E6F060CF313889481DFB969619B6C7615B4C767981F0CEACE57B1E0684624F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953112, "uuid": "2a273806-295b-4312-bdd8-b1afa36cf6cf", "value": "384:IyjXE/VQqpGBCfN4NqdueMrUObPaaurau1:I7ZYBCfN4NqdueMgObyaQai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639953112, "uuid": "26b70c0f-0524-49b3-9c8e-5c5d109a1b66", "value": 21670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639953112, "uuid": "804c2f73-3ea4-4011-819b-e4ef232b3089", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953112, "uuid": "c8819bf9-6d30-40d5-a859-60baf65d6d75", "value": "ldm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db66af08-60e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639929659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929659, "uuid": "868299f1-1e83-46c6-a81d-736580b5ea47", "comment": "Malware payload (Gafgyt)", "value": "3fbbff16acbf3b9485d05bbd5a213ded", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929659, "uuid": "0e5123f2-3da7-4ece-ab89-950f1c5af34f", "comment": "Malware payload (Gafgyt)", "value": "c58d61a46857c2584f0606a1746b8e103e3e4c648f66c88ca8e7b659afc49856", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929659, "uuid": "9ac17e58-a5d7-43f0-9bb0-df78ad3b2b83", "comment": "Malware payload (Gafgyt)", "value": "d978d4b8b718e2a1a1a1498029d1fb5e47f8a2ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929659, "uuid": "3e89019e-2349-4d8b-9044-03714241179f", "comment": "Malware payload (Gafgyt)", "value": "fe319a71daae01b5244d1a72b85f443201239e4ea23b4b189572735ed77bccc71170b587516e46c697f806d8dd6aac86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929659, "uuid": "9fd7d546-0d6a-44da-a62f-5a8c47377205", "value": "T1EAC32905E8918767C2E217BAB79A425D33332B6893CB33255938AFF41BC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929659, "uuid": "51ec5d24-d7a2-4984-9449-7899692dc8dc", "value": "3072:KdB2qwap6KVXPi4jv8x+pMDkmDhZmTQOIsXAqE:aRwap6Kt6+pMDHZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639929659, "uuid": "0fba8e80-5064-44da-afd5-525ffc9a794a", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639929659, "uuid": "b5f219ea-80d3-4b87-90b6-c93233604476", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929659, "uuid": "dc9f77fd-3668-4007-ab4b-6b204d6bd953", "value": "3fbbff16acbf3b9485d05bbd5a213ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a20187-6066-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639875180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639875180, "uuid": "b950676c-27c7-47a3-b3d9-27c2559d9e2a", "comment": "Malware payload", "value": "724d7178dacd7697dd75751a49bbb897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639875180, "uuid": "80f6b0e8-8b16-44ba-b5d6-5edba492d1e4", "comment": "Malware payload", "value": "c80949a2de5a8518242d97f829f907cc3a0a276a4d577f0838a3974b68c56d06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639875180, "uuid": "a140a61e-abba-4610-b4c2-ee308c10e8b2", "comment": "Malware payload", "value": "df10e6f4a81466944fd5e3951b22e7dce72b9a50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639875180, "uuid": "d2e91939-63dd-41ed-af9c-e88b0e88384a", "comment": "Malware payload", "value": "cc453d3ad47f42ecad746db93408f080c639ec4d61868b14d0192d24e4a3bd5b3a3bf0e22ba23849fb5d64e75e96d2a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639875180, "uuid": "700e9b48-0c58-4ba3-917e-07a0430ba123", "value": "T122A633BE502B4779EA43DEF8E66BE4B129DF3C0772029F67741632CFA5B114B8112A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639875180, "uuid": "652e7411-4709-4ce9-8049-3cb361cbca2f", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639875180, "uuid": "16e3cbb3-8bec-44e1-adc9-8d8efac775a1", "value": "196608:MYzt07ZFeFBCHcIvYlwMDfm0nZUhfklFl7w:K7HuPJTuMZifI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639875180, "uuid": "ee6ce35e-f1d0-4c5f-a521-6972cd6ff24f", "value": 9844736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639875180, "uuid": "14278b0e-bfef-4117-882c-4844784b9648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639875180, "uuid": "20dcd445-1f28-4e45-8b19-5e333fab417e", "value": "724d7178dacd7697dd75751a49bbb897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe7af1f-6115-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639950416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950416, "uuid": "79e50b73-c08d-48b8-b944-bae7f39173a0", "comment": "Malware payload (Mirai)", "value": "1bec9377b5d882c5ce68ecec3855812d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950416, "uuid": "b2400696-a61e-4174-bebe-25c9975ed892", "comment": "Malware payload (Mirai)", "value": "ca35c25fd52eac502d024e806e7280dac4bcb129d6eb1dbf5242574f1b6b3c6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950416, "uuid": "82184766-daaf-406f-87d7-b4d590749b45", "comment": "Malware payload (Mirai)", "value": "10ce5daa9e2f464b684e5cb10c0196d1c7effe6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950416, "uuid": "6315ed31-d960-40b4-a453-6b875df71bc4", "comment": "Malware payload (Mirai)", "value": "960778d852cad9890d73b7b516e9e90343aa56d3e5426ca1b7d39d3e805457dad8abbd57f8564a7f2c357570eb140fcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950416, "uuid": "3e200ee9-ee7f-4abd-8249-1b521a269593", "value": "T1C213F128953FBF03C381183AD5A2C64A925802F199E41B736F84C374BA95B725DF8B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950416, "uuid": "9e1ce968-710d-4ee1-ab92-8487dd214413", "value": "768:sw+mrixWjZnRuqhoh5PNDkdga07EmnSV/HZAcnYeoRGwOwJxP7egey2s3Uozle:D+yix2Ruqhoh51V37rSVvyp/RGWPKgLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950416, "uuid": "62227938-6cd4-41f8-b82a-4323107eaec7", "value": 42520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950416, "uuid": "1106c83f-b9ba-4155-865b-06968db1f6c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950416, "uuid": "b71c7bdf-484e-4fbc-8a28-655512059943", "value": "1bec9377b5d882c5ce68ecec3855812d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cd8473-6106-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639944151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944151, "uuid": "ffc81e83-6534-4ae7-928b-b8ae21cb7769", "comment": "Malware payload", "value": "161b55442095e370be8d86793a6a30ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944151, "uuid": "77abdfdd-c6f4-4ba9-884a-ab22f0021118", "comment": "Malware payload", "value": "caeab7a886965dffc43ceb230217b9903b87246f8c1edc1417f75572064a0f29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944151, "uuid": "7280ef25-9884-4153-9fd7-037c5ff517f4", "comment": "Malware payload", "value": "0d111cb5a1639e14ad988261a90c6753290a506e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639944151, "uuid": "14328cec-75a7-42e3-a011-8ec3c44fda41", "comment": "Malware payload", "value": "fa1a5d432cc051595e578548e407136d0cb5ab3ba1e293875fa3d318e1107a4a843f82cb92fb0cf3ce469a6610e3e05b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944151, "uuid": "4eda0a64-21b9-4701-bcf1-2af4dde1eccf", "value": "T1E4F4F11067D0D035F57752F44676A3E9A93F7DE2AB2498CF12D52AEA5630AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944151, "uuid": "a8af1b3f-42ee-4a6a-b475-174d276cefcf", "value": "9b5e0e93b958d7de96d2eb171562e213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944151, "uuid": "e0e60aec-62f9-4f51-9fc4-5fa7b0b91ec4", "value": "12288:SNfIOgLJhx1tzRz2y2TL4AX/O2uA9169KJ2PhFpHfPURBxU0A/igQ:sZgLJ/1tzITG2V916YJ2JWBxS/i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639944151, "uuid": "cb0220fd-1664-4ba1-9381-690aec1c7d47", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639944151, "uuid": "09b23710-a3f5-4017-b734-f4aace68230e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639944151, "uuid": "eccca8f8-52ed-4718-b03e-779fb8a98e21", "value": "161b55442095e370be8d86793a6a30ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f50868-610d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639947042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639947042, "uuid": "9c5d5e86-0dd2-48ad-850c-55012f5b991b", "comment": "Malware payload", "value": "46f49fbf9a5989a874e1b5f1a2f4b98f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639947042, "uuid": "aa3735ea-7325-478a-b032-dd41ee50ce9a", "comment": "Malware payload", "value": "cb2101238c58e971a09ae5a3c5e0a8e64f52f18dd5827ce6888fc03207fd8b77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639947042, "uuid": "3c2bec89-5409-4ec8-8827-eb9eaaf97569", "comment": "Malware payload", "value": "5b062c9faf50ee4538b9e4f88d26e5bc812fa1e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639947042, "uuid": "9192b05e-4aed-458a-9843-43c9c2716650", "comment": "Malware payload", "value": "b463c5fa6a57ddbe9a5006414cab73ccf603cecc17eb389fed32e6cbfd8eeca8b4c3b0f378bf40ab67ee7b014905427d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639947042, "uuid": "2b1bbd86-859c-4699-8daa-13ad77cf6b10", "value": "T1F583E6828F07C412FA8ECDB9D2B159270AF25E60D555B54ADA38F348AFB73C0152F64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639947042, "uuid": "cc451c99-d895-4dc3-b083-c474ea84d116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639947042, "uuid": "3891b142-46ba-4042-b4ee-a395dbc0b710", "value": "1536:27s3pYB2XhgrhHzWmVqhYy6zBA6zBT3hyI:93pYcXheFW4yKBAKBgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639947042, "uuid": "f54a1628-4c3c-4cee-ad85-465549bc7724", "value": 85800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639947042, "uuid": "5eb8ea6b-bd16-4d6e-ba86-f1cf6fdf1fbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639947042, "uuid": "40438a70-dd89-4a08-bf76-2262df1ddd65", "value": "46f49fbf9a5989a874e1b5f1a2f4b98f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b753e8-6105-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639943770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639943770, "uuid": "82ed7674-698f-4a64-9238-7694cb166a08", "comment": "Malware payload (ArkeiStealer)", "value": "81a62684a1f6a84f95958c184b62ec36", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639943770, "uuid": "be222c78-ba2f-4f5f-9d11-4856e632cb9c", "comment": "Malware payload (ArkeiStealer)", "value": "cb660015dde27352dd9ff5ffeb1b07d46987d7371199850bb36038fed2fd42e6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639943770, "uuid": "f3b9dbd8-832c-46e5-b4da-92ef24692089", "comment": "Malware