{ "Event": { "published": true, "date": "2021-08-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-27", "timestamp": 1630108982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e6007fa8-7d6c-4fe9-b751-7bcf9b99a774", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3cdae3-06f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630040843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040843, "uuid": "09cbd04f-ab76-4909-a100-1f61aebac570", "comment": "Malware payload (Mirai)", "value": "5b72991619b8c65b86ab8dbf87d1e579", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040843, "uuid": "348ed6ec-d004-43cc-b224-dd86ceee81d1", "comment": "Malware payload (Mirai)", "value": "0018e361be72a44b7b38bbecfede8d571418e56d4d62a8e186991bef322a0c16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040843, "uuid": "a36c682d-860f-42f7-a20d-c71bc7d43853", "comment": "Malware payload (Mirai)", "value": "854ebd69d8337f08260be30795dbb3e8d8b90107", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040843, "uuid": "15d29c99-efe8-4f40-aa14-c12f5d680daa", "comment": "Malware payload (Mirai)", "value": "ad5402d74c111fee7838cd365422c5416bd1857084e7641b28510d35b401f81dcf50c308508c99aa5e32a1db97d294b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040843, "uuid": "28f1b50b-d091-486f-a715-a72a32aaa85b", "value": "T1C8630681B8819913C5D4237AFA6E01CD336623E9E2DE721ACD215F2177C9D2F0DB7692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040843, "uuid": "6cc2e8a5-ab31-45de-add8-0086fff08524", "value": "1536:OENeRByflO9esxOuoCcbQ5QxA8XetrkVJ:OEGByflO9esx5Qxa9kVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040843, "uuid": "5fbe188f-ec48-4f62-bf79-91a32fecccf6", "value": 68112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040843, "uuid": "98384256-9529-4810-8c74-fe674f79d582", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040843, "uuid": "4d1a509a-028c-4048-ad87-e63ee466eeb0", "value": "5b72991619b8c65b86ab8dbf87d1e579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea567803-072c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630065003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065003, "uuid": "7e8e3cce-0b3b-43e0-9f94-81bde9936d30", "comment": "Malware payload (Mirai)", "value": "b28607b8428e5ff1b5040e72e42b0aa0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065003, "uuid": "9564d32b-fc68-47d4-a5ec-b3b105c2836e", "comment": "Malware payload (Mirai)", "value": "0032c45459ac9c321616fe912ac4659b87748eebf4723294ccfa9a360772350c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065003, "uuid": "86795268-dea4-41c4-92b1-16aab0099bde", "comment": "Malware payload (Mirai)", "value": "42e73e776f50ee2c3a9759da288be2654d807495", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065003, "uuid": "dbb9110b-4ecd-42a9-ad2a-728746c1dfdb", "comment": "Malware payload (Mirai)", "value": "bca7ed48344ab858b529458b7c2b0466da24db1643aef8dbfe25eb06f838ed477be86fa71cfc64603b03ae156f97d44a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065003, "uuid": "7efa0b6f-c529-49c4-ac93-c950362341db", "value": "T177F25A886553E5F9FC1602B1647AA7315FB2E03A106AFC8BC76DE936DD23901E60739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065003, "uuid": "904fb5dc-8b8b-4f35-beda-d5ae7e1e06fa", "value": "768:X8X0Y2WfimspB778iZr/lV16/mkQNPTEuFlxc+Xn:XO0Y2YuJ78I/lDDkQN4uDxc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630065003, "uuid": "9d35526d-824d-4664-8781-1f6ca4a75b40", "value": 36448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630065003, "uuid": "9ab5ff3b-902d-4b93-a2c4-7ea4df9585f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065003, "uuid": "14de3bee-45c9-4824-bfc7-f9a5a09136e5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3553f9-074b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630077973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077973, "uuid": "4933a054-8440-46fb-8e7d-febaec233df9", "comment": "Malware payload (Mirai)", "value": "5ce48efe439a1e77c3e2c6488cb843b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077973, "uuid": "04816087-e1f5-4442-a4bb-ab98a39b94c1", "comment": "Malware payload (Mirai)", "value": "013b7179963fd888556afec29596c0e166ee1e6a7d8478fd77310b72f56e5b48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077973, "uuid": "db7085ea-9bbf-4e5f-a8fc-f5a9ab8ccb23", "comment": "Malware payload (Mirai)", "value": "0f9a167f2d86606c0d8e3d334cd2b93cd0f520cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077973, "uuid": "6156a04e-7780-4439-a28e-b06790122f58", "comment": "Malware payload (Mirai)", "value": "fcafabdb8ea945f89277e50e4533164ff87f29013d47dde1e44f67c7a3f1acf1e1bc5fc12151b3b1f943826916570b74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077973, "uuid": "826de00a-44cd-411a-9ad0-85953126a233", "value": "T107537EB9E12EEF64D44146746D198E348B13A18093733DFAD690CAA6804BDADF809FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077973, "uuid": "188205c9-8039-44d6-bd23-9ddfa7cd7b04", "value": "1536:mWaJj1y4BFBWwtJ+TJuCxIfs3zvD7/qYQmiBCH:mWYc4BfW/5yf+zrPQmiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077973, "uuid": "84caee65-9f2e-483d-9df5-524f161d0ed9", "value": 64408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077973, "uuid": "859ee87b-ed49-4ab5-bc93-1cadbffa3ee9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077973, "uuid": "d4783a90-9e32-4a6e-8b10-bb0014de7c5b", "value": "5ce48efe439a1e77c3e2c6488cb843b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b997c3d-06f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630039718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630039718, "uuid": "9e452c63-11dd-4942-ad3a-a4174f358d40", "comment": "Malware payload (Formbook)", "value": "d47bebcb61de18bf3da40c659305bb72", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630039718, "uuid": "83e1b94b-9807-44d7-b2ca-8a0f6f0b0f29", "comment": "Malware payload (Formbook)", "value": "054ad10b9ac73036510a637ab415ccadbdecb9ac747ceded86d597c197a6d886", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630039718, "uuid": "bc6bac23-7628-4d33-93c3-3df20dfe64b5", "comment": "Malware payload (Formbook)", "value": "34d2308fe366de7e89e7963d36ac10b278233db8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630039718, "uuid": "48190249-46d0-45da-9e18-900ac76d80ad", "comment": "Malware payload (Formbook)", "value": "f73d00c81319fd2edb28137c483c2df7985d11d86103b22d59154a100629864bd3cf02bb2a0ae6e10ab3cc49ee040db1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630039718, "uuid": "4beec99d-fa91-42b7-86cf-739218285fd0", "value": "T1E8D4236BED16574DBCC2E35B87C7FA4C2AB93A4851AFBAEC11720904CF1418E38895D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630039718, "uuid": "ac996bbc-fde0-47ca-980a-00216e4ade46", "value": "12288:CMLz2ktf8P5EfNiASH+SrnkiYYN8Pd4VH4nTql+cVjSZXT2:skNCEfNsvnmYyO+0+cMZj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630039718, "uuid": "3f01f12f-30e3-47de-8ef0-6322f41d5398", "value": 633129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630039718, "uuid": "4cd20364-76d0-4b10-bd0f-093af1c07e8e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630039718, "uuid": "8fb10330-4ddf-436e-a23b-7de69f1fedf6", "value": "00002337526082021.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2277d286-06f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630040616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040616, "uuid": "05eb930f-9603-4b00-b193-cde7ecd21b0a", "comment": "Malware payload (AsyncRAT)", "value": "76ea12b59b1fbf46676524a21c88ffc7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040616, "uuid": "89b400a6-f69a-4e39-bf3c-6af8827b34fd", "comment": "Malware payload (AsyncRAT)", "value": "0633bc4885fc8eb9c2f8bcd8110bff69e47444e68f4beb6757b23b2a2d59d3f7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040616, "uuid": "314f03d5-a5b4-467b-bcc3-d1e940163373", "comment": "Malware payload (AsyncRAT)", "value": "25685008ec1e45a00d5fdf1a343169a9efd71cbc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040616, "uuid": "b5c5cdc4-31c6-4870-9c7f-7babdaf68f88", "comment": "Malware payload (AsyncRAT)", "value": "89adb4ed0bbd3d00bdde6b342dd05be8c6500263b9797f342c102b7131f43cf3d46dea73c5079648c72dc4481926b65b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040616, "uuid": "2fb8ccf3-d3ef-4a0b-b3f3-87560a974572", "value": "T1E524BF51B7C0D373E2B40730C9EB86693B236F57AE422A9731D433BD68F5311A426A79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040616, "uuid": "6e34adf8-e95f-4fbc-aabf-994e3e519446", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040616, "uuid": "a4266566-790b-4b67-8927-d4a2bdfcf587", "value": "3072:kF9LlxThxUTAzHiGox/C0wdvMqLD2T/ZS50M5anf3/L/5p1CudpSjnIiYj:E9VxdLjosFUqLD27etav/hXSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040616, "uuid": "a0d3dddf-07cb-419e-b0e8-a8c44c54b86f", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040616, "uuid": "0bea68f2-35ae-43af-a77e-b820fe05f7d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040616, "uuid": "3490c1c2-701b-4254-9b16-7151546b1cbf", "value": "76ea12b59b1fbf46676524a21c88ffc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafb1dd8-0770-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094210, "uuid": "43d9528d-0c88-43b6-a71d-5e48815d7ad4", "comment": "Malware payload (Mirai)", "value": "6d4a7260719f7ef06a67bdd4e384ee90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094210, "uuid": "34af91c4-1686-4943-8976-36829fd4d641", "comment": "Malware payload (Mirai)", "value": "068b1d9ab570545a01738ad6a1e2cd5147c5d8b6067d4b57d7e95f974779b865", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094210, "uuid": "ae741da7-ff4f-4964-942c-4bfb6c950d29", "comment": "Malware payload (Mirai)", "value": "b5e89edc1fc8a94c83c8949a95c14bf70aaa5f80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094210, "uuid": "8a667cfe-69a4-4584-9391-91b8b9e94738", "comment": "Malware payload (Mirai)", "value": "de098b23cdcb601f9682e5ea8376218019680ae9f11fd23af6e1c4c4b32309b6b5fc84c95305f4f300e693b935bfc2fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094210, "uuid": "d90b8df0-4b46-4e38-81b9-4dd61bc8403f", "value": "T183C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094210, "uuid": "e59b8138-d7c4-40f8-b6cb-3555019701aa", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP0L7ymm/QMurB1nKGNb:SMQplV0amm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094210, "uuid": "e4bf5e38-5904-41ca-ba05-5c27eecb9207", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094210, "uuid": "111ab410-3658-40be-8682-01b3535ef77f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094210, "uuid": "01e46f82-dd47-4964-a125-287b98d0da1d", "value": "6d4a7260719f7ef06a67bdd4e384ee90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d604e7b-070f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630052204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052204, "uuid": "3b8afc8c-8b62-4050-af24-9cc964d16c5b", "comment": "Malware payload (GuLoader)", "value": "33363faf8e6cd5a32b58dca2779203d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052204, "uuid": "f2218b0b-a2f3-471c-9c7f-d8a44849b12b", "comment": "Malware payload (GuLoader)", "value": "07e27ffdd2a9d7dcefb638ec18e3b47131a1887678b58466110d0facc6edd085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052204, "uuid": "6717b187-273a-4772-a611-51762262609d", "comment": "Malware payload (GuLoader)", "value": "f4fa8db47033c888af7a7757c3aab434df10d346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052204, "uuid": "d08d3bab-c327-48bb-a9a4-ab775d22a705", "comment": "Malware payload (GuLoader)", "value": "4a5a60ac11d30d7596c7e554e6fef26a700f500f08eaa697e6ebd1f62459d32766ee6b6ea1fbe08b2b873a511e648434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052204, "uuid": "a41d0e48-7ff7-420f-a459-dae81d03294a", "value": "T1BDA33823674304DDF72E09B2151179E95D1BEC8023D63F8B9209BB1528BA643E8F5EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052204, "uuid": "98021b0a-c73a-489a-b243-843d529b15d5", "value": "4419916ecb458ad734fae4d731539a36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052204, "uuid": "965e6466-4142-4b22-9e0a-5f79b08d8c28", "value": "1536:t1nLPXb4M7mLQMnCzqzYNpnMFMo0lF5D:tqM7mLQxGsNFEP0lF5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052204, "uuid": "eefc6e18-704b-4d9f-bc18-38642accb001", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052204, "uuid": "23ad2ffa-3ab8-49da-9a83-c96d2b323fb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052204, "uuid": "e3bdb420-c5be-4add-90ee-e7aa0d6f8241", "value": "Swift_payment.pdf.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ac9e01-0771-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094461, "uuid": "2bc4e1fd-7b09-42c7-abf7-a8e7ec7edff7", "comment": "Malware payload (Mirai)", "value": "f4a6b73b81f7bfc5d6be09e1ff0a6765", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094461, "uuid": "c0449a06-ce6d-404b-b9fc-84e23bfdaba5", "comment": "Malware payload (Mirai)", "value": "08306eb3142ce6527936d759a7d887482cfaf9667b0790a3517e3be831e2fc46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094461, "uuid": "04135190-5e54-41da-953a-3dad1f25f71d", "comment": "Malware payload (Mirai)", "value": "7094585f2330c23063a57071a1675ae6c94ebc29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094461, "uuid": "b2b20abe-62d7-46cd-9203-327b00e8bafc", "comment": "Malware payload (Mirai)", "value": "81cce8de90e4f8939d41f1e126cb455758b4bd3fa83387b3dc927d48c63ef739a465bd3b37fc3c12668791a3c78a8a03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094461, "uuid": "70e553d4-62ee-44c3-83c3-78572a0c1d99", "value": "T1CEB32A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094461, "uuid": "06724302-436b-4d77-a3d2-f49db46161a5", "value": "3072:pC/4rdZHsXsZwwR9XNk5mm/QcuLmHniPNb:pCwrvHwsZwY9XOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094461, "uuid": "2b8c44a0-5e78-4137-9642-22b84f2b8281", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094461, "uuid": "ecefbfc5-6bb4-4e60-be58-cb9cf0ea83aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094461, "uuid": "f9e73dcf-a84a-481f-b94c-b59164c32c87", "value": "f4a6b73b81f7bfc5d6be09e1ff0a6765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4945ee9c-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1630053136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053136, "uuid": "dfc4d211-cce7-485f-8efd-49b2a88fa082", "comment": "Malware payload (CryptBot)", "value": "b9b6e5ebbe3898932fc9e4542d8f3d68", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053136, "uuid": "c0abb41a-1122-4b40-b39a-74204140b5de", "comment": "Malware payload (CryptBot)", "value": "0997ed7bac99475d1b76eda90aa27685ab2313be5f822a64fe413fc4492d4518", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053136, "uuid": "a5372b3e-b89f-48ae-973a-e70b455fc5a3", "comment": "Malware payload (CryptBot)", "value": "c6fe49632f812243426ea67f5feb500f94e3c0ae", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053136, "uuid": "5cfa500b-03f5-43c6-9663-48e0ce718691", "comment": "Malware payload (CryptBot)", "value": "e0e281f4cfb2d5b54effe1eecd8ed85018b7da63d3c19fd8b6371b10104e7d323ae71e0902c18c895d869be970e2adf2", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053136, "uuid": "fdf05517-16ed-46c6-bab2-b099d0e73c6e", "value": "T1B4E5335709A11584EA452A3A455EE4DFF34646E387FA91354EEF0E932D0B3BF0FA1E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053136, "uuid": "0e5d7c01-da29-4f1c-866c-724029dc8157", "value": "f8d9e6f58bdad8d3f277d01c805576b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053136, "uuid": "230c209d-bfc5-49fb-92f0-49aa5c85836e", "value": "49152:wkLr6NO6eLrSTW0A19IlTe5T99si/dCXkKWQ8lfeFjsr39KTlROs3C:XLsO6hPWq5A9TqyQ2feFjsrUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053136, "uuid": "2ce414fd-da68-4828-8cd6-c3c46bb58af2", "value": 3288064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053136, "uuid": "c228229f-68fa-491a-a622-05af0c2a613d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053136, "uuid": "283e858c-d92c-4cbf-9019-6fc67916dd5a", "value": "b9b6e5ebbe3898932fc9e4542d8f3d68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddca014-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630050835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050835, "uuid": "394bcc1c-3309-4120-8903-3c6e5610f556", "comment": "Malware payload", "value": "ce82b0b90961b9e7d107811c9f64e335", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050835, "uuid": "7fbd004f-cdf1-4fa6-8724-5dd3cb43bc53", "comment": "Malware payload", "value": "0ae9e4b7bbd8e780acf2092301c4b58747dcc2945deb238e0b347d5e52bd6721", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050835, "uuid": "d8820fe7-6c8b-4203-9ffa-a86ddcc2e28f", "comment": "Malware payload", "value": "6cdc74f5640b89727e5a86fb6a677bf252e482ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050835, "uuid": "7abf8789-1ab2-4da3-969b-7c808b1b51fd", "comment": "Malware payload", "value": "0f5f28330dea78ca8d1d3215f0905afaa27b9986261ed3300b8322c7b2a0ebcf678073897af58534793dcf0b3064a06f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050835, "uuid": "d8aa54ba-a381-42ba-aec8-9728027bb9d9", "value": "T1DBF0D34CCB08086E405DA4272C4C8164FD7F90B49A8CF19EC516F9C81065D8C11FD9ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050835, "uuid": "69513419-c820-4ea5-a3d2-834d7b36ccf7", "value": "12:58/VBHL6JoZMgDzPYybtmPiHH6fLGqFHjqCE6UTVWuQlZQTazIkgkUQfYJSqH:5yVJWJitYyRGDqj6UTVWJsaUk15Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050835, "uuid": "b4025f03-e1ce-438d-8b23-b535599bf878", "value": 638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050835, "uuid": "90492346-c84e-4484-86b8-de126405bf03", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050835, "uuid": "e2986152-6c0c-4c83-9107-256947823c22", "value": "UPS-Delivery-Details-001848480.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651d1714-074a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630077664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077664, "uuid": "11dc1b0f-c7f6-49b8-ac21-4664b4582645", "comment": "Malware payload (Gafgyt)", "value": "82574273475d01fd1fa7f0206da12ad8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077664, "uuid": "e857b9cf-41e8-4ae9-8515-1504c50ce897", "comment": "Malware payload (Gafgyt)", "value": "0b60fdaa5832b4989935d2ee375babf2e2f303173e9783d6259752d0491cc02e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077664, "uuid": "b6dcef7b-24e9-43db-9466-e6c755ac37f1", "comment": "Malware payload (Gafgyt)", "value": "5e0987b5ca7131b877aaffe793d529006ff71f12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077664, "uuid": "cd30af34-16f5-44fc-86ba-7109cde80f15", "comment": "Malware payload (Gafgyt)", "value": "e70d8c6adf9240cc4ecef11794f9fd88ab70ae5196a348cd180027be9507d49f3c1d1db19e7008087e2347bc5e181a24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077664, "uuid": "46c7f30a-2e4f-4159-8e03-ab36d495e743", "value": "T19004826ABBA19EB7D80FCE3306E94502108CD58A42D96FAFB6B0C55CE74B94F05E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077664, "uuid": "2757521c-cbae-4098-9e1c-6978ae8cf954", "value": "3072:s7Ep85+78N4DzQ5hUFUH5oE1j2qm8V1FhqsyiWJGq:s7Ep8+8N4HQ5hUymqm8V1FhqsHWJGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077664, "uuid": "60be0a2e-e0f4-487c-bc06-a79faab137bc", "value": 188298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077664, "uuid": "4d7c6c0a-c353-4f86-88c3-1a958b327f87", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077664, "uuid": "2308795d-b002-4fb2-b457-57a806c9cd21", "value": "82574273475d01fd1fa7f0206da12ad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c38fa8-072a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630063834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063834, "uuid": "9dfcdf8c-342d-4c35-9cba-17be317b41dd", "comment": "Malware payload", "value": "28bb67ced0a22bc15675cf8d971f2330", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063834, "uuid": "b8c7499d-5ff8-4586-979a-045b73e6afef", "comment": "Malware payload", "value": "0c22cc7844309d8d8b668bca34e1c834cfc046f1ef855960c0275252a3d9f78d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063834, "uuid": "0ab41ed1-e0c9-46bc-8ec8-0817356d2aa3", "comment": "Malware payload", "value": "f63925f4b3eec78cb86342775c6ce066630b05cc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063834, "uuid": "fa27dc55-c800-4ede-ba82-c12361135e09", "comment": "Malware payload", "value": "d4a613e0ea858058c2e1fc78d9add6a8a58e211b02240828ee192f4d38a6b2df278345c6388989eb12f3858b51391734", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063834, "uuid": "fef5dc18-4a2b-4517-b057-649b0f91f38a", "value": "T14AF5F191B7EB2517F9F3CF35ABB582590A2ABC915A22D71E0118761C0C7BBC08E50FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063834, "uuid": "f4c808b8-fdb5-4fb2-9d5c-20077a77d476", "value": "98304:cGvS27tBjIE2s5ksv1GoYGV7Iuswgp9vcphaSU:caXIWA4sf9vvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630063834, "uuid": "40ac141b-5a44-4fbe-aabd-64662f8033cd", "value": 3451633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630063834, "uuid": "bec6fe34-5f6c-4ae1-9ebf-8eb31aa2f964", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063834, "uuid": "d0cec2b9-eaa1-4857-a945-a36ae6a51eb6", "value": "esp.console.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4144f0e-070a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1630050309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050309, "uuid": "1cca127a-b48a-40f7-89da-63d682735254", "comment": "Malware payload (Dridex)", "value": "523889c41d9c65281f118d3f4c26c708", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050309, "uuid": "51aca17a-1953-4f98-9bca-7592fb36c6c2", "comment": "Malware payload (Dridex)", "value": "0ccc1ea2dc07c5d01ffbcdf63a94f5bf52fac32ab3d9075204cd07b2d0455126", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050309, "uuid": "3f66bcf1-a1ae-423b-bdeb-50338a37da8f", "comment": "Malware payload (Dridex)", "value": "f33305576a93f1d66896bd2a1a3b0d3eb85d9a40", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050309, "uuid": "909340b9-0741-4453-8bb2-424e73e571e5", "comment": "Malware payload (Dridex)", "value": "26c14356cdc2ce91595c40848c15148e6c961189bd7061485f20eb3e16f0d65b8e4d33fb1bdb2b576ad67d6386d7895b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050309, "uuid": "08e95ca5-e91e-465a-b184-7f1c3b88aadb", "value": "T18195F1467AB84A23D4AE0634EC369B35A372BF0599F4950A7790390F3975391F802F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050309, "uuid": "2e0c4022-0639-495c-84aa-74f2c0b6163e", "value": "3816e024f07550fcb35f43cc373de23a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050309, "uuid": "a06da687-7981-406a-adb1-016e5061f81b", "value": "6144:3K6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTR+XdUPe3KVaHEP:3M+ZdkmHubeaCo6wUd+eFEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050309, "uuid": "475ca341-4ff0-4d6c-8ab1-fcaaee281329", "value": 1929216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050309, "uuid": "4066adf3-9236-46b5-8d95-71afd2d5c6ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050309, "uuid": "aae5acc1-82f0-476f-ba77-da3a7c920349", "value": "523889c41d9c65281f118d3f4c26c708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765e020b-0710-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630052782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052782, "uuid": "9501e432-4ce8-40ba-9306-00129fccf23c", "comment": "Malware payload (RedLineStealer)", "value": "9606cb48838e6225282432f0fe3751cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052782, "uuid": "0a31a06c-a0c3-4080-9c78-bccedefe2655", "comment": "Malware payload (RedLineStealer)", "value": "0d38dd37d7333f4608ea9cddbf6105069caffdbac526da3fa572d5b13374bc9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052782, "uuid": "a0ca0cdb-71b7-442a-b7e1-3b5fa4bff5c4", "comment": "Malware payload (RedLineStealer)", "value": "3e12ddb205747cfe2e644ccdd4bb3f392f3ddcb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052782, "uuid": "dda80320-c7fa-4092-a146-3c3977629194", "comment": "Malware payload (RedLineStealer)", "value": "ea2c53d7beeb8dd310f8e9021caadb88e9f38fedeb27c4e3b88198ecfe33e7e2565dc42314826fea0e547a08e556a32a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052782, "uuid": "4355e0f1-bbbe-489d-bb61-12bcac044852", "value": "T15EC5125B2300C9B8C7E099FB2DF8CE89334DE9B248E8C5949B47D5DF65D26AC3D12609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052782, "uuid": "6520c9fe-dce2-4499-9ac6-cc9a681cb2a1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052782, "uuid": "404c6039-fb99-4c6e-b03f-15ed01593fed", "value": "49152:ENELN5cDhrTq4bWiDXI2Y8A7qn58yw3ItQs/eQ5PRuD+3AjUiCabtBBFeWY2AVn8:ENE5aDhru4bXYDqn58JYtX/dgD++UiCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052782, "uuid": "7d7e714f-539e-4b7a-8a94-bee7b636ae0a", "value": 2577864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052782, "uuid": "ae851868-7ba6-4339-a6f5-04b530a384ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052782, "uuid": "31730732-b986-4167-8517-7c28ab782c22", "value": "9606cb48838e6225282432f0fe3751cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41776af6-0716-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630055271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055271, "uuid": "f82f24e6-0e71-4f12-9ef5-180b7b1b5db5", "comment": "Malware payload (AgentTesla)", "value": "6646213e564d27b399891f8b4d153852", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055271, "uuid": "59dc09b3-0ef0-44fb-b6e5-2e2f4be80826", "comment": "Malware payload (AgentTesla)", "value": "0f242e89dd3f1685ace979a248300f7f414932b8a2a75af88585c427f2758c10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055271, "uuid": "c4c6d4d6-5aec-4221-8892-c9b4408e7535", "comment": "Malware payload (AgentTesla)", "value": "c6d9757c53c4d25d2bdf80111b34c1d2fc66d4c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055271, "uuid": "b526cab6-0701-462b-8db3-3454a5eadf6b", "comment": "Malware payload (AgentTesla)", "value": "1e36541027ab7a11846efb6da0b46c33564c9b05f24cdd74d8efdfe85a863782bd841890cac6720dd0f3ee1905f6e645", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055271, "uuid": "02da58f2-be4e-4493-9312-b261d1dca57d", "value": "T1E7242A166715D550CB6F417FC01A820831F1DB07972AD78F5AA6D8FA2F812CEF92B8E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055271, "uuid": "d049a885-676d-4533-9c2a-d1eafb1c616a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055271, "uuid": "08953826-6be4-4bda-a2c0-f31e614795b7", "value": "3072:8GWg7fejSs+XV9sEag7UsTcbVRlIdsXsp98lhnfTvY8LrLMN1r0haLoh+i6tUqWD:8N+XV1nU1VjIwsMlN7+14hRnmUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630055271, "uuid": "6306768b-82c8-454d-b93a-90d2574da74d", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630055271, "uuid": "dc8536f5-ff00-4eea-abc7-b097bcbe5d80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055271, "uuid": "2d965000-0a69-4570-b9f0-fc784047b51e", "value": "6646213e564d27b399891f8b4d153852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fea4df2-0723-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630060771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060771, "uuid": "7a0f2080-a338-43a5-a870-27dfd8a55f32", "comment": "Malware payload (QuasarRAT)", "value": "01e4b34085e840c3c2cebf1e0db0aa29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060771, "uuid": "3f3be25f-91c2-4908-b3ad-b12410a45f14", "comment": "Malware payload (QuasarRAT)", "value": "1082af11e2e9949798b1752d511d0c134ccc7bb54147b5c83a5d0edddd236e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060771, "uuid": "b682fa82-a2bf-4fd6-a593-57bb7bada4b8", "comment": "Malware payload (QuasarRAT)", "value": "2c1bcfac805bd6bd400389b902029eb80865f518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060771, "uuid": "2c9da6c5-28c4-4746-b009-87761e2e544d", "comment": "Malware payload (QuasarRAT)", "value": "e4c8d2498c863010a0b147cd474e10aaa67278ec4c168e9dacf6774c36f74fc752463d395b5e0430939ae96762742d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060771, "uuid": "c8163eea-83a3-4f68-bce9-c7f00ddefee3", "value": "T12484121A5CC64C99E6D4B7F461F1865B293A7D5204248389EDF8FF2C9972113ECC24BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060771, "uuid": "985198cc-40b4-4752-b181-8aff5aea83f6", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060771, "uuid": "f7b9cb99-67a4-4794-8f5a-2281bf697faa", "value": "6144:l4XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0PzQ:eXe9PPlowWX0t6mOQwg1Qd15CcYk0Weg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630060771, "uuid": "ea25ce16-77c9-4619-8026-5d1b26b42a6e", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630060771, "uuid": "8bf2e45c-de1a-4186-bfe9-3eb55d7774af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060771, "uuid": "3a069d7b-a234-446c-9283-c83fddf9b02c", "value": "NEW980009000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2455c52-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630076049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076049, "uuid": "da7ac666-d85a-46e2-a0c7-220d873c4431", "comment": "Malware payload (AgentTesla)", "value": "7af863f7fb9584f56d37a52a56c9f0c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076049, "uuid": "948ab6b7-281c-4f84-92cd-be5d37e1a508", "comment": "Malware payload (AgentTesla)", "value": "1121c94650a0d43b96ae946168f466220208c3f017a0895456b41da2f8de73eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076049, "uuid": "147e63d1-cf7b-446a-924b-5eee9902dae8", "comment": "Malware payload (AgentTesla)", "value": "179e51b334ec8fb5134591609d793ae3d7e45330", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076049, "uuid": "faf40d0a-c7cd-43d5-90e4-701f1150b0d7", "comment": "Malware payload (AgentTesla)", "value": "bfd8d5440beefbd5a16929052bf247a9eb1ba201b9b3e590f55c61a30af6b02772875263e134de43c0573f3659cf6b72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076049, "uuid": "c7710a3c-b6cb-48d6-a35a-feca9b5f54dd", "value": "T107055D3D29BD222BD179C7B5CBE0C837F4549DAF3111AA6464D38B6A5346E8235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076049, "uuid": "7dffbabf-80e6-4810-a4f5-2c18cb165fe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076049, "uuid": "af4e6c99-c3eb-4311-adcc-5edb7a526c00", "value": "12288:+wZOtSwJpnKxVN8Dxf22vHjkY4QA/A/xYL+CeMy72gkLhrbR:atjJAxVN8DxfzvjOjAZM8zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076049, "uuid": "cdc03bde-6868-47d9-b973-d3415a5fa0a7", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076049, "uuid": "cc1965e0-dd0e-4fca-9aad-234c61cb7d36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076049, "uuid": "11924c7c-932b-42f6-976f-ea28a649d452", "value": "7af863f7fb9584f56d37a52a56c9f0c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac35cf13-070a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630050296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050296, "uuid": "4de09eb0-d361-4d4d-9cae-1625fe288c6a", "comment": "Malware payload (RemcosRAT)", "value": "d72b1d55152d84d2e5073cbce6ec288d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050296, "uuid": "26667eb1-5b02-4b78-a111-fa229841feae", "comment": "Malware payload (RemcosRAT)", "value": "11dc18c6952c7a65ad39f039636472137bb9b668fac27ff116154d46152e3d2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050296, "uuid": "d9a39eb7-cc29-414c-8802-955c15f14359", "comment": "Malware payload (RemcosRAT)", "value": "51c0aa00242b8f29613537e94e603082aceddd28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050296, "uuid": "1bc65190-3d0e-451a-b3ea-019a24832e0d", "comment": "Malware payload (RemcosRAT)", "value": "39683edab9067dfc8e05cd5a5ee651856e356d15cbea8472043c4e48b26f338263efca72545aa0afd23f9b0c0c7a8d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050296, "uuid": "86a10748-a227-4a5a-9f3e-19191cb471ee", "value": "T1DBE47EB322C0877EC03E18749D2770952425BEA1AEB2AC4FFF987D459674BC465123EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050296, "uuid": "dc0e0b3a-9f13-4b3f-bf42-d645bfd55504", "value": "7f96272d7334ea5c5b0f297a4213e926", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050296, "uuid": "74a0b703-2030-4fc9-88d0-388ec07c314f", "value": "12288:R+i5kuKF/CFs3c7WaNipAfofysLefr8xdv:cEKF/P3c7rMAfo6s6frS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050296, "uuid": "06ea2585-835e-4dfd-b323-824e7e5de75d", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050296, "uuid": "4367b5af-80f8-42c0-812b-3f986ec743c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050296, "uuid": "d54f16c7-0110-4f52-bba5-7e9d3a6b1745", "value": "Documento de carta de porte de Dhl,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c394c1da-0758-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630083836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630083836, "uuid": "d91cda0e-c0fc-4406-87a6-2f7cd336c16c", "comment": "Malware payload", "value": "072769a3e8b70e0f24b31278c5f4c897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630083836, "uuid": "dcf9ed8c-347e-4f07-aaf1-f22e9219b93e", "comment": "Malware payload", "value": "120a50bdd5effe67ea0270aa7f938039e7a5e6a589a13e9371e381f4d1518dcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630083836, "uuid": "f299892d-1773-47ea-beb0-428b059a621a", "comment": "Malware payload", "value": "4df76b3f862bcd1c41257d34099332d242c0ed53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630083836, "uuid": "30119b5b-8374-45a7-9e85-3a46a3ca745c", "comment": "Malware payload", "value": "b02fc7a99063c9807068783e339489f00b638017810ab724abad42e72bdd4dfd9382cd1d9533b63375e6f4a57230cee2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630083836, "uuid": "96321c61-6c1c-45ee-bf6e-d34b407e29ae", "value": "T1A5F3D0168B306033F901457C6B3551ABA4798EF25635F8B3BD847C986AF1BF2C226717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630083836, "uuid": "899aa964-f6db-44ca-9c3d-0a30d4ce1479", "value": "7e4a49baed74fc5fdf2cc2a93738ac6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630083836, "uuid": "af8a1266-3030-4fb5-bb4f-865a588d571c", "value": "3072:rL4wuR3N7eK96CPeaxIPYla4K0np7lxxLh1OxZ73aTj/sJEFOTlZ:H8R9sba2YFxLqxZzgj/WE4TlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630083836, "uuid": "13458f9e-5766-45a4-9d43-068da0991bc8", "value": 161264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630083836, "uuid": "f25ba186-3199-432b-a0ed-67391f70d869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630083836, "uuid": "9267f973-83d6-485c-8851-79cd36ace61a", "value": "072769a3e8b70e0f24b31278c5f4c897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba1713d-0716-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630055261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055261, "uuid": "7a528cf3-c54a-4794-9511-413be6dbdb57", "comment": "Malware payload (AgentTesla)", "value": "a925487b5ee23d910404239193564887", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055261, "uuid": "6184ef41-513d-47e1-abdb-ec5eeca3b32e", "comment": "Malware payload (AgentTesla)", "value": "1224436a7a30ce80c8d1f4c257c3a0962376c406b04f4cfef69f3e0414bfb156", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055261, "uuid": "08a211be-9b6c-4a3e-b24f-a1d697ec67cf", "comment": "Malware payload (AgentTesla)", "value": "ec926496abb16186246e5fed00926a829048aff9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055261, "uuid": "f9060fba-11b6-4306-bb7c-75c32f49e8bb", "comment": "Malware payload (AgentTesla)", "value": "f155a10cd8c709553ee22b7e8917ff18e1ff699ad5ef88ce3aa7c7ba9f64afc37312c4fad73fe55e65a466ff943ba737", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055261, "uuid": "1a5eb9f1-4aa6-4f66-ad2a-ae473b7e8d90", "value": "T1D715B23D29FD2227D175C7A5CFE19827F0449CAF3111ADA4A8D7A76A4362E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055261, "uuid": "2378783e-88a9-44a2-a215-bab7f53d1c84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055261, "uuid": "813e184a-1b28-4d5a-9fcf-d36608b9e410", "value": "12288:Q/yBzmGpNgt7iz0oJkAvPCYk7tU4dzu8PuBWOy32pX:Q/yBzKIwoLyYk7xdiBWO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630055261, "uuid": "471b7c97-391a-49b3-88a2-93451d165211", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630055261, "uuid": "56f5d0fb-f900-43e5-acb7-7554bb8cc85b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055261, "uuid": "c7779e72-e36b-43d9-9a2b-805f53ef601e", "value": "a925487b5ee23d910404239193564887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978a5aa2-0700-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630045966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045966, "uuid": "c3741550-3410-4dca-8907-a9308f3986c4", "comment": "Malware payload (RedLineStealer)", "value": "3538c2e1dfc1a3c80ea8b7e3121fcaeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045966, "uuid": "7d7be8c5-205a-46bc-848b-85bf2c1346f0", "comment": "Malware payload (RedLineStealer)", "value": "1273c78b4f196fc982cb1e9b7abe9d2b5c4f10c5486e7a891615bb273fef419d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045966, "uuid": "75ede16b-9164-4cc3-a758-01f93f361f88", "comment": "Malware payload (RedLineStealer)", "value": "8ef32363e189cd92d096748c33eafb27d194ecc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045966, "uuid": "719f41af-64f4-4d5b-bdad-4820eb2e0fb5", "comment": "Malware payload (RedLineStealer)", "value": "f642a912ebc2481aa12408cf480c52a81333246d7e072b03c7ea25436503b72750d6c12df01a9d566100f83bebf2efbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045966, "uuid": "c4bfe205-8d44-4cce-9110-55f9b29f3c6c", "value": "T1BFB33A2563ECD62DF7BE0A766470151487F0E1CBA001FB5B8EC274DA5E337826A446E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045966, "uuid": "bc851ad5-bb29-45a2-859f-9754e87481ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045966, "uuid": "cd5cdea7-ec7e-477e-afe6-56ca6a3e5e7e", "value": "1536:axPQVbw9fIIfrAUsYl/E4gBy0/rjbuFGdxnQuyqHdpVBWOElG6eRaoigC:QUw9wIjvlKxxn3ykdpqJey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630045966, "uuid": "2f3997f7-1549-4820-a6c6-a8faaa01ecdd", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630045966, "uuid": "3c9327a5-c0a6-4fc1-8c99-43efa7ad67de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045966, "uuid": "d3f18ae3-19a0-4bc6-863b-d3082beef659", "value": "3538c2e1dfc1a3c80ea8b7e3121fcaeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3a8e88-0748-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630076740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076740, "uuid": "2a86900f-9b93-4c71-8c68-1faf7b54ac79", "comment": "Malware payload", "value": "3cb7fdbf051ead4532eb48bb9dd94204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076740, "uuid": "9a3b05bf-841a-4827-9bee-ec5d19af14ce", "comment": "Malware payload", "value": "13713a7b6d609042754fb59c1c9f3049c27c5ac8b052fd2e71f4025b8bc8e8ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076740, "uuid": "76c942e3-5f9e-4975-bcc2-5aa00b726c50", "comment": "Malware payload", "value": "8e7627cd476a58dce7985583ea36abffab18f8f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076740, "uuid": "b5099f48-ce31-4890-811f-9a4a9ecd3a37", "comment": "Malware payload", "value": "2f1a5232de8037d04e168888a9858e7f9db89123064425915aeb96acbf20e9fa2b6196cfe6175b9959db2aceede73c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076740, "uuid": "86251a4a-8195-40f7-944f-07991a1b23fe", "value": "T18D063302A9C16533C5356D325594E6B0723A3D302F354BABA3D81EEEEA311D0D739BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076740, "uuid": "d0c94d50-7bc7-4dd1-a187-edd78e2eff04", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076740, "uuid": "26308a51-d44d-43d8-bcdb-b964ec5e59be", "value": "98304:JWHcy0JArY4RtJQ8CR/SKac37XiWKlu0yqP5KFEBDvbqwfiJK:LJGRgq9c3v0pIFEBrFiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076740, "uuid": "fbc3813a-9c43-461c-b787-001e47288b93", "value": 3912305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076740, "uuid": "06226d20-d57c-4c37-a9a2-0f75b4f786a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076740, "uuid": "f8d722e0-5710-423e-b746-93bf257428ce", "value": "3cb7fdbf051ead4532eb48bb9dd94204.