payload (ArkeiStealer)", "value": "9af129b77f7d99e677fb9104f8891b963aa6d53f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639943770, "uuid": "c46b53b7-5599-4610-b6f0-da70e30e33f1", "comment": "Malware payload (ArkeiStealer)", "value": "f14d62bdba154f726042e3526603c3176e8fc7afd1b1a962fca076d8efd7e65a8ae28766717e0ea425bd93784c2e7c2d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639943770, "uuid": "3b630568-861f-425a-888b-4a1da20b2284", "value": "T190F4F100A6A0C035F1B722F859B553B9B53E7DE2AB2494CF62E129EF56355E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639943770, "uuid": "8c6f625c-232c-4eb4-bb1a-7d37b9e4226d", "value": "9b5e0e93b958d7de96d2eb171562e213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639943770, "uuid": "23d107b1-461e-431b-b678-8004401d0550", "value": "12288:7OWZQfzlE0rvc6AOfYrh3eNnMLL4NdOO4Cn/Ux+IkphHvPVZNds0g:7VUDTc6U3eNnM4zOCnssnDNdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639943770, "uuid": "605aab3d-c00b-4314-9ed3-b23a6af90ad7", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639943770, "uuid": "3a0bba21-70a3-47e1-b78a-859e0da1d23f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639943770, "uuid": "fede34ef-6a93-46e2-9e8c-434701bf0a33", "value": "81a62684a1f6a84f95958c184b62ec36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d908bb40-6083-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887993, "uuid": "b834fbdd-ffcf-4f89-9026-a3179a4d1473", "comment": "Malware payload (RedLineStealer)", "value": "f96541b6d93e8532258b3d9c27acd267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887993, "uuid": "27f73f70-66dd-4d9a-b2ac-46ffbba2f750", "comment": "Malware payload (RedLineStealer)", "value": "cbf3805247916022796d89a2f0010c0ea5d2dec1d57d0cfd729d5a6e0ba4f7b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887993, "uuid": "41c1adc5-94de-48d1-ab0c-bae7c1ca44ec", "comment": "Malware payload (RedLineStealer)", "value": "f908d1eded5ac4510a958321acb8fb6bf7e50dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887993, "uuid": "a980af8e-8dac-425d-a63f-d1a392bb749c", "comment": "Malware payload (RedLineStealer)", "value": "cd865f86fcc17270ce1397153d07ed5ae3a06f6d4c6a4f1e8532fe0cbabe17279ad8718d22552768e885bd4178c9c01f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887993, "uuid": "c9d2ad7c-6b04-4506-bcb9-e94ec05fcf84", "value": "T12784DF00B7A0C034F5B752F84A79D3AC793E79A15B74E0CB12D12AEA5674AE0ED7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887993, "uuid": "005963ea-554d-4e33-8370-8f081168defe", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887993, "uuid": "0c1fcb30-9a51-4930-a8e4-d10831a3dfd9", "value": "6144:1uNMy3+hrU4j0x1LHQ3be3WYeP2TG++3voiKj4B23HyqXM:1uey+r9yMS3NePEG++fO823H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887993, "uuid": "43ec0a33-f28e-4ce0-a2ec-8e57debb530d", "value": 406539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887993, "uuid": "03651682-e1c6-4606-89d7-e18d3098b48f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887993, "uuid": "b995cddd-6247-4aef-b290-b61a20990f40", "value": "f96541b6d93e8532258b3d9c27acd267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba80b1f-6093-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639894575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639894575, "uuid": "2a40e803-8a8f-4b75-8c3b-abcd2f264a0d", "comment": "Malware payload (Loki)", "value": "a98b7bb930217ee8599c11b0e62f2c05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639894575, "uuid": "acc7c462-0fc4-4d30-bc6c-65a6705315b2", "comment": "Malware payload (Loki)", "value": "ce3ea975ce1c32928f5ccde304d2f54a65d965d832409b8186d171fba2f1918f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639894575, "uuid": "35351f26-9989-4b4e-9a02-b72f9924a755", "comment": "Malware payload (Loki)", "value": "3e122063dc3e01016c2bdb00b44dbd30dbbc9276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639894575, "uuid": "97d1b896-ddb2-4990-87ef-60b8b4673f17", "comment": "Malware payload (Loki)", "value": "8846aadebed4ed1120a8eb0095be7f2afc7b21cdb89815016eff92c4e23f3c20b3d218851dcecdff1256ffa32f9d8c18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639894575, "uuid": "577dd4c3-475f-4143-8119-7d1824eb4f87", "value": "T17684015037ACAB27C56D5BFD44A2204143F1A0267292FF897FD670FB1BB2B828552D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639894575, "uuid": "49425e77-aafd-48ff-a55d-922ed68f318d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639894575, "uuid": "d7c62bca-3df7-49d3-8cca-3710082c9fa4", "value": "6144:hopagyyuHoA5QF19zyubGKEyXWpAFkV8TpCc1GMTHDB/o8IbKys8XwxITXOwg:h89uHoA5QfJyuSK3WeFkVupCCF/9I2sA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639894575, "uuid": "9ebd5fd5-0b86-42ed-b0b7-be5c43c06fe6", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639894575, "uuid": "e101123c-3b94-47b7-ada5-568aa5d87588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639894575, "uuid": "bb0cd4ca-6b33-4bef-94d5-3c747e22064f", "value": "a98b7bb930217ee8599c11b0e62f2c05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d54f60b-6083-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887679, "uuid": "2bc5d7ba-7cfc-48be-b93f-4f5cc331e532", "comment": "Malware payload (RedLineStealer)", "value": "7f48e73f61d169be4bb21590c7b68e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887679, "uuid": "2111c975-2145-42d3-9ba6-a11e6a3da237", "comment": "Malware payload (RedLineStealer)", "value": "ced624bce198d1238d037e22cb18e099f24428f592bc7596eb582a1a909915dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887679, "uuid": "8f198fc3-a19b-4148-ab33-e6c1c7fd6c69", "comment": "Malware payload (RedLineStealer)", "value": "97aa07c122edc7742ea14e9421e5fd5f05295874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887679, "uuid": "39646fb5-99be-4eb1-8ad1-459e32e7de8d", "comment": "Malware payload (RedLineStealer)", "value": "f7d51f2b4eea55798bbe64278085426b7e9292910387983ecae2576dce802f1e482391d2d4e6b254db7413f227e8bfb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887679, "uuid": "f78287da-6f0d-4ad8-983d-db50b937740d", "value": "T15C84DF00B7A0C034F5B752F84A79D3AC793E79A15B74E0CB12D12AEA5674AE0ED7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887679, "uuid": "3163c038-e40f-4db0-a3e7-87553cbb06fc", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887679, "uuid": "1384e6fc-b2b1-44e6-92fb-b122ed85c5c9", "value": "6144:1uNMy3+hrU4j0x1LHQ3be3WYeP2TG++3voiKj4B23HyqXM:1uey+r9yMS3NePEG++fO823H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887679, "uuid": "da2c4b2a-142d-4da9-b471-25c9ac9ad70d", "value": 406530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887679, "uuid": "f85dfaff-3b23-41e6-979c-cb4d52560d51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887679, "uuid": "05b36026-6f55-49cf-a080-55db7dd9baa4", "value": "7f48e73f61d169be4bb21590c7b68e40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4df99bd-60a7-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639903475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903475, "uuid": "0c8948ae-6f48-41c6-95b2-b6ef53591932", "comment": "Malware payload (DCRat)", "value": "d3840589d2d3cf227bcccce0545643ac", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903475, "uuid": "bcc02ccc-5725-496b-bc18-25045baa5629", "comment": "Malware payload (DCRat)", "value": "cf037a7fcf166b8fbeaba45fdffa05065d0850d554b2e265f2bd5cdb9befec78", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903475, "uuid": "ddb32936-516c-4d67-afed-5cc9ccb49f5e", "comment": "Malware payload (DCRat)", "value": "9bbd47b308066b5c4a205056c7d343442ed7e913", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903475, "uuid": "6ef844eb-9ee0-44c3-b349-b466306bcc0b", "comment": "Malware payload (DCRat)", "value": "9342106232ce26010322de754b89d12b30336db242bb00aec95a5fa5c3bcd5bc3c1799c595c59f8dfddf2cd3b0cf4a4e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903475, "uuid": "ad9dfe09-0eed-406d-835e-1d090dba1e56", "value": "T15C55AFB77D68225ED38477F634C90919F1D98F411377A69BFA3F81538D82BA508CA8C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903475, "uuid": "5dfa6f04-3b53-4f68-b97b-45269961cb66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903475, "uuid": "79b6110e-86ae-49d4-866a-6b4f2b388edd", "value": "24576:svMGmeHPR3e07Siud5TFvqpI37tkMduWuU0N4L5hRiiERqLvrbxvww:sXcApI3ZkMc9N4Lt7E0vXxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903475, "uuid": "3412ec6f-8420-44ff-b247-7f888eb22da9", "value": 1314008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903475, "uuid": "0103fa16-730d-4d0c-b944-687e4dd66e41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903475, "uuid": "8cc30342-e36c-4a90-967f-c18cd189b26f", "value": "d3840589d2d3cf227bcccce0545643ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b498d0b4-60e4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639929594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929594, "uuid": "db0186b5-1665-4897-a5af-631bf70077ac", "comment": "Malware payload", "value": "d5e4da52799733e0d24d8a3196f2a788", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929594, "uuid": "c4b76ab2-89d0-4b83-a0ae-5170850f9b65", "comment": "Malware payload", "value": "d113d6f2b3c4d7a9ddf1ca867e534c0f0388f198b0b17e9db067961008e1e038", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929594, "uuid": "44c7326b-94c0-46a9-9532-2bd64c24d7ff", "comment": "Malware payload", "value": "c42027862304c138543533a5e5530aeee72df8eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639929594, "uuid": "1cb975a2-a420-40ff-a549-f6a2b3f90bce", "comment": "Malware payload", "value": "bfb162c90eba33d6e51ff0359b31c9d35c986fc32c1cd58fae30f9c4d2b80f99c541d62b192c90c5cae21056997897d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929594, "uuid": "f1df0fa6-2c63-48dd-a237-86b729d3e6cb", "value": "T151D3956EFA12EBBEE16C863107F76F70D39531A22AA1D341E16CDA181E7125C2D4F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929594, "uuid": "37a4cd93-4c7c-472c-964b-8fbfbdf6e41b", "value": "3072:jGTyrDxJWwAfr9f3yJddxUEJmTDmjOrWcpu3NJFARtRVJhGvaZqhZYiDhB/ZZ9B2:C+nZSZAnJeUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639929594, "uuid": "a446002d-a73d-41c1-8b70-cedb48037af9", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639929594, "uuid": "9cb22159-f72f-445c-9145-664702c327d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639929594, "uuid": "6f47b2bd-58f5-4ee7-89d6-a9529384618f", "value": "d5e4da52799733e0d24d8a3196f2a788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c6f1fe-60d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639924631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924631, "uuid": "21ff7469-050a-421d-8236-1ba95448542e", "comment": "Malware payload (Mirai)", "value": "809e62760842a2e09db53a582d9f85fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924631, "uuid": "ee214bfc-5db6-4cde-84be-f657515791b6", "comment": "Malware payload (Mirai)", "value": "d1260946642baf5c1480b268b494b0b6afd2cbf72d9aee2eb65129fd8341b610", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924631, "uuid": "bcb6e360-daf9-4a0e-b020-f523a1ef50e6", "comment": "Malware payload (Mirai)", "value": "1402b7aa37d2b47d537616e1c19a175ba1ec5aff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924631, "uuid": "2ba3a094-49c8-4432-a9e3-d655ef4b698f", "comment": "Malware payload (Mirai)", "value": "ff8d4e4cb902f053fc97fa22f62253f1a59607fc90d129e3468ac9c6b7b58730f1e25df79fe2f10cbff9e1f053f36de1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924631, "uuid": "b2626480-a27a-4373-be7c-4634f1d569a4", "value": "T1E9C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924631, "uuid": "c9cb9911-9e3d-47c8-a8e3-173ec34f3839", "value": "3072:ekYPUfsgnsb0J2ag/VfpkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0pkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639924631, "uuid": "871f4eeb-f99b-490c-ac74-3a18682fead5", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639924631, "uuid": "412442ae-a58e-408d-b4fd-bcb0ff5e93ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924631, "uuid": "20aad33d-5957-4699-952e-d3b29d49af0a", "value": "809e62760842a2e09db53a582d9f85fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21dd117e-60d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639924623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924623, "uuid": "d4c492b5-8a68-4ce9-8a5c-b21fad9f5a83", "comment": "Malware payload (Mirai)", "value": "0d84293f24d00f0f36854601d084fdf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924623, "uuid": "05664b23-5888-4b0a-9c60-bd5e74b4fecc", "comment": "Malware payload (Mirai)", "value": "d15cec8cd8eaffbf0efe5cd7f9fcdd5196e9d1e6da004f3730dc88715d5bb5e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924623, "uuid": "d5bde365-522b-4e2d-92a8-09006d47d7b4", "comment": "Malware payload (Mirai)", "value": "688bf96a233f62d113bda749e259858cee436d61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924623, "uuid": "27b66a6b-1a78-43af-ae2b-29206d0eb7cd", "comment": "Malware payload (Mirai)", "value": "9eec4d0a70e8bdf8b24134b0292e4d61e18b35984d121238d010006202b41eb39863c416393e89cc3123380fa269a994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924623, "uuid": "f24cacfc-b5d9-4e55-95bf-1b128ce893a3", "value": "T146C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924623, "uuid": "77ad467e-1bad-4b00-88e9-789636a4b7d7", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeXEdWfRZrmW+IFj:Ted0W0MZQHzd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639924623, "uuid": "fe393a3d-98c0-4ee6-aa2a-2e631cb2b12a", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639924623, "uuid": "7550fd09-9717-493e-a2c1-c93d5dbd76d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924623, "uuid": "001e78df-c77a-4d01-a3c2-19d8a5a120f6", "value": "0d84293f24d00f0f36854601d084fdf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8b2480-60f4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639936376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639936376, "uuid": "7cf36e05-0557-4e32-b48d-e2863d21981a", "comment": "Malware payload", "value": "1278e7fd9ba042c162d04e4bb4b5e471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639936376, "uuid": "9d78dac1-9f68-4875-90ba-88eb742aa302", "comment": "Malware payload", "value": "d1a5b0c2921ff9bd8f61d5681eabab1fa054c4e19521a2ae317802b672c8e060", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639936376, "uuid": "53d8345f-bfcb-49db-a0bb-82c81e0e690e", "comment": "Malware payload", "value": "b654802b57f6a83bbc8a26fb414f2ea339ef9d73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639936376, "uuid": "7b5901b9-2610-458c-b63f-33c2e136077a", "comment": "Malware payload", "value": "6ac552034061b867f90f2ea1d6c963280887fc53e69b47fb0c837dbd1aad13d4a359f3bb19d0c6d2a359b419185a87cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639936376, "uuid": "650905af-fdd3-4cb6-aa0c-1a08771be96f", "value": "T1D405F1E4B54CC7FBD0735A364D9B0739679C1DA3A650BA058539CCCEDACEEE214222C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639936376, "uuid": "f2ad9a74-f66e-479a-aac0-917cdef60016", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639936376, "uuid": "4954a6fb-422c-479d-8204-b5d6fdd2761b", "value": "12288:+5Gvj5UHmY/HIHz1U760O4z1aXT2dLzfQTjPTvzBWhYRs/xA+JOskYnQ:+qj5UGcHIi2X4paafIBaYRcljQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639936376, "uuid": "017dfff1-5018-45f4-93fe-50f8acf68b3b", "value": 838896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639936376, "uuid": "40371fdf-b3a5-4135-aab6-8696cf28eb53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639936376, "uuid": "1121c540-c606-41ee-acba-fa4b2555645e", "value": "1278e7fd9ba042c162d04e4bb4b5e471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d06c7e-6126-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639957805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957805, "uuid": "e145c133-05c8-4e92-9c38-09ff7caeb866", "comment": "Malware payload (Mirai)", "value": "e93913e52965fbfdc8d5500df72f8c7e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957805, "uuid": "998aa860-e166-470f-91a6-8a0e99f100d0", "comment": "Malware payload (Mirai)", "value": "d1c771e59a3e7ec8626718f3588c29146b43b19875e96c35c4f5cdc8c5ad7820", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957805, "uuid": "41d8d8b4-9d5c-449f-8ba2-954f4e1280f2", "comment": "Malware payload (Mirai)", "value": "6b4330e5f4e7acafb228ea1ec753392892c22a82", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639957805, "uuid": "f5cb3c92-da0c-4b2e-8f77-76a3eb61b2a4", "comment": "Malware payload (Mirai)", "value": "bbe6807f57905bb041bffa254b25c04784a26f4e7dc3c6c273ff0730d05543f74c3852d1a3ab1922f0dc8f753ea4b2e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957805, "uuid": "694f64df-958e-41a8-bfed-d738fd001082", "value": "T15FA35D86E283F2F1EC050D347067A772DA7AD57B7139EDC7E39CDA369861202C215A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957805, "uuid": "e9ac87da-6db5-4237-b1cd-3ce6348ff2ce", "value": "3072:KfycFiaaGIwBsQcGKCHMGR/JUBOd3KVDQ:KqcTDYXi6JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639957805, "uuid": "ef09ea3d-ab0e-431f-a379-d84cab39d9c0", "value": 103664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639957805, "uuid": "ee246cd4-444b-47f1-84e6-f4f3494211d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639957805, "uuid": "b71d0cb4-30ce-4e2b-9396-b01502e8d432", "value": "00100001010001001000001001.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb57243-6082-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887386, "uuid": "a98f15e2-1bd6-43e0-bc87-5ec8c7f9b6b4", "comment": "Malware payload (RedLineStealer)", "value": "5301a991920ced5863cf039630f96629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887386, "uuid": "61797aaa-589f-42f9-9587-5e3b66ddee77", "comment": "Malware payload (RedLineStealer)", "value": "d2b868eda7b504b47b0597cbe29ee4cb63177a0585c56a5c847b53a05ba71eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887386, "uuid": "146e1f1d-fbd7-450f-b5ec-30b98f5f6016", "comment": "Malware payload (RedLineStealer)", "value": "cc36c82ac43663e04452c25d26427685318361d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887386, "uuid": "096fae1d-06c5-4682-b943-63030deec4c4", "comment": "Malware payload (RedLineStealer)", "value": "f58a2a63cc362396309262aae09bd6b71fa1cb362ebada6971d7f7639c2520c0ae4877791d6d2e4f06d12a22b4fc4b17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887386, "uuid": "c67e7286-70fd-4e94-b91d-4f10e7929a35", "value": "T12694CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887386, "uuid": "3a6a272a-1fe9-4b63-9717-c619edbeebb8", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887386, "uuid": "e169d0cd-87ff-484f-909f-06ed77e99a9f", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887386, "uuid": "6c764cfe-5243-43bf-bb35-ba7798940992", "value": 411164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887386, "uuid": "31ae7511-4cfa-4290-8f7a-7c9ffd5c9ec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887386, "uuid": "b89394a9-407c-449b-94a5-c1019266a675", "value": "5301a991920ced5863cf039630f96629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040b4189-6081-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639886777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886777, "uuid": "058f8584-25b7-4789-a3f5-0d4611fda4dd", "comment": "Malware payload (RedLineStealer)", "value": "a9f12ee9f7837846d472da6d0c1a367e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886777, "uuid": "8419ee8f-11eb-4487-9843-bc7de83e6811", "comment": "Malware payload (RedLineStealer)", "value": "d303f85fce835fcfe378620cdfa762d4855e991acd57946e1d6c547ed33fdd81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886777, "uuid": "27461762-be67-47fb-9b24-a2e1b96ad261", "comment": "Malware payload (RedLineStealer)", "value": "628ed88c92cf1edcfec8cdc3c402ea0a275007c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886777, "uuid": "a0841a91-ee5f-47e5-acf2-d9de294c6aca", "comment": "Malware payload (RedLineStealer)", "value": "3e6f4ca5c535d56f0e5682515ec70940acfb417117f55ffe887ad6b01b9402b24a70c4f0f17ef9e69cfd70bf13c103cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886777, "uuid": "d2329e16-3164-4a3b-8b23-c50364d39c44", "value": "T1FA84D000B7E0D034F1B752F44DB6D3AC7A3E79A26B24A4CB22D516EA5A746E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886777, "uuid": "7da6fa7a-f77a-4d93-855e-7d06893e4d17", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886777, "uuid": "2567a787-3320-4e69-8a4b-c681179e0764", "value": "6144:KzshTve85lg2KTzLkvdq0nTUZKz9tyR4kS3K9RKElse+zTMwnqXOjhiEjrFPxoxB:P56uq0nAutyR0K9RK0se+X9PjrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886777, "uuid": "ab637af8-8bbe-4e85-a43e-3e85fb79aadf", "value": 