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69ffe45-0717-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630055870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055870, "uuid": "51edbf03-53a8-479a-a2b8-04d4c631885d", "comment": "Malware payload (RemcosRAT)", "value": "eff4f95a7ae8393e96d50e6e8a83b7b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055870, "uuid": "715efb3a-b10d-4187-869e-642631c29975", "comment": "Malware payload (RemcosRAT)", "value": "138ef44ad62de7fbb51ef1e66c3fd1055c3989ba20ca7a4e4f083513080f9faa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055870, "uuid": "122508b4-c7a6-465d-8e59-17bf13a2535d", "comment": "Malware payload (RemcosRAT)", "value": "b6f4e8ae7378d16d2986715a69b9eb0efecd7012", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055870, "uuid": "77526b39-1f88-4bdc-9de6-bb37fccd463e", "comment": "Malware payload (RemcosRAT)", "value": "ee57d5aa0bbdbcfd3cd256ccbc73ddf6ec4de9d3be2d3b6bc65f040f0ab30c23ea1751a50cec40cd7da3bc41c4eba73c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055870, "uuid": "c87f956a-f7f8-4972-8f1f-e9d9ec1e2f1c", "value": "T1446412D861E9D22EC9F1CF3AD2C35A5496F0C516889FDB2D80A4B548CD3B7662B8C5CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055870, "uuid": "a9c53e72-4404-4944-93d7-818cbc4ba19e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055870, "uuid": "9687ec6a-3d55-4f5f-a2fe-8f1eaebe3ea3", "value": "6144:n/Krkqh7dEZXG2x4kKfeiHifvxms86mgkveSTin/gfGc4:/ix2ZXGcJ6BAJz8hvveX/+Gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630055870, "uuid": "5ebfb207-875e-46ce-bbda-e5e4cce52f6e", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630055870, "uuid": "959a47f1-8fef-4e3d-9249-8105d0e4c9b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055870, "uuid": "8d246a8c-9b23-487e-bb36-e4da0a6845ae", "value": "eff4f95a7ae8393e96d50e6e8a83b7b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01b37ff-073d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630072260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630072260, "uuid": "8daa73a1-86e8-41a8-816b-fbdc93a0d6e0", "comment": "Malware payload (NanoCore)", "value": "e1ef3603a040895afd69a98a272c9790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630072260, "uuid": "27ddb462-8e07-4075-9982-e973f70ee933", "comment": "Malware payload (NanoCore)", "value": "14451edae10ff52ecbee2e6588d9de9ce95162d06c13dea3ee5d0ebbd64bd283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630072260, "uuid": "d7199e4f-a05a-449e-aafc-d8a34a3cb023", "comment": "Malware payload (NanoCore)", "value": "f07336caf6d8d7d88dc665147aaaecb3cb997cda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630072260, "uuid": "9ab77b36-5dee-4047-bb63-57afd1c168f3", "comment": "Malware payload (NanoCore)", "value": "7522a5880dae1d4ad6264d3782731fb32c27859f531a36e0c5a5c5fd9717c44f6a8beb5391823c0c0cba83c90a66ac27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630072260, "uuid": "5950fde3-93fe-46f4-83e9-cec874822412", "value": "T14E157E3D29BD262BC1B9C7B5CBE0C827F0549DAF3111AE6464D78B6A5346E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630072260, "uuid": "0c95a2aa-9ba1-4721-a9d1-c24ee7a32391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630072260, "uuid": "0f34f923-d0ab-4797-b008-db79f2a4ff6e", "value": "12288:No4c+oLjD0YUsdRlgZRKqGYdbC/0yVP4c1Bm8:+JfDxUsmQqjeBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630072260, "uuid": "f8359459-3969-4b91-a460-6cfccfad8840", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630072260, "uuid": "2ed24ab7-30a0-48cb-8ed5-15599857c5fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630072260, "uuid": "c25c45e0-acd3-4d0f-8019-d438b2274ff1", "value": "e1ef3603a040895afd69a98a272c9790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6889b5-070e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630051774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051774, "uuid": "d38a7ed6-3640-4345-9511-9a7deb0af321", "comment": "Malware payload (STRRAT)", "value": "7e2ab591bedbba74f8eec6456ae47d5d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051774, "uuid": "591b8164-a8da-4ef7-8e77-ddbd0c0e28aa", "comment": "Malware payload (STRRAT)", "value": "147a2f0b5db31df9dd9ed75cf520cf7b434e26e286392dadbbcaff90df219d28", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051774, "uuid": "8e54da36-fed6-4039-966e-482d7080f97e", "comment": "Malware payload (STRRAT)", "value": "5c835fdf5fa55493eb7bc9a711a9cf417ded08ed", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051774, "uuid": "0fb66432-50c6-4551-8bcf-b4341e1b936f", "comment": "Malware payload (STRRAT)", "value": "2d16fe4ac95d3f9a524c80b03f1d15b4319259123f93a24b99e96974f7d736f7fb774fe4f46596aadfe2721c9f2cc7a4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051774, "uuid": "e7fc5f0e-6e52-4f20-ad4f-bdfbd8d7ba4a", "value": "T156A3DF1BF99E95A8E44B88FE51049722F94D569C974A633B34FE0A8A0E74C3C0711EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051774, "uuid": "94a88fbb-9444-4037-9ad1-a4adb9ceafd4", "value": "1536:rPApu9LxVwivNyje/xCkj4qzzrv1CVftcO7pChN1mb+n1EKF/FZ7FQo9y:xLHZp1jxzrv1C0Vhyb+n1EWdZ5Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630051774, "uuid": "6c796467-a181-4b56-8e4b-edc2030c580d", "value": 104621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630051774, "uuid": "696655e8-f5d0-492b-9744-cd703846d427", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051774, "uuid": "75acabeb-4d4a-46f4-a12f-f7ede55455d2", "value": "attached.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088f0063-0733-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630067630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067630, "uuid": "bf19c7fb-6091-4f63-89e4-41c07533bd09", "comment": "Malware payload", "value": "54f8ac92afeb71cf53fe5c10a71fb880", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-61", "colour": "#786ACF", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Sanuwa", "colour": "#AAA96E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067630, "uuid": "33bbffb3-c7e6-4396-af9e-54ab6e7ad110", "comment": "Malware payload", "value": "170da670ff6787cb5a2829022e5a4a8acc9ab59bd31b3378e4bcdfc72b89712a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-61", "colour": "#786ACF", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Sanuwa", "colour": "#AAA96E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067630, "uuid": "3f1d927f-bf67-4162-82b0-b071286391ec", "comment": "Malware payload", "value": "e8e23e2a2a00a9a041bfeb851fc11b7cab429b45", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-61", "colour": "#786ACF", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Sanuwa", "colour": "#AAA96E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067630, "uuid": "01b0e716-448a-47e3-bd43-0f41a37f7c02", "comment": "Malware payload", "value": "3ead044c1ec4e63f101392aa5e5ea21d9619bdea318443b9035d6e73dc89984e647e0aa4be5fd2079039f93b506377f7", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-61", "colour": "#786ACF", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Sanuwa", "colour": "#AAA96E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067630, "uuid": "e38be614-5867-4c4b-85ce-56f58e398964", "value": "T15A33F1C5F851CE8AC7C296A19F3DD4512F7BB2734188242DF1C3F66834C3ADA896B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067630, "uuid": "42be69a3-13d8-45d4-9cf1-996bfa026185", "value": "1536:FIeqlO63yVaxdRxxyBJVsfRGsWOoTyYRTIJ0Dr0D7GNOb0DP:fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630067630, "uuid": "a7f13f57-2a8f-4721-b60a-7333676da0a9", "value": 54280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630067630, "uuid": "4df49079-aec4-4eb9-b454-f1e458da1744", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067630, "uuid": "b1f70d02-2275-4203-b4a8-2c1ca6947b81", "value": "170da670ff6787cb5a2829022e5a4a8acc9ab59bd31b3378e4bcdfc72b89712a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a169b10-072d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1630065244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065244, "uuid": "fab6afde-cbe2-4423-b111-53bb4d2a34a4", "comment": "Malware payload (Cerberus)", "value": "906fa025f84da7144000a26f2609deec", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065244, "uuid": "c9488f43-17d7-409f-84ad-a6409d38b64f", "comment": "Malware payload (Cerberus)", "value": "1a5bf2c57b4851d2e2186298a7cbd438e5cae349836700a5dc6102615ed0c36a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065244, "uuid": "a3bf118e-c3e8-4fd8-9c4e-643ced6b2ea5", "comment": "Malware payload (Cerberus)", "value": "6e9a59a56e65672ec6f1f002aec438f8e29f86a7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065244, "uuid": "8418ce41-23af-40c1-b0ce-157687205523", "comment": "Malware payload (Cerberus)", "value": "441c4b2ef4549cc7a3834b99f6bb3fa7ae2379e37fc4f116ddd36876b887b8b5be64ee19068e3d3f4b329b527cf80ec5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065244, "uuid": "e1d15718-ffe0-4acf-bccf-0f3bb84f1596", "value": "T19EE5331AFF63002DC7175270D2A3421736367DCCF1A9B8BE50774C993CA7A589E02E6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065244, "uuid": "53002999-5592-4c70-ab28-93938fed1bbc", "value": "98304:0BdJdIpwPF9tDfc6acf+iociKkH0FIbAs6+O4m:cdJdkE9lfracf5zebu+nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630065244, "uuid": "73545968-c75f-45d6-a78a-9ff4cd24bbfb", "value": 3199375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630065244, "uuid": "b79ac186-c7f4-4af0-9972-51d625859bc9", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065244, "uuid": "3d7e5d53-e76a-4c20-a3f7-b96ba65e5281", "value": "Bildirim_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ccb158-0784-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630102548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630102548, "uuid": "68717589-bfe5-46f6-a278-4690ac7974a4", "comment": "Malware payload (NanoCore)", "value": "37b894e4b59106d81ac3df4138559034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630102548, "uuid": "e568dc67-17e4-489a-97bd-22ae8226fd91", "comment": "Malware payload (NanoCore)", "value": "1a7fa1a7ead0615e3d0a3412f195afbb5577bf7bea6584a7ad5d8599c8027309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630102548, "uuid": "c79d1361-8239-4274-8714-c4eed38b640a", "comment": "Malware payload (NanoCore)", "value": "fc97795f8500f365fb517789838f243f07831620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630102548, "uuid": "5e0cbdd0-94f4-415c-a0ac-322ff14d7717", "comment": "Malware payload (NanoCore)", "value": "21e19e547d1cec8647a44365bd9e3a5280970a9d58415100f2d2f87d46a9cb1a2d94f0964786f137233803a365dc2f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630102548, "uuid": "f47beeb5-f960-4742-883a-1806c488a8b8", "value": "T198F4AF606AE58AD9E1EED376E1F8400107B5EF81E442F70968E930B86D73F055B2727B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630102548, "uuid": "3d3b9b36-8986-4b31-99c9-ee8b643ddb4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630102548, "uuid": "503f44f8-37f9-430f-9b6f-b48d27617e07", "value": "12288:sc0ec522oSOWR7WpMuWy8ORdH9rRjaaDfbehmUrpD3p9tO57fQZDWkLCrVespBeP:Vc4oR7WpMudhRddrRjdHeocFe57BBFBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630102548, "uuid": "8240f231-25fd-40ee-93f1-e61bfe167f4c", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630102548, "uuid": "2164abb8-cf86-42be-bf7b-1c698b343bae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630102548, "uuid": "1883af6a-2cbc-40be-89d7-4c09e082a687", "value": "1A7FA1A7EAD0615E3D0A3412F195AFBB5577BF7BEA658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb03fde0-06fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630045167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045167, "uuid": "ac5c1423-647c-45da-bec2-ce87b7fa6030", "comment": "Malware payload (AsyncRAT)", "value": "cfd0d3019414ab97ca0501e683121468", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045167, "uuid": "fa06d10a-ba48-451c-8609-cf1063953f73", "comment": "Malware payload (AsyncRAT)", "value": "1af4ec43ca70d9470db5612542c489d99d825d4a5bece64ef08dd465911bce94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045167, "uuid": "7e199bff-0a8e-4933-aa31-a39752e44a8e", "comment": "Malware payload (AsyncRAT)", "value": "3ac49e9e6e79fad05430b51010ffddfc236600b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045167, "uuid": "45cbefc5-8d2f-4fad-a469-6980280bcf9f", "comment": "Malware payload (AsyncRAT)", "value": "ca4d449d9cb4ef462bda9e56bcfb795f2bb3e5cf441661c622dafadd01aa2c6a3ad7cf3b5bf641fe5ec85a4bcfb92749", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045167, "uuid": "d31fb3e9-386d-44e5-a016-1f9fb7908b1a", "value": "T1FA231B003BE8822BF2BE4F786DF26145857AF2A36603D54A2CC451D75713FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045167, "uuid": "2a122a34-3303-4225-9fd3-95d962c6b6fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045167, "uuid": "fcc67ec5-554a-4f4e-bc39-cfbd1b93465d", "value": "768:vuiD1TUEFSuWUow3kmo2qzvlsCPEaMPIcTjbwgX3i50/PWIBDZWx:vuiD1TUKg2kJEaxcXb3XS5+BdWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630045167, "uuid": "86049e01-5296-4b96-adc4-c723ee21ffa9", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630045167, "uuid": "e2fe9275-0ce4-4ce5-a2ed-c647f105b5da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045167, "uuid": "c6592556-2792-4bf4-b822-bd1adf450960", "value": "cfd0d3019414ab97ca0501e683121468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ebdb42-075b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630084905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084905, "uuid": "9254bb33-a730-4c64-ab08-8c4ac9a843c3", "comment": "Malware payload (Glupteba)", "value": "8b77251f930fdf421bef43338fb37eda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084905, "uuid": "67338f8e-d02e-4824-a2c7-97cfc00faf2b", "comment": "Malware payload (Glupteba)", "value": "1c26aa5bcb8e5bc2170d8c7b8c2b0698d4e8a60f0d0f65c1a9a3d5e9b360cf58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084905, "uuid": "8d930a9b-134e-4fcb-b16c-c1b078c4fade", "comment": "Malware payload (Glupteba)", "value": "8aac4f7d7ff58bba329dc6010bcbbf81bf7368fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084905, "uuid": "c0077863-6ace-4ec2-b8cd-b166c24f9af9", "comment": "Malware payload (Glupteba)", "value": "8da4960b55af4dca73a3da62364af32c16f4e86b289b595e1c0eb09528795126a4101d05568ca9d278027515beb3e2dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084905, "uuid": "de2c55e6-12dc-427a-b7d8-4e1f85ecd0d4", "value": "T1C8263334A311D034F87A26F0267A42FDB424B9B24B6494CBD6D512FE6B78AED9D30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084905, "uuid": "7e7e9290-8d2e-4ca0-8b59-7b0689a6dd16", "value": "e68f2e15edc1c604720a74f10b8483a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084905, "uuid": "32a3309d-7fb4-4c84-845b-fe499fbea196", "value": "98304:GChMla4YM1t2qJkC00wojnkWat4i9PgZBa8xdZpmdkurp9wedtX9Q8YEFY2:GFXYiJkCZ+WaaE4ZBaQy6e86FYAY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630084905, "uuid": "f6f1f9b2-2c7e-443b-8b90-539fcf0f0e39", "value": 4650024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630084905, "uuid": "7aa8351d-d888-4e12-b193-928848e80b69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084905, "uuid": "62db368a-faff-4117-8f01-6dd6885212e7", "value": "8b77251f930fdf421bef43338fb37eda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793922c0-0747-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630076409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076409, "uuid": "13b025bb-df52-4e6e-9710-50167dc7a96b", "comment": "Malware payload (Mirai)", "value": "f6ff7e1fb69346735c9f75f9fdf0a154", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076409, "uuid": "3e70e19f-125e-44e0-9e2d-e24db398a2e2", "comment": "Malware payload (Mirai)", "value": "1ca154a9462044674c5c60f3c0a8cccea28758b846f3e223fb232562a44fd7ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076409, "uuid": "482e8811-22dd-4481-819d-ea4499f46e69", "comment": "Malware payload (Mirai)", "value": "dd3b1a98b1b74f6205d3ca8cd3adc2df66fe9457", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076409, "uuid": "c4c3c292-3366-4523-89ed-1a658309bec4", "comment": "Malware payload (Mirai)", "value": "3102b0462fc3862d5b267f110ffdf0fe59ac10c2ce1164daea21494e63801179c29dee1996667f95008c1c16735a0a09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076409, "uuid": "61cc815d-2085-4ba6-a95b-deb8d7362c01", "value": "T1DE63F8D1B881A726C2E11377FA5F018E372497D8A2DB33278C259BA47786D1F0C57B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076409, "uuid": "34198d55-9c76-44a4-9518-0ef8627b8e61", "value": "1536:aStr+60dniE6ydaheaLoYF3PQ5S4E+8fhWhG5j1QcQ:aStr+1dul3I5S4ExpqG5jQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076409, "uuid": "700effc6-9d83-4a75-bc30-525968458756", "value": 71800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076409, "uuid": "05ca3d48-ffc1-470b-bc70-eb1b31edf037", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076409, "uuid": "ca965d92-4dac-463a-b657-4b60657013c2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7947cd89-0777-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630097025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630097025, "uuid": "ac278681-db0e-4816-b98c-0ef5c9f6bd9f", "comment": "Malware payload", "value": "1c31f27bae6ee506d36e2dc876074670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630097025, "uuid": "1019ba24-6d19-4962-8108-56f58ea0a9a9", "comment": "Malware payload", "value": "1cdd54b1e4627c03763084b0b3064b085fe7b50de63121cdddd32dd10e0dff7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630097025, "uuid": "fb02792b-7c42-4806-8e75-0f5a5a204e9d", "comment": "Malware payload", "value": "d4c68965794c588c75dbe526fa1d39cfbd56b5f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630097025, "uuid": "2924ac8b-8fae-4e05-97e6-5b6983a6ca9f", "comment": "Malware payload", "value": "4396d3ac8100cc5afa3430ad54edbf26b46b27a8e1a8bef48ef53fda17c1a22d53b8afcb2965f9f8a7d28339ec16bc52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630097025, "uuid": "2df345c3-0243-4a4c-a008-d16c9445032e", "value": "T13784BE30A790C03AF5F712F449BA83B8B52D7EB1976450CF92D116EA0B346E9AC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630097025, "uuid": "04664063-7302-4e46-b5af-5f520efd9f64", "value": "ebf21d5f80ce6d78a1158dea28ff74e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630097025, "uuid": "db62a894-0159-44d0-a332-0649bdef77b6", "value": "6144:q4gRPBLT7EysmQkAK5vaitpLt2s4nMntYeu3miyS0IceWwfVRq7v6iaTIVO1yUw7:+PtHEvgpLww5WmhwVRq7v6iaTICyUJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630097025, "uuid": "3b6495f8-d845-455b-96a9-1e62d65789b6", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630097025, "uuid": "1772af99-1ac4-4b78-bf66-bddcdd9eaab4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630097025, "uuid": "d9ef8e57-85d7-49b6-b726-e66b46c6c262", "value": "1c31f27bae6ee506d36e2dc876074670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839986a7-0730-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630066548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630066548, "uuid": "fae918ef-d282-4206-9deb-666294808077", "comment": "Malware payload (NanoCore)", "value": "abb7cdc024b876ae4bf31f24d7c91b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630066548, "uuid": "a3b8882c-e0d9-499b-a2bb-fd5d0f22b49f", "comment": "Malware payload (NanoCore)", "value": "1ce353e990a32078c455c1d9e2bdc69267965f8bd93e00988b93241333bb3224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630066548, "uuid": "e75165ef-862b-4077-99e3-f6995ddc7da1", "comment": "Malware payload (NanoCore)", "value": "c05d57d955ee5410d7182196ea1f2341ba1c5e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630066548, "uuid": "bbeae194-686a-4df7-aa28-832c3418f7be", "comment": "Malware payload (NanoCore)", "value": "168ed4849da6f0c4d1ce5f61e11093109d5eb7ba8c213d25b1048bc81a3d3671ae282ed2bf1d2d236125e492241c0018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630066548, "uuid": "577cff1c-6db9-4a29-bf31-a6915a5629f9", "value": "T1B4157D3D29BD2227D1B9C7B6CBE0C837F4549CAF3111AA6464D78B6A5352E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630066548, "uuid": "f5e088d3-1b92-4076-b03a-d7d3bd77620b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630066548, "uuid": "e0b91131-1c57-4226-9743-cda5d8cc9536", "value": "12288:/L2L1OjEVNuZBnE6565ItDoecG85mQqqxlNi:iLMjN7wekem5mQqq3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630066548, "uuid": "6885a9c9-24f1-4492-b25f-259271af57ab", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630066548, "uuid": "cfac9393-e9fd-4ea8-8ea5-1495121bcbcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630066548, "uuid": "af8d7093-3a20-41c6-a43c-fe0c23d03aa5", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152b60a9-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630053049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053049, "uuid": "bb6792ff-679c-45c6-bec8-d3b6548bbbd1", "comment": "Malware payload (RedLineStealer)", "value": "5591fc3cd5460cc2ccf7da0f3bd11f19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053049, "uuid": "9c54acb0-fb4a-4005-8a31-aaf17655fd63", "comment": "Malware payload (RedLineStealer)", "value": "1d89a940dccccb58ce59943e5fab66203118f104511f4a30a777a4bb6288a531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053049, "uuid": "56512d0d-231c-4f24-94d7-bd33312b9624", "comment": "Malware payload (RedLineStealer)", "value": "842b8125536d9e217e9809498a4395a249709840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053049, "uuid": "68bae473-16ae-433a-97a5-11c9ef291b73", "comment": "Malware payload (RedLineStealer)", "value": "9970bff6506bad06041f98f1691741528ce36ff1b6317d4e63da71b9c90d282072150b9c76b96f9a2a9e6c411d818ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053049, "uuid": "3f6f804b-9d8c-47ff-8288-3d4bb84e0695", "value": "T19974BF30ABA0C039F4F712F85AB583BCA9397AB1677450CF52D51AEE06346E9AD30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053049, "uuid": "4f4bf2b1-dbad-4a71-ac4a-a4c371bcb8a6", "value": "3b142de1de00907afa014d92f674693b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053049, "uuid": "f83a6ede-f4d4-407f-b3d4-1ed0ef55b392", "value": "6144:dhFJEnr0VFQzb5GgUD3pa5Q2sjKVAmNyjV0gf1CiS/xScdx6v/65x9:RJEEFQzbhUD5aSdjHmNy5d1CiSxdxuy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053049, "uuid": "24c2128b-fe4c-421d-8676-5fe6be994d72", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053049, "uuid": "747d0527-8eca-493a-90ed-6e38a21509e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053049, "uuid": "318c2973-f2f4-4dfe-aa7a-40dfbf54f51c", "value": "5591fc3cd5460cc2ccf7da0f3bd11f19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d43e39d-075c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630085436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085436, "uuid": "e310b613-862c-49e9-a00a-78f55ca2b6db", "comment": "Malware payload (BitRAT)", "value": "f921112a3539f7f93529c88376508582", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085436, "uuid": "111fb84f-e69f-4a75-bcd9-839781c882ae", "comment": "Malware payload (BitRAT)", "value": "1e62a15bef6c5fbd94137a339272e93ee6b646f1f18a68a5e52d6e19dea03420", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085436, "uuid": "897f947b-4d31-40d9-893b-fe83a3b987f3", "comment": "Malware payload (BitRAT)", "value": "957a4e0b947482a8215a9450f1890dd47e45e642", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085436, "uuid": "7e93bad7-77c5-402e-a5dc-31026dff93d1", "comment": "Malware payload (BitRAT)", "value": "df2c295dbb583c4b1c7231233c4608399f3f765a3ee01aa32eeec1dd8b05f93e1802378e84f0604d0790f8e88a8f055a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085436, "uuid": "eacbfdf7-2c46-46f6-a063-ecd8e4bae3ba", "value": "T18BC58882DEEF8F8FC88F3475805E6D1308CE859814764AAEEC17AC14B3D268719655FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085436, "uuid": "a8bc7f2d-d0cc-46cd-a966-9e4a929537a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085436, "uuid": "8a58bd4e-7142-4554-9224-187b614f096b", "value": "49152:9KscKOXDAEzXdG+591Zg+zQQwLb/KTmLmXAGw+4akSI6232QguwV4:MFDjzXd55q+sHLbdwA+4akt6A2QguE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630085436, "uuid": "c832bedc-d434-4552-b5a2-2d11d6fc9b46", "value": 2604544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630085436, "uuid": "f2238bae-ae24-437e-af2a-5126b27f0896", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085436, "uuid": "022e3b13-1d08-4e23-8137-6c61a1508a89", "value": "f921112a3539f7f93529c88376508582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afa323f-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630053085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053085, "uuid": "41b842ec-a188-49b7-bafa-4365326546d6", "comment": "Malware payload (Loki)", "value": "18045215860546c3c9de345bf98758b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053085, "uuid": "acbe5a6e-0203-4567-8d45-3350940d3e15", "comment": "Malware payload (Loki)", "value": "206ffaee571e12d28029dc615f16722fd3309c82cfc441fc304e770a6bb1d881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053085, "uuid": "45eb2812-c065-4fd2-8faa-e4f3ff66203f", "comment": "Malware payload (Loki)", "value": "c93ecf5ce383f3703493e48fbe906c5fc45cb729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053085, "uuid": "84dd954c-222d-4468-91a3-261264840464", "comment": "Malware payload (Loki)", "value": "203bbe32578342d7b0f5ff06e9cd9751f240b62a859a8e1db573fbc095b694b7886b48205e6a34d4fd2e514c1cb9f3ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053085, "uuid": "dee08fd2-9e94-4f58-baba-b3b200c9ee3d", "value": "T18325D33D29FD2627D176C7B5CBE09827F554A8AF3111AE6468D383AA4312E4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053085, "uuid": "1dacd19d-20ad-4645-8aea-ee2b433b3a95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053085, "uuid": "e408f23f-68cc-4df7-823a-a88e52a147c1", "value": "12288:iatxMsxjWs6ysH1ZZngzTzDPUa8CdcKBZGBC/XJGXpF4dferuh4QPujP:HxMAVeH1bgzjMa8CdDWBsJ3ferqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053085, "uuid": "b3555a28-3ebb-4c9e-bd20-52e3ff500c1b", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053085, "uuid": "35471792-a2b2-4b10-99fa-a3448c2de6ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053085, "uuid": "7a670df0-fa64-4ff9-b5b8-8d67e0cfd42e", "value": "18045215860546c3c9de345bf98758b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2967d3-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630053386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053386, "uuid": "60b40007-f074-4c00-b247-c15de32f0dea", "comment": "Malware payload (Smoke Loader)", "value": "be8fba1fa1536254d7aeab7b52344a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053386, "uuid": "9ad69ebb-0041-4a05-bb4a-168e47afcb39", "comment": "Malware payload (Smoke Loader)", "value": "20ae56e2ec11dc0b943ea744a21cfd4c166a14732683664bc846286123a18e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053386, "uuid": "189b958a-966c-4503-a72c-bdb1664148f3", "comment": "Malware payload (Smoke Loader)", "value": "23f42db215a021dfa596fbb72f61e94b04cd36c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053386, "uuid": "09fcd934-9ace-4a47-a907-2e5ee6e94e04", "comment": "Malware payload (Smoke Loader)", "value": "2382bce45714182438631911be233d9626a40a79c39b040428767b70add735764fe737737c47c25b92411027d5301f31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053386, "uuid": "e9f86402-df65-4b9e-b62a-9982851d38a2", "value": "T1FD04BE8076A2C57BF9C209304469DBA1663BBDF35B608597B74817AF3E312C0462FAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053386, "uuid": "aecf711e-ca43-4656-9744-b741938f9c73", "value": "a70e187b34266b8bda252cd2ef2d0837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053386, "uuid": "eb76bcac-644a-4fd2-a1c3-4b609f703b2d", "value": "3072:p2xjEfArWWDm3bCq5y5YaMzIRHwhZoWC9sI5/DuT61m:o6ArrDm2sVzsHwhZU9sI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053386, "uuid": "822e93b7-fb30-4435-a2e6-2c841a8c14c1", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053386, "uuid": "32b5427d-4e90-4d59-8348-50055aa546d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053386, "uuid": "fe65fb6b-015e-4852-ab3c-e808b82b8800", "value": "be8fba1fa1536254d7aeab7b52344a2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53ac5f1-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630050848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050848, "uuid": "5a09104a-58e5-4539-be93-257b551f6d8f", "comment": "Malware payload", "value": "637ce3c455f19e7909f73b17dd1e95ba", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050848, "uuid": "61f17601-2944-4000-8bb9-aef33c1e2c67", "comment": "Malware payload", "value": "22b80f28414bab64ee6f962302a3c5cb8dbf8eb3e0e4f1a2a582f3779d502b23", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050848, "uuid": "dda11781-0bfa-44d8-a099-f190b5817187", "comment": "Malware payload", "value": "08a9786bf88ecc52c7d000d72bca5029da766438", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050848, "uuid": "8da9b7d8-d4e1-4e7c-99aa-a1c489384947", "comment": "Malware payload", "value": "5d6142e1595db676d41c701c03a929443a300a4fd604a8b4fe6ef590fb6f08fdabcbb96dab5464a3609f36149216da9b", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050848, "uuid": "8ecf1bc6-2325-444e-8d96-16686ae64c0a", "value": "T1D4029EFADDC6E182C7E1133DD3BC5C3FF702602A9655A19F5140586A239A6D38BD3292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050848, "uuid": "adc506ad-ddd2-47b8-b875-ad2134720841", "value": "192:xrXP/7qriGUxa76uVFhX4GW7cHQgxLuYHDbsmQV:dXPzSAxuLhoGKK9smc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050848, "uuid": "e3c2ba58-823c-4d67-ad0d-13c8a7ce722a", "value": 8224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050848, "uuid": "bad9c75a-88d9-4db9-abc5-6db6cbfeb70f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050848, "uuid": "e0504fd9-0347-473f-b8f8-9f127ac9d449", "value": "Order 122001-220 Catuneanu.