406549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886777, "uuid": "796fccb3-dcd6-4877-aa62-470bf2725359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886777, "uuid": "aee0789b-a5c2-4d5d-81d1-839a79fb9d39", "value": "a9f12ee9f7837846d472da6d0c1a367e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f853cb49-60f9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639938727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938727, "uuid": "daf2581c-0c7c-4917-add8-0f45e6d550f3", "comment": "Malware payload", "value": "96cd7135389f503e44a6fcab1be94227", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938727, "uuid": "ef14b99c-5ed1-4b6e-b325-88ea6aed5877", "comment": "Malware payload", "value": "d69f386b9b1ad223837ddee2f65a14e5beb9c154669dc2e21b31ac79f7838113", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938727, "uuid": "d7bd35ce-b1d1-4170-8a79-8e15d434e456", "comment": "Malware payload", "value": "b87de313060bec267facc549ec17cf6ab09d9b43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639938727, "uuid": "f6a60f87-1cdd-42c2-8eb5-0e7075d7d18c", "comment": "Malware payload", "value": "4689ac02aafb9cbbb4a2f58e83381cca625f3f59d35620623a27865bea2cac21bb055fe7d3c5c0a7df1c4efcf2d6cf26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639938727, "uuid": "fd2270d3-a771-442d-a7ad-4ac3054dd0a8", "value": "T1E1359F9AE746D9E2E1A30576029FC7F60231D1360103D6F7EB48FAB87862B157F07266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639938727, "uuid": "8d796133-5c6c-478f-ad98-ace1fa794ef4", "value": "24576:RsqZhvnhHXuhshNjm3Bp6gDgR16lwzBWa4wwS49TrHg29XE/PkroyUkNR9:PhvnhHXuhshNjK8AlGWaoZroyUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639938727, "uuid": "f30e6f90-21e5-42b6-b7bc-b6abbec6b80c", "value": 1058408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639938727, "uuid": "c611841f-f0a5-4758-b584-28ca67900acb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639938727, "uuid": "c07b2df9-dd23-4e3a-9d28-d14385b1e3b6", "value": "96cd7135389f503e44a6fcab1be94227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c08509-6091-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639893704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639893704, "uuid": "9477a7ef-fa51-4ec1-b95b-6efe8a631c4f", "comment": "Malware payload (RedLineStealer)", "value": "a20fa4bda1f55ffc37c227b963a48d39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639893704, "uuid": "60ab99b5-40a7-418e-a4cf-52559fb64253", "comment": "Malware payload (RedLineStealer)", "value": "d70a071d2f67f6460e2bd58127b3fae2e3f18866571617e66d94112e7c86a2ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639893704, "uuid": "93cf0395-2a54-4f17-afbb-0226035ca09d", "comment": "Malware payload (RedLineStealer)", "value": "1543c7f5c483705495d2ea1b68fb7aeca2a8fd20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639893704, "uuid": "cbc64742-d705-4216-be3c-106c40996c96", "comment": "Malware payload (RedLineStealer)", "value": "6f5adff94a998cbd9c5c2a80af849a5ea9e6ac74db9f5bce8d426d8c3a83f0ee7f194f2cc0632e1f6fdb810b7aa18971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639893704, "uuid": "12171c8c-b430-4165-ac85-1f02cf29179a", "value": "T17094CF00BBE0D034F5B316F8097593B9A53F7EB16B68A5CB12D126EA96356E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639893704, "uuid": "25d77b57-44b0-482f-95f6-4d9c7d624460", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639893704, "uuid": "cceb54cc-90fd-4b82-b9a6-54c55c6e8ec3", "value": "6144:T5hai4opa05IBHc97KiHXISFNHcQiyVaV+kzFlteG9Yul6CrD1e:FciHs0uBuKiHX5FN8QQV++FmG9YuZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639893704, "uuid": "73a14a29-78d4-4e42-81b6-3cae8c9765eb", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639893704, "uuid": "fd306210-f825-4699-9d1c-2f31b3360fb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639893704, "uuid": "e9eb7b18-456d-45c4-8f58-c0ed4d484092", "value": "a20fa4bda1f55ffc37c227b963a48d39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bd9b64-60a8-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1639903737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903737, "uuid": "e73bee28-fcd5-4b63-a1df-09bd1c6883a3", "comment": "Malware payload (CryptBot)", "value": "5b5540baed04e453ae72ca2fc74b2a6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903737, "uuid": "a375ec61-5648-42be-bea1-1f8b9a85ca77", "comment": "Malware payload (CryptBot)", "value": "d7e055feae0f43ff14859faafa33113ceba3977171497635576fd74608a64a7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903737, "uuid": "3b958212-f990-42c6-afcc-cc4732828c95", "comment": "Malware payload (CryptBot)", "value": "d93e8a383780308c73ebb639024b2029f64d72a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903737, "uuid": "9dc2f62c-e73d-4492-bf39-73a366ae0a06", "comment": "Malware payload (CryptBot)", "value": "a47481c06332f224be109d720d08591f43c974fd07bcfaac43b6b977aecd87f67cea2d983dbba9394a29b3acf7793687", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903737, "uuid": "8b1969f9-ac6d-404d-9ab5-cffda4a0ebf6", "value": "T1F584CF00A7E0D039F1B752F44D7A93A8B93E7AA16725A1CF12C057EE5A74AE1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903737, "uuid": "4b7ece4a-9e10-4c06-9921-b07feb604460", "value": "e948cceb87d1cee17f7cbe2fd8362589", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903737, "uuid": "707ba54b-bf94-4eb8-9555-67919ec98662", "value": "6144:uwRb77CXB8LDmgBnNYZXNe5YkMRd71TY0Yye+hcEcxL5YN6nPGq04ZUBiY6XwknI:FJ7GyvNNQQ5xI71TY07eIgTm4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903737, "uuid": "72eb20bf-e4be-4cde-afa3-28d2dbb542d4", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903737, "uuid": "28259d2a-0138-4a12-ba94-732d0cbadee8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903737, "uuid": "d855f9d4-5f8c-454b-853f-120aa9af3bb9", "value": "5b5540baed04e453ae72ca2fc74b2a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d236f208-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923630, "uuid": "5e6dd65e-3833-4e01-9f9e-f2a8fb83b39a", "comment": "Malware payload (Mirai)", "value": "2f56a534bc999d9203c000bffdbd0715", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923630, "uuid": "0ec5a004-205b-4548-941c-50741f225241", "comment": "Malware payload (Mirai)", "value": "db595e0ba3fe3366e739a1d76da1ee886241308c3bb057edd0453897613814c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923630, "uuid": "78543304-bd82-42fd-b7ad-69d986049b56", "comment": "Malware payload (Mirai)", "value": "92787f9fe00ef5487922a265c43b4687f24a7ffe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923630, "uuid": "f2f1882d-ff2d-414c-8ca2-43237bad54c1", "comment": "Malware payload (Mirai)", "value": "94fb71ab41907978116b2e4b415bd4b8e878edc4a8b231b9f69fe7ab93e6eadca20e5f7cf4b21faae16cec886e6ff338", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923630, "uuid": "b8186d8d-eb3e-4852-8fd3-075e037ca0fa", "value": "T162D2D0679D81E9B4D99160B2CCFF0B5AA202557CFD0768012B18863C7DC50CF9F74E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923630, "uuid": "0d40ba4e-2575-4ffc-a95f-c994beeedb14", "value": "768:zaksVO/TaAtG3zjiBFmcDYM3vuXdsknMxhY3Uo6z:zaxOrVtGviXdYi6dsknehz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923630, "uuid": "f94ee66d-0c02-41f6-a1d6-6fae31af8ba7", "value": 29500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923630, "uuid": "10ad0667-5379-4593-93ab-2537d9cf6df3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923630, "uuid": "b19f79b6-6ecb-4d7b-a5ec-d916248885cf", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9877648d-607f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639886167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886167, "uuid": "d6662ac8-f896-443d-8929-9d708b6ede83", "comment": "Malware payload (RedLineStealer)", "value": "0826739c586a82c816d32cb9034dccb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886167, "uuid": "fcbc70ec-2f88-4c40-b364-90aa0898980e", "comment": "Malware payload (RedLineStealer)", "value": "dffc96e5487f30252d16fa0d9ad5cb3e05c1298efe91f6b90deaf1a33918a6cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886167, "uuid": "05385b7c-f920-44d0-a32d-d3ae18758a28", "comment": "Malware payload (RedLineStealer)", "value": "982fee4a04ed018d3d745304139450b58dfd55b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886167, "uuid": "7393d611-2dfd-44aa-9a4a-b70dc7fc3e52", "comment": "Malware payload (RedLineStealer)", "value": "b3b834127ccc3c8f56fe60854fbd11773c6eb43164a6bccc719eaac0d9d7e1950f0e6ecb579e7825241b29d7205711c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886167, "uuid": "f31ed027-faa4-46c9-b9c4-2c486ef6f3c6", "value": "T1A794CF00B7A0C035F5B762F4497993A9B53E7EA15B78A0CF12C02ADA5B746E1EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886167, "uuid": "68866f2c-a239-4588-bd9f-c3aded123520", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886167, "uuid": "2d1eebbd-1c03-4b62-b632-a46fd95e9938", "value": "12288:hCPsdZ6XS6QojTc4tPHqdiBJOUu+0TZfgz8:h3dYi6QojB8dcOUgT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886167, "uuid": "1e15d595-f2da-4e17-a192-c8d8cea08b1d", "value": 411144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886167, "uuid": "d8258b93-c93d-46b3-a8ee-c35056a80ba6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886167, "uuid": "e90e56f8-a323-4329-a6e1-36e244f038bd", "value": "0826739c586a82c816d32cb9034dccb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c902beb0-60e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639930057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639930057, "uuid": "9053bcf2-9ecb-4101-8846-797c3e0329be", "comment": "Malware payload (Gafgyt)", "value": "f8558e046b2523fda3be78cedc797752", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639930057, "uuid": "82cccd1d-3c43-49dc-95f0-d4dc3e67ea83", "comment": "Malware payload (Gafgyt)", "value": "e17ff5a33ff7b4eda8c3ae4e48b56bcff8643601411bb8870a21a266c1a21b9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639930057, "uuid": "af3c17c2-1d95-486e-9693-bee5b447b7f0", "comment": "Malware payload (Gafgyt)", "value": "0125efd0ee929ffd47a073369c01de5764eb8809", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639930057, "uuid": "e1848688-46b7-4ed1-8483-e59fec1f60eb", "comment": "Malware payload (Gafgyt)", "value": "9dc01a5990cb38f552a5a6fe827f1445216e215f988974fafa460ad5ef54b778661885c53b5b83d2fa9537946c290103", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639930057, "uuid": "8bcc5f76-f686-4b31-9986-d295d32c214e", "value": "T134835C49D747CAB3C88307B2029BBA764532F93B5E2E9E45F70D7CB49B124D87226712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639930057, "uuid": "097d4faa-aafb-4a15-bec9-4cd3823c8b1f", "value": "1536:sQmab6bXPm8VjWWHT0im5t3ItTShKW6GLdUF5MI5AtpgwoUOGHfV+mLI2VOYjXUd:Oab6bXPm8VjWWHT0B5t4tcnBUF5MI5d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639930057, "uuid": "40f6f2ab-5124-4ded-a727-1427329406a2", "value": 86409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639930057, "uuid": "5eebeb63-e287-4a7c-b8fd-0d7f5985ba5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639930057, "uuid": "118d14aa-a600-4eba-96a2-966e374aecd4", "value": "f8558e046b2523fda3be78cedc797752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27dc8d7-60a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Tsunami)", "timestamp": 1639900357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900357, "uuid": "a9c75c12-53d7-4542-a136-d02edf99a4cf", "comment": "Malware payload (Tsunami)", "value": "7d3f686801ae3f90f36aae17f7a66478", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4", "colour": "#8E62DB", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900357, "uuid": "837e06cd-7d39-42e2-97fb-705044319777", "comment": "Malware payload (Tsunami)", "value": "e20806791aeae93ec120e728f892a8850f624ce2052205ddb3f104bbbfae7f80", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4", "colour": "#8E62DB", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900357, "uuid": "931af837-a621-4432-9b8c-38d0a1209a41", "comment": "Malware payload (Tsunami)", "value": "237315820fe77880e892d5c30b2f5fde7e5f6d64", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4", "colour": "#8E62DB", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900357, "uuid": "32049161-1a02-4931-ba6e-f60da07ef2cc", "comment": "Malware payload (Tsunami)", "value": "800c04d8a1bcf505b393a10e21c1669360bb10a79d3dc8bf3c0e449d2c3788782d20ae0ffeef503757751f4ea0f2d0d2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4", "colour": "#8E62DB", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900357, "uuid": "7b72dab3-0efc-492a-abff-8f4577b69fd0", "value": "T1774302BDBF10C188D7293AF017FA3641647B7E2F55EEA095535AF6196DB00EA1233348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900357, "uuid": "3daa7798-af3b-454a-a75b-f6b321c2f1f4", "value": "1536:GeHlnEW13o/C1WgtCA0MtslCxZr44HB2mzj9Ll:HndFo/MWgp0dlGZr44km/9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639900357, "uuid": "bc6e65d6-3830-4dbe-a427-804e230bac1d", "value": 56644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639900357, "uuid": "4c57fbf0-b2d3-4a72-9806-7f2907c1c80a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900357, "uuid": "1c4a2a38-98d0-4d8f-a91b-977d2603582a", "value": "pty1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6095ec30-611d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639953934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953934, "uuid": "f9d001be-217f-4bb4-95fe-3e1725a91cc4", "comment": "Malware payload", "value": "2aa8128b8188e0b038a033203fa1b7c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953934, "uuid": "440ab4df-8bc1-4cb2-badc-c42f071c7c03", "comment": "Malware payload", "value": "e2437d4c62a734010fa04f779a68d888ff73c8a1dd9c937bf9edb54f96046ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953934, "uuid": "44db4816-73a7-427c-98ef-b1d0d844b812", "comment": "Malware payload", "value": "4a95d41e5631e77110e216e849ff353c189e2712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639953934, "uuid": "380a1955-43d8-4d0b-9944-e133bcfc7653", "comment": "Malware payload", "value": "306f9df351b252947eb27f33fe18ce5dc3a8d1bbcf9b655ee0a6dd5faa4281979e2bd0d1870f75b8174dec5b93dad3aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953934, "uuid": "6b1c933a-b809-4c75-8082-db6f7bb252f0", "value": "T1CF45B2E53ED1593BF66AC8FDA858ABCAA688D9002BF460C313CB34905D35FC65DF5248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953934, "uuid": "762b3e7c-4646-434a-ac4a-222ce42d22df", "value": "a408a05be1289da77ed9d49f514cfabe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953934, "uuid": "4006cc80-19c0-4b5f-ae8c-59645a85df19", "value": "24576:qWLSJjxHZsT0qWeGXvn6WS7VluW9nk2bol+SW:qWLqjx5sT0dP0VlH9nXQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639953934, "uuid": "31a57461-93c9-4fec-a45b-2a98e3961a08", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639953934, "uuid": "8c1ae209-6854-4409-ac6a-3e6adb6ed802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639953934, "uuid": "d1475651-9b15-46c5-a44a-b621965e3cfa", "value": "Activate it.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93a4b1a-60a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639903509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903509, "uuid": "b3897088-f624-416a-ae7a-b82c38adbf36", "comment": "Malware payload (Smoke Loader)", "value": "a091e224d47479e03ff306a32c2744da", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903509, "uuid": "d2167241-37fa-4688-a37d-038e98d588dd", "comment": "Malware payload (Smoke Loader)", "value": "e2d8361ae362eefbb66c5449c87b6d3c9855dad5d8ba02c3cc1d2511b608d4fb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903509, "uuid": "0733acad-4732-45dd-98d5-7c7fb962ad9e", "comment": "Malware payload (Smoke Loader)", "value": "56454c9a115eab1ba17f2a29e95d12ecffca451a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639903509, "uuid": "7f187f02-b0b0-4da8-9bc1-c359b7b1eb93", "comment": "Malware payload (Smoke Loader)", "value": "426f46a6a25dd7e70a86c4147d81b651925cb595656a6e66f4171c8147d5a7fca45a12a4dbfaa0137acdce4cbfdb704e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903509, "uuid": "489985cf-c7dc-46d9-9da5-60a4f4e273f8", "value": "T15A549D04A7A0D435F0B762F459B993BDA53E7AA15B35A0CF12C517EA5734AE0EC3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903509, "uuid": "0a11bcf6-7608-4be6-91cf-b5dedd4ec910", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903509, "uuid": "bbbe01b0-b3f5-4e57-8696-5f5c0909a684", "value": "6144:fe4BDFTtmPisyinRzmr2lascSqZBq4ajNZEiudYaD8z:fe4dFTtizyinRzo2la9SLyiud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639903509, "uuid": "aec159f8-e6b5-4b65-923d-7c90c8259c84", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639903509, "uuid": "ef5d82ae-31a9-4e2b-96b6-2fc013f704d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639903509, "uuid": "99b04573-4c7a-478b-9e06-8efe0d7bbdbb", "value": "a091e224d47479e03ff306a32c2744da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a05f80c-6115-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639950433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950433, "uuid": "7549993a-bf25-4806-8551-999dec6fa195", "comment": "Malware payload (Mirai)", "value": "a2e5f531bd8e3c962b2c6cd3ebd8f85e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950433, "uuid": "e10d5f24-afd2-4cdf-b5ec-73141be542ea", "comment": "Malware payload (Mirai)", "value": "e2e4eab59a75aaad8b9c87616d378218e674d11874b4c43e27534090327b3113", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950433, "uuid": "32a011fe-4615-47e6-b853-3d0947273533", "comment": "Malware payload (Mirai)", "value": "ad53b15985b0655b61c82803adb5e2319099554a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639950433, "uuid": "6b99aabe-4aa8-4ffc-a17f-03aa7a3ebca3", "comment": "Malware payload (Mirai)", "value": "5eeb16db411ee74a17a7a1ea3c4464b23abf9c2eeb6127b5da2068610fc8a5196228298753d4a8086254c1d46f4700ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950433, "uuid": "5e6d3765-b330-48f8-8f79-c53951546115", "value": "T1BE93F587E753E6F2DC9512741C67AF3D27B1B0591433EB4BFB6CB8B68A1B2018912748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950433, "uuid": "8bb27bf9-535b-4c7d-be96-54e552b7309a", "value": "1536:MMnEyDuGj2r4ikIV3ecpD4LGRSdPS+l/a:MTyDu62AkecV4KRSdZly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639950433, "uuid": "074d5a53-ed1d-4758-93b5-c5f67a540134", "value": 91568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639950433, "uuid": "966b4ba6-91ca-439e-821a-c9376f8f6353", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639950433, "uuid": "64df9296-1021-47ad-bd57-ba4e95f5ae67", "value": "a2e5f531bd8e3c962b2c6cd3ebd8f85e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3182e8-6083-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639887682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887682, "uuid": "b9c98ec1-6978-425a-86b9-1b25dbe50ff8", "comment": "Malware payload (RedLineStealer)", "value": "c3d5c0c72ef4a7eb0cb5273d529e23e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887682, "uuid": "bc2dba8d-d733-4e26-b3b6-01d1907a34bf", "comment": "Malware payload (RedLineStealer)", "value": "e3721c6f3d01620c45f58f04369fd946dfbbd7bf38154516223181cf93347eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887682, "uuid": "b11e809c-df14-41b3-aeb8-3c8eb75d4916", "comment": "Malware payload (RedLineStealer)", "value": "11e2bc7477399b47216ec64c0a756517bf7426b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639887682, "uuid": "9a02b66c-54bc-4c70-9584-7d0612738824", "comment": "Malware payload (RedLineStealer)", "value": "33bfeb7c95b8871f4a34c51031d8d220e8f8c8ccd4252f01a344eb3a6609a9e8943833230a293deb53bd273f56474bd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887682, "uuid": "dd9e46cb-4076-4506-803d-fc7f11c901dd", "value": "T17384D000B7E0D034F1B752F44DB6D3AC7A3E79A26B24A4CB22D516EA5A746E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887682, "uuid": "548ba6da-a3ea-461b-9826-e4ef518e4660", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887682, "uuid": "10abf442-d8d9-42b7-aa05-3194e42b07d4", "value": "6144:KzshTve85lg2KTzLkvdq0nTUZKz9tyR4kS3K9RKElse+zTMwnqXOjhiEjrFPxoxB:P56uq0nAutyR0K9RK0se+X9PjrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639887682, "uuid": "9681b83e-d149-4ce8-914e-2d58b55bf931", "value": 406536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639887682, "uuid": "29f4c603-2dfd-4305-85e0-744812a48fcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639887682, "uuid": "9ed1bf07-9656-4469-ba2f-7cf81f59c27a", "value": "c3d5c0c72ef4a7eb0cb5273d529e23e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4690a1b0-60a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639900203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "b878baaa-044b-4aa7-bc78-1c16150e2026", "comment": "Malware payload (Mirai)", "value": "5091af5636d4b88773c09dab66b2d322", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "a61cb3cf-c34f-4ecc-b356-ce1b1a86c60f", "comment": "Malware payload (Mirai)", "value": "e4d29ffb8a973202420516b2f179c3c09151249cc85d3cf630a9d308c018e210", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "9079b9f5-3ef6-4d17-a216-4a9700835e3b", "comment": "Malware payload (Mirai)", "value": "42ff65981e2c181daa9592d982101af1b8b1a0e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639900203, "uuid": "0b61afe9-3384-4d78-88bf-f851cb0abb76", "comment": "Malware payload (Mirai)", "value": "f76f2baee3e62076a2a8e166e8d7aa7e0e544bdaaeb38bd77a108ac31414f7492bdc3d57ec735d01f32a33c7e63037fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900203, "uuid": "9cfb3810-f7aa-4771-8e64-d1993e74a650", "value": "T1B2534AC8A5C3E5F5EC001D79307BABA1A973F53F2035EE9BE79A25639902603E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900203, "uuid": "d84b8930-d04e-4451-ac3b-6bee97d98c91", "value": "1536:V5Vn4pXoqVExGxRP3MFnKiZjGKO18HKaPWXc7UnDJEAG9l:7R4pxuxGxB3MFnK2GHCHKD6+NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639900203, "uuid": "a8553e4e-cf95-4a6d-b6f3-9243ddb3ccda", "value": 63696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639900203, "uuid": "b2b3531c-178b-4cf3-8826-c396171530d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639900203, "uuid": "3117d3d7-1313-4ffc-9f31-b5ac00de0efc", "value": "KKveTTgaAAsecNNaaaa.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247cc5a4-6081-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1639886832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886832, "uuid": "6c8ca467-2882-4369-b1bf-59dd0a73b231", "comment": "Malware payload (Tofsee)", "value": "05b03b1ba00752c267e7e892af6f1a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886832, "uuid": "72a5b2c8-8ce7-429b-97f6-a4533d001fce", "comment": "Malware payload (Tofsee)", "value": "e6f9478f5ec1f4e62aaaa075b7a1479d2aed7c65a3560659bb3690d36d68c0bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886832, "uuid": "4b2a4af1-e08c-45c0-8a07-a9955828df69", "comment": "Malware payload (Tofsee)", "value": "7fa922df2958b1182ce1a5f4a1fdbb40a3bc72f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886832, "uuid": "5af272ef-b100-43ba-a298-21dee58e2452", "comment": "Malware payload (Tofsee)", "value": "a9e73cca2e74002a2d57360dd015782260bf089c3c1d8883aebeeba0eda8837cbaaec369fc80e0c88557640ca25dabbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886832, "uuid": "9d79e14a-eaa3-46af-b8d4-69491d084a7b", "value": "T14C549D00B7A0D436F5B712F848B993ACB93E79B15B3590CF52C566EA1634AE4DC7031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886832, "uuid": "e5c620c4-23a6-46db-b164-3c80b400a1c3", "value": "5865534cf92870d611aa6cf226405c03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886832, "uuid": "a89a56cb-31cd-42cf-8920-ec12924668ec", "value": "3072:h0ySS+yVI6eMnVjzTfU09x8VXchkllRBa3635M/s3Q9aDG8BX1lLOBaXkMv9kf7O:/I6RxzTf18MhklZ+635mK5jOBaUMavp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886832, "uuid": "1c03cc4d-9c0a-4347-88ac-7858a7d22fa6", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886832, "uuid": "df553c40-f3c4-44da-89ba-51aaf040dd85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886832, "uuid": "acaa245c-572c-4fab-83da-96554dee0e93", "value": "05b03b1ba00752c267e7e892af6f1a8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad7be95-60af-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639906572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906572, "uuid": "5f5d7f61-d6f7-467d-8e87-5fddb22d8e3a", "comment": "Malware payload (Mirai)", "value": "53e6f628a481d5d44bbf71fbf2c45b6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906572, "uuid": "b573734d-529d-4bc3-b556-85ac7f6caf65", "comment": "Malware payload (Mirai)", "value": "e95645407e5ebf6267f03524035e1dc195b53eeb4d2eafd4bf442e3c5002a729", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906572, "uuid": "2ff41f0b-7490-4ca4-8d69-a52fb74acd6d", "comment": "Malware payload (Mirai)", "value": "38914154b71b7b5a0896360fdf0fded81c4870a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906572, "uuid": "7b6c4ea9-f48e-46c1-8929-fafb6f0809a3", "comment": "Malware payload (Mirai)", "value": "d7defd2e57d2a65c4053cee031e21162ebef8e6e5df0717265c3691108fc827c94493232d58a9a7876bff4bbb86a08d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906572, "uuid": "1a9048eb-4f5d-4e9c-b4bd-125c6c7cd87a", "value": "T1D7E3A76D3A11AF7ED26CC2310BFB6F70D35521D626E29355E29CD7481EA038C9C5EBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906572, "uuid": "2f04f5c5-b455-402e-8698-4407c2b20e90", "value": "3072:GyiR9SZ8Ugjl5lpKD5hnA0z8U+3rMsBRTFCj4jM:OrSZ87BTkD5hnA0z83rMsBRTFCj4jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639906572, "uuid": "38731641-6342-47f3-ab51-64d1b14e611e", "value": 153077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639906572, "uuid": "32928f27-1061-48aa-ac6d-f7c25a9f78fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906572, "uuid": "55ca8938-44c1-4f5b-92d6-328f21dd019a", "value": "53e6f628a481d5d44bbf71fbf2c45b6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb7e26d-6080-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639886768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886768, "uuid": "ea831ddd-bfd4-4bd3-8aff-7e80ac752841", "comment": "Malware payload (Mirai)", "value": "c98e4eb1d67963ad6d854e3afe950387", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886768, "uuid": "fbd64f0f-f31e-4d78-8a3d-a1143ef97037", "comment": "Malware payload (Mirai)", "value": "e9744244461056c64fc390591729c035f3a375bc8ecfa1a0c111defa055c1273", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886768, "uuid": "63e1efea-8c2f-4c78-9cde-3fbe5d3bce98", "comment": "Malware payload (Mirai)", "value": "8d692f73e5b6c3309568a3f488a93f8685c6661a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639886768, "uuid": "4d337df4-832e-4291-8478-339cdcf7092a", "comment": "Malware payload (Mirai)", "value": "fde4d18005f42944367ae633ff70a5095dcab09a7c30e763e6de1fe3fda6f3f6d93345bd9efd9b14fd21fd0ee7115516", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886768, "uuid": "2abc468c-a066-492a-85c7-95489f2d1678", "value": "T12D6328C4B583E9F5DC140B78307AAF725A77F53AA079EDDFE3D42533A842642A10226D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886768, "uuid": "40a11f0d-8dda-4965-b684-32832f44b618", "value": "1536:WIgEaqpqismXeV44jvQGY7y1XuCOHItqIlYaZwDM97O:WBElpLcy4jvQGY7y1k4qIlYayA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639886768, "uuid": "f5449258-1cef-423e-886d-ff4be45fb657", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639886768, "uuid": "7263abf3-cd25-48d9-baec-7830bd08b7bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639886768, "uuid": "c11d24ec-abb9-4430-93f3-9765fecd04fe", "value": "c98e4eb1d67963ad6d854e3afe950387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d9501e-6108-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639945078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639945078, "uuid": "ad6e3a9d-79c7-45dd-afd3-880bfb679c1f", "comment": "Malware payload", "value": "2d6fd4cc2dc401c05dbc9089bea70990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639945078, "uuid": "74bdae30-1b91-4ca5-afd4-d948d05dcaa7", "comment": "Malware payload", "value": "eb4ed5f6140aa6e26adf5408f9924e5263b9c0fa3b66cec699f7e50eb893537c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639945078, "uuid": "16ce772d-2ec9-457d-a3ea-ff190263ae11", "comment": "Malware payload", "value": "4afa6d150ea57b2301149e93c63769d8f1399664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639945078, "uuid": "563b2f4e-041a-4f43-a0a0-74d0abb89a86", "comment": "Malware payload", "value": "4d1721289342232d51c6d0bd062c99920a5720c1f94f28a3f8de60965bfa32653a8640d414594dd74d1424bdce24936d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639945078, "uuid": "91d95849-25b0-43f9-8ab6-7888cb29b4e9", "value": "T1773733B250F1091DC7A784B1AF3124DD5B2411ADBA6F7166FAA30920F5B38A1C3DDCB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639945078, "uuid": "62eaf538-cd5b-4fa7-9715-5ea6c8e22546", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639945078, "uuid": "11a330d8-2b9a-4c1e-8667-69a936969329", "value": "393216:ZWKkJuYbK65rESq6vA4YvbDD2i8FfQyNCoruduO4csz5SGjsxzCJQYb5w0IA3ijL:ZWp9bKAESzvu27oyzrUfsz5SDmbw0d3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639945078, "uuid": "6e3a3a3c-e392-4162-b906-220cd2b7df6d", "value": 23556648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639945078, "uuid": "7402d0bc-2b0d-44bd-9fe8-3818299b510f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639945078, "uuid": "4cad96b5-4d45-49fd-8272-f1191af4684e", "value": "tailscale-ipn-setup-1.18.