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8056d78-06d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630027955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630027955, "uuid": "2ec54d3f-e595-4826-90cc-1559880048e0", "comment": "Malware payload (SnakeKeylogger)", "value": "61e17d354f8529a203207e491cab779e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630027955, "uuid": "a3212af0-ad28-4c39-9ebb-163bef1dd5b1", "comment": "Malware payload (SnakeKeylogger)", "value": "26274dd1baa5be91bd6bdb0db48895d89da2a78e6fac273257557de473adc841", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630027955, "uuid": "6fd71021-1088-49b2-80cf-504e359c611e", "comment": "Malware payload (SnakeKeylogger)", "value": "15e607c32e57c63fef7d826449e289b68c299874", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630027955, "uuid": "dc4382a7-e206-4ffe-9d93-fc5b2cefe974", "comment": "Malware payload (SnakeKeylogger)", "value": "441c2872d0fb142c69cbe5ec29a9f862d2158eb84f07ad99ae2e955086d2308e1dc95ef97d13dd3249b790d8cc62f718", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630027955, "uuid": "2ef324fd-6030-4ac1-bdc9-36f126d827af", "value": "T17585693C29BD222BD2B9C7B9CBE59867F05499AF3110AD6458D3576A4B13E4234C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630027955, "uuid": "d722ad0e-82e6-4796-a91a-aced3ced6261", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630027955, "uuid": "dcefd683-3a6e-43e6-8e73-1cb5a6b3276e", "value": "24576:ElsWIgramvBeIc9QMpLdYBkyrMaRCFlOCKyslGEXrqKP1kVWV/Nm/y12Nhm0:EpImamkI1Mp5SryvnHgrFQyY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630027955, "uuid": "43ee5079-740b-4fbb-a7f5-c8f2274b9cec", "value": 1830912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630027955, "uuid": "79509b0c-725d-4ad1-b3b7-8870190d37d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630027955, "uuid": "7c9a345d-f3ae-468c-bcaa-ba76c4e38cd3", "value": "61e17d354f8529a203207e491cab779e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a592d28f-0749-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630077343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077343, "uuid": "c45f3e8c-2273-4e46-9646-0042a929b792", "comment": "Malware payload (Mirai)", "value": "6d85c06ced8c4a95bfab77aa004d00ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077343, "uuid": "1e670f3a-4da2-47f7-b8a7-83441545100c", "comment": "Malware payload (Mirai)", "value": "2671a9719778e35b8520f27a13c539717ef1293e6e8735ac4241e35726408396", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077343, "uuid": "b53fbae4-36d1-41d6-9fe1-01a11ccaa1c2", "comment": "Malware payload (Mirai)", "value": "3fc4bbc8f952d9233b3b429971fee8ce5938c751", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077343, "uuid": "dec4b147-0eb9-43e2-b69a-1baa663f33a5", "comment": "Malware payload (Mirai)", "value": "2e11f31db68d737d6fc0b43ce59003d3176b12243696f5469f9c41adbd4496bf00233cba467903b7343598a10bcd9274", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077343, "uuid": "7862931e-2561-41bc-b91d-bfd435b77029", "value": "T1C153D692B851A779C2D0537BFEAF088E3750A7D8A1DB321789640B917B8790F0C57F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077343, "uuid": "3459df2c-bef1-48c6-828b-ec6ebbccbd48", "value": "1536:jnlgbiensz7/tIHRjNlHbga0OROQf/ssvhWo5yPn8:jnlODpl74JO/sAx5W8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077343, "uuid": "1d9f50e6-c4c2-4193-b0c1-9e5978db41d4", "value": 62696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077343, "uuid": "8476f5ca-7bd5-4807-a5ba-a4afbcde50c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077343, "uuid": "038cd608-52e7-4326-8808-732f2fb68864", "value": "6d85c06ced8c4a95bfab77aa004d00ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3b7a59-0712-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630053710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053710, "uuid": "6c1ddf05-7919-4bf2-9b94-6f3b02bc2ee5", "comment": "Malware payload (RedLineStealer)", "value": "5b0e056cc4170183afafb9bd8c2e7764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053710, "uuid": "0c3e1535-b641-4cee-8004-fdb6da409e40", "comment": "Malware payload (RedLineStealer)", "value": "27caeabbbc3f50ddde02957ab8b5e196077f534e522c7be75b32fc369d2ac282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053710, "uuid": "12fca5f1-7ea4-4972-a66c-45ff41f8e330", "comment": "Malware payload (RedLineStealer)", "value": "6e6ff3f39fda1d6505c1831cc846b7dcbf405efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053710, "uuid": "2922a2ed-d9e9-4c92-8f67-fd2a3997119b", "comment": "Malware payload (RedLineStealer)", "value": "3adb894ce4461a0ba02c880cba2a9b8932fe98cd33866481576628553cddb478b8fbdb9480bbc65a8a4d57cfc0fc8492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053710, "uuid": "0ae548dc-6ae6-4641-a75a-e73b0c85f402", "value": "T15A54E0007671C4B6FBC6093598A9D291267B7CD35E72854B368C1F6F3E212C18B2EAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053710, "uuid": "6c6c2e59-8732-4c7a-afbe-8c2bff4db3d8", "value": "915c33ea178f4e014c52a0e08d0a2d56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053710, "uuid": "c855b9ee-3e69-43fb-b2c8-c7c5a691b521", "value": "6144:BSRHG1dtQdoDRvTr9O/5sHfKzmPtZBW1HwhZU9sI5/:BSg1dthRnARq1Kec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053710, "uuid": "a94f0bb9-76cd-4e4d-94a2-36a32b2e3328", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053710, "uuid": "4a757ca6-447e-44e8-82e2-8c04551bd836", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053710, "uuid": "8f32ae14-03de-402c-8dc8-7e9f9c681fc7", "value": "5b0e056cc4170183afafb9bd8c2e7764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5194d1-075a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630084580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084580, "uuid": "e4616272-f976-4b02-92a7-6d29bd1b030b", "comment": "Malware payload (AgentTesla)", "value": "d71f491288c6eceb46c92467c83f3758", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084580, "uuid": "cb5ea044-3cd5-4fa2-b374-c775c0eaca86", "comment": "Malware payload (AgentTesla)", "value": "280a1c3d36875ea098f7b1bd7201805dc2557a47278f1d400d599d5d8cf7f557", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084580, "uuid": "dce0cafd-49ab-4640-a321-d5b0ff67bc05", "comment": "Malware payload (AgentTesla)", "value": "b636e040d9cf438866839b4a4bf8b67d9d5c4471", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084580, "uuid": "5f63a213-0756-4f64-b13d-8b1bd7e6a835", "comment": "Malware payload (AgentTesla)", "value": "e0029edcabf49262b52c084fed0e88d9ffb5965d041e18f51dda0b862d93c0811f53eb05cdae61f20ae09523f29df34b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084580, "uuid": "0094a2c3-5699-4962-ad06-5ba1e73e234a", "value": "T12A35D43D29FD2227D179C7B6CBE49827F554A8AF3111AA6468D343AA4312F4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084580, "uuid": "baab62cd-c7f3-4c8f-a2db-09f152cdcc53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084580, "uuid": "1c5daeb9-cf3d-49f9-9bb8-4ac095176718", "value": "12288:v6JKQzjleingKK/KgXpBfQvHM7+2y1s9Ykc7wCkgqkOBTKXpzcpfAeDuR4QPujP:eK6nY/JpT7hy1QYPXklTKxcYeD6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630084580, "uuid": "ec679a00-f36c-4b40-9bc9-1da694305f38", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630084580, "uuid": "b52430a0-09cb-4b6a-baef-1c070a3fc921", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084580, "uuid": "b3fb2a30-2a74-4953-8157-442d36fb722f", "value": "d71f491288c6eceb46c92467c83f3758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76543de5-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630050635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050635, "uuid": "f1fc8ea3-1386-42e9-b08e-ce85f33faae2", "comment": "Malware payload (Formbook)", "value": "5e5049bd28483cfdc82402a148ad3ba2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050635, "uuid": "7f1c38f9-1b78-4c19-8ab3-1f05cbb1b216", "comment": "Malware payload (Formbook)", "value": "284d7db37a7c0921dc821da9918971bed9d3d3aadf94629c6afbbe65fe37767d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050635, "uuid": "e4c28283-727f-4757-98c4-62cfb91359b8", "comment": "Malware payload (Formbook)", "value": "990fd507c5fbc0d67901efc9bd0d31445e16db1b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050635, "uuid": "d98ffa7a-d964-4cf1-a9b9-a5f8500d3884", "comment": "Malware payload (Formbook)", "value": "0623d9a6ed5756a37703c13c30cf3fe6f31e9416a38a39854e9236bb78c2ed3e67a45611724ddad8072e0f85de172088", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050635, "uuid": "b69f189d-e1c4-4dde-8b26-a7beb61bcf84", "value": "T1FD4512EA59905B43C0DF33368121E6D45A3CDEB11BC4F015E662B939A03B67CB9DC9B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050635, "uuid": "8233940a-51e7-4e80-b0ce-a27283f12d71", "value": "24576:qjJisSMrZslGA9Heqza+mx/O+9nfd0jEpJRItGHv8W7iqWEK9l:qjJi0Fsj9Hequd/3fCYp7ewPE9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050635, "uuid": "a79c323d-7008-41e2-8c2d-d71b6c22f79f", "value": 1274880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050635, "uuid": "72d9d749-41b8-43f0-bd19-4018b3dc1d80", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050635, "uuid": "1fc15e38-5362-449f-83e2-dd64fd177ace", "value": "MV TAICHUNG.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91ae8c8-0720-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630059874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059874, "uuid": "7b7cda36-a682-4e7c-90d9-0e3bcf31ba67", "comment": "Malware payload (Formbook)", "value": "7a9cf63d76a9013b241c538061e457e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059874, "uuid": "e94f2a3d-fb2d-4450-9123-1d725c15bafc", "comment": "Malware payload (Formbook)", "value": "28c67cdcd4523ca934a1b72c6c8f5ed39874b6b8f66e3f679cb1095f859f6e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059874, "uuid": "ccc79d74-2d6b-42bc-afe9-11ba331b1224", "comment": "Malware payload (Formbook)", "value": "f694dec9c2b83cb06887d7996031e69b748af9eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059874, "uuid": "8c0c8733-642b-481c-8aec-adc56d33fbb2", "comment": "Malware payload (Formbook)", "value": "1b430163dfb329d4026ab0a11ba34db8590345214eea76fcb36f966b758d142f0e04f9af86ccd27553125565ec11d098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059874, "uuid": "4edd035c-7a9d-4aeb-9d72-bd27cac707fa", "value": "T1ECD4F149624C0956CADE4CB481B0E13887B59F3386C5EB898DD46DAB72A53D14F0BBCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059874, "uuid": "ed27242b-e6f4-41ec-bcef-8d9fb9231cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059874, "uuid": "78e2c37e-7409-465f-8fa2-c3790bf18976", "value": "12288:DE4qEJBJnO/F1l1+51DvL9YG3Gp0uyGwYvVPwD3GJDPdvaVMA:FJnO/3L+5RJypDm2JdvaeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630059874, "uuid": "3ed0adc3-25c9-42f8-90bf-6327b0f07475", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630059874, "uuid": "80479724-c3b6-4bb9-bcef-56e4cbc842a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059874, "uuid": "ca9ae2c3-fba3-46ab-a7a2-98e44704df23", "value": "Purchase Order# 210145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559fd670-070a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630050150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050150, "uuid": "a725ae01-c3fe-47af-9134-7dc217fc9b7e", "comment": "Malware payload (Mirai)", "value": "858c141dcadfc051e37e5cc3da75435f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050150, "uuid": "896efbb6-b46d-4655-a87d-9ebb05627184", "comment": "Malware payload (Mirai)", "value": "28f3952e999bc3c17dd36ed6455e6809b408ba08189009788389a64f2fe0f99a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050150, "uuid": "ed91006e-1f41-44f7-afec-82869cb95ebe", "comment": "Malware payload (Mirai)", "value": "ad6b50d4e55cc77396f4b45bc1faf0b7a53a9cf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050150, "uuid": "b018c5c6-44f6-4cef-84d0-694d7f744640", "comment": "Malware payload (Mirai)", "value": "0ef604a696402b612af17131169f1a8e9b08f52ca6b4ddca69a763e300622a114adf98e7b689b612317bd234da0b5038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050150, "uuid": "a598301f-dabb-4cde-bccc-c9e9297fac6d", "value": "T17C922996A802CDF1FC3602F124269F64FBB1F43AA425980BD7A75A78D856E40D71332F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050150, "uuid": "10526ce2-2b95-4b70-811f-f89810ca1c9a", "value": "384:fi1x2LYAIy0Nsy/9/i1/jzTaEXuXWV3vWkTU4Ltrlq2lBEG28FE:q1pqk5YbjWkT/rlqaC8FE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050150, "uuid": "a7fb63c7-8a50-46d5-89bb-2ac449f3eb22", "value": 21256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050150, "uuid": "ed58f535-11a4-488e-8eff-21edbda7d931", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050150, "uuid": "ba5db323-724a-4656-8835-3c53c67bfc50", "value": "SecuriteInfo.com.Linux.Siggen.4102.9772.5731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b6a239-0710-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630052917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052917, "uuid": "2c2bc41b-8c49-46e1-a710-4a5695a86e83", "comment": "Malware payload (Loki)", "value": "9dfcb05d29041aa67e2630b3386a5433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052917, "uuid": "fc95e3a7-9f15-406d-9d31-e5059fbd593e", "comment": "Malware payload (Loki)", "value": "295a2b49624e25f2bda364955227cdfb704462029876ac0d81e806ef22935d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052917, "uuid": "be358182-3ba9-42ed-b07a-1f34e57d636d", "comment": "Malware payload (Loki)", "value": "922a6c066096383d0d4a65c40aaf83d8f2dcf052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052917, "uuid": "a33569a8-80f1-4303-a686-ae06445e4896", "comment": "Malware payload (Loki)", "value": "1af5b1da65ec804496dde8469170b32e5d2f62f058a663327096a6adfacf8d0e39602279e692ecf4b07003e8eee004d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052917, "uuid": "db4c8a45-f22a-4975-a261-c4b60ff9e20b", "value": "T18A25C33D29FD2627D1B6C7B5CBE09827F154A8AF3111AE6468D343AA4352E4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052917, "uuid": "adbfbd43-c071-4f14-975b-b0178e17360f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052917, "uuid": "bd9100d0-1a69-4659-8a07-e67273efb6a7", "value": "12288:dPaKmjkjzg3JeS4a/Gm1DvwbG78giNZAbuLiTzMzhObrCXeruh4QPujP:laVh4Kf1Dwf/TY/TzM2mXerqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052917, "uuid": "21a2ae08-cf57-4d9d-8b39-2b2537d4e4f7", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052917, "uuid": "756e546d-f80b-4d2c-839f-ebaa2e3a2178", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052917, "uuid": "10922a2b-4271-4543-9a4a-168b76499427", "value": "9dfcb05d29041aa67e2630b3386a5433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110ad2f9-06f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630040586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040586, "uuid": "0a55a87d-efe1-4449-98ce-0dc78714f862", "comment": "Malware payload (Mirai)", "value": "dbcadb42c4a369016db1785904f74f3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040586, "uuid": "be550b32-64a8-460b-92b6-1f86a191ee7e", "comment": "Malware payload (Mirai)", "value": "29b806e552ef8f76bbf33fcf55b011c68ab067691dc509f4eba318d7e1d74a3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040586, "uuid": "bd057a77-78a6-4da6-a30a-f55bb49b9eb9", "comment": "Malware payload (Mirai)", "value": "a20fcc75c7583cfa6346dc61382dff6a3319ed9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040586, "uuid": "33103860-3d8e-4318-b11e-b17d80e4819f", "comment": "Malware payload (Mirai)", "value": "021d59eaec822efb000f1125dd2e0cc694b029308ac05da0e49d11bac119361c81da9718779e29cb6144ee22fb5671d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040586, "uuid": "02ae5cb3-2d92-4be6-bf71-ad0dd548fb0f", "value": "T1AA533A02326C0E57D1921AB4253F1BF183FFEDA420E4FA89290F9B5A8575D37254AEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040586, "uuid": "964c2437-9699-4fcf-89b7-2ac0ac358b92", "value": "768:HFwqq4FH5If5Dhd8731/UxdrbJnoWuCjTSar0QH/FxCrOBdShj+KHINwHyeLTvw:X557FMd6nCjl5H/LPdGHyePvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040586, "uuid": "4f77ae6b-05ce-40eb-af53-990211a7aa8c", "value": 64052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040586, "uuid": "58f04723-61b8-4fb6-be6d-9d9ec79769c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040586, "uuid": "9a173ba4-fa7d-4d2f-a91a-2dc6a4369f2a", "value": "dbcadb42c4a369016db1785904f74f3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9d1c15-0702-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630046724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046724, "uuid": "8dc1aac4-dc4f-476e-8b4a-44bf18b7566d", "comment": "Malware payload (STRRAT)", "value": "aac5d2ef572e27c2cf7fa45f364b29f6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046724, "uuid": "35372b71-df31-4e60-bf9f-7384aff374d3", "comment": "Malware payload (STRRAT)", "value": "29fad6e1f4b1359c780d8b0d582e20928224a16b028f0f0cb7dec464b902a50d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046724, "uuid": "a889c936-01cd-480c-9c7c-1178b025e371", "comment": "Malware payload (STRRAT)", "value": "5a0abbeecb14d5dd5e5057dc748a0e4676ee5db8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046724, "uuid": "9d0565c2-1847-49e8-a081-97c85582dacb", "comment": "Malware payload (STRRAT)", "value": "bf880fce83b2b0b6529fd84c8cd8ca780e378c133b674b336518ea3629542291742b89653284563b3fba2e1f8a7220bb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046724, "uuid": "922f78ed-3040-47b3-b731-da424b777d3a", "value": "T1B5A3D01E7DAE80F4E08B8933550C9577AA0C55D4C206DA2F69FE08594C3ADBC474BAEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046724, "uuid": "afd33fbf-aa1a-44a1-87ea-bf1d172290b7", "value": "3072:DkimTCP69UCzO5qNJLKKQslG2N+oWe5KM5:DkimTCPzYO5drslG2R5KM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630046724, "uuid": "993ff03f-3384-4975-8c7e-0cd0d4d9fe93", "value": 103455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630046724, "uuid": "cfe8d0f5-3b44-4868-8d14-752508396bdb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046724, "uuid": "4ebbb2f3-f288-4762-abad-f94dedf86112", "value": "Quote.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a088382-070c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630051071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051071, "uuid": "f882c4eb-8273-4a10-9de1-e1223e19e9f6", "comment": "Malware payload", "value": "700f7ce978f72e77b69e3cfb23889440", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051071, "uuid": "a9e041e9-53df-4662-a26b-665cc1b2f0a8", "comment": "Malware payload", "value": "2b04fc22292fd13da9a551ce8e5bd019fbce29660b80c5eb245d78df2dd684a3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051071, "uuid": "4fce29ce-d292-4788-ac6b-78a76d4ce660", "comment": "Malware payload", "value": "d11a46e9bc8c0381c228def1c84b63d7168c6c0f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051071, "uuid": "b324515e-386e-4235-b752-af3161829a38", "comment": "Malware payload", "value": "68f3c5734f0e0f361a91e02e0e4851e0980184398791f6264c5f8cb510d80ee3c349841ebab7d9277b0da6798340baa9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051071, "uuid": "4273d503-a8a8-4a02-9bfb-5fc0f59e194e", "value": "T139F08190D5ACD7A782C6F2D519A7C800FC25138243A4EB873474D111C96D4F499E9602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051071, "uuid": "52febd67-f74a-4693-9e17-6ebd9e083468", "value": "12:8gmzYl6fQ0wggd3pm9iV5R9Gg2IIxmZ9y5PMJo6R9GgEPmguef:8gbMR2EUMg2IIxmZcZMJoeMgeuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630051071, "uuid": "2d4f5eb5-99db-4297-a6cf-f3d31bff40e4", "value": 556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630051071, "uuid": "8499e150-01b8-4ac7-b8f0-d303f5048466", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051071, "uuid": "2cdf1ab8-b4ff-4c20-9f05-437e277d7cf9", "value": "MNV92.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2300ef5a-071e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630058655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058655, "uuid": "f7c442b9-8eae-4a9f-982d-4e1c7cd6740c", "comment": "Malware payload (Mirai)", "value": "84c8222643f01c3b007a720a117d359c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058655, "uuid": "3e6e68bb-bda8-4d70-b7a9-f9b14933c386", "comment": "Malware payload (Mirai)", "value": "2b4f065c6e06638ac2f8d7724fa74468438992df0168de210a6ba76742169252", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058655, "uuid": "14f229b5-6745-474a-bb04-9aeaa43c3c6b", "comment": "Malware payload (Mirai)", "value": "9faacd4b306587043050d3f8b24a3a7aebfc75e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058655, "uuid": "bf941b7b-6d03-4d88-b8fa-ccae240a18a5", "comment": "Malware payload (Mirai)", "value": "ee442c7981e2e89e3b891cf5e55a3a89bc033eee438a8bc32fb7ac059f8b2a8c86fdf6cf79531206aa886663c576c0da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058655, "uuid": "66841b08-18da-4cc7-b4a0-8fabdb605b8c", "value": "T126736CCEBB53D8B0E812253419536BE9AF3DA9307120DD2DD76C7A61FDB0702F926258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058655, "uuid": "f6c20ef1-75de-4ea2-a3b4-02d332e4a9fd", "value": "1536:gT6vPq4y0XDl1OjjwbfejKOJ6KKUk318NtmHBj+FXMUebu+rA:HTXZIj6wuaNioF8UeiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630058655, "uuid": "8f0f5e3d-f186-42c0-a0d7-3d8504b11b2d", "value": 75148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630058655, "uuid": "b7254e7d-a5e8-43c3-a8a1-09b81a3f3f49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058655, "uuid": "8a7244e6-9b72-4dc0-9222-155f44fe0afb", "value": "84c8222643f01c3b007a720a117d359c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5940986b-0759-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630084087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084087, "uuid": "1f089283-2406-494d-88be-0e76d074f21b", "comment": "Malware payload (RedLineStealer)", "value": "58a192c56eff7d48740607232cea9d49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084087, "uuid": "3b9b052d-ef39-4ce1-864e-cd4606318e63", "comment": "Malware payload (RedLineStealer)", "value": "2bc19a1a48254b0ce6a30f471c0e870ceff05ef8ab66ce5d9bb4ecae869d3b10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084087, "uuid": "a64c632f-a1fb-4bc1-bb53-2f39cb1b7c11", "comment": "Malware payload (RedLineStealer)", "value": "6bde1b43b0eabaa2151f5126c102eb3cc5dbb693", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084087, "uuid": "9bc7416c-9aaa-4432-be9c-68dc156f85d8", "comment": "Malware payload (RedLineStealer)", "value": "b1e27d20ed75259c5eded0ca413b6136b0a69f10ce4d104d8f5f06ca344f3db4a3ceb751dbf0d7a9659133c51046c29f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084087, "uuid": "3aac282d-e0ef-44f0-b9df-dcc72d2bd55a", "value": "T11855B3289C6471CC742EB18D4E7245E8439EFDA621A2EE2376DD5B328557D9CEBE3C00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084087, "uuid": "9315701f-cd2e-4e3a-880a-b8cf91ece0a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084087, "uuid": "cf91a38b-79cc-4c07-94bb-dbafb0e04fd1", "value": "6144:HgICFP7B/5KbOPSaCkSF0UcUm2m5haafXbQHtp5lICT+5Bj9hvKtmXmL+DV/bHMN:8Qi8lICT+5Bj9hkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630084087, "uuid": "2135bb35-d3c3-49e2-a557-7e4be77e31ca", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630084087, "uuid": "97a86907-3d88-41e2-ab16-3e993fbbc860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084087, "uuid": "7af18c7d-901e-4f91-87ee-8259675c0141", "value": "58a192c56eff7d48740607232cea9d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666748f8-06f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630041159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041159, "uuid": "57f354ca-e111-4df4-bb83-d86884f23fbd", "comment": "Malware payload (Mirai)", "value": "31b05fc470897bb186aca5f6922ccfe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041159, "uuid": "75b20679-5cb2-45b2-b821-272e07ebb8e3", "comment": "Malware payload (Mirai)", "value": "2bfca0726b9109ab675e6bdbe0fb81e80fbf7ee6af2f129672569e5476e57b47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041159, "uuid": "bd0c9d3d-a706-4b89-b1b7-ae7a0e2e122a", "comment": "Malware payload (Mirai)", "value": "5bfea6f87b7a7ada27e0147374c42dbab2cf4058", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041159, "uuid": "f770cce7-8f1a-4ae6-9337-478ea8f73d56", "comment": "Malware payload (Mirai)", "value": "071efd9655764c0ce884a4b4dd008e95366ed51ac5ae280543c676765b55afa56bd1482825007d2c4dc9f6e18b7d65c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041159, "uuid": "6b9502f7-94f4-4b1f-8ebe-aa21cbb5238f", "value": "T1A043841ABB250FB7EC2BCD3749A9170625DD550B22E83B797D34D818F61B24F09E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041159, "uuid": "8c966757-84cf-4639-bfcd-afcddc4f804f", "value": "768:ZJiJGUDeOJZK3PIw78kPkZhUdZFfLtS4AFe/e3ve02hv/QXaKXim4SHOYyFB:ZJCeOJ8/IwQHUrS9SuvLsnVeHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630041159, "uuid": "c30d70ac-7f95-401c-8aab-5b9540b5c518", "value": 60172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630041159, "uuid": "42a42e11-89a8-4391-a708-b43a48a3ede2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041159, "uuid": "a08c5109-205f-40ec-b439-e0d48985f7ad", "value": "31b05fc470897bb186aca5f6922ccfe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c2393f-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630050736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050736, "uuid": "887e0a27-f2fa-41d0-9e10-bed585d03e92", "comment": "Malware payload (Loki)", "value": "52ea97b7d1ba5f55516650c37680136f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050736, "uuid": "7ec3a16d-f576-4f1c-900a-e3c5f98f42da", "comment": "Malware payload (Loki)", "value": "2c1f9a272ab0b4f9f297a5e76fb25a64f7e7f95e0e92e62846061b47e061cdb7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050736, "uuid": "109b17bb-5542-4d49-9c1c-cbd59d01f400", "comment": "Malware payload (Loki)", "value": "6e42c85fa3e745cd613d10d77960ae05c8f288dd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050736, "uuid": "7faf1cd2-c000-4d19-8f41-531947dde84a", "comment": "Malware payload (Loki)", "value": "17a8e88dfc3a07542c8cb7c7b9912b9c690cfd75f3c6b12a41271283c3a77cba5ecfe119478834cb12440b5ada1daa5f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050736, "uuid": "b7f3f15d-719f-4880-8682-a502f4a3081b", "value": "T1DC4512219CC65F07E99FD93ED8A9694037D9FF971488A60A438DB1239BFC79403D22E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050736, "uuid": "d55e46d1-b0ad-4cb5-b513-b2c65bbb7865", "value": "24576:Yt/kXCSIrqq/1mRQzX7eSqMK/NXYaU6ifBpPmoJ2ywz7hucO:YZ4rxm7eHD/tYJpkoJ1wnh7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050736, "uuid": "ed496f9d-d3f8-4e44-8b59-eee6e1f2e6d3", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050736, "uuid": "e6def278-f8cc-40e1-83fa-855fddfe73d7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050736, "uuid": "731edaaa-25af-4016-bbc8-3754f7088a74", "value": "union.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e864039a-0710-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630052974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052974, "uuid": "217a8fae-b4ba-45a8-a212-f53c03c52378", "comment": "Malware payload (Smoke Loader)", "value": "40801b51a7038e69cbfaf82fd9538b95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052974, "uuid": "80a25d76-2c8c-4602-92f6-5e285bf05209", "comment": "Malware payload (Smoke Loader)", "value": "2c9bad80a8ac44f67fd3982a4faa1303aa12ac6b9728c436c2e2863a95a474e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052974, "uuid": "01afc435-0605-4254-9b34-5878d61cb741", "comment": "Malware payload (Smoke Loader)", "value": "7a664a7d3668bb80ac0079090056198dfcdda65a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052974, "uuid": "365968ed-814b-4d96-8659-1094717e7961", "comment": "Malware payload (Smoke Loader)", "value": "ae74faa0b60fd4dcc233ca74f8d0d275d3c0d7df4ab37eb35ddd6d8af312ed02bd393b7fca83a747216b674b34105f26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052974, "uuid": "7463a6e2-887a-4c43-a055-bc5545049e46", "value": "T15A448D30AB90C035F4F712F85ABA83BCA42D7AB1572450CF52D52AEE06346E5ED31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052974, "uuid": "740697c2-5da3-4ad0-bd0e-9a97e450e61e", "value": "3b142de1de00907afa014d92f674693b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052974, "uuid": "73fd8516-2cdd-4c9c-92b5-7c31e64f2f5c", "value": "6144:holLEzr0VFfNp/fG9g29B29oLdhKyf9laNO5VMcscIQa:+LIEFfNp/ig2b2exhTlCOHrIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052974, "uuid": "ed9a07ce-a74c-479d-a977-88a1d55a8d13", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052974, "uuid": "d4ee109b-7a53-4b15-8554-786a38fd39e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052974, "uuid": "db687878-21e2-472a-bef1-d06672830dce", "value": "40801b51a7038e69cbfaf82fd9538b95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff99960-071e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630058650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058650, "uuid": "5c9f3398-1c1b-4197-81a0-815d080a6985", "comment": "Malware payload (Mirai)", "value": "3d69848a6428dda95be1fbc3a00df0d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058650, "uuid": "420846af-d8ee-4a93-8a43-bb3097323213", "comment": "Malware payload (Mirai)", "value": "2cbdd52dde29b0d20e32a5724c109904ea0055375d3526128998210d80914139", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058650, "uuid": "dd88cd28-07f8-4e3b-84bc-4ae18289bec2", "comment": "Malware payload (Mirai)", "value": "f320fa9de5837e96e859cd9020c93d310ea76191", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058650, "uuid": "c3bc81f1-391d-44b5-a513-42a8c3ddb4e9", "comment": "Malware payload (Mirai)", "value": "ffc1d3ad9cdc3ec4be66e831c819733d8ab515214540d64ce5048bf0d000860e73835043997f6d84150dfa9be362c5f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058650, "uuid": "474a2551-ac27-4a8c-a68f-3d6ca31b73c8", "value": "T1D4A3D75A7B314FAEF6B8863687B7CA21637823D333D1D282D16CE5045E2034D696F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058650, "uuid": "4cbaa351-2e8b-456e-899f-841f8394d811", "value": "1536:fygvM6sGhyqssoNnMa3UBk2VRe6Fbwr+ehugME:aXGnopMaOk2VFbwr+eIgME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630058650, "uuid": "bea8b7b3-fdbb-49af-8588-31cdd9bb88c6", "value": 98276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630058650, "uuid": "6d325e9e-3342-45f7-b306-f8fca550a49c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058650, "uuid": "ed389949-acf0-4a6e-aabe-c7a42345ba7b", "value": "3d69848a6428dda95be1fbc3a00df0d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddc432d-0749-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630077330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077330, "uuid": "26e867af-5be2-46d6-8b50-6c30d18d2755", "comment": "Malware payload (Gafgyt)", "value": "855f2c160fc484c5d9b33b040626c49e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077330, "uuid": "b8497aa8-9632-4b00-9fdc-7930cfd4f9c2", "comment": "Malware payload (Gafgyt)", "value": "2cbebd7addba42403fcf7d25ceb322af9151094f485c720c697f850b54924396", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077330, "uuid": "d9315c1f-00ba-4e43-b8a8-e5c3334a4fb1", "comment": "Malware payload (Gafgyt)", "value": "c0ce14ca573a26c30331c1d2b1ac8191324aff4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077330, "uuid": "aa82cd89-fbff-40d6-8e04-0d6704ebe512", "comment": "Malware payload (Gafgyt)", "value": "c539c0b2fe21704498873ce7834143c41f837dddad81b0a3cf6a8cfac7593ba0ee7daba404262c21027e0baf7f3bfae5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077330, "uuid": "00e77e2c-ce0c-463a-8fff-2dc6c004ecd8", "value": "T1CBD3294BA61C0B87C49B5AB13DA727F0876CEAE1119352C5A91FFE804333AF52127F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077330, "uuid": "6fd46230-6f15-4a6a-ad22-3e06591f83c8", "value": "3072:JCBaAjuR0WRr5lGrc5hUrkbfos5osXmKYVyeWdZr2oq:JCBaAY0ilGw5hU4bgxsXmKYVyeWdZr2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077330, "uuid": "31641491-067c-4afd-9cad-7df40cf04350", "value": 139094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077330, "uuid": "95115255-4d5e-4e37-918f-6d9bf3b497f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077330, "uuid": "0120152a-26e2-4cf6-b324-284de49a72b1", "value": "855f2c160fc484c5d9b33b040626c49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d7b35e-06f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630041136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041136, "uuid": "58cf7c52-fc81-40c3-86ee-058003380e79", "comment": "Malware payload (Mirai)", "value": "d833cd2f1f362546d6d3a19bb95d630f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041136, "uuid": "b51d878c-954b-44da-bc69-f91a768925c4", "comment": "Malware payload (Mirai)", "value": "2dfdca753bdbc98310365b9b956b6e42d20838cf2f4e1d6392b83d0bceebdfe5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041136, "uuid": "894c63fa-77c5-4de0-999f-615c24adc2cf", "comment": "Malware payload (Mirai)", "value": "75de62cf41e30d72fdc0aca21d4575040035f57c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041136, "uuid": "26314a91-f3aa-4818-93e8-43bfcec3b4bf", "comment": "Malware payload (Mirai)", "value": "3a1b0a4639962db73b38a2701bcf631ebfa917f290bd8f1f5a29053b9e02a989ba99f4ae83a61d8c5a5143ca6036daf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041136, "uuid": "b6fb65e4-f5d9-4e2b-9bbf-cf8cb0328414", "value": "T15173D549FD819A12D4C926FABE5E115D33132B5CF3EE72029D301B2577CAA2B0F76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041136, "uuid": "5d5ec13d-6971-4a2d-b007-6373cb1983c7", "value": "1536:69n+0KTxD6PT0uN/tL3tJvCCYpWitKQl+9ls3ipFURGu:Rxu/tz3YpWitKu8FU0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630041136, "uuid": "af435c93-b7e0-46ca-9379-01efeeb3bb2a", "value": 73796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630041136, "uuid": "eb4ce91f-7b59-4e69-9144-ebd5abdd12f2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041136, "uuid": "5fcdf46c-e26f-4014-a926-837474188235", "value": "d833cd2f1f362546d6d3a19bb95d630f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14ea9d9-0749-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630077336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077336, "uuid": "b3aa30e8-c0d4-4842-ab0d-ddd652a838dd", "comment": "Malware payload (Mirai)", "value": "7d1ab012e2782b90149edc78792a477c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077336, "uuid": "37d8c837-556e-4352-b78c-795a90f93ce7", "comment": "Malware payload (Mirai)", "value": "2e3b7113f3127a692066b81f4ad014e0d15c31a5968b61527137a2990768c9bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077336, "uuid": "65f49a8e-9b2a-44d8-907f-febdd50b5888", "comment": "Malware payload (Mirai)", "value": "4467003cb62d99daee280954b4618482372b3426", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077336, "uuid": "ac48a50d-81ea-44fc-9ec7-c7fa6fbd7cb9", "comment": "Malware payload (Mirai)", "value": "e1ce5eb78f51bfd0da1f048d51c045db6674716fa35250a4132002432af53d141862fd0d5999b301201ca48b38273355", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077336, "uuid": "275aa36b-6e4c-44d9-b39b-83a81f8ad53c", "value": "T1CD533A99F5029E3DF88FEE7980150E0EB93063D212B31B276AAEFDA37D331549852D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077336, "uuid": "6e5516e1-328e-4e69-a10a-1b7dbe348814", "value": "1536:JTGrGqnAePFOFa96rp8F20kyONfkBa9Zv:JSrGeNc1CkkUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077336, "uuid": "ec848a2a-560b-4302-a2ba-7411519960e5", "value": 66036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077336, "uuid": "c8801c5d-5f65-4ad9-bf51-7c46a2f4e2ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077336, "uuid": "44698822-16fa-4d0b-9055-689e5d1deee5", "value": "7d1ab012e2782b90149edc78792a477c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046a7937-070c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630050873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050873, "uuid": "92589773-7194-4c20-b0b6-12da290a7ffa", "comment": "Malware payload", "value": "53165f172af545d65aec91d9147d6de3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050873, "uuid": "48c002a2-4845-4037-986d-3a2cd7b7cd34", "comment": "Malware payload", "value": "2ef50d47e37d225c3b4fd0774a9f6a02a23dd07584df1e8c3fe500c56a7fe41a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050873, "uuid": "9ea5756f-8e8f-471d-b0a6-a1863bd57aa1", "comment": "Malware payload", "value": "0f6267f32ab9f0471de8e614d2ccceadfe3bda33", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050873, "uuid": "57081997-4582-4677-9788-ce68f33ec666", "comment": "Malware payload", "value": "e0b771e62e69369e6a68193d8c06a5af44772a494480ba0c26d72e634c32cf81a791928060e7a4ff6f6d2e17c619dc0f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050873, "uuid": "15b529d0-1a03-40a4-b724-a8d496c8a6a7", "value": "T16BF0994DCB0809AD018EA187280EC010FCAB92B1A15CF1DE8C1ADD48146AD4C14FE5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050873, "uuid": "d2c13ff2-55eb-4f90-80ae-451fea7b462b", "value": "12:RCtMgDzc4S6J+bTSSQx2hYRtmgHHwmVL4DK3uOIfmQlZQTazIkgkUQfYJSqH:RCtK4DJLSjhYVQmVu7jpsaUk15Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050873, "uuid": "0edf75b5-ada5-4518-9dce-aca3d7ba9311", "value": 651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050873, "uuid": "9db17a9c-5787-4375-999c-ea2bb2aeabeb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050873, "uuid": "a65e0dd8-10d9-462f-8387-6f22428002b2", "value": "UPS-Delivery-005177992.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac57ea9-0749-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630077325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077325, "uuid": "16386cf7-871a-4a2a-bd37-c306986ad50a", "comment": "Malware payload (Gafgyt)", "value": "f75b186bdc859c37a1af8abc6b7abb3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077325, "uuid": "bec0fbab-744e-4fb6-a84a-a1f37ba10af2", "comment": "Malware payload (Gafgyt)", "value": "31cdac9aa6c8a15765c06a3ef5cbcf45b53eda4ee71fad7a5e9a6c693fdbb50c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077325, "uuid": "62fff550-1cc4-472e-8df1-dac9855cfeac", "comment": "Malware payload (Gafgyt)", "value": "fd9dc51524d642c2b25ac055dd808ee06f83c1a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077325, "uuid": "9efdd161-6bf6-41e7-99fa-12a6a44c3992", "comment": "Malware payload (Gafgyt)", "value": "734643c76cc8e598596b03415ab7e4da69d3db9761876541882b2074ee3fc83210752d15d9e3af719da86ece6c866d59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077325, "uuid": "51d0ad84-44fa-4a4b-8fae-f308997272d2", "value": "T15004857E7E21AF7EE168873207F76FB0C39521D326A19392E16CD6185E7524C184FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077325, "uuid": "71d897b7-22f1-4a73-9710-3851daad4a2c", "value": "3072:fbdnusK2MIBMIUIUp7DaO//ltkLr2aL4zG5j8cxRG6oLcxicxfucxz2cxe+cxi5/:zAsfPBPUIUp7DaqQEbeCc85hUh1qm8Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077325, "uuid": "6ff2561f-8884-4e5e-81d5-8f24ea16993a", "value": 188298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077325, "uuid": "0e4db308-bbd4-4a04-bc21-aab7e1997dea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077325, "uuid": "3fe84119-5216-4cbc-8c61-490267975801", "value": "f75b186bdc859c37a1af8abc6b7abb3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fede208-0701-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1630046222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046222, "uuid": "97ea521e-d3e5-459c-8cd9-ac1a4db68456", "comment": "Malware payload (CoinMiner)", "value": "12bb153c831ecf1f0ab5e69e425d10ec", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046222, "uuid": "78cf0cb2-88f9-4c4b-bd50-511a5fe7f613", "comment": "Malware payload (CoinMiner)", "value": "31f0308a25262c3c2f7e58d60d2c861d73fd4fee2822af6ce393a7676453d3a4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046222, "uuid": "b229442c-517c-4987-892b-544271ea9265", "comment": "Malware payload (CoinMiner)", "value": "21f739383c4b33f635c1f66b85d7212baf03f1d4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046222, "uuid": "f1a01c1d-e916-42ee-86d7-9fdf6db7181b", "comment": "Malware payload (CoinMiner)", "value": "5d41640d5c9402387b2200ff884ec5cfcfbcffd79ea05f1d1733f6be4035a019cfd3c43fb257d7297bd5051defd6d95f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046222, "uuid": "38c03d33-3c2e-46a3-bfa0-d272c4d68ef4", "value": "T143A5333E69215EFFD81EC2BB69B6F6FC3B96BE0A66BF49143438C24D4120774448AD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046222, "uuid": "25c22404-b5ea-418b-91df-85c337448957", "value": "24576:f/BuonfWSrUFGuWrbb34Mwk9ZyVmw7HFEUN68PWFc1WOi1S235stpG49y/N4e8c9:fWIKGp74Jk/pRsd328KN4oSaU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630046222, "uuid": "0af7af46-ca19-4506-a3a7-c31d9115f6f4", "value": 2112512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630046222, "uuid": "519738b0-5706-4bd2-a2a0-0c4f61802580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046222, "uuid": "757dc9ca-29f9-4334-a4fc-77cebd8ef91a", "value": "12bb153c831ecf1f0ab5e69e425d10ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5651da-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630076069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076069, "uuid": "357943f4-22e3-432b-a148-5398d29623f8", "comment": "Malware payload (AgentTesla)", "value": "f1b09d483d854ce02b5fbcfc059381a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076069, "uuid": "3ab08dac-7b8f-45e9-856b-07bc5803bb31", "comment": "Malware payload (AgentTesla)", "value": "3218f1bb88527852e12178e56a9bf32aedd40a02bb83e8e51645ca7882686367", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076069, "uuid": "f526b738-671a-47b6-bdcd-ae0994f23663", "comment": "Malware payload (AgentTesla)", "value": "5be2dd716d56cf03b20d7ff48d6c76ad456b9d39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076069, "uuid": "f1c9224f-a805-4545-87de-fed0758b3e7b", "comment": "Malware payload (AgentTesla)", "value": "52b85456c81a42e879084ffead67c383724c50aa05574abdff0cbc119179e2ad740e5cf2feead07f86decda15f6c3fe4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076069, "uuid": "7a662d44-38a2-4181-932a-c9f5a4fcc3a1", "value": "T189054C3C29BD262BD1B9C7B5CBE0C837F0549DAF3111AA6464D78B6A5352E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076069, "uuid": "a7dc3e52-1426-4148-8073-1b1f41fc2838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076069, "uuid": "1d6010cb-5dc3-4339-a833-0ee9fc4b95fe", "value": "12288:bxjOXNDKfTToFAAh7BpB6zYtDt4dCunh1O:ZOdDKXUAAtBKYRWfPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076069, "uuid": "b4ba1946-f940-4ed7-86d8-6495e8348f7c", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076069, "uuid": "bdb5dbf3-0dc2-4038-90a7-c70019693113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076069, "uuid": "f865fd9e-5e68-4779-949a-30c349b38202", "value": "f1b09d483d854ce02b5fbcfc059381a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de354613-0710-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630052957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052957, "uuid": "ef3b40a7-f709-4696-a89a-18a09b593c17", "comment": "Malware payload (Smoke Loader)", "value": "80adcc2e1e5bb2b4e60190f6b5a6b941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052957, "uuid": "ca1e5ee8-1b77-4544-a356-f0453f3c906f", "comment": "Malware payload (Smoke Loader)", "value": "327cb9607bb1d38e8cab276f8a936212ab99917625cf6f6ba41d28965bce05e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052957, "uuid": "8f5d6827-9d28-46d7-b427-fa54c385611c", "comment": "Malware payload (Smoke Loader)", "value": "8fe50cad6a24673ecaa51744e19e9b7dc140aba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052957, "uuid": "6816153e-8511-4d08-89f3-b61603218581", "comment": "Malware payload (Smoke Loader)", "value": "0c77d932784771b9cdb100035ef7f9c0664fc59d63d423caa04e30c71bace4a3dd5ca44cfa18fcef059d5609404b1830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052957, "uuid": "699bf67a-9ec0-4c07-9def-975a5a5319b2", "value": "T120448C30AB90C035F5B722F84ABA83BCA5297AB16B3450CF52D51AED16346F5EC30B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052957, "uuid": "8509d405-7128-4836-8cb7-d78dcfb0b91d", "value": "67c13f8f6053dc802ad3289485f66709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052957, "uuid": "baeeb796-b5a8-41d5-8548-018f7be48f49", "value": "6144:Di4XU0CKeTkVr0apEp5ggGgDGodngrL4FxTUhfP/+v:nXmFTkVrFEp5gxgFWfP/+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052957, "uuid": "2cb958c9-2111-428f-8d1c-b5f5a45e2e42", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052957, "uuid": "44c1c9c2-33b4-497a-aea8-2938a0d0b60c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052957, "uuid": "8e7d740b-347f-49b4-9040-06e18d8e852d", "value": "80adcc2e1e5bb2b4e60190f6b5a6b941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764d1613-06fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630043333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043333, "uuid": "09ae15f3-f8e1-4153-bf33-79fb71adcb79", "comment": "Malware payload (AgentTesla)", "value": "f593b7d3a66ad5040f9b1e1044a29522", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043333, "uuid": "8b0e58e0-e771-42cc-b93c-ff9e011987ff", "comment": "Malware payload (AgentTesla)", "value": "34ad8e7cecf4fa155a5e6f40b0ddb3ec5eafabb9424f9bec7d4a1f5e35b78bc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043333, "uuid": "16c48961-b9c6-48ce-bc71-b9464286e7f0", "comment": "Malware payload (AgentTesla)", "value": "23c282ad68d7a2acb8bded4bdba09164c69fe5f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043333, "uuid": "0d6be75b-daa9-409f-ae44-d0fdc2190c78", "comment": "Malware payload (AgentTesla)", "value": "c0818a92282e6243e91adffad0c5baae879d2892be567116067d525a5f94727864745a65a7609abdebc72aa37c619d2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043333, "uuid": "05c9e0b1-27f3-413e-a778-24eecc126d5d", "value": "T1CB45EA3DBD252633E7BA86F8C4960D4EE69414CB22734DDF42D2A7892017617B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043333, "uuid": "fa15a544-55d9-4a12-bb3e-90ed042419a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043333, "uuid": "daa3eb78-12ba-4b3b-9265-0d7319489a5f", "value": "12288:qubK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoyJX:qRRRRICCDn5eS9TvS5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630043333, "uuid": "855b3f08-218f-458c-b43d-d66348047af4", "value": 1219072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630043333, "uuid": "6e95c563-3b06-47a7-b76d-34b7a16894db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043333, "uuid": "3869cad0-0395-4e6b-8f23-8636f5e6253b", "value": "6Y5P9BoimMLclbt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acc857a-070f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630052387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052387, "uuid": "6a64d6f5-a655-489e-9997-ba5623d5ce04", "comment": "Malware payload (Formbook)", "value": "68acef4fe796ab131edc1f1d9ecb0517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052387, "uuid": "5e547fa1-ece3-42d4-8b7d-0fc3c120d120", "comment": "Malware payload (Formbook)", "value": "35042592e4abe63a3a51543f2cf419f83dee5e2b44bc2d7fe33173fccd10d93a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052387, "uuid": "0b429e3b-6a46-408c-a9cf-e538258b8bdf", "comment": "Malware payload (Formbook)", "value": "73c0064a5650f3abe97b0175c40b6ea2c64c395a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052387, "uuid": "cb5eb1c1-a5fc-420d-ae02-c919363e9ed1", "comment": "Malware payload (Formbook)", "value": "9025ea41ff50cd05e216f5f162989bd5b0767c431d3f3679a723d56c5afb64fb82051ff234013157008f54e2bd8db49d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052387, "uuid": "769ab2d9-b021-420e-8ed9-29f9112c37d5", "value": "T15535D33D29FD2227D1B6C7B6CBE09827F55498AF3111AD6468D383AA4352E4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052387, "uuid": "ed688d80-40ac-4e7c-b6d2-4289d5acb6b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052387, "uuid": "839a02e8-3b45-4fde-a094-3c53e02268fb", "value": "12288:iwi9Kn3WDstMNlM73n6uhIRuu7shN4W34nVSN812NI1JGFXLeDuh4QPujP:ni9KnGQtqs6uOQbh6W24NkJWLeDqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052387, "uuid": "14316cce-5f02-41f4-b301-d0eb7f1d4fbc", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052387, "uuid": "0e66c081-1d4a-4061-86a7-3f7d3dbbccff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052387, "uuid": "3eeae003-dfd7-4004-aadd-41415e022b41", "value": "68acef4fe796ab131edc1f1d9ecb0517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c05335-0701-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630046231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046231, "uuid": "b71517c2-b290-4b1f-9f02-20e09ebac6f0", "comment": "Malware payload (RedLineStealer)", "value": "6e02923c6b44da79dd21035b3cb9a02f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046231, "uuid": "18837429-687b-43f3-879e-a07cdbc1f13a", "comment": "Malware payload (RedLineStealer)", "value": "35e4927ea02978e01bee3917c5c2c92d46308473bf3eaf4ef1d4d3c0eb0a0d4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046231, "uuid": "a02b49b6-a96b-4444-8ce4-0e5cf42450f4", "comment": "Malware payload (RedLineStealer)", "value": "da39973f49aacc8195d0d207f494b47ff9503e4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046231, "uuid": "d3367a65-af3f-4e98-998e-a40ae3ebed8a", "comment": "Malware payload (RedLineStealer)", "value": "fbfc14c811394347d8d93858c769b25af0d00d1abfa679cd7d743c4918e207f1076b10d44efe2f75aa8a610c78ac0b19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046231, "uuid": "deffdb2f-fc76-4fa9-aca7-7aca28ed64dd", "value": "T1ACB33A2563EC962DF3FE0B756470151487F1E1DB6002EB5B8EC264DA6F32782AA446F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046231, "uuid": "20f4a799-36bd-42f6-90ec-c24cd6a4e668", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046231, "uuid": "c948432b-eef7-4755-a3f9-5f80b6f0bf1b", "value": "1536:LxPQlb8lfuw8rAs8Wz9TWD/poy04Kf5ejbuFGd/nQIyqdd6VfWOEEG6eRaoigu:lw8l2wO6WRCD/q6x/ndy4d6EJH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630046231, "uuid": "a72faffc-3be8-4271-9ea6-e910e508440f", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630046231, "uuid": "16524c7b-3e67-43d5-a5d7-88f759226d6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046231, "uuid": "9be63beb-b5bd-4f28-ae13-4fa48038d9e1", "value": "6e02923c6b44da79dd21035b3cb9a02f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0240f0e2-0703-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630047004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047004, "uuid": "685b6a37-b01d-4038-a3f2-653bd84a5dc7", "comment": "Malware payload (Mirai)", "value": "895f078749878177ec9f7da8299cb8cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047004, "uuid": "49d62e0a-acfa-4963-a3b8-0be000dae995", "comment": "Malware payload (Mirai)", "value": "36e113f4a34c3603ce188077ca8229d70665ba3e1d53531c5e2c8b54d75aed00", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047004, "uuid": "696eeeec-87eb-4873-bf49-ea207cec0ff2", "comment": "Malware payload (Mirai)", "value": "6de1057332e504c513f35938bcdd443eccd07908", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047004, "uuid": "31d72378-2253-499e-9a16-6f11e783b9c3", "comment": "Malware payload (Mirai)", "value": "103e01067ea407e1ceac71266e3a9b0276716d25d409aab1cb4fa39a21b69c10d1c3e4cd8cf3f1ce8d94db920909b9bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047004, "uuid": "215a4734-d2ec-494f-9f6d-f73516a6dc9c", "value": "T109D31A46E7808F07C0D62B7ABADF425533239B64D39723069528BFF43F837AA4E66505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047004, "uuid": "aa1699b8-e755-42ce-bb0b-5793ddb68129", "value": "3072:tdPiTKTaXhJG0e3hCn2qaJYGm8asD2IZM/9GXYXCmjwzLjysuV:tMKTaXhJGL3Yn2qahEsD2mM/9GXYXCmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630047004, "uuid": "dfad7603-9fde-4f7f-9d72-2970df88778c", "value": 142679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630047004, "uuid": "a6f593bc-3f51-4dd5-b6c5-f2d986310728", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047004, "uuid": "86238491-7bf9-4f5c-ac00-4a026adf81f0", "value": "peach.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889abb2b-06e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630033486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033486, "uuid": "69742ee4-a444-4a94-b3b4-96dd401867dc", "comment": "Malware payload (ArkeiStealer)", "value": "772e5f453fa9373d39f023d7c38e6b38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033486, "uuid": "a838b300-3a69-4e43-924f-af8ab0a33bdb", "comment": "Malware payload (ArkeiStealer)", "value": "382dbb2ef5f54e3735817318b680935e068749651f702213ab3edfb7842115fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033486, "uuid": "ac5fe000-52fc-4660-a25b-7981e8503a7e", "comment": "Malware payload (ArkeiStealer)", "value": "6e80a1283ec85c129ad355942faa3bdd7a00b4dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033486, "uuid": "8dfdb142-1e21-4b10-a85b-2f9a0eca85d0", "comment": "Malware payload (ArkeiStealer)", "value": "05f5b10ac2033e5af5387f9d0c43d45f2f1cf3c27b06a8fd54d1a5a6c1cba11f8a2cb40dbd30d377d225905816e17c76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033486, "uuid": "9ca5610d-1863-41e8-a4f9-68c3ae5ac4e7", "value": "T19043F10A270F80F6E91907B9D26352946336C3033A37F6A934D9B1AB5FD2A434B127D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033486, "uuid": "d087c704-402f-4b16-a53e-0cb61c655c97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033486, "uuid": "387dc5c4-f364-4705-9764-80a7f4a37925", "value": "1536:nnuJMdwyV/iPs3mFmIW8VWE46Csg5kl+BxIMmGpvHe:nuewEqPpFDWJ/6CsgJBWMV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630033486, "uuid": "894491ae-83b5-45e1-9a15-6bf93e7aafab", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630033486, "uuid": "ddac120c-57b7-46a2-9b57-15294373b6b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033486, "uuid": "5cab4c9d-8c78-4a23-9286-e887e07e32aa", "value": "772e5f453fa9373d39f023d7c38e6b38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d834af-06fd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630044431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044431, "uuid": "9da98c2c-40f0-4b76-9cca-9d73cc926757", "comment": "Malware payload", "value": "4778aca48d170d67aabe89fddc783249", "object_relation": "md5", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044431, "uuid": "bb9a098d-dbea-4270-b17c-32694428cdb2", "comment": "Malware payload", "value": "38ff459a46e9ea6d63a83c1eddb640626fef562cd1bcb0ab3823c4770d07d0fb", "object_relation": "sha256", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044431, "uuid": "53a4e7fa-e910-44fc-b9e7-53f6f5989a45", "comment": "Malware payload", "value": "c07cdfc9f349b323fbc4309ad907e0d9b4295a7a", "object_relation": "sha1", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044431, "uuid": "66bb355d-d47e-4ff0-9c2e-3b216dabeec6", "comment": "Malware payload", "value": "0d38cec30bde1a0f6dc43baafb2cd1056ab87d4700b436391d632f4295fe8a965626c28c02eaf31ebdbc9425e5372722", "object_relation": "sha3-384", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044431, "uuid": "a9df01d5-cbc9-43a8-b022-4b8b0e01c10a", "value": "T113D59C46FB48A97BC4F7933245355226113BCC658B43E687794C363C1BBBADC0B5AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044431, "uuid": "1433a142-fbeb-4035-b343-56dc0c092eef", "value": "49152:fFSORq9FCJL/kX/hnHje2wN6RN/eeJIPPbLRX+Hfr2f4du1e:NRqCJL8XJIoFeeJI7gHfr2f9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630044431, "uuid": "2abf430e-5249-402f-872d-3efa7b6901a6", "value": 2866339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630044431, "uuid": "43e988e6-2114-4619-888d-f12dd2dce077", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044431, "uuid": "20663ac0-63ab-49a7-92d3-66d99fe6d161", "value": "38ff459a46e9ea6d63a83c1eddb640626fef562cd1bcb0ab3823c4770d07d0fb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31600626-070e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630051808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051808, "uuid": "fa4335b2-1e33-418c-a46e-be749382f5d9", "comment": "Malware payload (STRRAT)", "value": "a405af40a581ee2f0408f195eac26dc9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051808, "uuid": "1597aff3-28fa-4606-9d96-cde33e199fa7", "comment": "Malware payload (STRRAT)", "value": "3a1f6872728b85b1777450badac363ede549d11d2144b5af35035c1e0da60de9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051808, "uuid": "659a3606-f502-4e59-8689-72d7f962e9d2", "comment": "Malware payload (STRRAT)", "value": "89070bac1eff692f089c431d6b95ad64095e77c9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051808, "uuid": "e31669af-76be-435b-89b6-db38020bd758", "comment": "Malware payload (STRRAT)", "value": "c7ac0ea456ee099bbcf8b79dca5b27a92d8b218f1d62088ad87caf040d6fbf703459908c83b0a72b8bc28f0e7ddd4f5e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051808, "uuid": "567e591f-5529-4ccc-9004-fef11bd0ce5c", "value": "T1E5A3D01FBA9B84E7E09F5A369008C136DA2D5149D296A53F60FC598B0C79C7A0F079CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051808, "uuid": "7e7d2080-c6b1-4af2-acef-2d27908534db", "value": "3072:qES7fGr+2adei9woomfn9FvfjxJOFlPDtH:qES4+2adbH7fjfIDtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630051808, "uuid": "4b14139b-e5d8-4a3c-afaa-6380c7135a4c", "value": 101988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630051808, "uuid": "e65d292d-ba61-4750-9306-042578ef7e40", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051808, "uuid": "d299ab61-9e46-4eb2-9945-698bbf514cf7", "value": "Attachment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1213387a-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630075807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075807, "uuid": "e84920fd-5b3d-4726-8627-342893471e61", "comment": "Malware payload (Gafgyt)", "value": "c635bd5a222e31c91d8f4499083a69d4", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075807, "uuid": "d5675dc3-ec84-41cc-9a16-4f41b8088fd8", "comment": "Malware payload (Gafgyt)", "value": "3dcfb94fab0360f4085b0799c1f27d22d2e7f40829575cdfb7c553ed0a2f5023", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075807, "uuid": "e1e19963-9d25-44f8-a646-1ab1ed57d101", "comment": "Malware payload (Gafgyt)", "value": "ec73fadaaccb447133196c57e4d79aa3b4e7ade2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075807, "uuid": "22a1d0e7-8c88-46c5-92e6-4fdc4548710a", "comment": "Malware payload (Gafgyt)", "value": "191b5aa23c32e9f8a8d2beb7c6f09a3dba9634bb976a7ac28fa587ba8bbfb3426b5398c2ad4d925a81f7ca0ee0c4ded8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075807, "uuid": "e84af0fb-fd63-43c5-b2a1-decb66c1cebb", "value": "T185E3E705FD00577BC2D327FAEA9E43CD373616A867DB33115A346EB42BC1BA82D29560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075807, "uuid": "9f4ed0b3-0838-4509-b824-e3654e83eb0c", "value": "3072:npHge04HPZkwCJ2Qa5hUF/72T3KGe/m8mrQMWSfWBjIvq:aTwPZkwlQa5hUl72K/m8mrQMWSOBjIvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630075807, "uuid": "e9383ef3-6a93-4a1a-b56d-7efc8f533010", "value": 152869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630075807, "uuid": "91ecc48d-49c5-40d8-84ce-cd43acee7402", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075807, "uuid": "30351df0-cf45-46be-864d-7ac17a81a4b0", "value": "Korpze1233121337.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879c0b0a-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630050664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050664, "uuid": "42a644bd-30e0-44bc-9a3d-ff1d14e868e3", "comment": "Malware payload (AgentTesla)", "value": "9790ef0533b2822047ccb451f4172560", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050664, "uuid": "f9ff69e7-85fd-49e6-95f6-9455a702ca16", "comment": "Malware payload (AgentTesla)", "value": "3f7830e1c77f805d984e8a92d91f0c4939830e1cd1a9c2079cb8b3b7954f55be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050664, "uuid": "7b79199b-ce3e-47e6-adfd-a6b45ed6cff5", "comment": "Malware payload (AgentTesla)", "value": "3c3e073bc4fbb534826706ba5cd686f21682b815", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050664, "uuid": "22a474c6-66d5-40ca-8d7b-0fb0d77ca4b2", "comment": "Malware payload (AgentTesla)", "value": "e2848d98ecc1b9d109dd6906ff7c417703ad34b6946160014b00633ca4bf34f9e85aeb4fb8dfaa00c147d98aaedd4c38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050664, "uuid": "96512c4f-7646-4d9c-b677-d64f4f64fc9e", "value": "T1B5741380B2066F0FD5FE1FB11147F765E2B9FD0C5ED768AA185AB3A8F07878091B1912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050664, "uuid": "67acfafe-29e1-47d2-9c7c-28de4c4d41b6", "value": "6144:tIu5CopeiPIAwXsdyI4khkpDcLHlfsZXUZpTc/pt2K2RkSs6KNr0bZCxAGxWx0xr:pdXQsj4kepILHlfnw7P2Rk+K17x80J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050664, "uuid": "e1b4d4e3-e279-4446-ac9c-0ed729c5a8a6", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050664, "uuid": "9fa3c582-aa5d-43c6-b4ff-e024d7a3cd77", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050664, "uuid": "7bc0fcc3-296b-430c-89ae-8dc483c2b4fe", "value": "Order-2021-PO0834.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca881617-0744-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630075257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075257, "uuid": "cb6e9a28-b775-4a50-8aaa-8d591499fd9f", "comment": "Malware payload", "value": "bccc7b87c6456e4f32b6e7e244a58e39", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075257, "uuid": "3cee3d59-6587-4449-86a8-898955cfdc2a", "comment": "Malware payload", "value": "3f9b5880b0076a4451cdfa5292f8b839c14fc7d9d1a88910fc5d6f66cf363322", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075257, "uuid": "70fbeddb-0ede-4656-9e42-8c3808eae954", "comment": "Malware payload", "value": "b57f37cc7a9fa113a85411ea8ce4c44e6a35eb85", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075257, "uuid": "4e073f8c-ab11-425c-bfe0-13ccb7c76d2e", "comment": "Malware payload", "value": "484b25b030dc9be952f236e4bec563cca7ec7fab3cdf827104229c238000adae974008681055067ec4583b46558fa569", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075257, "uuid": "f2f8c747-3bff-4a37-bda6-c0d9ecf0fb26", "value": "T1A5D5230676C81B73D5AF0670E24BC326E676DCB45122891B939B0A0E2DF35B4A7B33D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075257, "uuid": "12d077ea-70c1-4ed5-8123-8a4e2d6f36f1", "value": "49152:W6EuY5AvbrFIjKFiguez7buCnIrgmzu6kKWtMpL58ALkdyEKxSnzKxf5j2FVZzCp:/Y5AvbrAKFpu27Cbrg+kKWYF8/yEQSYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630075257, "uuid": "8abdab54-c095-47d7-a4c7-a594d5583371", "value": 2862592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630075257, "uuid": "a7ddb9ee-ae63-46c4-884f-fbc892d2685e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075257, "uuid": "949ac36c-a756-4f0a-a25b-c4f7ba9f7bad", "value": "temp_output_pdf_01_09_2021.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efed2fbf-077b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630098942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630098942, "uuid": "7184bd33-48e6-4b68-9960-8196d53a90f7", "comment": "Malware payload (njrat)", "value": "099c9da2357e0f58ab09fc5a24589e41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630098942, "uuid": "de45e595-496a-435a-8f8f-53c94a89d32f", "comment": "Malware payload (njrat)", "value": "423d89d3e4d7651aaf9a83e3ed444daae54e14b2104f5a8552ad61df7aebff4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630098942, "uuid": "bbfc880d-d9e6-4a26-88b5-7adda25a0960", "comment": "Malware payload (njrat)", "value": "917bd4b5cd6c621e52f96ae1565122e724ceca1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630098942, "uuid": "0e43894f-e011-47b4-9c8f-1bbb9cbb6242", "comment": "Malware payload (njrat)", "value": "fcc9c883be9202518a7aaf80c68d1f6e432d1902c10b3629dcee4aec11a3f6b77dd1acd98a0ea9b2e08c3b19ccb3606b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630098942, "uuid": "580f480f-74f7-4805-a44c-421bfad042f8", "value": "T12FF2294D7FE08168C5FE167B05B2D413077AE14F5E23D90D8EF664AA36736C18F60AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630098942, "uuid": "ebb4b7b4-1cf4-4119-b149-d57a042ad6fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630098942, "uuid": "ce9f52b6-04e3-45ae-8b92-eb522eed7f0f", "value": "384:YwdmBkiyJnDNGRn5IyUvwIFvthI/im1xbrAF+rMRTyN/0L+EcoinblneHQM3epzV:xh5M5jUvFFwqmPrM+rMRa8Nud7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630098942, "uuid": "4dda3437-4f0c-4cb1-b0ee-ab3e5bad77fb", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630098942, "uuid": "bf66f4f9-17d0-4849-bfba-e5be2911b291", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630098942, "uuid": "f949af09-0f26-47b8-89f3-a2f3341ffc34", "value": "423D89D3E4D7651AAF9A83E3ED444DAAE54E14B2104F5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ca68fc-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630050496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050496, "uuid": "7a1659a9-79af-4191-a923-0ce65ad47003", "comment": "Malware payload", "value": "a08f1536f1d1a3b68da8a7d1ca0ced60", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050496, "uuid": "5658cb8a-b632-426a-81ac-2bf746403210", "comment": "Malware payload", "value": "44fab41a5ffc0c4f38c7fff04e740a6150ba90e1b6b3088821be7fad6252ffc3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050496, "uuid": "2d38ce10-2acd-413a-9164-c6da3df0c867", "comment": "Malware payload", "value": "e017f0c77683c24f48728996be8ed22eada1bdf7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050496, "uuid": "8360372d-34e3-4866-aa00-1c89a0308947", "comment": "Malware payload", "value": "fe2f06fcd623a269c4db8b461b94308a06e36f1f27da910bb6d29d4cac94f30c29b88e5552161d43b6864ae5737fc45d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050496, "uuid": "30e55d2f-ee19-4388-bbcb-3150a18e4c29", "value": "T19C14AFF0364498E2DB9E97979255BD9C1326F07FAECA25CC0146FBF52A733418A0DC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050496, "uuid": "aa138dc4-4866-4948-98d3-7a8e65b19fe5", "value": "1536:DF4qHh7ASQqLhxfc4VzUnGFiP/GGKWIqgAoaYAqI/ksCoTIV8k8JXFoOn0pHiIxA:Gp4zLnqRoxpCIMAsYvDz6Ahi9AS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050496, "uuid": "9bc472b1-5f45-4c93-a439-feb4bf3e65df", "value": 194224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050496, "uuid": "f488bf2c-ab47-4e7a-85dd-b6261b880a05", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050496, "uuid": "bd6b620c-1d5a-493f-b6e2-59dba297a0f5", "value": "27082021_46542936.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bad554b-0701-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630046241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046241, "uuid": "15d45bcf-b326-4170-8b84-56938a762adc", "comment": "Malware payload", "value": "ce4002fff7d4123ec0a8ff72d29ca3c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046241, "uuid": "77ed745a-90da-4c63-8956-7a410e095b09", "comment": "Malware payload", "value": "4569c2ca16175dd869475526af97004f47e2918edb583043b609fceb86b35161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046241, "uuid": "f5c890c4-c633-4d51-ac27-6737987e8704", "comment": "Malware payload", "value": "c9369810faf12b6100a627325f4aaf9daa39451f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046241, "uuid": "27c61800-8e54-4b54-87f5-37fbabb725d4", "comment": "Malware payload", "value": "bc1428f758dd115890a2f66f70f92d1351fb3e2e831a9438b75565d0729dbbfad994d3ac28c5f292ee709b1c6b8c938b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046241, "uuid": "a600f772-641f-472d-bf19-21c0a52b9808", "value": "T1A39533E3E8F1C1D0F4C84D7C61EAC2E4860DA8D2C2D6B1D5F8D6464969DD82B9F09DD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046241, "uuid": "e6c5d5a8-f717-4268-b274-0abd5f5f3417", "value": "49152:tsIw/F0L3HCwDZvpS5tYEAhmVM2ARPZDlZH:tsIwKjHXDZmO7hmVM24Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630046241, "uuid": "30ce3586-0f9c-4ce9-9feb-8470ae5275ef", "value": 1999360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630046241, "uuid": "986dcac6-1e08-4a26-9461-c5a23152b6fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046241, "uuid": "bc4c88ab-e847-4234-87ef-fd7028238e83", "value": "ce4002fff7d4123ec0a8ff72d29ca3c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cae16ca-06f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630040579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040579, "uuid": "491130ba-757b-480a-a6c4-64fcb9d80da8", "comment": "Malware payload (Mirai)", "value": "c128025f97eaf50e8a08eca72fec29b0", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040579, "uuid": "19c9a4c8-8210-4351-ac8c-a1bfffa9573c", "comment": "Malware payload (Mirai)", "value": "470cfb12f301e318bb674c204f181460c0047f9ae239ec3524fa4e9a068da565", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040579, "uuid": "26670577-7caf-45d4-8630-dd8eeb4b032f", "comment": "Malware payload (Mirai)", "value": "8fcf02b7953e630881027804314d5973b05f04ed", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040579, "uuid": "7f3a6ce7-0aca-470c-86c2-04914a47bd14", "comment": "Malware payload (Mirai)", "value": "7c9fd140b06b8b6db24dd4cb1f6da214bf08095bdf7ef799fb369c7a5fb37fd54ba802ea9cc1ab577be232e5eb4555ea", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040579, "uuid": "74530b66-d4f2-450a-bc22-473f5d2683e7", "value": "T194054B26B6F370FCD157C03107DF9B72A936B47902216EBB2284E9352D42E912F19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040579, "uuid": "613bee0c-3621-4948-b098-54232e524cb1", "value": "12288:WVDBXdXXRlDpqsmoFqCD085WxKpbVmcUjrhuCrydBz8:WVDBXdXh/qsFFb02WxIVrUj8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040579, "uuid": "ad5bd8b7-1b36-4884-a295-1e69cd57ec28", "value": 868464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040579, "uuid": "39a914ce-8a81-4345-8082-3e2ee3cb35f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040579, "uuid": "5e51e231-d3b6-4962-8a87-f017cd9e1c92", "value": "c128025f97eaf50e8a08eca72fec29b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7afa68-0771-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094479, "uuid": "38d57c4f-3706-4eef-bcb7-840724503b21", "comment": "Malware payload (Mirai)", "value": "780eec76c561bd4d0a1496117e327f1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094479, "uuid": "f4d3e322-8a4c-4922-bd16-9e03b5c6976d", "comment": "Malware payload (Mirai)", "value": "4735baf774f91b7b3089fbd0da7a4b0fd4711be49f18ae6669bedc8d4f60d917", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094479, "uuid": "ef9a68a2-880c-4e11-8f97-9acf844743af", "comment": "Malware payload (Mirai)", "value": "af0932fdf34c31d4b87b7de8c2dfbe00e4945478", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094479, "uuid": "f4b459b9-37e4-42b4-b1ae-8f8061bf8b57", "comment": "Malware payload (Mirai)", "value": "2d89a391d829f5fdb79e6cefdc4313fd6937582f47a2e1780b358886c7059d7e1b8d64a47b285bf3f07a3995d18d4e4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094479, "uuid": "53869068-6408-43c7-a965-b8e047dd3a64", "value": "T1E6E38536B7619E77D80ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094479, "uuid": "d67314b0-4eb7-49c7-a0a3-f564797183a2", "value": "3072:dgZc9h1jlnLA2PiXYeyCc/VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ/VWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094479, "uuid": "45e1503b-8edf-4c05-ad88-e3ec796af5b5", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094479, "uuid": "e003859c-430c-4761-84b6-5bc62fa8639c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094479, "uuid": "b0e12241-b799-4b48-bd40-f806975fbc3a", "value": "780eec76c561bd4d0a1496117e327f1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9a9fec-0710-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630053013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053013, "uuid": "70b7506a-a535-4429-a19c-90a68c962d4e", "comment": "Malware payload (Formbook)", "value": "d54de8ce055f3b89bbd6ab22edff106c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053013, "uuid": "c0d94597-07d3-4d82-8633-853c904c77f7", "comment": "Malware payload (Formbook)", "value": "475032f04ff405e24ecc5e2a93fb9c0c5fc037cc59e06b1772a8e60bc2dcadd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053013, "uuid": "2d5533a5-fa38-45da-8d5e-ceaecbd887e7", "comment": "Malware payload (Formbook)", "value": "91ac6f83d907831ff427c1b6c54c93012a73265c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053013, "uuid": "3027c0a5-647b-4e51-96a6-7249b7740872", "comment": "Malware payload (Formbook)", "value": "a4d84ff5cd233912105982e0603befca8a7852b12f3bdf1c59bfa6ee818f4a281808a1e525bc58e634a84aa19f88245b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053013, "uuid": "4228a70f-3a85-4209-8153-f7fe54e7a1b9", "value": "T15535E43D29FD2227D1B5D7B6CBE09827F554A8AF3111AA6468D343AA4352F4235C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053013, "uuid": "6f66c167-a782-40cc-9fea-67aef0b8b11f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053013, "uuid": "b1738e58-bea6-42a6-9305-5d48ef0c8fdd", "value": "24576:MS6HyG+3KNeaVb3GKuYFOJe/lOgwt8eD6u:MnILal3GKzFOuUgwt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053013, "uuid": "b29f2e77-1a3b-4109-9507-6466cbb311f9", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053013, "uuid": "8420fb8f-1d65-493c-9ec4-29f4dd6fd14d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053013, "uuid": "a8f1cac5-9957-4e64-9bb6-1fc5d2007961", "value": "d54de8ce055f3b89bbd6ab22edff106c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d05fd14-0715-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630054914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054914, "uuid": "6e37d5f3-e493-4335-b0b9-b8bd03f3b9db", "comment": "Malware payload (AgentTesla)", "value": "6fbe57fe42928aae799cb89b2e8ef138", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054914, "uuid": "a4532321-1513-40b9-9a2e-3c03b0a7fd3d", "comment": "Malware payload (AgentTesla)", "value": "48f268292bffc3cea6803c275830f32655e65c08cd4e96bd68ffe7bebbd670b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054914, "uuid": "3f40a779-6033-4cc0-8d90-95a6a879f3fd", "comment": "Malware payload (AgentTesla)", "value": "be3ae30a5562ba903f5f305e51196988bac4bd9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054914, "uuid": "00abf9d0-c119-461c-996b-00d2737b3c9f", "comment": "Malware payload (AgentTesla)", "value": "dc9d7053a705245faa3d074bca615ab84fcb95ab995814b89bbd86a4a295286781823d3a9599879bd579c9075c4b2ffe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054914, "uuid": "6843f9ce-96b5-44c7-b5bd-acf5decbd787", "value": "T18235E43D29BD2627D1B5C7B6CBE09827F15498AF3111AE6468D383AA4356F4235C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054914, "uuid": "aa002a7a-1d48-4ca1-b414-d83b0a449c27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054914, "uuid": "7c779117-330a-4ab6-b89e-d98f2abf7af6", "value": "12288:CBYvKW2JXA42jYW8tCb8GwzBfUiFXWQW8noPz6mEpVeDuR4QPujP:QYyW2A4RWkCBji7Jns8VeD6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630054914, "uuid": "d93af15b-6108-4aee-bd0e-1058a39c11ad", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630054914, "uuid": "9c3f4830-d184-4dbc-8f76-fa46cd52f892", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054914, "uuid": "a8147b3a-2d03-448f-9823-9ea1b176eefa", "value": "tesla.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fcea93-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630050631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050631, "uuid": "5de9adcb-846b-4f27-b291-9be6700162df", "comment": "Malware payload (Formbook)", "value": "4b1c547b02f6c29c424fa933e63f3313", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050631, "uuid": "dabbb383-12f4-4a8c-a27d-59ec2790fb9b", "comment": "Malware payload (Formbook)", "value": "49120d38b2c2e1a11383c409db05c1df0d8694189a4946f2f1afc4d14ef813f6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050631, "uuid": "05c8a43e-6c17-49a0-acbf-b20a6a669a21", "comment": "Malware payload (Formbook)", "value": "5e3e29c974fb37cc344da7620f18991427a6201e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050631, "uuid": "1f7f4e76-b132-42ff-9731-1ddf340eed00", "comment": "Malware payload (Formbook)", "value": "3e48875b792c1d6b42bc6519324099db8a77a86a175ae55ea62c26524eede3ca13de1692cf42e3e829ae0ed82f35fb99", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050631, "uuid": "5253e8a9-aaef-4c64-9d08-bd16e6101a80", "value": "T1CA45128DA154E937F8CFAB70D9C28B2091C8ED054526A9EFB63A7F14917057353EB348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050631, "uuid": "44d9b269-a27f-41a1-aa9a-a5178e19f6cf", "value": "24576:oinj2WJ+RGRjYGHjwBacKZljghRuICEb4qQhpt58blzlVR3dYvHl9Sa:jjF0RyYGcocK3GCjqQQJGHzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050631, "uuid": "ae439a9d-4128-4c2b-becd-eb5773c79e57", "value": 1225728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050631, "uuid": "918a2099-cc74-4c64-b1bd-e368ace61c24", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050631, "uuid": "7e5ed45b-51de-43d0-8c44-a909f2752015", "value": "COAU7229898130.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d98cb3-06fd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630044831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044831, "uuid": "598e3e03-689d-4f42-8508-cd58baa37ab3", "comment": "Malware payload", "value": "a49b49fc0253c0dbbbd17e42bfbe9df6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044831, "uuid": "8897fe88-c9fd-46a7-bbb7-4a05f21a5ebc", "comment": "Malware payload", "value": "49d0b1b5280ab2b29dfafbdeedf0b360d7953bafcfcbacebddf7b50a321cb6d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044831, "uuid": "31ef6a2a-e5e1-4b77-93f8-e681629e0c14", "comment": "Malware payload", "value": "227cb9214abd56b9213ae7b65a7f953b9f9bdb5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044831, "uuid": "76175c2c-c6d7-480f-b7da-810437cb4920", "comment": "Malware payload", "value": "e707550d6c7e008260d62a63b75eb199cc9fe75eb8d17868f3f4ea676736c51d09528002732db875c93fb40b8058090a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044831, "uuid": "476f39e1-54c5-495b-a2cd-490e6418f13d", "value": "T158F2F00B67DCEAB7E6B339341F2117C0B0A4E5941724AB6F048E106579D763EAA16BF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044831, "uuid": "421d542f-6c23-4a60-ab89-3992985ef746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044831, "uuid": "3df3e59e-3d9c-4a00-ac4e-962bfc5a1ab6", "value": "768:q6LiRTtlquXp7pPPuWJknGi0mJcWZSPh1nQMX8fen8gKCB:dLoTauX9hPuNPPcWoPDnQMXD8gdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630044831, "uuid": "b5ec0275-b140-4d88-b0ef-f7c6b8ce08ed", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630044831, "uuid": "75dc9421-1d02-432e-a733-ae410d0d1e2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044831, "uuid": "ad786473-6130-4687-9f82-32b11fa05d3b", "value": "a49b49fc0253c0dbbbd17e42bfbe9df6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc6bd67-06f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630041143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041143, "uuid": "f16b79b4-ed56-422c-bd4d-046588d3a649", "comment": "Malware payload (Mirai)", "value": "cd39a84b79cbb963c01747b3a943a60a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041143, "uuid": "2d1cc8b5-46ad-42a3-b079-e8b12ff82b14", "comment": "Malware payload (Mirai)", "value": "4c0604dfbc3e3f1ee2a65cc9628b746f942681358a4307997eb86b6b8e8b8901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041143, "uuid": "c876845e-f2e1-43c2-97b8-b1ad6e2fbb6f", "comment": "Malware payload (Mirai)", "value": "5b06138925374a3a977e2b5cc895225f215dc9db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041143, "uuid": "e7c93dd6-acc2-4a2f-9183-accbf3891b96", "comment": "Malware payload (Mirai)", "value": "00af374db1a29626bed26aa30acb803e9d130571379f61ca42e9a39800829797bbe9653a72ba0caaef582d83ab5455c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041143, "uuid": "b8f59a1a-bf66-4487-9f2d-be35fcc1b7d8", "value": "T12CA33A839743CEEEF9AA8BF44F634EB463C015A734B6C053E6AC39058B252D15D19EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041143, "uuid": "50083ef9-7368-434f-af59-d20a19d6025a", "value": "1536:utHXywWZcLmbZPuxE1NY5FmkoLhh9Fd4d6l/lkwSDzok2QLKT01e27z3M6QQgUNb:6wF5u61O5DoLzzdEwk2eT/x74DQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630041143, "uuid": "9836bf57-66ba-48c3-be0a-0840c503e35c", "value": 102480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630041143, "uuid": "bb1d38b8-fa1e-4254-97dd-89535a26b9a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041143, "uuid": "01ea06c0-e86d-45d9-8987-c9c961fed11a", "value": "cd39a84b79cbb963c01747b3a943a60a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88791032-0771-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094474, "uuid": "0093a825-44ee-4d31-ae38-6fb52f645b5b", "comment": "Malware payload (Mirai)", "value": "d25a824b5fbceb32c41877778408c09d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094474, "uuid": "8a26e7ea-004c-4c18-b0cd-9e3d66eaed0c", "comment": "Malware payload (Mirai)", "value": "4cbeffe3edf28390f63ebfa7b362fece2caeb8e3758ba6f6b051f650fe2cc5c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094474, "uuid": "b5b9c8ea-33ca-4b7b-ba5e-d9932f50e93e", "comment": "Malware payload (Mirai)", "value": "6562aadff7a6fb7d887436afae346c3980173187", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094474, "uuid": "326a4951-f4e1-421b-942a-2ef71f459640", "comment": "Malware payload (Mirai)", "value": "1195008859a516e9f23a357dc1d3575cb61b0488f8749c8fd2ccefaa239428a3583a7da90df1b98d88b3bed036c8ef54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094474, "uuid": "5de83a16-6b22-4e7e-be9e-650b1266ff4f", "value": "T1C2E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094474, "uuid": "73ca8741-ac77-45fb-af25-6c388316a382", "value": "3072:Cv/WwsLgaq353qHiCOvhOp9qkDQHbeskmhxQwoVSUNu:KPLaq351hOp9qkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094474, "uuid": "fb9ac83f-2bb1-4331-afdc-94b25459e13d", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094474, "uuid": "dff9d07f-ffcf-4602-9ef8-38810c89075b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094474, "uuid": "d22fb42c-1ef0-403b-a3fa-382b29123518", "value": "d25a824b5fbceb32c41877778408c09d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af207f26-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630050730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050730, "uuid": "7d46e071-9f3f-4964-8f71-405a0bdbfb3e", "comment": "Malware payload", "value": "2c8e85e32a1555e54b35e6255c4a8fcd", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050730, "uuid": "5db80be1-e4aa-4801-8d75-61ace05ff50b", "comment": "Malware payload", "value": "4ce8c618568fa28a0877067bd09d1aa6681fc3937ffc6c2bb2e6b527c9e24c64", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050730, "uuid": "103bba12-f0fa-4eee-bf26-588a9e045014", "comment": "Malware payload", "value": "5356b410a7b310616b8417f1231d5f4a827d8f09", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050730, "uuid": "e240b470-7430-41fe-b509-f565d01104f8", "comment": "Malware payload", "value": "8298fe0cb374baefa6fac82c1d4fa45ada8419a4ec35cdd038eb78bf8823383391d8fb5d140e4620e909a4b685bd99fe", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050730, "uuid": "e4364072-2d3c-4d56-84bf-cdf62d9b0386", "value": "T1C955128FF4C1EB2BF6EEE2F494DBD02A04D8DD3C7352A6473965BD287036211A5464CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050730, "uuid": "dea912a4-f63e-47d8-941e-e60f2a8bc333", "value": "24576:ugMqldWvLdphD254x6ShEDUGRDLk0OpXdtXLWitpet9MfSmfRj1/WYu:EqyvE4x6QGtkzZL4kHftBWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050730, "uuid": "e6f318cf-a158-4873-b67a-139d6d9aeffe", "value": 1361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050730, "uuid": "5d5a9bed-3192-4eae-874f-5ef4f6fccccf", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050730, "uuid": "92ead250-b43e-4932-a2ae-abf09ac800be", "value": "PO19-003219.XLSX.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2db5aa-070a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Kovter)", "timestamp": 1630050346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050346, "uuid": "8df21390-a6f6-4144-95cc-34d4a0c5488b", "comment": "Malware payload (Kovter)", "value": "936e1e0d0b9e9371f8b2b0638b057e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050346, "uuid": "f7a6aa36-9741-4825-b98d-1dd0dcfd3b20", "comment": "Malware payload (Kovter)", "value": "4defd9f70057e085921215b34a0b170a75f04d5365c060c0eb013e8b1948b4ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050346, "uuid": "b8b81efd-09d6-4f56-9f71-4088b3301371", "comment": "Malware payload (Kovter)", "value": "449db2b11501f8f3c136bd01521e7575c8230318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050346, "uuid": "27d09430-893e-4f9a-bbe9-90719b60db29", "comment": "Malware payload (Kovter)", "value": "b59c1ef7f2f3ad7836244289e8f87415edf360177234025b158a0729cee82cb8f7002f08bd7ad768e813856367e38def", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050346, "uuid": "083f63c3-7b00-4e12-a944-54d3a5e3d09c", "value": "T16284E069F3D181F0F2E758F88D96A37EC621BC8A4611C5836794FE073AFA217D8471A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050346, "uuid": "f365349f-edb9-401c-837a-1705e314fed0", "value": "d398fe3ed3bc9d8bca9035c09fefe333", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050346, "uuid": "f60bf1f3-70f0-424f-a192-042114080b8d", "value": "12288:JFepq9KXcyrAvdZCTNweaxGjkxtte8c8tnE:J0qcXcyKGyLAg3c8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050346, "uuid": "a59598ce-2e77-4688-a988-5aa89eb1c7e1", "value": 396125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050346, "uuid": "8144467a-cc2c-4188-89a1-43000aad5582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050346, "uuid": "69aa271a-a4a0-4968-98e3-d96c2b546405", "value": "936e1e0d0b9e9371f8b2b0638b057e28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b0a959-0738-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630070154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630070154, "uuid": "ee2d801c-a62e-42b5-a545-3fa855abccb2", "comment": "Malware payload (BitRAT)", "value": "15478642d48681a67374167d173d4f84", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630070154, "uuid": "6a47cdd1-f8c8-4dbc-83c7-3b87fe1ab845", "comment": "Malware payload (BitRAT)", "value": "4e1c013bf36b27f78e0fdc7ab5a67bc3f62f33c97f5848daf40df7ec7d842fa4", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630070154, "uuid": "81dc80ea-f4cd-4d25-b2c3-05e048b2a690", "comment": "Malware payload (BitRAT)", "value": "9790217e8b9a2134f2abf451ac68c847dc31c905", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630070154, "uuid": "54f30c6b-ebf7-4389-9c2f-d6ed1521102f", "comment": "Malware payload (BitRAT)", "value": "2b4cab2a99abafed9fcf7463b9b3c361e453eadc87e54ecd503fd792929c1b92891e69b682d449db4731eeb0b2b07fec", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630070154, "uuid": "926e6f68-45d9-4ed3-8bbc-68ab5f80eb1f", "value": "T1C1369D1906A25F72D56F3ABD892BD0C7BD19D2928CB640BDCDD0892F74E3E6037A4B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630070154, "uuid": "d8e2795c-9b96-4da3-8ff2-874f4b2b427e", "value": "a015e6773f75ebc5c3c4382777305de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630070154, "uuid": "4632d016-4fba-40ca-b179-6c666fc6e1c5", "value": "98304:6jT71ntlY5xzFunCcZ2iH9oFfQPjpw6D8cKuEBQ5Qbg+db778Fm/S3DdK1NPgf6K:i3fCcZZ2VQtbXQ9A5DdK1NPgCWXaYRX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630070154, "uuid": "17847f95-dc11-4cd9-8768-f9142382adb1", "value": 5085872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630070154, "uuid": "7beae3de-de68-4d65-b798-121662542870", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630070154, "uuid": "afbdb918-faaa-48d7-9b62-7e146d4a5aba", "value": "http___185.215.113.102_Rbget.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40726765-0737-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630069442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630069442, "uuid": "3a59a164-306d-4205-b7b5-8058655ee581", "comment": "Malware payload (AgentTesla)", "value": "359560373daff1db7303af2249f27d09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630069442, "uuid": "4898e56f-61ac-4776-9290-cda221660ee2", "comment": "Malware payload (AgentTesla)", "value": "5061c37f3da83ecc313ca31367f4217866a7b0cd7e2f5ea982497ac498e18e71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630069442, "uuid": "0f90414f-5118-4c3c-86a7-3e61d4d175e3", "comment": "Malware payload (AgentTesla)", "value": "b029a9c3082e9eb242354b631391cb525349bc96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630069442, "uuid": "9d66064d-cae0-4be8-bb6e-2667fc52cf75", "comment": "Malware payload (AgentTesla)", "value": "dc3e6156484349e1bdac768add173e14383ecb5df2d2ecbe07ee88cc03663c9a52c31457048346e5a096056e79d6ca25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630069442, "uuid": "eb0df9dd-3de8-4e9f-9a78-12ae51c56c44", "value": "T109055D3D29BD222BD1B9C7B5CBE0D833F0549DAF3111AA6464D78B6A5352E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630069442, "uuid": "5642f023-a3f3-436b-962f-4c0d1fd4c074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630069442, "uuid": "ba526e67-e91a-4803-8732-79c672b4f244", "value": "12288:11UEF/uJdCqanYAtSOfZha2e8cQ1QuWr:8EduJXanYAtZfZTemGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630069442, "uuid": "31205d07-47af-48d1-962d-d0207233aa4a", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630069442, "uuid": "f79b216e-4a8a-4620-8ded-c55031546dea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630069442, "uuid": "e532e8e7-aada-4658-8d19-af2c135b958b", "value": "BANK REPORT AUTHORIZATION LETTER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5377662c-0725-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630061743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061743, "uuid": "234ccde2-39e1-4735-959d-5998446d7f74", "comment": "Malware payload (STRRAT)", "value": "a3c158be8374abd88fa2017ed42b1993", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061743, "uuid": "edc4bbc2-0d44-47f2-8c32-1d9be28d1ffe", "comment": "Malware payload (STRRAT)", "value": "541593de78f03a5c0fe6aa5146148b320daa1582e1940d8f53530daa9d839a18", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061743, "uuid": "4154e15d-79f0-4083-92b3-9fcd141084e9", "comment": "Malware payload (STRRAT)", "value": "32a0e441efd32cfe7b052f4b39cec6bf7210ef0f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061743, "uuid": "80d76f9c-f775-4cd7-9606-a4f9f06db2b4", "comment": "Malware payload (STRRAT)", "value": "b6c3b53e3857409009efed7dded37ca113f13d18dc13f1b3e7fb95335d13408d8a0735a5741624479bd22b15361757a2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061743, "uuid": "b09ef7c9-cd0b-4d3c-9845-3790d37c5b34", "value": "T1A983BF2F3DAED1B8C107917761068637E51C429CE481951F22FCEA9B0E30D691A9EEDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061743, "uuid": "d57fd3ba-e506-411f-9be9-00b078725bb8", "value": "1536:BUukjxiLjb9Atk31fd7UiBrqYYZ3Nz+2SN+n1cswwiCT3ZbR2OLaztWf31ns:ByjxiBAtuZjp/YNNz+2SN+n19di83ZbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630061743, "uuid": "b5e88f1f-8a31-4db4-9836-ee8f0811fcf5", "value": 81290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630061743, "uuid": "436728ae-5b36-4769-aebc-de3e2c2dd9a7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061743, "uuid": "5154839f-ce95-43cd-a73a-6e2e4b478961", "value": "invoice65941152.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d01e0e-06fb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BazaLoader)", "timestamp": 1630043891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043891, "uuid": "f85b7677-3e7b-4679-a171-7047bb03944d", "comment": "Malware payload (BazaLoader)", "value": "6cb719c501f0b2a917df237f37a9ccb7", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043891, "uuid": "c5d27623-dec9-41dd-9723-0bcc65e88f89", "comment": "Malware payload (BazaLoader)", "value": "542ef83f25fbe709d0eb6666fe9615d15a96e87dcd3f2e270a40a6ed9e017f12", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043891, "uuid": "c3862bc9-ec5d-4700-857d-0b03cf52fdc8", "comment": "Malware payload (BazaLoader)", "value": "ec698df0bede632a8d0a3d01742d4d8f88ad1ef7", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043891, "uuid": "e1586591-63c2-4565-ac7f-b3ae48574952", "comment": "Malware payload (BazaLoader)", "value": "19791e1f6382c60f08c552e9ac63c2e66c93476bdd16b715c3263bf670fe5f0568f10e40b9b14ee564f6aed065ae36ed", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043891, "uuid": "45f42b7b-c738-43e3-990f-792a57cff7c4", "value": "T1D9D43B9E5593314AFEF14C38FDE87AA2DA932E3C8D2ADAF35991B0313D24161D857213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043891, "uuid": "c51ac94a-4369-4d29-8e74-a91e93b4f515", "value": "35890417b8426ce9add593489cc763e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043891, "uuid": "40c747ad-daae-4c96-8dcb-dc54aeea8156", "value": "6144:uP1vcksbe7cp8t7tkbVr8AFq8BgoWwK8ExPSpANCR6EDAAcUtRndNu7oiyRqengk:uHLoWwkxapzR6YBtlju7oiyRZKV1yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630043891, "uuid": "0af01d02-ce2f-482f-9048-6d228de7c234", "value": 633983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630043891, "uuid": "93a9155a-1d42-4c91-a530-a79e533f8cec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043891, "uuid": "23bdfea9-3cef-4a30-ab89-8fb1596949e2", "value": "stopSetInstall.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76134528-06f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630040326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040326, "uuid": "264d8a12-6f70-448b-8d15-30a1736b7cb3", "comment": "Malware payload (Mirai)", "value": "c10f151b76b3c6c1efa2a156fc717011", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040326, "uuid": "17b30708-36e0-4416-a993-8ff819f59040", "comment": "Malware payload (Mirai)", "value": "555ae4193c53af15bdcd82d534ed5f13fcc96c16c59b9e8072b5b122c6df8d4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040326, "uuid": "0be9329c-aa91-495f-ac12-59cd0448b2d6", "comment": "Malware payload (Mirai)", "value": "23b097cc791e12f0db3ca1519dd2437040ab51a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040326, "uuid": "f385b532-4770-4149-9507-3255b926df30", "comment": "Malware payload (Mirai)", "value": "5fe465c1f21d7961ea8ae973e2071115a95fd18267832e167b9bc90d4bc09bd486b5ca0b30669d54a7887fff959d9c38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040326, "uuid": "5ca67845-6ad4-41be-9664-e5c0f6da75af", "value": "T11B43824A2D218FADFB6CC73587B78E319758339626E2C684E15CE9011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040326, "uuid": "98ab91ff-8c7a-44d1-90b4-40f35b7a216f", "value": "768:LG1h9hgc2Uy82c/41EuDDDnFmRHWEM8OsKuqVhojfHTh49mjH2D/syef2ZgOSUpN:uM1EuDnU211PV+jbIDDef+JtQkXCM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040326, "uuid": "ced49f93-a05f-4f10-ba60-2f3d3341d770", "value": 59488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040326, "uuid": "bc6c0878-2771-42e5-8043-554b67881315", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040326, "uuid": "f9e2a6f7-d5f8-4992-a197-56011c4c6d1a", "value": "c10f151b76b3c6c1efa2a156fc717011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7aad08-06d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630027961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630027961, "uuid": "3ccd4f1e-2e24-4040-a568-7349620091b4", "comment": "Malware payload (DanaBot)", "value": "e84028b94d3abf5f753fe4ef54b4427e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630027961, "uuid": "998223f2-ebb5-4d6f-9b10-24230d3f5ad9", "comment": "Malware payload (DanaBot)", "value": "55f0976368822adb482407f46a40dcb9e0f2cc7e874d8b67c2bc82d82f7131e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630027961, "uuid": "a82f7738-855a-4390-b83c-ee27f25f23c9", "comment": "Malware payload (DanaBot)", "value": "6b49249dd5b5cddd81a40e043efba289972ad8b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630027961, "uuid": "81a6381c-8a06-4db1-a0a4-e62e623a1cf6", "comment": "Malware payload (DanaBot)", "value": "ca0467d77d070004eb33d92bc1a554df1cb8f5c04b55184472af08b51cadea121fafa231df1a5432dca0edd1ee20a82f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630027961, "uuid": "be23d2c9-bb5d-45e0-b973-8895a17f582c", "value": "T12C451231AB90C038E4B761F486B693BDB5287AB1976450CF53E112ED1A346F8ED3079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630027961, "uuid": "3d968291-fc10-48fc-98c3-557c9807c9a7", "value": "3b142de1de00907afa014d92f674693b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630027961, "uuid": "cba50078-6910-4b1e-b0c4-ae471c304ae9", "value": "24576:B67kak6S99HaKXLT75+6LdwjeiCjHoC36i/38mhKMbbojl:B9Xj5+6hiy36i/3jhKMbkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630027961, "uuid": "0fecbbd5-567e-4684-999d-b561e7037fb9", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630027961, "uuid": "64ae9835-2f61-4184-ba6a-eb3ca2e9ade3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630027961, "uuid": "eab7f824-e2a8-48d7-8a5e-46d44093aab0", "value": "e84028b94d3abf5f753fe4ef54b4427e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4036ddb6-0756-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630082756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630082756, "uuid": "f7957820-50a2-4e30-b0ea-06d925f6e41e", "comment": "Malware payload (RaccoonStealer)", "value": "ebc39bb40f527f80d29896197cd92a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630082756, "uuid": "e211bed7-2f0b-4973-9be8-f7f3969874c3", "comment": "Malware payload (RaccoonStealer)", "value": "59009e44b1435b3670b6e90a7fb319af6618ec7a44abef14cbe2f68a0ab7d491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630082756, "uuid": "f5d25dc2-2db4-4ed7-8a54-9a093eff6619", "comment": "Malware payload (RaccoonStealer)", "value": "2fa9e6399eb1bf1204272630ba26b39a3533b6d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630082756, "uuid": "30c2fd7e-b4fc-4dbc-9ce0-1df9817a3649", "comment": "Malware payload (RaccoonStealer)", "value": "4dffefdd5901d9b8c77de77dee30d33a31817bc1febf3312ec33597861b1c4b4caa862d4d89c8ff3f8410f6f98261f66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630082756, "uuid": "47c6254d-d451-486d-ad79-81e8f86e1c51", "value": "T104B4E030A690C035E4F757F899BA8279B5287EB09B7051CF53D126EA06386F8ED3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630082756, "uuid": "d7173ff5-bc63-43eb-a4fd-6756730c0d6a", "value": "e68f2e15edc1c604720a74f10b8483a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630082756, "uuid": "d21f5c53-69eb-4c5c-87ce-14bfbac07c4d", "value": "12288:GevbjIcY09g8kGHdoojE5n0rvXk97zkhjzCvrlpO72:Fj8RUkoXvXktzkcvrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630082756, "uuid": "8ed5d749-1e99-49a1-b531-36da7fc25589", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630082756, "uuid": "b971e0d0-bd11-466a-9e2b-34e418d22911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630082756, "uuid": "7dfdc9c7-56b9-411d-bccd-bda34ae1af55", "value": "ebc39bb40f527f80d29896197cd92a3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62151d0-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630076109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076109, "uuid": "5c0a4646-1202-4837-807d-125af8fac387", "comment": "Malware payload", "value": "d0adeb848073139cf2e1fb69ec5af254", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076109, "uuid": "ae6d454c-7778-4d96-9b84-86299878ef39", "comment": "Malware payload", "value": "595506e6f9a5928604d4e7caa6461da516003c9a0c31908e2b66b79a00d66d2f", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076109, "uuid": "d1266393-fa9d-4d40-ba3b-8d2b72a5de50", "comment": "Malware payload", "value": "6680be32d7ab888502e634cabcc870ff756f30a3", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076109, "uuid": "60c4aec9-c5a0-472e-983e-f6e4c223c99f", "comment": "Malware payload", "value": "9d9e85d5968a5c79bae4d79c4622f4b0164f112f87396917ae69224b3ce2c0930afef9dd0bbf2bc721ab10409f4fb5d9", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076109, "uuid": "af011e8c-d6de-42c1-b8d1-d2fde1f518e4", "value": "T1BA51840AEC4BD54CAF79236BED878A22FF1B811B5D93104C75DCC2495F30809A6ACF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076109, "uuid": "d9d04a88-b593-4966-8ee6-13f1e6f38e96", "value": "48:Acw+4HOjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQBoze:nwbWChrffoypvK0elkEYZa5ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076109, "uuid": "1e127cbc-eff3-4d14-9dd3-9726c6f9db95", "value": 3157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076109, "uuid": "114435d1-206b-481d-bada-1f67110200b7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076109, "uuid": "afe205e2-5b86-4186-8240-4c4e889272f4", "value": "B6xHnPVT.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03faf4b3-0712-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630053449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053449, "uuid": "b498aaa5-9a78-4c07-8702-52a97ce57814", "comment": "Malware payload (ArkeiStealer)", "value": "784d1f5c2ef013a0523ca0616f62698d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053449, "uuid": "89cc1211-730a-47d2-8cd0-72e011dcf3c7", "comment": "Malware payload (ArkeiStealer)", "value": "598d944c8f0ef8d8536487bb9b62ff8fbf6758b37da5132e17fb31e07acddc65", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053449, "uuid": "ac92ff07-25fb-4374-8c1c-54ef3ae3ed2b", "comment": "Malware payload (ArkeiStealer)", "value": "e4c76b676705a8ffcecb6fc8a9c2424300c9bd6c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053449, "uuid": "1681fdbb-4633-4b9b-982b-8c16e71e93fc", "comment": "Malware payload (ArkeiStealer)", "value": "d894e3b767090c02db9bc885a2802e00f08ae8964ea9b5950dfe1ec28492a00c28e9d002da0373627a0ef1fa8e78c59d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053449, "uuid": "65c8a9bf-6316-4789-acb9-a659ea53871d", "value": "T160B58E1869BFD019A0B3FE917EDCA8FADADE55E3240D743B109153174B22B80DE8B479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053449, "uuid": "56870b00-8033-4e7e-827b-70dfd489f02b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053449, "uuid": "fbc7c34b-d0d8-4330-b250-166773320326", "value": "24576:6mxGB0x427UGZgDcF8B9JgQLsuJp+t/wF1FWQ70JKlXQPsnrjv/pbxH0LGn5LtpL:6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053449, "uuid": "bdb2df04-1c9d-486c-80e0-b5965838e785", "value": 2485248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053449, "uuid": "e6e825fc-6903-4e1f-8081-6c9660c7ab01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053449, "uuid": "152a1b2b-8135-4537-a3e1-536e989733cb", "value": "784d1f5c2ef013a0523ca0616f62698d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699856e0-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630050613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050613, "uuid": "7cd15394-573e-43b1-af1b-f390caeff01d", "comment": "Malware payload (STRRAT)", "value": "73b16707becb49081784b85180af8fe6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050613, "uuid": "7c87ef24-b674-4ee2-991b-542345c28d03", "comment": "Malware payload (STRRAT)", "value": "59ec302ae2e1ce1d95a445986737455f84961c2287a7b4fc381b601442fb18f2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050613, "uuid": "db809148-d9ac-4697-815c-a7d207383864", "comment": "Malware payload (STRRAT)", "value": "4e69a183a5ec727a675efe11910e7a1257887bbd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050613, "uuid": "138015d1-4a70-4ad1-aa17-c0f49eeda5c8", "comment": "Malware payload (STRRAT)", "value": "33321a826b7454d04ffc492a69d0a8a91eade45785778062c790d728ef587c5033f60558533bcc76d04353914b07666b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050613, "uuid": "98ed1763-fb61-4340-a247-9e2f9b1b2445", "value": "T10FA3D02FBD7AC5A5E12741F256586363DB0D4688E84AA12F39FC5D4E4CB0CBC0606ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050613, "uuid": "e70ce4f1-d2a1-4842-bcc5-a787bbe1dee3", "value": "1536:a2ekI6k+IGOJ7hMjdNZSFd/H7Fjk8DdE/AbF9mq5RNP3KolPWmP/fZREB4Ajuzt7:aJk/hP27+/cF48Dj7mqLZQmP/fZRZzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050613, "uuid": "a87d2303-e8d4-429c-8c03-5e278f27dadb", "value": 107207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050613, "uuid": "e95436d9-1b29-4765-a94e-d1ead1553587", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050613, "uuid": "9d1c31f7-b523-4495-88a3-d132a85c510a", "value": "quote.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2492aaaa-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630053075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053075, "uuid": "0ab929c9-934d-439f-ac5b-75f728a14063", "comment": "Malware payload (Smoke Loader)", "value": "d2444b194223f262895bcb85cbb629a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053075, "uuid": "5a5ad36d-3b9d-4b29-9d37-ec7e20d5c13a", "comment": "Malware payload (Smoke Loader)", "value": "5be78e39793850a5e7574939c9b240b4dc7681da60e748cdc47c3d3a0858bc25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053075, "uuid": "147a1c09-d595-49e2-befa-eb548cfe92d7", "comment": "Malware payload (Smoke Loader)", "value": "f9ce98eabbc6ec5f8d970a2f6951b273ef3b2a5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053075, "uuid": "d81a59ca-cc79-401e-aee9-7409dd79b087", "comment": "Malware payload (Smoke Loader)", "value": "cae4144c5a5d0564bf671cca84457201598576e81a2be7fbd93c1af4db76fd57a52f72cdf663e8d9275d18abffa6ccde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053075, "uuid": "9249c2ad-b213-4347-8e98-0fd4005a4955", "value": "T127448D30AB90C035F1B712F856BA83B8A53A7AB1673440CF53D51AEA1B346E5ED30B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053075, "uuid": "4499c003-1bc3-4460-aacf-bb54bda16f4f", "value": "bca655fc687feaa215487bc7467daf1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053075, "uuid": "a446c88d-2579-4b80-84a5-505cff7668a6", "value": "6144:1kVHjbICUZVn9DjyU19UpjLyJRgQKEOFjV9231gxM:qHAXZVn9f19U5L21G5923", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053075, "uuid": "5f54c9ae-6337-4763-b207-82f1d6f54f77", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053075, "uuid": "af1aaa6f-44bd-4a66-ae20-199c90568257", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053075, "uuid": "c202a12b-2481-4dbe-aaa8-ac9683b04925", "value": "d2444b194223f262895bcb85cbb629a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedb1bea-0770-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094189, "uuid": "edb2b676-02fa-4eee-87a4-4bb5cfc92665", "comment": "Malware payload (Mirai)", "value": "02169dae2ce36f553c768d78439735ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094189, "uuid": "5eceef00-24c1-4112-ae40-c40e799f5af3", "comment": "Malware payload (Mirai)", "value": "5c5cf3e0449fadee446390578864504b6a6d0a48fc5fe53962cdcd7153a6d3b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094189, "uuid": "d7b16e34-6cbe-48f6-bd9e-a4ca1d6f3d9f", "comment": "Malware payload (Mirai)", "value": "3850af7f6a1844a295131a6ebf171560af100b08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094189, "uuid": "7bd1fd8b-f2d6-4926-bd43-1c25160d0518", "comment": "Malware payload (Mirai)", "value": "eae6e6a4d82b8e3c5fecc2e599b2119bde6e0326b7d8d296be7a949483775481dc769872f4084be7e56e6e04d6ea6c05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094189, "uuid": "4e021045-3a6f-49be-8dd2-74b411970a65", "value": "T178E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094189, "uuid": "5b6d0851-574a-4dc6-9310-5829608f3a57", "value": "3072:JW6dm9tS1aRGQdK76t/zCuI5mrThPaLEnvPrNb:c6IG+LC/mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094189, "uuid": "8782b038-8232-489b-b79d-5eda32fb8423", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094189, "uuid": "c531d139-d0a2-46bd-8364-ac8a753ab9fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094189, "uuid": "2b9bc975-fd0c-4a3c-a12c-5d509959ee62", "value": "02169dae2ce36f553c768d78439735ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed713304-0747-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630076604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076604, "uuid": "2f0b857b-3d36-45cc-a89c-4411120d667d", "comment": "Malware payload (Smoke Loader)", "value": "a054f5093f6730a9cf19aee1d055cd77", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076604, "uuid": "3709b011-172a-4153-9742-09f4fbd31d8e", "comment": "Malware payload (Smoke Loader)", "value": "5c5f1c427d4a21ba2aa034ccbc470134106808437899c65ec5f184c2176895b8", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076604, "uuid": "8c1decf4-1456-4f66-b17e-54ad3ccbcc81", "comment": "Malware payload (Smoke Loader)", "value": "0617a06ce029aec01c1b68c7aacdf2067bacb82b", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076604, "uuid": "583fe091-26fa-4987-be93-38410c53930c", "comment": "Malware payload (Smoke Loader)", "value": "b81e87d82cc06800b8e152993d3a058723411a6ce90b186971233063d0b8d16ff0ccf78924141858599c59939b644096", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076604, "uuid": "ea9621a5-32c7-4443-be0f-9e5daee6d176", "value": "T1E8448C30AB90C035F5B311F85AB6837CE5297A70673490CF52D52AEE1A346E9ED31B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076604, "uuid": "f263bac2-983f-49cc-9f93-7e8eadaca9f4", "value": "a3712f5292e4f38ef3a6c28b5ac50fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076604, "uuid": "432a0622-0f18-4283-8609-b3e984e08854", "value": "6144:DNR8jwBbvUhwm0ScuvfpAgGOa+ROISirsYcj:H8q7Uhw6cuXp/RCPiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076604, "uuid": "2f808d7e-79fd-4c92-92d0-ab9d89fd2e59", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076604, "uuid": "031e753a-b45e-4329-8e09-75cc50abbecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076604, "uuid": "1a3f6f4b-19fd-443e-82fd-c7b723bcb905", "value": "a054f5093f6730a9cf19aee1d055cd77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426979aa-0714-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BlackMatter)", "timestamp": 1630054413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054413, "uuid": "c67dacf6-00e0-4b59-9f7e-74fcb347c633", "comment": "Malware payload (BlackMatter)", "value": "38035325b785329e3f618b2a0b90eb75", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054413, "uuid": "0ac5e24c-d733-40f3-abac-d69c8813eca5", "comment": "Malware payload (BlackMatter)", "value": "5da8d2e1b36be0d661d276ea6523760dbe3fa4f3fdb7e32b144812ce50c483fa", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054413, "uuid": "3e806ce1-1aee-403a-9a76-fe7abcd04385", "comment": "Malware payload (BlackMatter)", "value": "33294a6c609b6ced2acef3964d7ec34dc0101a9a", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054413, "uuid": "0c6353d3-7407-4a86-8d1e-a6d071099110", "comment": "Malware payload (BlackMatter)", "value": "21aba68581d37eef7469c3ff2f24ab6168ccab3b48653ff6c5c2ada1bdabeb50a375a81bf7216ac03acc9088e138ce8e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054413, "uuid": "f21d76dc-942a-41e1-9663-0ca291bfb0ea", "value": "T18F735A1430639077E4921AF396AD36D8BB29AE7C09A574BBF9E41F042977413BF2049F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054413, "uuid": "9ed77dee-2306-436d-b1af-de519ef07340", "value": "2e4ae81fc349a1616df79a6f5499743f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054413, "uuid": "ec337dac-77a8-4261-99a6-47ec8a7b2fa5", "value": "1536:WnICS4ArFnRoHhcVyid9EZZoi+zQQaHYqf5O4QN:BZnmqVyq9EN+MvlZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630054413, "uuid": "5fd7e145-1d17-4dcb-b434-c5aa3a6d693d", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630054413, "uuid": "070b5638-2ea0-4e19-8bb7-0ec6bd1b9024", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054413, "uuid": "3663f773-777d-4ba8-ae08-151516458fbc", "value": "5da8d2e1b36be0d661d276ea6523760dbe3fa4f3fdb7e32b144812ce50c483fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a525ff-0717-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630055819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055819, "uuid": "2e20b33a-259d-41a6-947e-bb26911ff150", "comment": "Malware payload (AgentTesla)", "value": "887f2d8955b8baf604006452e3711e4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055819, "uuid": "014ca109-3000-49ed-86e2-1d576798bf10", "comment": "Malware payload (AgentTesla)", "value": "62401c134eb8bb2211fb5a461706bf1b1594f06c1154312cfdb821de660c5601", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055819, "uuid": "1311f8b5-a9ab-4525-88b9-e9b9569886ca", "comment": "Malware payload (AgentTesla)", "value": "3aeff54dfeb11032bafe6496c95b2da384162054", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055819, "uuid": "7f62c965-6b93-4914-a215-df29d8d04989", "comment": "Malware payload (AgentTesla)", "value": "46a75ccc4dec460d1c880dc065a206da0005bca64c80d9a6ff5ce4849e6ad6cfed0412000e8e36d6cba494d2795cb2e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055819, "uuid": "d2e40d0f-699c-4199-b007-1598476e5607", "value": "T17435A13D69B92227DD79C7B58BE18823F154BCAF3130A96C58C763A64353A4235D323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055819, "uuid": "7e563419-dd75-422d-947a-433b19dc85b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055819, "uuid": "6d565029-8cf9-4c54-ae8f-92e6db49bb2d", "value": "12288:C5yiJX6OV46ZsWRmwpZ+nUkUEFgdjLo+7/0uTs84QPujP:iJX6OVjZssmxr+ls0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630055819, "uuid": "80209f71-5d75-4f03-8261-6a9746ce2474", "value": 1108480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630055819, "uuid": "01e633f7-e615-4177-ae48-1b629ea392e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055819, "uuid": "fa94eeed-4a2e-414e-8c62-51d40935127a", "value": "UAE HC3ED23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71e7860-0706-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630048623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630048623, "uuid": "74eee1a6-6302-4de1-a31c-b2f6333ea94e", "comment": "Malware payload (SnakeKeylogger)", "value": "924c3a18f70d9337bd54151fa103a7fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630048623, "uuid": "48344f08-7b87-4707-a945-7286fe15f039", "comment": "Malware payload (SnakeKeylogger)", "value": "62488642461ae96d137e5f3a8cadecc900975889cc9f2c8b94894ba0cf1204c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630048623, "uuid": "29ecc9af-bb0e-4072-a189-b9c976a32917", "comment": "Malware payload (SnakeKeylogger)", "value": "ecb3ca627c807cf47b58f51bf412997b2ada80e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630048623, "uuid": "9dabccf7-0108-436e-9faa-ad948942d5ac", "comment": "Malware payload (SnakeKeylogger)", "value": "80b0ec0aeb07a4117292a91a3ee37e4279fc25d4048e321fd7c6cd9171ca95097f33808da2a821a3faf44818aa383824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630048623, "uuid": "b1a6656f-2d83-4637-8c60-ce55775f6b9d", "value": "T1EA64F15927BDBBA2D9AD0FB8F465822007F8FEE61843FB585B4478F419B33600B506D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630048623, "uuid": "1a335149-6a83-4e54-af20-cc23447fb8cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630048623, "uuid": "b0400829-1057-4619-9fc0-021310a27e4a", "value": "6144:Pr/b49xtvJ/xaOUsb+eUYZktySKi6IaqNb9RaztIdnRv1I:g9jFxrUsaejZqym6I1ZRazqRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630048623, "uuid": "04cd45b7-aeb3-465e-9079-922bfad625a7", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630048623, "uuid": "3a27b2da-694d-466b-b46b-e73a9456a0a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630048623, "uuid": "39ffcf4a-78d9-4c30-bc68-92cea55a405d", "value": "defects.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22799329-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630050494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050494, "uuid": "10e387ec-71b7-41d5-a4cf-96fd64b49728", "comment": "Malware payload (Formbook)", "value": "c0cdde350fd3c1e7e1c4ccb723d741b9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050494, "uuid": "5765f230-c140-44e7-9d77-acebd0f8f9f2", "comment": "Malware payload (Formbook)", "value": "62d0b4c65b13626421d99d674713e7c7127a4c0ad6cad0ed6d7c4f2b0af748ed", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050494, "uuid": "70d25d70-66e7-4be1-92df-d232a909f318", "comment": "Malware payload (Formbook)", "value": "e329dc867d11ec593addf9afa2a1ca48b9526243", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050494, "uuid": "169cb487-e2c1-4a45-944f-e0d11d226191", "comment": "Malware payload (Formbook)", "value": "7e26268ace62c3c38376428260cbe06787ee6fed0aba3883205823a9aa92ff8eb10fcfe18fff1fcfaf9badce098e2284", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050494, "uuid": "ecb615b8-0737-4d3c-a19b-b9a3c7618888", "value": "T16BA262ADC02706888F89AB786B1BAF58114C772DF7859633363C6B3527E6D3A541783C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050494, "uuid": "6ba11834-ff51-46a3-9d7c-a09fdd8c3932", "value": "192:gd7pidBQYle2oBDdDqgGpYfWguHRvqP6x4toqjbF9mE/rG0ASxEsJNnEn:gd7kl4epNvW6CzjrTj7Vjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050494, "uuid": "447584e7-f843-4a05-a7fe-223e9441ce3c", "value": 21890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050494, "uuid": "a19d4216-3d12-4705-b285-396c0ffa6b01", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050494, "uuid": "6b5f69a4-ff27-42fc-81f5-ce99f63638d5", "value": "invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244ef6d6-0744-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BazaLoader)", "timestamp": 1630074978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074978, "uuid": "cce39ff3-a7f3-455e-b1c1-a237085a4dde", "comment": "Malware payload (BazaLoader)", "value": "21fbbbe8b0905cd38331721737ad346c", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074978, "uuid": "fb06f016-a523-41f6-8254-1d34d22e9a4a", "comment": "Malware payload (BazaLoader)", "value": "62e646b44c307979e5385208bf0c698a08f8db0b9bdb839815b8bcd5ed9e3a38", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074978, "uuid": "b5ff78e2-f3c8-4c17-94ab-8c9fcc9323fa", "comment": "Malware payload (BazaLoader)", "value": "b52eab6611c4cb01032fad5054e73dfe93913a71", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074978, "uuid": "1990ba5c-a1c0-4f6f-8706-97bd6f6a97d0", "comment": "Malware payload (BazaLoader)", "value": "a126a56807bd29d28d81d193a2a7bb592ccc43269bc707eb00b3fe6c473ee6686d7f913ab2cebd08e68f5828b89a7dba", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074978, "uuid": "f5a2dffb-7d1b-47c4-85fc-1a0e830d1e42", "value": "T13135909514C4AFE7DCB6F4FD8EEAE016FD121650C1E5854946C0084A0AF93F3A6AFB39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074978, "uuid": "7e987e94-71a4-4a79-a09d-84394add62dd", "value": "65819c91413f83b464d6a3d119bd6467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074978, "uuid": "89c970c5-5589-434e-a891-94aa7933f407", "value": "12288:9fHnu1hxBOwTdG7MDsDbQg779SweGIvdZOyjGU+G0VCspXMl3A6Gnzq9PBa8nT6:pHK3OwTd8MQDbQgHgUIv1jGUXuCs9qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630074978, "uuid": "0efcdab5-781b-4a59-ac96-ed86a4870cca", "value": 1089665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630074978, "uuid": "9845d2a1-9045-4e38-b61e-aa19a64fe876", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074978, "uuid": "5fef23b0-e178-4601-8874-c4ceebd1328a", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904450ae-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630076019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076019, "uuid": "b8b29bcd-64c7-4271-9493-e4413f9886e4", "comment": "Malware payload (GuLoader)", "value": "2ad87765fd019e8ef963ac7410253804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076019, "uuid": "c81cddb3-2cc4-46fd-adc5-426b2b65e4b7", "comment": "Malware payload (GuLoader)", "value": "63e59c5359a142097952bfe67c232c599e45414ae2fe479fff75aa61ecf27b40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076019, "uuid": "539c06cb-decf-4b71-87d0-9bc892b60e50", "comment": "Malware payload (GuLoader)", "value": "5d7a3cd19f18019f4759802e915ea1eec9137dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076019, "uuid": "e4f17b27-410b-4646-b5c4-20e1eaf73060", "comment": "Malware payload (GuLoader)", "value": "78296cd92d82a54cc7fb990a115a331c14baa9be23210d228f854303d520749678e0c3ce1d6e15c03f35fe4b4b8309ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076019, "uuid": "989cfd31-ac0b-4d86-985e-63e1f50a8e8d", "value": "T1DE738D5760EAB96DC0F2EAF4019428943AF09214D1797E19C5F5CEA9173284E8EDBF0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076019, "uuid": "d20b2b60-560a-45c5-9c9e-19512f3aaef7", "value": "768:7RZGz/UruwDyQW5IdEqqn72bWmNA1lULJH9kWvk2MA4qvvvvd8SlqXstL:tELUSwDc5gJ7Te1+sWvEA4wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076019, "uuid": "8f835226-9e7b-4847-a5e8-5e0ecb9f2e2e", "value": 73518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076019, "uuid": "c19901fc-6c07-4b13-a020-0f4a2f68f7c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076019, "uuid": "a43160fc-a00a-46a3-b7d2-657653fe7f4e", "value": "2ad87765fd019e8ef963ac7410253804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b2d905-070a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630050149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050149, "uuid": "aac04d5f-1b59-4f6b-8cb4-4082abf322d9", "comment": "Malware payload", "value": "52a89f9299fcfcd3f735ef4de56dbf43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050149, "uuid": "c1e52bde-60a4-4ad0-ac98-0fb1082b7b28", "comment": "Malware payload", "value": "652a99e4187cfb5b48548703c725050d2d1ed51aee4c3c8d6cb1e1cf1aab910a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050149, "uuid": "14aacce5-3ba9-405d-b23f-ca4ce21de703", "comment": "Malware payload", "value": "7a77b8ed6d98cdd8f9c5374bf79bbe8dd989e44c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050149, "uuid": "8a74140b-8d19-46b8-9aae-2fd4022cb9d2", "comment": "Malware payload", "value": "c476430dfc3120b4bf17292afb1f02f092bba049f8c26a9ceba1d498aa88ef9798ccbb3fef0ef1c84fbc286134f8a73e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050149, "uuid": "83ddeaeb-f175-4735-8735-0cf3541cdfb0", "value": "T19AE25419EFA14EABEC6FDD3345F80B4534CDA40B12A57B393A34D928B61B50B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050149, "uuid": "7149e8db-6018-421b-a12e-34e0161cb73a", "value": "768:51ii+dfqEFXa8MHChlP/yTw67m4wefSUeWGVDKGrVNmNpXi3GxVrbIzKQmr:aiZEFXa8MHCP/r7GSU6DWfrc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050149, "uuid": "7a6f32ae-fd04-4171-96eb-97b43d7211e9", "value": 32196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050149, "uuid": "06aa2e8c-cf92-4629-aa71-90f71cc6c9a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050149, "uuid": "ff263526-3a23-484f-a58c-9786872f8e7f", "value": "SecuriteInfo.com.Linux.Siggen.4106.28607.4282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09590362-06f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630040574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040574, "uuid": "88e8854f-fa6c-450a-addc-139a9bf96809", "comment": "Malware payload (Mirai)", "value": "2193381c79803c9374a053c54d4e369a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040574, "uuid": "cda28027-860a-46d0-ac96-38465f30908d", "comment": "Malware payload (Mirai)", "value": "66295462e3cb69c572306973deef5226dd2debdac7df4d6fb1dc7c221c2b64e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040574, "uuid": "a69cb348-0ed7-40fa-8cd7-afe9484680ae", "comment": "Malware payload (Mirai)", "value": "d797299cb655bf4e4e4d210ffb9328fea6810d58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040574, "uuid": "4812d507-0954-4b84-8b07-bd9895c11277", "comment": "Malware payload (Mirai)", "value": "ee375d594d707208ce5995cc6d173e16770eeba7b3d9eb83cbdbe903cb30e04b2d83ace91e3d97c0a6ede0dcf17dadb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040574, "uuid": "c365ba7b-298f-4d1d-8bf9-a7ed7956eaaf", "value": "T1DD232A41BC91D917C6D823BAFA1E12CD37266398E1DE7203DD252F51378A82F0E7B256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040574, "uuid": "e141c49a-f60d-48a5-8ce0-097d9610234b", "value": "768:AEXPs/Hsl2Xcrpc+Q6K5p54cfzifNlJ4CtbVgPHCLZp7g3Q5p1pQdDz6lF:zPs/Hsg8pc+Q34cLiFlJzo8gQpvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040574, "uuid": "0969beca-3bbd-45f3-b502-1a7a62902f0d", "value": 45940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040574, "uuid": "c5517856-cb77-4e52-8a3d-2ba3ee4a118b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040574, "uuid": "b8335a9b-4da2-4176-8927-31fa765326fa", "value": "2193381c79803c9374a053c54d4e369a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf433fc-0710-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630052765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052765, "uuid": "2f35c2af-fed4-4cab-8e72-8e9f255a8446", "comment": "Malware payload (Loki)", "value": "075cbb286addebef69282e3cfbfd9355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052765, "uuid": "8ccbade7-3fa0-400c-8b90-b3f4fb7b516b", "comment": "Malware payload (Loki)", "value": "66ea8fac7f43257708ae64c55cb78f6d08e3b2467afc6c35eb89946680ec8377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052765, "uuid": "cf4ec946-6c6a-45a3-bbfa-9d4cd240731a", "comment": "Malware payload (Loki)", "value": "d06b4cec6dbb0306bc6634c490face7eda34238e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052765, "uuid": "421982b6-4074-4cc2-b351-6f260f74e35e", "comment": "Malware payload (Loki)", "value": "da35fa0dbb604ca611cde4fd49f5f5b3e83ef850662ba2ba848b7e1d5b835c4aa56583eed9a5f66de65a387351d0b004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052765, "uuid": "a08abc67-ddba-4f0f-9ee8-ee9222b11969", "value": "T198F45D3D29FD2237D1B9C795CBE09827F554A8AF3110ADA468D383AA4356E4275C323F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052765, "uuid": "58433151-07c0-466a-bba8-f4827165e0d3", "value": "12288:QIQr/XGlccuy5uu+ti3vZhfbkJIjqAzvXe:Ir/XGlz87iTbkYJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052765, "uuid": "7acda400-aaee-4cae-bf53-0eba9aac5e4e", "value": 770005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052765, "uuid": "57c7583c-7189-41cd-9477-b21d1d2b734c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052765, "uuid": "e20fd866-2c25-4e2a-addc-90be94a6d4b0", "value": "075cbb286addebef69282e3cfbfd9355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f7ce2a-071e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630058660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058660, "uuid": "c8086700-a866-4fa9-9ed2-77c58ffa0fb1", "comment": "Malware payload (Mirai)", "value": "90363f92bf600c4746b4e3ba29c77692", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058660, "uuid": "dbdde9b1-ed13-4f01-b8af-d7186e9a4d93", "comment": "Malware payload (Mirai)", "value": "66fa259ca495ae4e88646e280c4f439bb5418dd1e58be9bf95ef0db5a97fd098", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058660, "uuid": "3d6d2dab-29f4-4161-89a9-cdf39c2f28a7", "comment": "Malware payload (Mirai)", "value": "3b680ba848098970d3e7f138c7096b8e7ea9b01e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058660, "uuid": "80bab65c-5e9f-4b52-a8cc-e104dc4d0842", "comment": "Malware payload (Mirai)", "value": "cd9fb49ce3962b09ab5814310c511ec0f47e60f15a6f331729d870277b35f06f6c5614898d3a3475f35e16e6095f4511", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058660, "uuid": "a85f137d-650f-4505-84ef-5d4319621365", "value": "T1BC932A47BA91DE16D4C203BAFE5F031833127BA8E2DE7212DF24EF642B865DB4D26511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058660, "uuid": "acc570fb-d8b8-4087-9e00-3bd033271375", "value": "1536:uFnsGLgfbxlsf6oOaNiL+ICi6ALJ5WHXK5jYNwrNehuGvTEq:33GOaBALJ5WHXKpKwrNeIGvoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630058660, "uuid": "0ba0d827-1451-4aa5-8abf-2a637d583df9", "value": 92340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630058660, "uuid": "0b79d3df-37d7-41c6-8582-8ff5199baf50", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058660, "uuid": "121a1355-3519-4b74-9191-b82448aa16cf", "value": "90363f92bf600c4746b4e3ba29c77692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b032dbc1-06f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1630040424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040424, "uuid": "85673212-7a9c-4d25-9cd0-dfaf83eb90b7", "comment": "Malware payload (Dridex)", "value": "a2c869a9287b07e8601a847b681d6080", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040424, "uuid": "ef98e553-bae4-4577-8cdc-85e9b3aee3bf", "comment": "Malware payload (Dridex)", "value": "6878b5e139b743a2a6c9cc23c3837d4e935cdf8d4283a33c56358b9408c6960a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040424, "uuid": "77b51029-79e2-4ef8-967a-6bcabd81d945", "comment": "Malware payload (Dridex)", "value": "ebe0973e63917232f8608839f295c32cb209f817", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040424, "uuid": "ec1f6973-2210-42e8-aecf-1678a7871a88", "comment": "Malware payload (Dridex)", "value": "17cac9663e241be7a7ed762506db6f41fd87e56f527857375213267d5af5babcf33a43c11ad39e0e87fbe05308a2651d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040424, "uuid": "102be61c-573f-4c12-8c93-8230b4d78912", "value": "T175E4D07639FC6827E016F6B4CE1B8B714362BD4519F51E2A72B43C4B36B768A3502372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040424, "uuid": "b23eb341-57fa-4130-9d33-34d0604edee2", "value": "7c308a203a4dfc44a0e2bb332b3c2e1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040424, "uuid": "e0b4c6e6-469a-458c-97d1-bcb4e2c5d4ef", "value": "6144:QK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yTwaLPLliK9LUPe3K2J2J7zG3Z4AH/:QM+ZdkmHubeaCo6yLPxhL+eTJ2Jm3Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040424, "uuid": "69ecefb3-1d17-410f-b04c-210de752c8a3", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040424, "uuid": "d53803ff-5ff1-46d8-afd6-bab76fad0c75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040424, "uuid": "e2d0bba3-ff63-4602-b73f-098e72bfb324", "value": "a2c869a9287b07e8601a847b681d6080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acf13ce-0748-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630076707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076707, "uuid": "8338cc74-7077-447b-be8f-494e00b3fa2d", "comment": "Malware payload", "value": "2e012ed5da6bc435362d3c73ea0be5aa", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076707, "uuid": "78388787-2d0c-4354-8966-72ba3986013a", "comment": "Malware payload", "value": "69c0e53618d250d748170947b90c501594f29c5c893a22b7b3acbca48d37b762", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076707, "uuid": "16b2d152-0015-4ed7-a590-5c23f4c06cdf", "comment": "Malware payload", "value": "b666371413502055b7212cdd1b723db41edad060", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076707, "uuid": "06a1b740-7d92-4a5a-afd6-aa7e98cc670d", "comment": "Malware payload", "value": "7a573a0be0e7569d38963b3017e07566b4ce12ad77d2cbbd8960055a0ecef19d8b8d78fcfc1411005c512d1b669f4922", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076707, "uuid": "6f794a8c-46b8-49dc-a64c-5e9a79114d20", "value": "T159519509F847D14C9BBA232BED978922FF1B801B9DA2104C75ECD2491F30808A67CF4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076707, "uuid": "8ea8d9ac-f3d6-4a85-bb5b-809a5b7ce104", "value": "48:A4+4jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBoQX:LGhrffvIypvK0elkEYZ85M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076707, "uuid": "f72f7fe4-bf4c-421d-b489-7f74eb781a8a", "value": 3035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076707, "uuid": "3fe729a0-e712-4889-9855-5e0cf4d0b59f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076707, "uuid": "2e543a7c-8805-4967-b0ed-cf95c7121cea", "value": "rWcYKpLe.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7915accd-0720-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630059659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059659, "uuid": "d8930f92-2fa7-4b02-bbbc-7afb1191491e", "comment": "Malware payload (BitRAT)", "value": "233c0db3afe81ec0b12859e9ed2ad96e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059659, "uuid": "2a3b24db-5fa6-45d6-8b25-5b3ca9e698e6", "comment": "Malware payload (BitRAT)", "value": "6c0b8d19ccb66f0fbe99c4882d620a3bc5c95a78e67a8fc7f69918c404bfd4a0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059659, "uuid": "ce27c295-e0fa-4bdb-83db-a4cf167dd99c", "comment": "Malware payload (BitRAT)", "value": "b6186ca1301c5b05910013a62d08d01751c74e3e", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059659, "uuid": "be6fe250-4529-4437-8a20-7835cd556802", "comment": "Malware payload (BitRAT)", "value": "51fbca9e33538825625eaf7af2c9f071f633f7daa0c1739039a6e9d4d755b36196b4179500799da14683d6a90f6341f7", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059659, "uuid": "851c5b63-a5e3-4895-99cc-03459e35b27e", "value": "T1A8A52300D6A1EFA1CABF4D3AD1FAD84929374DE18E31D7EAC0DCBD65340638949E6943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059659, "uuid": "583d63ae-a0bd-47aa-955a-c55e5d2ba9ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059659, "uuid": "68166960-1090-4b11-a02d-be8d75da357b", "value": "49152:RHRk1X5GhWaMRWWxVAe25ZoyJk3d4iGm44ut:dmGbh7uyJkiivI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630059659, "uuid": "28849f12-41c2-43a0-9349-f6fafe9d4d00", "value": 2149128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630059659, "uuid": "22515473-0109-4a37-b220-1d2da5f6eb3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059659, "uuid": "576454be-623a-4a9b-bd94-9e481fd78fa9", "value": "P0#27-08-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eade12b2-072c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630065004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "a6f4c5dc-1dff-47c7-aaf6-e09bb902a0c3", "comment": "Malware payload (Mirai)", "value": "e91b233a103989a1d56be67a07a33803", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "cda7511e-8b31-4810-9326-367a9cb4ba56", "comment": "Malware payload (Mirai)", "value": "6d55541eec340827e1e243053570d84a193c53ea14b74cf425851e16b655d6dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "6e9f50c0-c59d-403b-950c-a2e192c31357", "comment": "Malware payload (Mirai)", "value": "dd0443425a5ee25044ae5ee672f63066f244481c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "27439176-08d0-41b2-9ca2-87372226b2d9", "comment": "Malware payload (Mirai)", "value": "2eed5fbc9f6343492091f1722df304363fe04163e24fa23654a16bb8040ba24d6985ea6f992218d5c238e1bb009abf39", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065004, "uuid": "d5db9513-ee1a-470b-a2a4-a3962cef892b", "value": "T1BA33C70AFB610DBBDCAFDD3745AD0B0534DCA92722B96B357574D824F10A20B4AD39B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065004, "uuid": "cdc8563a-3945-42ad-a9cd-ecf919aec012", "value": "768:17XeF4ZZor1Kkxs60ekTV+rxQe+De1jHUIXiwJqwTaKOT7PeWglL8:1beWZb60ekTV+rO3D6j01weKOH4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630065004, "uuid": "1e825b86-ccfa-44ba-beeb-3fc89587d4b5", "value": 54948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630065004, "uuid": "cdb6ebb8-7a2b-4e21-8b03-afd401ea0b8a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065004, "uuid": "20ec302d-fcbb-4a5a-824d-2778427e80f8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19d7083-070f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630052479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052479, "uuid": "ecac3748-0fda-4db9-b104-1395066bb6bc", "comment": "Malware payload (RedLineStealer)", "value": "33abc47044053a5b97f95d81712ffd57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052479, "uuid": "9078ee10-f980-42f0-9188-509b344b4f85", "comment": "Malware payload (RedLineStealer)", "value": "6f27e9f486516c22c2f04dbbea0ac3bdb8f7f14a2cffa9dd2f3b7f92323b4339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052479, "uuid": "73ad0477-322e-45a9-b657-be4d304d025f", "comment": "Malware payload (RedLineStealer)", "value": "dcc962b16bacd4984cf0d2337d30da34d52b1f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052479, "uuid": "758b112f-6971-4c99-9195-3151236cca9a", "comment": "Malware payload (RedLineStealer)", "value": "e118170c1abf290da4cef75f2cdd77a2871c76e77dc74ecbb077f2ac96b7bc719e87c6258f7409454ab0fa6cda36fecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052479, "uuid": "822444cb-5861-4eaa-8fec-5207a8699b0a", "value": "T186E36B7B2AB8C463C1091635E8A54F1F7678DE280986F344B497BA99DC3D3CC5DF9260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052479, "uuid": "151903fc-b136-434d-a37e-bf7fc09f22c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052479, "uuid": "c8fb1c2d-ef57-465b-8baf-9838df451dd5", "value": "3072:VDekR1/YsHsVM/bYHj9/LuGd171jpxszmiGAGRC2:VKkRis8VHZ/yGNHszmiGxRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052479, "uuid": "3802e3de-3b43-4bdd-a3ad-5df650ec570c", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052479, "uuid": "5ed5423e-7b51-4cc9-b86d-77d3bdb0499a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052479, "uuid": "440663d7-4cbb-42a9-bb13-d25a2b606736", "value": "33abc47044053a5b97f95d81712ffd57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4427779d-0754-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630081904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081904, "uuid": "fa983963-23a7-498c-98ad-cdb22dc6d31a", "comment": "Malware payload (NanoCore)", "value": "d1e55b3f06a3d6cf3495cc5ed0e089f7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081904, "uuid": "2247d6e3-c170-4ed6-a673-6f03e2b05232", "comment": "Malware payload (NanoCore)", "value": "6fcbef18af6a55ffcb456fa7b19c691a74165e39154a1278251e8d217e8ddbff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081904, "uuid": "fd2cd8f9-7394-4e32-88ba-0e34db9795a1", "comment": "Malware payload (NanoCore)", "value": "e7b68b734db3d71746df23e9d23d3e40716a0d28", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081904, "uuid": "60b9d825-a1ab-4efe-af50-67ef6a98bb06", "comment": "Malware payload (NanoCore)", "value": "f63f81d6f5bcbecfa113e2112fc464ba28fbecba042c5726015f937b32d0104b34476fba33909915e2e23fe7f54a7eac", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081904, "uuid": "d094378e-25d8-4ffc-a195-3471c6159a6d", "value": "T192B23DACC05706988F45ABF4672B5F44118C366DF788A633367C97742BE6E7B802687C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081904, "uuid": "febcb3cf-709a-4428-b02d-d821c68c30bf", "value": "384:Bf6AI072727e5t81yz4ikebxG/A3tV2HGesU2PUzpd2s:BLC7EA81ycimvmes5Mj2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630081904, "uuid": "2373eb9e-6ae4-4ca8-96b4-109b3a76b0c2", "value": 24384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630081904, "uuid": "3fe7e66a-b9d8-4961-b600-2dac0ce50d7a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081904, "uuid": "f2a845e7-4ac4-4617-aabd-bb511a9cacd0", "value": "PENDING INVOICES.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6836fa2-06eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630037025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037025, "uuid": "efa9cc72-0017-407a-a67d-e29356331a8e", "comment": "Malware payload (RedLineStealer)", "value": "63b84dcd1b3804bcb9daeca03e14bfc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037025, "uuid": "548b1c77-2c66-40bb-bb55-cdb42256ae40", "comment": "Malware payload (RedLineStealer)", "value": "702ae5d537783099e44743af95ae0c0f879f279e0246a360a9dab3c138f30994", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037025, "uuid": "0c5b588e-35fa-4b97-a235-e60081af87d0", "comment": "Malware payload (RedLineStealer)", "value": "7c2d2f2180ef73075ae39b379860a4985fb06905", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037025, "uuid": "f516f128-1a6e-452a-af25-c863b97c2c2d", "comment": "Malware payload (RedLineStealer)", "value": "84581bb3451671f6735a2a398930b5f19c970e39d4edb5df1ef3e85834550398a2f8814c9088702137948811329c367d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037025, "uuid": "a2442bd8-e93b-4544-b984-73e11902f59a", "value": "T163C52385D3B598E7C3A11B7825B17F30097E8EB9BC2C3DA16914F0A9AE73BF554C1902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037025, "uuid": "50435901-b64a-4b04-adc1-d4a37a4ce8ec", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037025, "uuid": "f3ceed38-8d2e-407f-9698-5fdddd8b86b4", "value": "49152:f+QWfTuAtu5HGsHmFu+/GAgDcJDjFZv4y9QajO:mt7Pu5HGg0KwJJZQy9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630037025, "uuid": "854f6c3e-0f01-4415-92b9-aabef5262913", "value": 2543048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630037025, "uuid": "bf8b7aa1-7502-4d51-af66-de63e30d8ff4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037025, "uuid": "0c178dbc-0b55-4358-80b7-5a99b1f297d0", "value": "63b84dcd1b3804bcb9daeca03e14bfc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2319e018-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630050495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050495, "uuid": "213a0d8e-033d-4613-849c-01c9388c0d14", "comment": "Malware payload (AgentTesla)", "value": "fc737fc30f8ea359be13bb354d75a786", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050495, "uuid": "bff50451-0e65-40c1-9916-002b37976368", "comment": "Malware payload (AgentTesla)", "value": "71c40fb6bbdf132d2f42c5ccd773543d7f0a96bd0ae3527ab2f27dc3fec23ae5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050495, "uuid": "8e982033-051c-4303-bf7a-ea7ef7a35957", "comment": "Malware payload (AgentTesla)", "value": "af52125ae3502d6a1881f9e97e090843920e2c37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050495, "uuid": "d3f2ea65-298d-497d-bb75-84f826c2e5e2", "comment": "Malware payload (AgentTesla)", "value": "87e32609b7ff2d35a0968a294e50cb315caef953b7aba4174f4f19298f273531cfef5b6ebbdb4321b62e1847ab094d7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050495, "uuid": "30afe708-51da-4cc3-8902-34dcb8f1efdd", "value": "T1829253ADC497066C8F8667B8571BAF49028C767EF3949133323867756BE6D3A801383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050495, "uuid": "2f49bef7-c59a-427e-a819-88a966ad497f", "value": "192:q6PF+hxAdb61G462a+H291EwcuTQrT96mDnCvlHpJKcsCWiqKTB1:q6IHiQ6z+Hg165gaCfJKZCWiv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050495, "uuid": "f522649e-9779-49cc-85a4-81aecd9aec24", "value": 19647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050495, "uuid": "4da96e08-075e-49ce-9de1-92497b5a5921", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050495, "uuid": "39380534-f883-4ea6-bbac-af9416d39dbe", "value": "PO 008-01.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8513acf1-0771-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094468, "uuid": "a180250c-8c9f-4754-a51f-329aee910348", "comment": "Malware payload (Mirai)", "value": "595e6a58db0ecdfe9718e254427e103e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094468, "uuid": "d5b0ce5b-eabe-46ec-9beb-ee4dabd6b5ab", "comment": "Malware payload (Mirai)", "value": "731491cead7a7bafb4a789475b3c923e929ec3b8727b173f8412e8aa94d8b4e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094468, "uuid": "ea81a81d-eac2-461e-a6d7-72e736dcd814", "comment": "Malware payload (Mirai)", "value": "b1349f2501c1e837ca6649d71e13f81f760d4612", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094468, "uuid": "b4e24323-cf4a-4dbe-b27c-ac6b4bc0e6c8", "comment": "Malware payload (Mirai)", "value": "82be082aafc1f52cd0b08f053beafeb395d6512efafa7d81697f163c5c3adc69748384e8495102add6eca1b11e311649", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094468, "uuid": "898dc924-ba1b-4971-9820-12a31fac9ebe", "value": "T15BA3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094468, "uuid": "d31f50e0-a386-4e62-9fc8-f0067d57f353", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fjHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fjHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094468, "uuid": "2e1f5a08-648e-4915-a889-d1b689681d1f", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094468, "uuid": "ff9e5df1-3556-480a-b426-eb12b3cc3a21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094468, "uuid": "eef00162-f9a8-4d4b-9ec8-2c1df430663f", "value": "595e6a58db0ecdfe9718e254427e103e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceac9160-071e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630058943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058943, "uuid": "ace96c5a-6df1-4113-adf3-6ee5bc7518ff", "comment": "Malware payload (Mirai)", "value": "01549d527d633c5d2790b282b78d95e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058943, "uuid": "1ae56f8e-38dd-4b70-b907-6b25b87e7071", "comment": "Malware payload (Mirai)", "value": "740838a5f0cbe27a18159846d76e7df08c3e211679f153863839b4fabefad592", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058943, "uuid": "ad989995-7647-414a-98a7-f941ae8b67ec", "comment": "Malware payload (Mirai)", "value": "d94abe89ec8f5d0c1c3f448bcb69913efb5edfbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058943, "uuid": "a1f67275-1de0-4409-af77-8e39a40c7da6", "comment": "Malware payload (Mirai)", "value": "e17ffd4482153dfe3549e424e1174c1adc63465b347404955225b314109d82ea18fbe01754e2d5a7812ae94c01adc0cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058943, "uuid": "ca24d350-8149-4dd1-aada-51c43dbf1190", "value": "T14FA33A06EF914F6BE8ABCD3B09ED070138DC592722953B7AA6B0D818B75E50B19D3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058943, "uuid": "192d2cbb-ea97-4c33-9d03-ec12be335bb2", "value": "1536:rT2LqekFvZGOS5ZYYadB67StrNEYvhvWZu/0ezFAgPWtHCuY4CwrfehucRcn:hC4rNENusezFAgPSVCwrfeIc+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630058943, "uuid": "ba6c119a-84a1-421e-80af-15885a967bb8", "value": 101540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630058943, "uuid": "f12235a3-8885-448f-a11d-6d7f83b165f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058943, "uuid": "20d6129f-a94c-43d6-8457-949d14021251", "value": "01549d527d633c5d2790b282b78d95e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24c807d-0770-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094195, "uuid": "318e0411-139d-4f4e-8d69-a4a256bd2eb3", "comment": "Malware payload (Mirai)", "value": "977bbdac396851207f2ca0c095d9e03a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094195, "uuid": "b972154b-435f-4e92-9abc-fec3840d98be", "comment": "Malware payload (Mirai)", "value": "74705d0fc63968ed0e04c385fa61a2bc22a2ab4bb7010aa56d52314474473560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094195, "uuid": "dc691801-9248-477f-8e79-927c2a9a5ac3", "comment": "Malware payload (Mirai)", "value": "60f91edd3929c7bb878bd2b4a39c9250be4aed16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094195, "uuid": "61698ad0-879d-47c8-8ed0-d18595c8aa62", "comment": "Malware payload (Mirai)", "value": "9eb2692a6d109765e3e2f49e0ac6676345ea8ed61e6fd7277779a71593ec213bf07abc409d73c80d2658b78e03204f9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094195, "uuid": "e08e22e7-c6a4-4a59-b88c-c4c6bbec32df", "value": "T165C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094195, "uuid": "ecc974c4-16b7-4b7d-b04d-8901860f0eef", "value": "3072:4jDy/+mh1vtbPIKaXbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaXbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094195, "uuid": "9619532a-e608-4c8f-8059-4b3d83b4b3bd", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094195, "uuid": "585ad0a2-4ade-4e9e-9615-5358db07fdda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094195, "uuid": "5d0fe55b-1e9e-4654-9adf-92a8a21a3444", "value": "977bbdac396851207f2ca0c095d9e03a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a805302-070e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630051823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051823, "uuid": "57ed061b-2b25-469d-8f29-8ebffdd6a391", "comment": "Malware payload (STRRAT)", "value": "fb39c861d8acfeab5478c2cc52dc9c80", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051823, "uuid": "cdf5d473-3667-4324-912c-7062e5752b29", "comment": "Malware payload (STRRAT)", "value": "7484c25d958881ba5c1a0d1b2650ff4c8e3820cf3a5b32445e4c8604e98c0f03", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051823, "uuid": "31bf94b6-14c2-40d3-825b-58f17b8880c2", "comment": "Malware payload (STRRAT)", "value": "249eb2c5182e0f93e2b804cff2887306f5527023", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051823, "uuid": "aa69aef0-3666-468d-b2ae-13b47bc6a834", "comment": "Malware payload (STRRAT)", "value": "60774fab84a040e0b33db20361cb02767cdc1fc40f2322a615afd0309a4340ef142b1157f7e9abff83ec3ce97a04056f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051823, "uuid": "4da121b5-373d-4d4a-aab5-4334005827b1", "value": "T17DB3CF0E3ED78075D61B9933861091236E1E014AD459909F26FCE8926D3DEBE0726EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051823, "uuid": "6d5c529b-cf5c-4a7c-8466-2d852159da61", "value": "1536:gMjupo7MQG9j6Y/d59wc5PQFJn1JifAy/dRi4fYUW5YcSLysfhRNwHjm5SSssidM:FGHJ8RYcICjm5x6sebSTDf1sbREP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630051823, "uuid": "72316d37-ca1d-4923-9cdf-e07300e4e1e6", "value": 109033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630051823, "uuid": "b8c016ae-bdd9-44e9-b866-45109df1cdf1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051823, "uuid": "f369850c-1cdd-489b-ab8f-9622bfd8fc54", "value": "PO 091249345.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214d0457-0754-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630081845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081845, "uuid": "20413a66-17ab-4d75-9c92-950c4d86ec9d", "comment": "Malware payload (AsyncRAT)", "value": "f2078386fd781f11b00cace49f7217c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081845, "uuid": "df6a45c8-d7a7-4463-8973-99440ec84d65", "comment": "Malware payload (AsyncRAT)", "value": "75455f8fe0ddf7a4cc93ea0072c3786bb4ec968930f182ccfcb4474c44d62484", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081845, "uuid": "bb6a456b-0d87-4a0c-8d61-9d19486369d4", "comment": "Malware payload (AsyncRAT)", "value": "274ad248f1a7669b8453fa09ede42ec339115cff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081845, "uuid": "f79bcd77-a754-42ef-a49e-17368561be22", "comment": "Malware payload (AsyncRAT)", "value": "8d642ec1a153a010ef2d38ee7fbc17384c5ff704b633ae9dde2586f0e3d070291f7a3af648d637a8525949383e669ef1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081845, "uuid": "c029d8a3-b3b9-4248-b4a2-768aa3c7f647", "value": "T18E012B0A4D29CDDB0049F19202D34DE9C6704BA74F807E7A247479476CAD22F6DCCD87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081845, "uuid": "7a96d41f-9118-41ae-a5f3-1e98c8c1cf35", "value": "12:0ChGF2MBNBXNoxAbOJk82cG2bwELPdg3Nfd+aaiTC:HgF2SNBXQXG2UE7kNEuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630081845, "uuid": "f55fd9b5-f2a9-400d-8c63-74c8e575fea4", "value": 730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630081845, "uuid": "fd61d6c2-4161-49b7-b490-53dfdc4cd324", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081845, "uuid": "f167099b-563f-4c1b-86cf-1d901a3b39e4", "value": "ZHDJFEB83MK.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d200b5e2-071e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630058949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058949, "uuid": "37449225-f6f2-4a41-80a5-f49390620e4f", "comment": "Malware payload (Mirai)", "value": "efe82b268bf884b54ecfadd2083694f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058949, "uuid": "ac235688-62d3-4f03-a520-1c8dd5fcc59e", "comment": "Malware payload (Mirai)", "value": "75b1e0ecec4000cbb750ba765b23887cec5a0bda03fff415dfe5edb4c62ea682", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058949, "uuid": "479aa119-9ff3-4fea-903e-957d1a9a2c84", "comment": "Malware payload (Mirai)", "value": "0a3c084531643a180a20fe8d4d229bc436e553e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058949, "uuid": "435e02e3-32a5-4875-aeab-e2fd495ad50d", "comment": "Malware payload (Mirai)", "value": "bf2be68d4b136e4f31bad7f581ab1955104b85f88dcc6c17ea1cb1073876a21020c39135d730c9c57c387a0e40e11824", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058949, "uuid": "f70f5e75-f575-4e2b-82b4-122e4f3bb612", "value": "T1F6732882BD91DA1AD9C14377FE0F434833256398E2EE7212DF14AB252F8B65F8E1B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058949, "uuid": "35749126-56a3-434a-8560-c18e01b70005", "value": "1536:GdxAU02NrqUjbqr03fHcrVvYwrNehu6Pm:KxAUPrnjbLvotYwrNeI6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630058949, "uuid": "b3583a5b-dcc1-43c3-9112-bfa01bc74b05", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630058949, "uuid": "5c2aa39b-04f3-4f19-bd18-993f0ab04268", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058949, "uuid": "f634f3c3-859c-42b9-9918-691a04c5b4b9", "value": "efe82b268bf884b54ecfadd2083694f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230128a2-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630053072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053072, "uuid": "b02b9642-de59-4e27-983a-587b05c47c50", "comment": "Malware payload (RaccoonStealer)", "value": "758cc07d3d1f7945d39a82352ea010a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053072, "uuid": "a7fe9d8e-34c0-4c2b-9e4c-34219a94d3a7", "comment": "Malware payload (RaccoonStealer)", "value": "766e0e4c2a91ddc5d70d3f0d2f20ad65be33853659a981c7c601750272508d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053072, "uuid": "c0ed097f-2fe7-489c-962d-24f02bfb85ab", "comment": "Malware payload (RaccoonStealer)", "value": "b8789453e50c85b5cccde1847cb3b20cd42821d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053072, "uuid": "fc4ebd17-a13f-477d-a157-1b386430c322", "comment": "Malware payload (RaccoonStealer)", "value": "2c30bbb1af2e1135b610a1c9d145d54f5fd0de6b9be982b15032ac5d4f117a0ee6e8f366b5acfab0b0d240c3e27d5549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053072, "uuid": "35b98ade-848d-441c-9882-d7da0c900890", "value": "T10F941215B975C072C1C719729C9AC36263DBED71AE21918B3FD80E5E3E726D0462E3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053072, "uuid": "f3289d93-9bf6-4434-960b-9929449dba43", "value": "1a5fe3d7e91739366ce1a49344f056ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053072, "uuid": "e368a685-5d04-40e7-b469-8f07b0c8b0a7", "value": "12288:kwW4HIyrZE2Slykx0TsBnA7MvbHRWxvDc:Af2Slykx0TsBA7GHYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053072, "uuid": "ca4bc3ea-a816-4844-befe-3c4be8e2da03", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053072, "uuid": "5b8f7ff9-3340-4788-938a-2644bdb7071e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053072, "uuid": "b7320110-96b4-4b82-b8aa-8bb168d0720a", "value": "758cc07d3d1f7945d39a82352ea010a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e684b2b9-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630053400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053400, "uuid": "c7ef785b-3379-4728-b0b5-9442b352e959", "comment": "Malware payload (AgentTesla)", "value": "8e565abca024f1cda5195f473e56c736", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053400, "uuid": "e33a8da2-e419-47b5-b838-b7de6f1c0b1d", "comment": "Malware payload (AgentTesla)", "value": "76845f8b7bac7bebc8a09ef2f8fac2f9d149572191906f7573b5f423eeb85f8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053400, "uuid": "6054f362-6d5d-4334-9e54-011f287339a2", "comment": "Malware payload (AgentTesla)", "value": "8d430dd92e05165f45cc7db2427c5036857e2e61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053400, "uuid": "376d1045-fba3-4d59-a5fc-b1a1361a5d05", "comment": "Malware payload (AgentTesla)", "value": "f51cd5d0045872beb43597ebaaf286b058c81f586907c713e51b510c086fe6881eb5e23804d6e179fa6344273d4fcee9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053400, "uuid": "b39d93ba-bb59-4f78-a124-b78c1a6d2567", "value": "T16135E43D29FD2627D179C7BACBE08827F554A8AF3111AD6468D343AA4352E4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053400, "uuid": "12945581-3890-4e6d-b53f-89a570970c5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053400, "uuid": "2d326351-b9f5-49ac-ae02-4f52641e478c", "value": "12288:cgm7/c+FACnuFxhRzBOeCUqGcnMVN21jm/Z4YJcGffULNeDuR4QPujP:7m40urhRz4erqcN21jmq61ULNeD6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053400, "uuid": "ab37fcfc-96c6-4972-9d14-e92a94143f10", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053400, "uuid": "aef7e868-fad4-4025-8fd5-f7b53bc43e0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053400, "uuid": "b70a6b19-0bef-4f15-b3c7-03df7fcb16e9", "value": "8e565abca024f1cda5195f473e56c736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae56a78-072c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630065004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "0a2998a2-e55a-4c1f-9fd6-4971ab2d6ebe", "comment": "Malware payload (Mirai)", "value": "6328bfc3863ad5858a7b8d47486bce00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "1833648a-7f3a-4d97-a63f-0c48eb2fb30d", "comment": "Malware payload (Mirai)", "value": "76e279d962fe2abff8cfe7f8bee4edfa4eee754041182a939df01dc9e36e7268", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "7caf0fed-5f53-4aa2-9bca-a2b9d98ecd01", "comment": "Malware payload (Mirai)", "value": "4cc940df75595c24fc2f0c201791fa33e5bf644d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "1871f409-984f-4f2d-9811-e48b546de7a4", "comment": "Malware payload (Mirai)", "value": "124cd847c6b513989413342d185e319297c1649e9a204651b284b04c64638ccdfe66e93cb11528426e2c2e4c420cc4d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065004, "uuid": "68e99353-3194-4936-b1cc-430c54e8abb7", "value": "T14B33741E2E229FEDF66CC73447B78E609658339526E0C685E2BCE6101F6034D645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065004, "uuid": "73face45-a356-4f7d-8258-4008222b4767", "value": "1536:dAJRcZJcZzoZi3Vy000z6SLw4D+QzQFhn:dAJDLw4Rin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630065004, "uuid": "d8795e70-76a9-4fe0-a1d6-fac922e41528", "value": 53684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630065004, "uuid": "9af4a6e4-bd63-434e-acde-6eb6e67ab170", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065004, "uuid": "c38ba839-919c-40a5-8fb9-df5ad092d904", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7860199c-074c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630078556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078556, "uuid": "784508a3-718f-4168-8d16-eda5ac733f9f", "comment": "Malware payload (Mirai)", "value": "31f85cc1d29456ba6cac439d8dc1d19b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078556, "uuid": "7964c489-458b-48a7-be84-ad80ab4cdb5c", "comment": "Malware payload (Mirai)", "value": "78fa87adf1162f8ce849d1d6ce8e5b9d08070527e2235bd2b52f4cc82a5edc0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078556, "uuid": "61cec267-0b72-40ee-bb3e-9c2fec2f75f0", "comment": "Malware payload (Mirai)", "value": "e5d6233346ca19e9dbdc879ad8d5f4242214189d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078556, "uuid": "ef3a2939-c34c-45b2-949f-418732abfe20", "comment": "Malware payload (Mirai)", "value": "227a99962a91edca7abe650ceb851b82ec45059ba36f94967812f10d2e1b52cad68a2febabebb687b53c3351de2b50bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078556, "uuid": "47822790-a276-4d0b-a25b-c56aeb93bcc0", "value": "T12C730985F8819F29C6D503BBFE1F008E331657D8E3DE721299241B647B8B91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078556, "uuid": "dd372941-cc02-4f23-a311-13127a5b89ad", "value": "1536:iNnmImSkiK9ZobNiAJHgToLpYOpedf/yAMf1T+M6Pc+IIiaGUcsvdPnonaEE:/SkiCZWNvHG6pYOp66XfR8GUcsvdvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630078556, "uuid": "c467b929-3272-426c-b896-10627f599975", "value": 80720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630078556, "uuid": "40ff950e-eefd-4461-b3cd-fa0e24619c88", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078556, "uuid": "0a2b9dbe-1950-4690-b49f-c12b266f713d", "value": "31f85cc1d29456ba6cac439d8dc1d19b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd20a69-075f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630086943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630086943, "uuid": "e2952896-65bd-4585-81ac-de7702bc09ea", "comment": "Malware payload (AsyncRAT)", "value": "6cf9a842721723f290f0042dbfc39f52", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630086943, "uuid": "fea23cc7-a5b4-404c-acbd-3155eebd362d", "comment": "Malware payload (AsyncRAT)", "value": "7a46b5a9e5ca439c490aab43bf8b440d6814042240d917aba8386aaf72fd1586", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630086943, "uuid": "36323329-9adb-4229-ac89-8c7794de642f", "comment": "Malware payload (AsyncRAT)", "value": "0fcf58d31a0a3eb64872b7a9bbf5dccea47f227b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630086943, "uuid": "4832bb1b-aa88-4798-b9d9-938d04abe09a", "comment": "Malware payload (AsyncRAT)", "value": "0348d7b93405057974233ecb1b10deb4be95771f7e7e036de6d08ae5972e2bef77a2cab47be85c38345dca11267fbf5d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630086943, "uuid": "7b623128-d99d-4555-8940-85bdcfc97217", "value": "T12FD4BE03BA44FE8FE7CA8E75D865D93117A1B0BD9F37C6723C8F1185B40A2D76A82416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630086943, "uuid": "0fa684e7-70ff-4f9c-b395-18c4efdf9f0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630086943, "uuid": "87b78b86-6ae3-4075-b502-cf223d35ac65", "value": "12288:cTwqT3DxIlIOe2KzC2Kxb5OGdWduMyVnGRfX2cpUw:Y1DClq2KzCpx1bdiuM2nGRv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630086943, "uuid": "54118e11-6fdc-4d29-b06a-17e888f50ac8", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630086943, "uuid": "cb53625c-1d39-4ff7-8b07-2eab76de161f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630086943, "uuid": "8e7f9497-f480-4174-a673-e6237254cf05", "value": "6cf9a842721723f290f0042dbfc39f52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66aa7280-06fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630045025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045025, "uuid": "d86701cc-e827-45c4-b4e7-6f3e494d0f27", "comment": "Malware payload (AveMariaRAT)", "value": "9c0a708ac219fdf26a8df99f338ba1da", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045025, "uuid": "89ac8b6f-1152-4049-90c9-617d58d59124", "comment": "Malware payload (AveMariaRAT)", "value": "7aefa586d32593736751d667d9588fcf4c3091ace48375d38f06947aa119129e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045025, "uuid": "4b6232a6-d1f2-452a-8831-6d6ab9c898f0", "comment": "Malware payload (AveMariaRAT)", "value": "a84dbb0ee9c53b9e2dceca4a37a88dbdbdeb2c20", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045025, "uuid": "2460311f-7ad9-47c1-ade7-0983dc9e1d77", "comment": "Malware payload (AveMariaRAT)", "value": "0002b9c4f654d14bbd4b26b6b8396b67a04cbd4f531ccc406ad8096534364d3c2538d1325147e5582296b063bf6f1816", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045025, "uuid": "b6c9705d-96ff-44bb-83b3-f519eda00912", "value": "T109B4E12D73C44B25C6985275C1E7883403EAAF837677D34A3E1879DA3E817648E8B7C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045025, "uuid": "7a283513-9adb-47b2-b7c9-d6a0c59e1c0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045025, "uuid": "3007452d-09c1-4d1d-98f3-42fb5de6bf5d", "value": "12288:CZZsq/S5WTYPnd8lzM452uiwKDeI5S9AV83CXlco9FzwHJe:m8SCKBciICAu3CX+o95wpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630045025, "uuid": "277b967d-7e39-4b88-84ce-9cbe52d9482a", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630045025, "uuid": "a966f3c6-2553-46cb-8251-f1e0f74cdb3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045025, "uuid": "c87f6f8f-e841-481b-ad1e-6125c8ba9391", "value": "Scanned Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ff0cec-0742-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630074151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074151, "uuid": "69e70db0-f4d0-4992-b95d-466a4a5a17d6", "comment": "Malware payload (RaccoonStealer)", "value": "adcafc93841e0cf3ddf4a1f15be10bc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074151, "uuid": "5edec487-363a-4d44-904d-04b055cfdb00", "comment": "Malware payload (RaccoonStealer)", "value": "7b28a5403fa87a6d4364be7177576da5359ef8e60e6ce0bd42bdf72f90a9ae44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074151, "uuid": "80da778c-b21c-44be-a104-54efe8f0be1c", "comment": "Malware payload (RaccoonStealer)", "value": "47f570203a21bc017ba0cac9ace105a9a4bba6ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074151, "uuid": "4f44c7c0-d286-40fd-a247-162b95e7518b", "comment": "Malware payload (RaccoonStealer)", "value": "17d748016df5f34caa3d4efb2973d0b1ee421f2abe134b75779cbc609a7f6c76f821a83a9a8785b9b3b30d7b62c4e4ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074151, "uuid": "91fb7537-b6b3-422b-894b-7d10ac276dbc", "value": "T13DD1E801A7DC4B36DCBA47791AB363208770F653C9D78B2E2CC4291ABE113104963BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074151, "uuid": "ce70c8e3-e192-4313-b5b4-617d65a9fc79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074151, "uuid": "7570771d-6a2c-4c04-8f60-97738f022804", "value": "96:Lb1UkSvhMfYDEsR4xacU1Oy0JoFOfDzrdaIv6Nyc2ezNt:31Ud8YDEVahcyFOfIj9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630074151, "uuid": "cdfc4a28-bfe0-48c2-9308-3bdcda5b5edf", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630074151, "uuid": "cfa43d62-ebce-486e-9a61-e19c6c230ebe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074151, "uuid": "17a5c55c-e7dd-4ced-8837-eafc90fd4130", "value": "adcafc93841e0cf3ddf4a1f15be10bc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b676a872-073c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630071788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630071788, "uuid": "40972fe9-08d9-442f-9953-fb3105eb607b", "comment": "Malware payload (AgentTesla)", "value": "c07fe32d3b39054b0f87fd89a66bd3dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630071788, "uuid": "91466b53-6cf4-417e-abba-4e1653c7baad", "comment": "Malware payload (AgentTesla)", "value": "7b2b5f6e6dc8ac1c1a34d76360a4756ef5a9c118ad629db31ed8f8508565ecff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630071788, "uuid": "69fc1267-b6e1-434d-95da-f3070ed3674a", "comment": "Malware payload (AgentTesla)", "value": "459d6eaba569b9e42a2926f454bc3ca176afe55c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630071788, "uuid": "c1e2f160-6f7d-41e3-b26d-b88e95587f87", "comment": "Malware payload (AgentTesla)", "value": "f80b3cac12874d29d1c0f114d254d98014c6577dfdef6cd584377c91fd3732a42e0f878f174c10c357326e0e36740db4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630071788, "uuid": "cf95590d-237d-4c4d-bcf6-7b533066c9d5", "value": "T192055C3C29BD2227D1B9C7B9CBE0D837F4549DAF3111AA6464D78B6A5342E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630071788, "uuid": "46fac78e-8e9f-4130-b0db-05d661885e19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630071788, "uuid": "a37a03a8-0022-428e-90be-f482d22e7021", "value": "12288:ioptPpWKTDk32fGpRhlGTu1unRn15mfC/oZZ7h5u+oS5j4p/:RhHTQ3cYRv1w1QK/ormUsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630071788, "uuid": "e85adc8b-49d7-4b0a-8659-0c2446392e25", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630071788, "uuid": "ec9562aa-cbb2-4145-8238-a0e7cfea1553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630071788, "uuid": "55a42991-dcca-41bd-9f67-468eb70f2342", "value": "PENDING ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f65cef1-06f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630040235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040235, "uuid": "4fdd0b6c-f493-408c-bafd-ee00da72bf59", "comment": "Malware payload (RemcosRAT)", "value": "c02fb969c868b75f525fc12941024fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040235, "uuid": "aa0f2c01-103d-45d1-b331-fc461755772a", "comment": "Malware payload (RemcosRAT)", "value": "7ba9b36e3c64a4228b23342cb27691d542bbe7cdc4a53bb1bdbd7622c55b5a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040235, "uuid": "f4a71e20-47c4-49c5-832f-66f0ee1a0600", "comment": "Malware payload (RemcosRAT)", "value": "73c4164a573da5b8f0d1f79e487e3d0f4013e7c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040235, "uuid": "93797be5-4155-40f1-bed7-a61baef872b1", "comment": "Malware payload (RemcosRAT)", "value": "a53e3a9b3b764d04d690dd3e72568f943a32f62d460d0dc82747b1cd5ec729506451b0190368f2bb39eed6d7fb8fe0a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040235, "uuid": "57dbdca0-8808-4a5f-b699-ad36da5ee27b", "value": "T17FE46C2773905D3FD23E3EB99C1BB299867ABE223E1C9CC619D834495D3E08525713A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040235, "uuid": "54704883-8c94-42fa-bd19-c503c8dcb1d9", "value": "6204ac5c7f2e83e9898645118ad9e836", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040235, "uuid": "8e50b474-e4a7-472a-8f2c-eb101662d7ff", "value": "12288:0iouGvscRqW8FvYKKCPOxoafEy+PlsqjGhH/LGE9:+uEscl8FJKCPOdMy+fj+HTGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040235, "uuid": "eec1eec7-1bac-4058-b61e-661ed2791aa8", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040235, "uuid": "4352f940-b42f-4939-8d56-f1fc17d21c01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040235, "uuid": "5df012f5-e507-4f2b-b4d8-7eb991e9183f", "value": "Confirmaci\u00f3n del pedido _ Urgente,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6705ef-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630050803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050803, "uuid": "c5ad38b4-99bc-47bc-b08b-9968c669e423", "comment": "Malware payload", "value": "e9810a2685006eabede179890758ef68", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050803, "uuid": "aba8d1f5-4f35-498d-bf8b-ed06fd2ad73d", "comment": "Malware payload", "value": "7dec1b79945d7e04715ac9f504d3c74546b000518c671b18b67ee13f286a6cb4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050803, "uuid": "ce936a16-80ae-455c-9716-342e229823c0", "comment": "Malware payload", "value": "95b1b0e5969e73f9b1bfefcb4aba0a3b590c1888", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050803, "uuid": "2a070a1c-128b-43bd-b13a-81642f7b33f8", "comment": "Malware payload", "value": "ee0065d6bbc87d2eb4a44b174bbb50433fc6b4da10953b9b41beadb4fee3d1fd289403dc2c9718947ba481aca7a6b73a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050803, "uuid": "607bc8c7-3a9d-4722-960a-fc527e37b24e", "value": "T103F0DD4CCF28056E849D604B6C1CC150F5BA42B071CCF1EE8906EC495666D4C12FE4EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050803, "uuid": "641a156d-5476-4f6e-bed5-308a34dd528c", "value": "12:RCtMgDzc433VkijSO2hYRtmgHHwmVL46ONmSqFPQlZQTazIkgkUQfYJSqH:RCtK433VPChYVQmV14saUk15Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050803, "uuid": "51aac27c-a341-4c0d-aa13-c6bd5a47a5ac", "value": 639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050803, "uuid": "91766dc4-5bff-4951-a675-1802341b20d5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050803, "uuid": "48ce9980-ebc1-456a-a7b9-30845196ed7d", "value": "Report_000394554.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a28e3da-0705-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630047957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047957, "uuid": "2b514464-b2c8-4969-8f88-b87381bf3985", "comment": "Malware payload (BitRAT)", "value": "691132fd9fe387cdb570edfe18b84e19", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047957, "uuid": "68eb7262-bb75-40e8-9440-0f11d0be5e2c", "comment": "Malware payload (BitRAT)", "value": "7e91804516bd4803c7334e8bb593aa9d3f5f2b5d0160161ba4a81a4bb2556e00", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047957, "uuid": "33b7c9f2-0aa7-4661-8213-fbacc096b284", "comment": "Malware payload (BitRAT)", "value": "17f73433351cdd58e7da809942e7d239a6df3184", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047957, "uuid": "458bab5c-b09f-4b13-aa98-a523bea15512", "comment": "Malware payload (BitRAT)", "value": "a169b6bac32875d8246ade088bd67df498edcd984fea9501e930dd0df2f315b0063be4689995e2b696ad36cd01b0b1f5", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047957, "uuid": "d27c31b7-b86c-4e66-93aa-1f6140a424dc", "value": "T137A53355A44B4FD1C26F1AF2E920835D9E6B2F957CE3DBEFE988EC803D11102D9419A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047957, "uuid": "9fa24438-c41c-4e48-b75d-4875b6cf5510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047957, "uuid": "ec049af7-ea5d-49df-ab5b-debaf2b330f6", "value": "49152:HIK1xxlFP7qVwP1+VOlWrDG1SLg9e5kVwddd07wctnHrSmGoNFAV:HtPP7qVwPcSgLg9lwiwc5emBAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630047957, "uuid": "d6435556-6f79-4439-b2e9-92f8f6bfaf99", "value": 2158344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630047957, "uuid": "364dff9e-d9c2-4069-b886-76513b279a4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047957, "uuid": "afcc3c1e-9ca0-4413-9c3f-b79501a772fa", "value": "691132fd9fe387cdb570edfe18b84e19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d269f693-0712-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630053796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053796, "uuid": "39a8def0-5969-4981-9654-424ecd60a399", "comment": "Malware payload (AgentTesla)", "value": "38bf678e20d9fcad11c66087a302ab08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053796, "uuid": "a2a117b6-73d8-4a29-8424-2c97d7969891", "comment": "Malware payload (AgentTesla)", "value": "7f768a181ec0419529c7c39c357ef8943a0c2a01c346fb8685cdc8a3c26e793e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053796, "uuid": "c7cfcfc0-884c-4000-8f30-895ea62ac8f3", "comment": "Malware payload (AgentTesla)", "value": "52469eeefbef70579756a05869f139a53e615c9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053796, "uuid": "add31fa5-ee7b-41e2-a1a5-c969276799a0", "comment": "Malware payload (AgentTesla)", "value": "2c653133ee7b9b81d17b441f64c1bdfa9e8f7b5ea95464083e87ae119e3964dbadf8168d797ae6fcb3bdf95a6819cf09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053796, "uuid": "dfd8dd64-a4e8-4c89-aebd-d42bf8c58b69", "value": "T1AA55163C2ABD222BD1B9C7B9CBE59827F05499AF3110AD6458D357AA4713E4235C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053796, "uuid": "02a647af-8cb7-412b-9038-6a3bd9841134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053796, "uuid": "08efcc6a-f033-46b1-b50c-3459c339396c", "value": "24576:ZgKWIZrajjQOs6oERK/mE/TQjJkFXWV/Nm/y12Nhmc:ZSIBaf1s8eR/TQjJkTyYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053796, "uuid": "bf9545f4-9f46-4f29-8efb-91b5ee76ab82", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053796, "uuid": "d3774273-f0ad-43a2-ad6f-cabe660c8638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053796, "uuid": "9213618e-a69e-4ee6-9400-0fde3aac1046", "value": "38bf678e20d9fcad11c66087a302ab08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef389b57-06fd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630044825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044825, "uuid": "2d289a28-cb93-40ac-b6f1-8eb75ae4c106", "comment": "Malware payload (Loki)", "value": "97c2aecf2380200fc50b84d72af34480", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044825, "uuid": "b7657984-3360-4759-843e-f6b8d035dba6", "comment": "Malware payload (Loki)", "value": "8083fc125756be5ccebc8b837ffd80063f42696159291e0df941c28f03170b07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044825, "uuid": "df8d5d4f-df81-4c8b-b4c0-487ab98ee937", "comment": "Malware payload (Loki)", "value": "01c9097664cafdec4058a4ba8553cbf7d0c333f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044825, "uuid": "3c6f0f42-ddc6-4857-9dc6-424fcd883b43", "comment": "Malware payload (Loki)", "value": "fb6679ab13756961d98da72aead9a698dfe5c1782c79676cf5253397b1e9993af6abe90642647ec0e6edfbd4b0de1aa3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044825, "uuid": "bcf3b780-b55d-4990-a350-32c7216f6b3d", "value": "T1FC84124548C4CCA6E72AB370D0B7CE9819757832CCD56B689754EA2EB870343B853E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044825, "uuid": "cf83447b-e68f-4feb-b193-6fe3939576e7", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044825, "uuid": "a4677b9a-d7d9-4d60-b73a-336bb137d273", "value": "6144:64XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0Pzy:xXe9PPlowWX0t6mOQwg1Qd15CcYk0WeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630044825, "uuid": "353f5f34-2afc-49fa-96c7-f9969df14a1a", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630044825, "uuid": "8e794462-4eec-4496-b239-124aa1731a6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044825, "uuid": "4a3c3aaa-11a9-432f-81b6-30fced0d4f1b", "value": "97c2aecf2380200fc50b84d72af34480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a1c6ca-0745-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630075348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075348, "uuid": "14303e38-12bc-4246-a710-f0242ff3b9be", "comment": "Malware payload (Formbook)", "value": "27626ec3be32c6e33b75072546074716", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075348, "uuid": "2a78cd97-567d-46cf-a274-28095cb3dac5", "comment": "Malware payload (Formbook)", "value": "82146337285682b37a03114d7a078a2d1a18c6a1961c6056480e3252133035db", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075348, "uuid": "ee40425c-829a-4374-bc87-28d9756bea42", "comment": "Malware payload (Formbook)", "value": "d0f761512bbc3d1540723785faa6802c4def26fb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075348, "uuid": "7bc0e014-ccb4-4b01-af42-721dc91086e0", "comment": "Malware payload (Formbook)", "value": "6828ab2f580004bccce00281978b62db8400eb3d2f2aeac5b710b3583c6d108dba25712821ac5c47248e6dc243f7fffd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075348, "uuid": "50239372-52f5-4e6d-9785-1f1ec7748444", "value": "T127451214AADB7F4EE482D8F4511F9E82A25D8FECA70AD2837D697149743543C2F6B20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075348, "uuid": "7f26b063-a0bd-4fac-ac0e-6849aa645f8b", "value": "24576:6BqFTlNCBPDmAQteDCOkM8vBElvyJvLF3ps8ll5Lcv8zsDSA33zKO02+:uq1atDUezUvB2+LF3G8llpB5A3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630075348, "uuid": "029c90f6-88ab-40a8-a944-4867501d73e0", "value": 1237504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630075348, "uuid": "25353ded-f8ca-4f85-85f2-99b7dae3e895", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075348, "uuid": "2dba97e2-99be-4512-a915-c2d49039b8bc", "value": "New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebb3a28-06f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630039724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630039724, "uuid": "a7fd6e7b-196c-4efa-acbd-85cec90297b7", "comment": "Malware payload (Formbook)", "value": "f976846b1a85f117ff078d9662931c48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630039724, "uuid": "52058cf3-d51c-4f03-8807-25dd916458da", "comment": "Malware payload (Formbook)", "value": "836579ca69ab6a19f5bbda57ab734abb715e0c7d8245ae0a9cb0e1b31b7ef437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630039724, "uuid": "2bb1e14a-159a-4924-85e6-3a88a79287ae", "comment": "Malware payload (Formbook)", "value": "b5cdfaba7d6a07225e2081dc4e6fe5265580ab1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630039724, "uuid": "947e7e75-32d9-475b-8b19-319e084c8a67", "comment": "Malware payload (Formbook)", "value": "cda966b6d85fe3e3e256f50e5f67c7ae16e66ae258282f84286c0938d485d1c2caf4c20d5419966650fb2f0092c26651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630039724, "uuid": "f25f3fc7-81af-4cde-8778-d8b79246bc67", "value": "T19C25B33C98FD2927C066CA76CBF4D827B004DAAF3226AD6554D757264353B8330D7A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630039724, "uuid": "64c4d1ee-e5e9-4223-9543-35fa0a29f3e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630039724, "uuid": "a48259ee-44d5-412d-86ef-f88a3a75ced5", "value": "12288:Dx0lQLjOZdIt7FDaoGR9gLlpNND6PQLxNcE9bwbwUX:lzLjOjG71aog9gGPQLL39Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630039724, "uuid": "23cac3de-cd95-4dee-8794-7ce9b4f8c923", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630039724, "uuid": "248be3b3-7443-494e-86cb-e40567a2ef56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630039724, "uuid": "08afe1b4-8bba-4b62-b753-af0bac855242", "value": "00002337526082021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ac57b8-070e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630051728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051728, "uuid": "24196813-19c7-4feb-953f-cecaf0602a44", "comment": "Malware payload (RedLineStealer)", "value": "803a64ba5597aea97235938b545e4a2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051728, "uuid": "93dc44ef-7481-485e-8b75-19f6ef9a8851", "comment": "Malware payload (RedLineStealer)", "value": "861f5a47b316a7668eedc2c5b7f7780406735223bd41a2a29f5df29331f7e51f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051728, "uuid": "255f2249-b19d-4d2c-8ba6-bad622687602", "comment": "Malware payload (RedLineStealer)", "value": "3ab85620061252fb234d1e72eccebe261cb3bae8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051728, "uuid": "3be112fd-982d-4612-84dc-57c0ef8c1913", "comment": "Malware payload (RedLineStealer)", "value": "0e5766c886323723f9c5ea9c3f6f26f67c10a4b685f79980604e03617d6e655cfbd16fe0bd1f1d547147c16fcb06dce3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051728, "uuid": "8112339e-d332-46dc-8b03-329e3f7c50ae", "value": "T1D1B3392163EC962DF3BE0B756470151487F1E1DBA101FB5B8EC264DA6F337826A486E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051728, "uuid": "a0749308-32ae-44a0-a754-89f59ac4fd79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051728, "uuid": "b7c12f12-d4c5-4eda-805b-b2732f5be269", "value": "1536:kxPQV70Sf+QarAGIO9VJY0XQljbuFGd0nQuyVddcVdWOE5G6eRaoigj:2w0SmQ0gOfsx0n3ybdcCJyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630051728, "uuid": "c1489aa9-a5d8-4db4-92c3-a24c9e8d74cf", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630051728, "uuid": "9ea7a96b-5c3b-4291-9a06-24e8939263de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051728, "uuid": "d09d4c50-f5fb-40bb-9b36-0e622135cf01", "value": "803a64ba5597aea97235938b545e4a2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c3bb19-070e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630051812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051812, "uuid": "39040fa6-b096-4634-9deb-834fd2de5edf", "comment": "Malware payload (STRRAT)", "value": "dd5d61f70b735816be30a3199d6f2b7e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051812, "uuid": "2755b914-60c2-4374-8352-6a4b6d57aaea", "comment": "Malware payload (STRRAT)", "value": "8734bd806a05fa2c9eb1deb90f8997ccd36a43c50e25ad5f3182a27d218de8ca", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051812, "uuid": "d66178a0-118a-4587-8afa-f6896a0a9c91", "comment": "Malware payload (STRRAT)", "value": "69b2e1cb754fe4f60de05cf2059541976bfaa30f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051812, "uuid": "c9266f98-95cf-44a5-b9d3-8364004f629a", "comment": "Malware payload (STRRAT)", "value": "e756348c05a18b203eb3d0bf8fedd3acf249cab3da8b4354c72a1950921de0bffa2b739adbdec5bd1dbb704cafee3141", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051812, "uuid": "769845c0-9d00-4f6b-a617-80eb56058111", "value": "T1A9B3D03AAC9AC4F4D057C87593185237AD4D18A8D14CB16FA6FC188A9C78D3D1B4ABCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051812, "uuid": "996739bd-2096-43a5-b7f0-4b661f6337ea", "value": "3072:9YJFK8whNIAnBJ74se6TRX2JPtsYHqwmQX2:erKhxnBJMs1TuPFPX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630051812, "uuid": "45014e92-33c0-41b9-9a60-000febe3bf8c", "value": 109878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630051812, "uuid": "e45766c3-18a4-45cb-b6c9-c700a5a934d9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051812, "uuid": "7d8c42fe-4ae8-4ecb-bef2-8e8e6718cb15", "value": "attached.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cda917-074b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630078281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078281, "uuid": "bc15c366-d7d9-4cf4-b233-7044fbc75450", "comment": "Malware payload (Gafgyt)", "value": "9421e054724716f66a3cf3d76e2317dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078281, "uuid": "0c87e7d3-c824-4663-82ee-a0a3a8909430", "comment": "Malware payload (Gafgyt)", "value": "88e561e8bac145efb370bc30fe28b3e58609099be289089c888795d04d714cd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078281, "uuid": "6cb775c8-d386-4304-8825-ad660e3f3d6c", "comment": "Malware payload (Gafgyt)", "value": "7b7d64f52097161087ee0e60296f66989ba81e39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078281, "uuid": "34a9519e-44ea-4241-9cfb-0891505e0839", "comment": "Malware payload (Gafgyt)", "value": "3460acfd00c285dad24b9f9e59a22c11973e3dfec16a4c6eb716c7f71c80c66f9848b8350da0345223fa52c5613c9113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078281, "uuid": "d3580a1d-dc21-493a-8db6-f72db22ee84e", "value": "T130E30949FC00576BC2D227FAFB9E038D773A16E867DB33115A349EB42BC57982D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078281, "uuid": "4740955d-e55b-4b1e-a7ab-eb4301dab0db", "value": "3072:7dHg60MHDMAgu+GOMe5hU+/Y2Hee2wm5TqQYeScGOjAnq:S/kDMAgB/Me5hUyY2awm5TqQYeSPOjAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630078281, "uuid": "80a3392f-9a47-4a44-a425-b1c5aa3d9e8f", "value": 146307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630078281, "uuid": "0bd4dfdf-e5a2-4b24-847a-7c40bf295d74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078281, "uuid": "2de52059-5f1a-46c8-98ee-bba530efc86e", "value": "9421e054724716f66a3cf3d76e2317dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f01e26-076a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630091329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630091329, "uuid": "4573492e-32cc-4436-bf02-603347d8a46d", "comment": "Malware payload", "value": "6a124d95c5c5038daf38b7d0d8719996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630091329, "uuid": "1fe89ddb-bb8e-44ef-abed-6f4c11893853", "comment": "Malware payload", "value": "8a47b898b7c8aa16abef0d692c9c7bc123cee04c37027ac109df1c6d1fbd6f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630091329, "uuid": "782e8437-be0c-4f12-9899-3286c38a5c30", "comment": "Malware payload", "value": "b1fc8fe4cc2e00479c8559ce4125af22175a1a07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630091329, "uuid": "b8b3ef65-433b-42bc-8305-0f5ab85a8cb9", "comment": "Malware payload", "value": "35f1068681d87ef437f927cfb919a76b798379db3281e1768ad6492ccb02337b253cbceabbf67d7bebdab98789930855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630091329, "uuid": "7a0d24e2-2480-4206-b6b7-6b89b40b8bda", "value": "T1B5940164941620CBF2EF0AF73210BA822165BC69BE7E67D782C2F7DD914472D788E345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630091329, "uuid": "2c743e57-9645-4b22-b33f-5efd08d837ac", "value": "b211bec2627ea9b5322d60ef3ed97e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630091329, "uuid": "db2b3dbf-23b6-416e-9e45-76b00b34ec90", "value": "12288:BpmGo6NcFaOrWsrTrABM5iSFV5GfJLYNDBqkpg8D:BAGo6NcBtXrABM5imGfJLYpBqL8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630091329, "uuid": "21474cfb-8639-43cd-829a-09b40fd839c4", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630091329, "uuid": "d508b008-4b41-4c62-af30-b63539e34838", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630091329, "uuid": "0088e951-d96b-4dd2-91d2-015e240ac164", "value": "6a124d95c5c5038daf38b7d0d8719996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867275f7-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630076002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076002, "uuid": "e2a30c4a-fcb4-439d-b4a1-6b0602ab24f7", "comment": "Malware payload (RedLineStealer)", "value": "ab23d03dcf23220295648cfb245d2d6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076002, "uuid": "5d458746-f219-4b2d-9def-04b2c9adcc6b", "comment": "Malware payload (RedLineStealer)", "value": "8ac21fd5101245c481930e8a5adafb8d2a6b96ba54c5f43cab187059835aa5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076002, "uuid": "44c23664-4864-4147-9c3f-2d42ba0d2e8c", "comment": "Malware payload (RedLineStealer)", "value": "c733c7112f9caee7991dc1389011be84056fc495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076002, "uuid": "fb1aa63d-4d7e-4550-954d-0440a6bfa84b", "comment": "Malware payload (RedLineStealer)", "value": "766feb4c9f15202af4c5a22424ec342a657969586a3ca4b2539398a7168a9fb832f14e72de878872ed70f60029025a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076002, "uuid": "92738c3b-e15e-4e8e-a101-553d67521979", "value": "T1C9D4FD24697FC419C1E7EEB22DDCA4BBD99A94E3640D76371064A33B8B41B84CE0F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076002, "uuid": "a731bf53-fdad-4ea8-b7e9-0fb4dcb15d12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076002, "uuid": "82902308-b23b-4c41-9a71-1a5d7b903b39", "value": "12288:wXk6XhlQ70M3HvlvGWE/FckBRi+9wjQPf48a6EzMzPxiDOZ1z4/2fH:wbvGlvGkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076002, "uuid": "c219d50e-8a1d-4933-b046-8fcb084d60c5", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076002, "uuid": "6643a487-6d54-4368-930c-771b23b30889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076002, "uuid": "7ae660e4-08d7-4aaf-91ea-98c4028aff81", "value": "ab23d03dcf23220295648cfb245d2d6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ac21ca-072a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (zgRAT)", "timestamp": 1630064166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630064166, "uuid": "0704e541-4153-4450-a631-bf7dfe4b7b14", "comment": "Malware payload (zgRAT)", "value": "625934da53bdef884f7539c41e201002", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630064166, "uuid": "61ffa486-9db2-4f4c-a670-0f726281b83a", "comment": "Malware payload (zgRAT)", "value": "8b17a16441971065f15718343556c4a4945dbe0393c268c751e80d0406759f0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630064166, "uuid": "884c8bcd-f90d-4bfd-924d-06ac39fd499b", "comment": "Malware payload (zgRAT)", "value": "58e5cd5f243fc8b1e02b4f3b5030873a3469029b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630064166, "uuid": "ea653463-ed4f-45a8-b03f-31e8b7a1f83f", "comment": "Malware payload (zgRAT)", "value": "98edbd71842718bec071f8fa42c41b2e1c44a6dbe384ff82b8ae4f0355347ac37ca206c5c43ac684a9cfb59f528b0183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630064166, "uuid": "fa1f3a1e-f7a5-4bbd-8e62-29bb84429f4c", "value": "T152D4010C3F07A45FD4B075F3289585B7692B3C51EA7287BEA0AE3A483978751ED20E5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630064166, "uuid": "53e5f772-b282-44db-8b7c-6fcb864c2a02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630064166, "uuid": "f863b997-e101-4a6e-82bb-3eee6a01ec71", "value": "6144:f6z2+ksJePZluhFqPqjCxdwcIZQfhTVg/0OK1jvskabIpDk+j7QtCuxTMax:8ksUBMFqGCXIR/0JA7bVUUCB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630064166, "uuid": "f21c4c80-70eb-4867-b90c-d601d2dfb8d3", "value": 608056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630064166, "uuid": "351d17c7-3b63-438b-83a7-93b9a318149d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630064166, "uuid": "958105a3-a577-4d9f-b90e-b53d0f279a54", "value": "usfive_20210827-130539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2056eb7-0710-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630052856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052856, "uuid": "5f8871fd-9319-448f-9b8e-c34d5471717c", "comment": "Malware payload (AsyncRAT)", "value": "9e6ebc85240a788f03c499bf879682ae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052856, "uuid": "a3e3eed8-ea89-4ab3-8770-030b45483b52", "comment": "Malware payload (AsyncRAT)", "value": "8b480ff5797c4d2a4a4c9eeb9207ce3fa89a1d063a72c90faa341e012faf9fd5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052856, "uuid": "1428e5eb-61d8-4047-a91f-3699559dbc5b", "comment": "Malware payload (AsyncRAT)", "value": "f6640696df495759c7410b1e4d1826d3b6aa03af", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052856, "uuid": "8ef52707-f9d6-4f41-a37c-87d1d3cfcad8", "comment": "Malware payload (AsyncRAT)", "value": "d389c4b8f7dc7351259429839c00993b8747dc0833b4c9567079b1c409abd2f80963dd4e41c3aff34339b948e7befa1a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052856, "uuid": "cb0cd8ae-3ef3-454d-b1ab-b8e00ada21f3", "value": "T15D94E4858EAFDDDFC2AF363FA14A0C8614EEC356465792E58F464E30B3852238D561E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052856, "uuid": "09f5aa63-ffb3-4370-a35e-754aff3bc86d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052856, "uuid": "4ed63042-a79f-4614-b3f9-7e67d36e1558", "value": "6144:EbCIphCOQoactW7Q6L+BWI0e5nViScGEliUPyh6jQyr95e0TKP+Qt5XLFTb/u0B:EDp4a47N+BWBe7iSchSoPr1itrPGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052856, "uuid": "a7cf81e6-f1cb-4ebd-b3b9-f7364d7f16b3", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052856, "uuid": "4fb3bd4c-7a68-4868-b169-400ee3173c7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052856, "uuid": "9779dd20-3d7f-49da-a804-40b41e43d07b", "value": "9e6ebc85240a788f03c499bf879682ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f23e0ee-074a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630077654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077654, "uuid": "ca7fb024-0436-4f20-bd38-ed9c91265549", "comment": "Malware payload (Gafgyt)", "value": "d12d3e30e344cfff1cb643b3aa4c26b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077654, "uuid": "c2b871e7-8509-446a-85fe-088858f1405f", "comment": "Malware payload (Gafgyt)", "value": "8c0f2d6ae3594158201ae480019fc03fbcbf1881f16adc6fb587b1c01dec5f47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077654, "uuid": "f524e1c4-b742-4a4f-b1c8-71abc70edf96", "comment": "Malware payload (Gafgyt)", "value": "7e5668578b85104ad0ec922f18b0209e3f016a55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077654, "uuid": "16d65195-4fb4-451b-92da-c67c5b932176", "comment": "Malware payload (Gafgyt)", "value": "889db8cb487ad84458099b90df3d51357abc61d699a945bcd6a5f9420425f02694896e83ec7d3f7d388ad116640e4209", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077654, "uuid": "2ef161fa-f7cb-4b11-9cd7-0883d5245047", "value": "T13BF30B05D9105727C2D327BAFA9E538E73371BE867DB33119A349EB42BC17A91D39820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077654, "uuid": "30671f7f-e6f6-4930-9cf7-68d9dc0e1e27", "value": "3072:yd4CUlDNPaGf3ojkaRZ1wcT45hUtDc4m5+/Am+8kmQQLCo0XX4r:C4zBPaGf3AscM5hU5DmK+8kmQQLCo6X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077654, "uuid": "5c69d0cf-155e-471d-877f-5f83660275d3", "value": 165970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077654, "uuid": "78ec6858-08c2-45a1-ac07-159e256851b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077654, "uuid": "05ca90c4-1ff2-4dab-9925-ac5f00e3d158", "value": "d12d3e30e344cfff1cb643b3aa4c26b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41eefe3f-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630075887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075887, "uuid": "2f5c5243-4462-4748-bb52-295083a0524c", "comment": "Malware payload", "value": "e845c10b4b5ef37f2915a03b38f49528", "object_relation": "md5", "Tag": [ { "name": "ASPXSpy", "colour": "#E2CF6C", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075887, "uuid": "41ec4129-2d22-4748-af9b-b9f65c179713", "comment": "Malware payload", "value": "8c4b192ac1a9583de9ded10d373e0a469e1f85e272ebd7700337e18ba91f830d", "object_relation": "sha256", "Tag": [ { "name": "ASPXSpy", "colour": "#E2CF6C", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075887, "uuid": "8f20088e-93a3-4bd2-9b9a-d97c80a3af87", "comment": "Malware payload", "value": "48a2879652cc54bef6b07c0377d8b1f23bd717cb", "object_relation": "sha1", "Tag": [ { "name": "ASPXSpy", "colour": "#E2CF6C", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075887, "uuid": "a663648b-1a01-4940-8000-ea86a29c6e8a", "comment": "Malware payload", "value": "3b8f5e2b5641d2e4d0a1b7765be8f3d3f43f1a009d17a9d0b18b39305fb324187ecb7070bbf8a33aa6b5f1f52eb33819", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXSpy", "colour": "#E2CF6C", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075887, "uuid": "1ab98e49-0ccb-4079-9fdd-cc2ed005bfdc", "value": "T1B07329C81298EFFBC36765A6D7F5D6298E1102608F340CB1E7DF811F958582A4A32F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075887, "uuid": "7b2a0fc7-f876-4660-9a22-1aa0945b85b9", "value": "1536:YYZzFKOkuqp1VagQNOVzocysdAyAiQOlHKbnFMBMK6IK8eM2:RTkuqpLvOOVzocysthAOtf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630075887, "uuid": "0c592a37-334d-43eb-90c2-041ff2b0284e", "value": 74433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630075887, "uuid": "b1eb983e-a2a6-4302-8ac5-aa63f312b715", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075887, "uuid": "6cb6cd8a-49f5-48bb-9409-15feaa57980c", "value": "2FvyXcN8.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44481626-0774-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630095648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630095648, "uuid": "3dc6973c-8e2f-4d7e-85a8-81eaba2cf77f", "comment": "Malware payload (NanoCore)", "value": "024440f851eae792247d04d48eef6712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630095648, "uuid": "238ff146-d443-440c-9337-44517b8f5161", "comment": "Malware payload (NanoCore)", "value": "8e8fc9a962c13d9e88d7ae5b1f16e4c8c28d0966a454f68125234ec071979a62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630095648, "uuid": "eef1acde-e40b-43d9-882b-a91fb7c8181b", "comment": "Malware payload (NanoCore)", "value": "b13ef7c4fae66c0e8821b7a77ef30a691deea9b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630095648, "uuid": "dad83f77-4ea4-483e-a2ec-17bc8ad96682", "comment": "Malware payload (NanoCore)", "value": "45fe06b9cf8671f0cd2c8693be521ea740f47f580b436bb0ced2ca56f6b6257a62fd6718ce7bb0c4581aa36fcb3f312e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630095648, "uuid": "576b89fc-01ba-45ed-bef2-00511f27f56e", "value": "T12CC4125A2BA9462FE2DE8678601606429378C3E7D4C7F7DE58F855B68F12BE007070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630095648, "uuid": "3b0509ac-6768-4081-b82f-26c595b336db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630095648, "uuid": "a15030f7-1c54-43ee-9da7-a4296335d770", "value": "12288:WLV6BtpmkMqTyxfe0/BIDqQhz5lvp0cMdX435orP/jorAhJ:EApfMqTofJ/BIDVh3vfP5cPLQOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630095648, "uuid": "3fe897f5-f092-4f3e-8c8f-4e012973815a", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630095648, "uuid": "72a21c9c-18d0-4e0a-bf0c-883869555e3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630095648, "uuid": "da30d433-1348-4aeb-9eba-7d5fd985583a", "value": "8E8FC9A962C13D9E88D7AE5B1F16E4C8C28D0966A454F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b9a130-071e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630058665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058665, "uuid": "5b4148d1-44cf-4d58-97df-2b98110b57c4", "comment": "Malware payload (Mirai)", "value": "d601d30587621a7a3ff6ee899a9c290d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058665, "uuid": "168978db-3bfb-4990-a744-9063affb748d", "comment": "Malware payload (Mirai)", "value": "8e9c28ba532cffc54f4c1505700c2f41ed3194532c854a380e827615fca63d16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058665, "uuid": "8d07d570-bb33-4a7d-8b3c-f1cba838c2b2", "comment": "Malware payload (Mirai)", "value": "4f85152ebefbd130461d5a592aa87bdb14755073", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058665, "uuid": "bb42c7a6-d764-48b0-8766-d284d76742a6", "comment": "Malware payload (Mirai)", "value": "4745313eb697efb32766dd63930338d31d2932a4cfb7ae7f5f622b835ecbc1bf1e1f387024b81a9334eca8efe0cdbbf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058665, "uuid": "b77b8a60-4a97-4955-87e1-ce28173b67d4", "value": "T1ED736D83B70C0F43D1B25E702A3B17D2B39AAB8133D1E345A30FAA05D577A316656ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058665, "uuid": "ef02ff49-a3c4-4d8b-a0c1-f0306c616db4", "value": "1536:48isvkPwm/Cmzq1/bGjstlgWNLEUG4SzwXwr4ehush:48hvkK1DGjswzUAzowr4eIsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630058665, "uuid": "0d75664e-72a6-45d8-bf15-a5cbd58f9f05", "value": 76140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630058665, "uuid": "dd4456ec-7bd0-4c00-93df-506479e7fc9a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058665, "uuid": "a2342307-f821-498f-97c3-498315b42701", "value": "d601d30587621a7a3ff6ee899a9c290d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff90b970-071f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630059455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059455, "uuid": "46cc125c-ae5b-4f63-92dc-df27d7b29974", "comment": "Malware payload (Mirai)", "value": "4259d240cd11919fdb026aa532dafb2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059455, "uuid": "0b91f046-de3a-4ee8-9ef9-465604808bb5", "comment": "Malware payload (Mirai)", "value": "8e9d9ac06e0175e80c624e18f5c6358584c2fe943d8e69fee69ad3bfdd487bdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059455, "uuid": "53e59927-0b9f-44f7-84a0-a3d93d8c6b3f", "comment": "Malware payload (Mirai)", "value": "891e92fcc62f9d3bca03b71563b32384ed15e6e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059455, "uuid": "1ec6bc7d-f020-4f0a-b2bd-569082ccfc88", "comment": "Malware payload (Mirai)", "value": "d7afdc2aa789e059cdb6d5924bacf877e3a961613e4e38d6b62dacf63dedbe40651a921a8048faf0bc3b45daeba5c9fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059455, "uuid": "201ba22b-a59b-4794-a935-e285ab8716c2", "value": "T1A364F2CAFF11BC3AE985067539AB074DB7B4DA86C3C7E080F294C55E38AD285BB611D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059455, "uuid": "ef98da47-4671-46b1-be57-7df90fa8d3c4", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioTPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiHPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630059455, "uuid": "9c09e024-93df-4ad2-bbee-a949419ab3e0", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630059455, "uuid": "c220098d-fe38-4364-8a07-4d4d86acc21b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059455, "uuid": "ac8b8fee-0f97-4e36-b18e-ccf21ab87a88", "value": "4259d240cd11919fdb026aa532dafb2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f640972-0762-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630087963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630087963, "uuid": "2b568d1c-5b63-4ea7-b66c-bad51c8f2b8a", "comment": "Malware payload", "value": "e3e05d75c47fdb8a7a0941874fc11d06", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630087963, "uuid": "2509c620-9f4b-416f-84b5-06883684e5a3", "comment": "Malware payload", "value": "8ea46ac64f5af7bb295a8b784738fc11fc0fde1543d7da43c0f97f88950185c4", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630087963, "uuid": "d42872de-a7ca-44fc-9df6-3200033c9888", "comment": "Malware payload", "value": "56b71f91e7a1455c530751d254c81d184a15dc4d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630087963, "uuid": "c5544751-b170-4187-86be-1ff5625ef1f9", "comment": "Malware payload", "value": "31f3763e7730f8b2cd90418d373d9d3e3429fb7d93f60f874e75f003fcac8ff72c18486ce4a8be6a8da9811cf54af5c6", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630087963, "uuid": "9f9cde3e-bc37-4793-a068-ed42598ebf9f", "value": "T15BA4AF8A9591A247FED58C79DCD8F1D2C6837B395D3ADAF37CE4E03068281A4D89B113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630087963, "uuid": "a7fc8d9d-c648-4d80-8425-21fbb6fcd127", "value": "35890417b8426ce9add593489cc763e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630087963, "uuid": "1d73a06e-0bd7-4005-90a3-3c010bf64bb6", "value": "6144:JfhK4Oe8t9VVXESXclLbMD7CjcQJLSoxhKSwZHNKt6rAE4Div6qjtyFBO:ROJ3MlfMD7CVL9hgjMpEMmy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630087963, "uuid": "0be82c51-d2b3-4881-83c1-c8d1d86af6aa", "value": 481809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630087963, "uuid": "df2d562a-178a-4bda-87d7-80ee49593a37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630087963, "uuid": "cfd77c91-0e9f-4b31-93f5-f45107b2380f", "value": "StNsbaY.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344389d5-072e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630065556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065556, "uuid": "883089c4-df99-4a99-91a0-73ab0b3cbd8b", "comment": "Malware payload (Loki)", "value": "2d22348c85e24449af7060bc841d378f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065556, "uuid": "28946091-65e7-4f12-86f8-564a1827b225", "comment": "Malware payload (Loki)", "value": "8eb5324d03faa53ae0684014d1c14592dbe2d68cfa65fa39b88b18f33ffe3e39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065556, "uuid": "13199b56-23ff-47ec-bc66-0c4984efa058", "comment": "Malware payload (Loki)", "value": "b3269b60e5a84772b6dafec26a2966951cff3d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065556, "uuid": "a442dd7a-87b3-488d-afdb-fe867d6870df", "comment": "Malware payload (Loki)", "value": "490f21e1933e5554fee9e7169301dc828c6dffb6f7b0ac7b478053bf3da2cce3f1fe2ef314d8914ee4c4c9c4c0b54870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065556, "uuid": "ae27a8fa-d270-42d8-aecd-7eee653fe1e4", "value": "T150052A3D29BD2227D179C7BACBE0D837F0149DAF3111AA6464D78B6A5352E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065556, "uuid": "2a171611-6df9-478a-92f0-d6ea306fa353", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065556, "uuid": "9baff6d4-fd6b-4015-a7ae-bd3902325ea5", "value": "12288:j1rYZfn72IgIL3RWR7gZeUQ64RojGWoaFXxmI:5YZv72IgIzAO0Up4RojVpFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630065556, "uuid": "8e0dfe86-d4bc-4451-bfdd-411941ac9b42", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630065556, "uuid": "c1818922-8c61-4844-94e8-b5f9a5ce9365", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065556, "uuid": "aad35df2-45e8-4784-b366-e344d70bafbe", "value": "wire transfer slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b554bfc-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630053059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053059, "uuid": "6fa0cd72-4c7b-408a-8624-26f0a206c4b5", "comment": "Malware payload (Smoke Loader)", "value": "4ab0fcc94cfd9132a37d1887d91fb6b5", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053059, "uuid": "a9fef4bd-42c2-4708-ac77-cadf4432c48f", "comment": "Malware payload (Smoke Loader)", "value": "8fac24a6f5fb920a1ceeb5759183bd6bd00720d739e35fce318da7f92198610d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053059, "uuid": "03c87384-1169-4055-a8e0-4223318d05df", "comment": "Malware payload (Smoke Loader)", "value": "cac5125f83e011d360c06ea19eada8d7ea774020", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053059, "uuid": "7cd70697-1e7d-449f-a5fd-91e9cd567c00", "comment": "Malware payload (Smoke Loader)", "value": "bd4877495a434b6c0164bd99e952bd630da7a4aa788413c46573dd654f86c695d165a052385750afcc640968f3ac683b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053059, "uuid": "8b2f62be-be4f-4b00-93af-b202ed67b47f", "value": "T118447C30AB90C035F5F312F85AAA83BCA9297AB1673490CF53D51AEA07346E5ED30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053059, "uuid": "fcd90caa-6093-4f5d-8cc7-5a843ac32346", "value": "3b142de1de00907afa014d92f674693b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053059, "uuid": "88977a64-9e95-48f0-8938-0033e302c83f", "value": "6144:rJTpEdr0V/0zggGSQxRYrL7jkS7/929ONT4r:lpOE/0zguQx6rLUAlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053059, "uuid": "cb0e4f6a-ed10-451f-806d-1b55c5a6d4e1", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053059, "uuid": "5310063b-60c1-43b3-9db6-27cfe96a2d96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053059, "uuid": "6e3908b2-3289-4c3f-91ad-17bdae1f0a0c", "value": "4ab0fcc94cfd9132a37d1887d91fb6b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d2252b-075c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630085425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085425, "uuid": "0da98389-d183-4abd-90f9-034f7833816f", "comment": "Malware payload", "value": "e4c49f9d53f701a8e2edecc9dd8a5057", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085425, "uuid": "a30fb762-37ea-4d22-8874-bae8a02a1402", "comment": "Malware payload", "value": "90b9d553b4883ed20e3273a86351f103d10b012dab0c82179bb6b5bfcc188b88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085425, "uuid": "24c58bbf-f7db-475a-b526-9d91b9fa2f87", "comment": "Malware payload", "value": "1f8f7f175f1bc7f2da13bf60310da90ca8933f7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085425, "uuid": "c6a49b3f-a4e3-489a-a339-4de04cbfffc3", "comment": "Malware payload", "value": "b482722992411296df219486a3ab5e2ad06ec28d7830dad78150bf8357250f4fdd1acf9f1bc8afc5b25266722c28a647", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085425, "uuid": "ac5dddfc-51be-4e36-b97e-707dedba462d", "value": "T13CE3E111DA28E027F48115B482B13ACA18790EF78739A4667C85F86C79F5FF5812B2F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085425, "uuid": "95408a18-0b73-42c9-8a58-98d133d07a99", "value": "340cbb019799ff7ed95694815ec3e316", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085425, "uuid": "f6c49d9e-8e83-4a13-a9cc-e33ac3b6efe3", "value": "3072:NgS1Vn/bFL4NM9fmbv1e2s05UOsDs5rdt0EVZXtK9LYHxdj/sJEFOTlZ:pN8M9fmxHsYjtFVvK1Kdj/WE4TlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630085425, "uuid": "30a86e5c-3b00-4477-bb1e-abade6735d1a", "value": 154608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630085425, "uuid": "9b235070-41cd-4494-a66f-8c037a865cae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085425, "uuid": "d0069f98-cfea-4b31-84ac-ab9a2498fc07", "value": "e4c49f9d53f701a8e2edecc9dd8a5057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d83ee8c-0732-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630067236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067236, "uuid": "f4a9cfc0-3593-4833-9cb7-126418d6cc2b", "comment": "Malware payload (RedLineStealer)", "value": "933243647044b5c0bf8463105e7f89c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067236, "uuid": "2fcdbe68-7807-40d2-a614-35c4f9f745aa", "comment": "Malware payload (RedLineStealer)", "value": "916349710295f7d3913a28505fcea2ac8b0bc0b34e7cdc04e45feabd6cf47182", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067236, "uuid": "7b4c56a2-e412-4ad5-af60-ae129c65887f", "comment": "Malware payload (RedLineStealer)", "value": "e35c70d350856bdf59de6a2283f1c98a4786cc7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067236, "uuid": "3319f7b3-f7fb-484e-af16-0700b35631a0", "comment": "Malware payload (RedLineStealer)", "value": "d8e2e9b17a9a829ededb97ce954c3da2852d37da3e7afe7544a5f5fa977ddda34479348ea490f72f33d00170dc5a23cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067236, "uuid": "7cc614a0-5767-4a6e-af76-168bc5ae59fd", "value": "T19A06333DE6B4184DC25A25F78475F5382BE82F2116FA5050AECCBD3B3AB457F52CA068", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067236, "uuid": "76a862b9-310a-49b0-84c5-4bfade8fb324", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067236, "uuid": "d8d0f441-94b1-4d2c-8a90-c161fae3a325", "value": "49152:4AVpSbbZDZ1NrORgsKdDZhtLcSZ2NUnvO4bi3RzEO+twtnESTEGOMVwrv2fgD1uT:4A/gDZ1dORry9YSURBOSn/wG5cUgsKZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630067236, "uuid": "2fdfefdc-26c6-42b7-b4a4-db251dbe18fc", "value": 3948968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630067236, "uuid": "4a803d4a-04bb-4f1d-844e-02fdca797400", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067236, "uuid": "2dc577cf-f132-4c99-9bf1-71d53be1155a", "value": "933243647044b5c0bf8463105e7f89c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011dc55d-0703-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630047002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047002, "uuid": "e169a490-57d5-4a8e-9199-850a3cb7c748", "comment": "Malware payload (Mirai)", "value": "4f4e0e13386130c697a325bcd045c9af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047002, "uuid": "202d7872-74c4-4439-b7f1-dab398509ac5", "comment": "Malware payload (Mirai)", "value": "926581f0ed225771334266ad77fbae0fbb0bc52a22d422a5c6d78111371a3a8f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047002, "uuid": "e06b9aad-d3b9-40e5-8914-da7c72466e43", "comment": "Malware payload (Mirai)", "value": "52586021e4f9dc08c59ec97c75248d709965cbc4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047002, "uuid": "6b49cdcc-62ed-4c25-baf3-f8479be531c2", "comment": "Malware payload (Mirai)", "value": "17ad02995acf16a7552dab3f958e8f78469d90add6f770044f2588cbda27231efe310d849879631f448f2f9639f9cc7e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047002, "uuid": "dea0c8ad-9e4e-431d-be68-55d6502be132", "value": "T1AB036B88DB43E2F5EC3705B1E5ABA7715731FA275429FEA7C36908308C02112DA07B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047002, "uuid": "bc495b49-5d49-4c80-bd4e-d18673ed152a", "value": "768:iTruD3v1bmtI07ctv4rcGM9phKfTjiQcljr+1rYH++TQmD:iTKDdw7UYVAnKr2RljSWHAmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630047002, "uuid": "63203c63-b7d5-475b-aa44-54c9d21642a3", "value": 37988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630047002, "uuid": "272070fa-9c79-434c-b9bc-6311a8c93201", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047002, "uuid": "aaf2bd7a-e570-4bf8-a8c5-81b9f8a7b0db", "value": "peach.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54186573-070a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630050148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050148, "uuid": "92c6a612-3c8d-4f6f-9113-0722da84afed", "comment": "Malware payload", "value": "8075723b7bb5b837fe6b728722ccf920", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050148, "uuid": "ca307da5-4aea-4a7a-9d9f-c8225b87d5dd", "comment": "Malware payload", "value": "970b2b7f8b5fc9f7fceb8d33c8074233e2fee34ac92d51f4b9fb1a4aab2763ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050148, "uuid": "61d25845-d3cc-4b35-b705-ef02b4ac5d4e", "comment": "Malware payload", "value": "5155c8e4d59189195d29667e9131a94b2ef4b60b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050148, "uuid": "22d87e62-93b7-4524-823d-992191816017", "comment": "Malware payload", "value": "e9118bff482d4d2f58979bd44de76e22313c82295e47eaabdeb655ee90c51e45904c94182271f3caf292b26003637004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050148, "uuid": "9e37a6e1-d571-48df-9515-f87dfa637194", "value": "T184E217173659E5BEC999C334456BF034D933743C3222B51B37D4BA36998EE202F2E51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050148, "uuid": "353a550a-e184-4657-a7ff-64fdd5997e2d", "value": "384:BWskamFsqGhR9jQRljpvMtH5d4mA0nIEYFF/89WDEuaUQwk70a1E+XwLl0kGuty/:AFTaLRRQNv2H5htnvTU6wh0kGAiwsyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050148, "uuid": "7aea66b3-8ea8-45cd-85bf-f4d83850c0ad", "value": 34183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050148, "uuid": "c6b0d716-dc13-4a29-8edb-8c94da5bc1c6", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050148, "uuid": "39f9a990-9b91-4121-9f11-1725bf9b4cd7", "value": "SecuriteInfo.com.Linux.EbolaChan.23.16765.13905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f668164-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630053146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053146, "uuid": "d4d4baca-d2ce-4c99-af9e-64de9df11c20", "comment": "Malware payload (AsyncRAT)", "value": "26597663fcdb8fc32e2076bd5834889a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053146, "uuid": "d31d28bd-785d-4e34-abc6-1ecb861c3aaa", "comment": "Malware payload (AsyncRAT)", "value": "97a47ec80b071d3d18bca405cbbb3984d3d364745852142a09ec75312e5eefb2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053146, "uuid": "6902f755-81c4-47f8-85fb-ddf641057d34", "comment": "Malware payload (AsyncRAT)", "value": "43b23ed222226e50c3ddc633ba9fb53457a7178d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053146, "uuid": "6ffd8c76-a087-4390-95e0-52f02d47cf75", "comment": "Malware payload (AsyncRAT)", "value": "83d7c8e771f9d2aa863669870fad1b06460dd0a5a5c29a5912d4a02fe1855ba375618b1a1b390d90c760d7cc7775b65d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053146, "uuid": "89f4a8c1-5b82-4c77-b8af-42fe9fa56107", "value": "T1D9236C4037D8C136E2BD47B8ADF2A2418679D6676903CA5D6CC810EA2F13BD596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053146, "uuid": "20aeb05a-886d-490e-ad37-6b8fbfe5893a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053146, "uuid": "c1965c3e-4927-4031-9a78-fc53a302d055", "value": "768:DcICljTILmCKi+DiBtelDSN+iV08Ybygen/4hP5EZvEgK/J3ZVc6KN:DcIYdmBtKDs4zb1+/MP6ZnkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053146, "uuid": "016f2472-ee75-4356-8530-ba92c3182e7a", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053146, "uuid": "5a2a6702-02ed-43f4-9244-2135ff24a76c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053146, "uuid": "9ae7b5ec-70f5-4345-810d-eea58ff154d7", "value": "26597663fcdb8fc32e2076bd5834889a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4300b7-0753-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630081377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081377, "uuid": "0d8d3753-b025-41dc-89c2-0a4e45e1a3ad", "comment": "Malware payload (RedLineStealer)", "value": "c618e4cd017c81f826dfddc3206a7b69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081377, "uuid": "c6f7ab4d-0517-4783-afa3-80b71414e78e", "comment": "Malware payload (RedLineStealer)", "value": "9839e455ba50a03657cd2cdd70ff5946652031aa69eb6e665ec5e01fe5441acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081377, "uuid": "a68c12d2-2508-4615-88ce-6a7908146aae", "comment": "Malware payload (RedLineStealer)", "value": "f91621e9c0d0b8ceefff4a5a55efe461a858d678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081377, "uuid": "e2041bbd-0ec2-4333-aa3d-08d7659a6512", "comment": "Malware payload (RedLineStealer)", "value": "0518cf5048739d2d2dd754072da71088e997c3add8d7b786b7b77ee2e969a2d14d4bb74c891d998911cff60b55238b2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081377, "uuid": "3c61e8b4-4383-41aa-840f-3124510dba7f", "value": "T1C6F39D6B24649062C55C1735E4760F4B367CDE394981F249B08EB3AADC3D3DE89F83A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081377, "uuid": "3636571a-cb42-4706-961b-fd6bda171695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081377, "uuid": "076f18f1-3064-4e98-b9dd-6a3e0047f8c1", "value": "3072:wr47cDYoegp8DnaoWGX/RdHRlYNklZLz:04c8oe/naNG5doNkll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630081377, "uuid": "71aef63d-0706-46a9-b904-a6df0d855bda", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630081377, "uuid": "be419977-8267-4579-8b84-c3ca5f17b51c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081377, "uuid": "4e83ddac-7fd8-4c9f-b1f2-a9445bab1a13", "value": "c618e4cd017c81f826dfddc3206a7b69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92dfacf1-075a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630084613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084613, "uuid": "6bbb9fdc-09d6-4b15-9dd9-85703c646532", "comment": "Malware payload (AveMariaRAT)", "value": "4683903d41b7091586fb2cf1737dc916", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084613, "uuid": "bc71db38-e0fd-49fc-a893-24647baff3d7", "comment": "Malware payload (AveMariaRAT)", "value": "995253676a48f849d9f6c5c8e23a612a4aed9fbb3526e9b15894e9397e25fb69", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084613, "uuid": "c84551be-7f8d-470e-a90c-0bb2867650d4", "comment": "Malware payload (AveMariaRAT)", "value": "a622afe5c6596f9ffd72d6ce838e704833b9c3dc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630084613, "uuid": "8a93035b-7122-48f2-a0f3-7f76507d4b15", "comment": "Malware payload (AveMariaRAT)", "value": "6d2ce2751e565859679fdb534c7623530b616aac38c2fef448e4539cf53e2c4d79160dbecbc3e788f263e4d8ccd97bf2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084613, "uuid": "e5afe1ed-42ad-4d6f-94c8-fe0bd6c8dbc1", "value": "T1D96539047B94C161C88614783952E7AC46B07DFA58798F5FB380BB6E7E3449A253BF23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084613, "uuid": "ba26eca9-7cee-4e3b-8831-ea34b7735418", "value": "ea10bfd7ebf0fdb25ea89f5e4ba40ddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084613, "uuid": "eeee181e-b225-4dca-808d-c2ba297f4a42", "value": "24576:oUzUqL1Ez1PWJEYd3lul0+OzaAscp+CPdLN81JOJ6ban+k:oUwqL1Ez1PKEYd3lMCrlLN8L65nV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630084613, "uuid": "ca01819f-9752-4b5b-9003-305fcc652c34", "value": 1415680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630084613, "uuid": "