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7933c918-6099-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639897282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639897282, "uuid": "4367b9eb-d7f9-4eeb-b4a1-cd67798578ae", "comment": "Malware payload (RedLineStealer)", "value": "da35d5fc62fcfeed244a00df5d194c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639897282, "uuid": "ff756cbb-b314-4ad0-a9b3-63a173d2409f", "comment": "Malware payload (RedLineStealer)", "value": "ec6a61ef3cf3ac84411a167e0befa73f66f4e667c6d9540560befa5dcfe83c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639897282, "uuid": "385a3502-0926-4209-8ed0-d3a3f841fac0", "comment": "Malware payload (RedLineStealer)", "value": "a82d4b4b4e3c29f49173587d941359459b7f4a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639897282, "uuid": "0ebeb6b4-8d57-4647-ada4-5e88ca7d0623", "comment": "Malware payload (RedLineStealer)", "value": "d27b0ead3e0923367bae23b938c4b70bd45b8558d830bc241038cfbd978b88ea1f9d491c321d9701a755d912a4db6e56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639897282, "uuid": "5352ca3c-1184-4db5-b570-39855519c7ef", "value": "T199549E00A7A0E435F5B762F849B993ADB63E7DB16B3490CF12C516EA5A34AE0DC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639897282, "uuid": "003bc39a-0703-446d-9fac-a2a97b1a7734", "value": "f46517a27dfd5e3e6128969b75b2086f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639897282, "uuid": "17cd1561-1b40-4ca0-9a4f-904f6bf1d446", "value": "6144:TIlSNkwHW3RXW4616RIaCRqVPj6CTEmaPued:wMDW3RXX616+7CgmaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639897282, "uuid": "55c38d5d-2606-4aac-b55b-42f21d321099", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639897282, "uuid": "ffddad57-2a9a-486c-be13-0835d0bf9f16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639897282, "uuid": "caa21115-5cff-4701-848e-73519ce6f089", "value": "da35d5fc62fcfeed244a00df5d194c55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e3fb00-60af-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639906594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906594, "uuid": "747ea9de-07b8-49ae-8a6c-4ddc012eb3bf", "comment": "Malware payload (Gafgyt)", "value": "fdf6e989f56ee7fc92ac637922eb6c2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906594, "uuid": "0200736f-648c-47e9-be3a-875c939e3e51", "comment": "Malware payload (Gafgyt)", "value": "ecdd083590757493dd9c7a51b61e815521baa2020aabde1d64d4c468a1cc867b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906594, "uuid": "331b834a-6a31-4ec8-b791-79ada4c8e5c4", "comment": "Malware payload (Gafgyt)", "value": "428d4144917a23c0ab01ab28c8e67418b967108c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639906594, "uuid": "037f344a-a4b7-4007-a6f0-3cde4ed78db1", "comment": "Malware payload (Gafgyt)", "value": "11baeaff444c44576fbc45c728c7068bcf63cfb0712801572bd2ce74ebee607cfaa24a3688cdd245523adbdef957d3cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906594, "uuid": "d9a01d05-ab77-459c-b5d7-f45a1425f36d", "value": "T1F5C3866A3E51BBBEE5A8873107F35F70C395299226A1D781E26CFA185F7128C1C5F390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906594, "uuid": "3b39ad37-fdd6-4eed-b389-9bbbeaed562d", "value": "1536:PVNC7Ks/fVlKnOlYAK0peNd5kNkWvIQj/2rKofVHrUo6YwreVFlhD/07Ve+vg8:K/1DeMzYgo6YwElpGk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639906594, "uuid": "2785a55f-17e7-4d89-a62f-2b692db98c8d", "value": 119151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639906594, "uuid": "a4bf8385-889f-4227-a09a-4a62708e1572", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639906594, "uuid": "0bb3fc8a-91a2-498a-8921-cf243587d6d3", "value": "fdf6e989f56ee7fc92ac637922eb6c2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97889798-6103-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639942859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639942859, "uuid": "48cc26f4-1f8f-421b-94a7-ae3f821f7e81", "comment": "Malware payload (ArkeiStealer)", "value": "fadebd4b77cccbf045b2364e9f20af4a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639942859, "uuid": "7caaf2e6-0245-4a36-b3d5-2b0380d1620f", "comment": "Malware payload (ArkeiStealer)", "value": "f13cef1cd039b27e7ad75ac6559cd9bc3311d0e7179a405c47346ff339da1f14", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639942859, "uuid": "2b7f6e66-c67b-43a3-b5c0-7fc89c1b9def", "comment": "Malware payload (ArkeiStealer)", "value": "d4a512b9bd4a0326b51524c42e1b433911df2e9e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639942859, "uuid": "e010edde-5a6d-4aad-9508-c9da7342eb35", "comment": "Malware payload (ArkeiStealer)", "value": "e186754f7c67dd4020b57d5016dc40d7dafe4774926859a02902c446e0918fca5aaae94f6086b94b03782dd96345c60e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639942859, "uuid": "064bb87b-5e45-4610-bfe7-8ce2b09ce13f", "value": "T11AF4F1106AE0C035F1B716F8D9B692A9AA3E3CE16B3554CF32D43ADA5A346D1DD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639942859, "uuid": "651ce88e-822c-4a50-9eff-5715a89660d3", "value": "9b5e0e93b958d7de96d2eb171562e213", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639942859, "uuid": "7a36ba1f-74b8-44ef-8a4d-ab829a1c69c3", "value": "12288:4FYZHDZ9IjnhflWiWdsBM6zCyFLeKM/vTv07x4xBHNPoRlk30ANd:gqH9qTMK9rFn0vTv00IlkXNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639942859, "uuid": "2f16b163-c6da-4800-aa48-0dfebc7763d7", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639942859, "uuid": "45d390e9-6d78-40ff-bf0d-11a2ffe4dcac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639942859, "uuid": "ec45c603-b467-4854-9da5-b50929748b4a", "value": "fadebd4b77cccbf045b2364e9f20af4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee375b6-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923625, "uuid": "9f518907-7c57-4a04-8681-1af858bea528", "comment": "Malware payload (Mirai)", "value": "4ca279a9589bad7ffccddcc94c9a1ad5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923625, "uuid": "5f12e1a9-70eb-4982-b8d7-cc0fc2e257b1", "comment": "Malware payload (Mirai)", "value": "f1d1e1e9570ee195ba5b5ea551642269149c123be2b0d80f38a9b86870c3b854", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923625, "uuid": "5b8fbea7-d40c-4aca-8919-1ce6bbb6f14d", "comment": "Malware payload (Mirai)", "value": "86a734b45c6267c5ffb6d05d16acadd7abd98814", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923625, "uuid": "aa7c4e92-1df1-4428-a21b-ce56dd1437b5", "comment": "Malware payload (Mirai)", "value": "ffdfd959d09572f9aa4ed9279a5c197cb4b76ee9b0e91ee86cc5bf1b3dbd10e104d20e58c42b98708319d4918e8edade", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923625, "uuid": "bf3d228f-6442-4e5b-9611-9d6bbd0473e2", "value": "T155E2E1D9E1E2F7C3C26B807E295D3A83691C9E1D41402A517BCC791BA892FB436647B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923625, "uuid": "620c5ace-d06c-4b4e-8f5f-4d012af944c8", "value": "768:ZrnwTgp0X0ZILcakR6ENZJSAr/XcrAVW6m4EXy1P8Q2wnbcuyD7UiyqF:Ssp0fLr2TXcArvckU6CXy1Pkwnouy8ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923625, "uuid": "01b03e04-be83-474e-9353-0823c0f37833", "value": 33032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923625, "uuid": "0fa0484e-f24d-4e74-a325-d0008d5164da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923625, "uuid": "b16254ed-0514-4232-9f18-8ed45d25983d", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3078280-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923632, "uuid": "58e3383e-98db-45c0-9d8c-dacee994ff7c", "comment": "Malware payload (Mirai)", "value": "4ff53e4061fe6725a6934e5551ed8cef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923632, "uuid": "3e7a4d71-54eb-458b-b3b7-e3e97bcaa4ab", "comment": "Malware payload (Mirai)", "value": "f35a4d18ba6ca149aabd4bff97bde17d055525e088b081484d3a2b7f65cf7721", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923632, "uuid": "ad064dc0-45af-4274-a44a-dcdeda8c7577", "comment": "Malware payload (Mirai)", "value": "7d3849c6bcf55158cc8c5637c66f03188ba322bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923632, "uuid": "72db17ea-3b86-4982-9fc6-69638af9a74b", "comment": "Malware payload (Mirai)", "value": "4022e82be6bf82196d5540a8284c15af152cc596015dd031d65a99bb30869a8e8e27b04018a8ddcd48f4c098c48d26b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923632, "uuid": "25ebcf6e-1d1f-4f1c-98f1-0790c17a72b3", "value": "T13603F121910E7652FB352C35D3965787911802BC867D38AB373842DBCCE85A67BFEB14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923632, "uuid": "59db0e24-cdc8-4698-b0f2-138014ab8c43", "value": "768:gUZgyV1aRUZ3/2cwCnNqKA1vMFwm9qL7YczK22EBejq3UIU1:GwsEfAmuzBLPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923632, "uuid": "1e8888c3-51da-4236-b796-00eccebfdeca", "value": 37920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923632, "uuid": "4edd08db-4a59-42ba-bcc1-68c9ca2a0dd5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923632, "uuid": "58119808-f011-4b25-aa22-0fb1b821007b", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb7268a-60d8-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639924562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924562, "uuid": "33d0806c-509a-4a77-8d44-73e2ebf52637", "comment": "Malware payload (ArkeiStealer)", "value": "12b73c8f33b64dadcf0cecf53752d1b2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924562, "uuid": "5c3587c7-6f71-4ccb-945f-41b2cf85b070", "comment": "Malware payload (ArkeiStealer)", "value": "f42b3b3342d496edda11ff983d90f5cb38d32dca38d9d3381eadd9d063eb19f2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924562, "uuid": "cc58bfc7-7a15-4350-8497-6f1e7a5b9233", "comment": "Malware payload (ArkeiStealer)", "value": "d76cd3b31177484f3fd53b3e5e7fcb57a11260d0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924562, "uuid": "8ca4c961-1e41-45ff-8d63-01abd4a77dc9", "comment": "Malware payload (ArkeiStealer)", "value": "80962ce772ebc183f4190689a8670fb7b2b00eaa3a205d380f8fc39fed2b37a74d257bea06ea2dfae7ade156e91ef5d0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924562, "uuid": "d5aaaa53-a831-4b8b-9273-1b5d64de5679", "value": "T197F40110A7D1C034E0B726B85C7993B5AA3F7DF2AB24A1CB61D467EA5A346D0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924562, "uuid": "5d130d28-075d-47d4-a912-413fb01cfd20", "value": "5f124a733ee23e7a763027f872397aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924562, "uuid": "f1214fea-d5e5-41b7-a841-325a5a1640fc", "value": "12288:MlX8E/zRF7iDSHRYrs/BTPsuISgmrDB20uHMh+12Zx2d4QJX:MlX8E/zRF7iDSHyrEsuISFR2/5mx2th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639924562, "uuid": "9c9176ab-94e2-4573-ae6b-9ecc36dcea4c", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639924562, "uuid": "64bc5084-eec2-416b-ab40-d146eac589b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924562, "uuid": "948e4fca-2a35-42ca-a091-bdc5dbe02119", "value": "12b73c8f33b64dadcf0cecf53752d1b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de293d0-60aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639904403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "00e0d5db-4d52-40c7-9f69-08caa6b92ab2", "comment": "Malware payload (Mirai)", "value": "83a85b60d663544415b44fd9a9cc84b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "538a30a2-8fd2-473f-b5c6-88114f26f532", "comment": "Malware payload (Mirai)", "value": "f42d438037b16e56a5404359f9e1b05d4d20ce480100188d910484e9fef80241", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "517a5b3f-c2f9-46c8-a677-017c36f29a80", "comment": "Malware payload (Mirai)", "value": "760879da4a19199b8225d4f92f3775533c387f2a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "3cd013d8-6b58-4736-a9e6-abbc5c6d91dd", "comment": "Malware payload (Mirai)", "value": "ccb1bc3acc4de43d4b9e0cbe869a11c88516016769376546c756c8631197d2ab33eef3e94456e53ffc133a61d8273d91", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904403, "uuid": "425f63d8-aa4e-48db-be58-1bac5bfac327", "value": "T16EB2E199D6EF27C3D2A29336E07C5A4DE2B21AC10747444A210D729E929760FC7FB3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904403, "uuid": "685cf02b-841e-478f-916d-460ca1bf1b31", "value": "384:MaDKKQOcRpmYLdn6RBOFRFt5rUF81uiSSlCo3AnupVFNqnrrd1NEZgO8UXWozPLL:H/QOC0Yhn6ROHWF09cwNPFCnNBxcNcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639904403, "uuid": "35f3381d-7a29-48db-8a89-5820088c2e4d", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639904403, "uuid": "d96635fe-c437-48c2-89e8-24c3b761fca1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904403, "uuid": "be449965-4dd9-46c9-8263-dd5340b47cf3", "value": "phantom.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084723ce-6066-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639875188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639875188, "uuid": "676b2173-ffa2-409a-87a4-26f1d5ed9d42", "comment": "Malware payload (RedLineStealer)", "value": "169f98d75d6afa0229fb4d556b73e46a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639875188, "uuid": "6386b225-73fd-4ea9-8cdf-fc98c2c9ce71", "comment": "Malware payload (RedLineStealer)", "value": "f7a6f3e70fbbdac903eb05428b9f48179fd41a2aa6a04f6915697d9f6582a1de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639875188, "uuid": "dcc7b6bd-f1dc-4000-b720-b0254f9cc608", "comment": "Malware payload (RedLineStealer)", "value": "844ed1d0a800580d63a4ae8db0e580b0965a2608", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639875188, "uuid": "4fa411cd-f7fd-4955-8803-2ab3850a3642", "comment": "Malware payload (RedLineStealer)", "value": "72f70587b7628ecc6fe1c858cf0537462d879ba2c7b11884df7cfd44bda1641fa7c4e9d3f673c66e7fe1ae0f95324528", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639875188, "uuid": "e6b2130c-53bd-42ef-a113-49cd1dd24ee5", "value": "T1FD54F1313AFCC472F163CA354870DAA35F7AE522596151472B28276E5E70ECC4EEA31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639875188, "uuid": "7db30a04-95ba-46e9-82de-e41fe91ef788", "value": "254f2d7d316c651aeb3e2ff6fd4504f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639875188, "uuid": "87cb7114-2db6-4445-9cd3-7c449885efa3", "value": "6144:76iULy1zceqnDcPpTd9q4/6++VGz59TrfxhlsihJoLkuzbgwuaB:eAzGDoBdVS++uDTrxP/unnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639875188, "uuid": "434efea3-9554-496d-9170-deadd8823f3c", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639875188, "uuid": "5e530341-f37f-4692-a3f4-5e5cdcd068db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639875188, "uuid": "9020a78e-bf85-4e10-8b67-d59cd32c62f6", "value": "169f98d75d6afa0229fb4d556b73e46a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e160f52-60aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639904403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "be79700f-5240-4c74-ab6e-cc95488e0550", "comment": "Malware payload (Mirai)", "value": "44d8d977d1e166d5a0bf4aa95f2295f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "bc593228-36b6-4709-9ffe-128861d1b165", "comment": "Malware payload (Mirai)", "value": "f848fd5716406432ff14fd3059a290fde4e72f62de87871d68b5e5a8bf300dfe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "0bebcb53-7a65-41c4-908c-9190a552b01f", "comment": "Malware payload (Mirai)", "value": "a2155a2be37b809cb3acac465673b831d9d2be6c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639904403, "uuid": "888e8379-e25b-4b6b-9643-1a7c748b915f", "comment": "Malware payload (Mirai)", "value": "c688a3cbbea9bab0f10f0fecc966d1be5838a834e04a7c7780f3dde76b4c43495a52881c864bb4a5bc60624fe8412850", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904403, "uuid": "a70f6ece-b38a-457e-a0c5-b0a5c388344a", "value": "T177C2C07DE8A4BD46CDED08388CDE13B50D9D76C2B68E4F5D93261DC4AF2118B3C9A464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904403, "uuid": "59dd78c3-0506-4330-b69d-2aa330a90376", "value": "384:PmWuv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftw7:P7ddenS3j6Koolozxfk5JmsEzrtt1W7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639904403, "uuid": "f45a91f2-7300-4cd7-ad0b-ed407c58da5e", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639904403, "uuid": "6a54d98a-e8e2-493a-8362-b84f0d59102f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639904403, "uuid": "9d71c9a3-a4e3-40b2-a0f9-43845b44c3f9", "value": "phantom.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf3662a-60d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639924103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924103, "uuid": "b1e8103a-eaf9-4a11-b8ba-49d1362984b8", "comment": "Malware payload (Mirai)", "value": "243440272a14191884db395df50a61b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924103, "uuid": "e65473f1-d1bb-4d27-9a4e-0d904efd3413", "comment": "Malware payload (Mirai)", "value": "f885cb392444c6c693849685d1dcac5a276555c3c98723cc6c4377f1d9d75a8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924103, "uuid": "55ea2e93-2d8e-41f4-8517-531e1c4f79b3", "comment": "Malware payload (Mirai)", "value": "91109ee6042c2e57851f42d39350e6466f38d6ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639924103, "uuid": "b28e65b0-be60-41e5-aeb3-2d7c18cfee7f", "comment": "Malware payload (Mirai)", "value": "d06dbb715b8eface22e227f2df542ac27c77fc9a69f4772f474cfaf105fc39a600f6a36c0ec499730325855e5748cfbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924103, "uuid": "162d3c0d-40d6-4f4a-9f5e-9274755d9415", "value": "T192B31845F8408727C3D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924103, "uuid": "c6b68127-1ab8-434a-ae79-4860433e2628", "value": "3072:MSY+46m1qOzss9FPPKNy+AmkZrQAhPDCXFke:06mgOzJ9FPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639924103, "uuid": "854d6939-b5ae-48b7-80f3-e6d9992e44eb", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639924103, "uuid": "99799b95-f6e5-45ad-ba91-4543f63d22c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639924103, "uuid": "f2f5c856-7125-4bd3-b78a-18353ffb396c", "value": "243440272a14191884db395df50a61b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88f48b0-60db-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639925735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639925735, "uuid": "a8d34d88-ace3-43e4-8fa6-e562d37a994c", "comment": "Malware payload (Amadey)", "value": "a82516c96211f55ab91fd9da89abb5c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639925735, "uuid": "dba35ae5-b80a-4076-aae6-059567e01858", "comment": "Malware payload (Amadey)", "value": "fa9188debb5e0af03fe51e9af74f6e0e76f8eb2395dc64fab0a31cf082f4d371", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639925735, "uuid": "d9587f41-0278-4ece-84a6-e068d2590566", "comment": "Malware payload (Amadey)", "value": "dc2faabbb5363cafb4e99888cad8516bc1a9e680", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639925735, "uuid": "70775511-efba-49f9-ad65-fbd6330bd396", "comment": "Malware payload (Amadey)", "value": "4055e6cf2aad2860ea0ea1d0e383a24ce770f067345a8be220eb7fa753fe9bffc0339d246f74ebc357367a75c935494e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639925735, "uuid": "91b1407a-0352-4e5e-b7b4-dfc940db4d5d", "value": "T155549E00A7A0D435F0B716F41979D3A96A3FBDE1AB2191CF22D527EA5A356E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639925735, "uuid": "89a77b65-7470-49fd-a4db-15827e89a4a5", "value": "5f124a733ee23e7a763027f872397aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639925735, "uuid": "a20f77fb-cbd6-4845-9d77-96c7ddd4882c", "value": "6144:bugdxTOd2RMz4w100aVjFoZQDhEAt/vh:bfrMz4CVaJF3tEAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639925735, "uuid": "eb5515b4-9aa1-4fe0-a589-46db0db236f7", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639925735, "uuid": "7b56772a-55eb-41c8-b460-25381e5ceb55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639925735, "uuid": "0db86e32-e7d3-4692-9c80-ad2c74df3a3c", "value": "a82516c96211f55ab91fd9da89abb5c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f133d687-60d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639923682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923682, "uuid": "5e45b7a4-5b90-42d6-9c9f-008f58f71e64", "comment": "Malware payload (Mirai)", "value": "f946878224464f4bb3f2f636cb12861c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923682, "uuid": "a2cdf9a0-bdb7-44af-8425-e1be233bfdfe", "comment": "Malware payload (Mirai)", "value": "fc1dcf5e165f865ae5a23266a4c39be1a398ead843ebe53731b11331958924e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923682, "uuid": "664aa273-dfef-4b80-bc7a-43ca9d22ec26", "comment": "Malware payload (Mirai)", "value": "d7f8b7d9b9ecc1c214c3383ade13c668da83f2da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639923682, "uuid": "edbbedee-961f-4360-810d-9244fefe94f8", "comment": "Malware payload (Mirai)", "value": "e6a38f1587f47e8463dd107b63e42b077da1b028d581ce18b75b6f4f7059a29bc5d7e34daee18e64c644876e31b93f3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923682, "uuid": "7ed696f9-7562-4740-984e-dada22ed779d", "value": "T1F5A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923682, "uuid": "9309557e-caf7-4eb1-8d3b-bb60f5b33250", "value": "3072:VSx+i6mqaObhNInPNKV+qKmZuqQ4DPwXXtse:y6mRObnInP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639923682, "uuid": "069bfb88-b04e-461b-8d0a-9b96b902759b", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639923682, "uuid": "cdb30a68-1acf-463f-9616-5e747907beda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639923682, "uuid": "731eae7e-0114-4ebd-bf0c-c3f24d3ee1dc", "value": "f946878224464f4bb3f2f636cb12861c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }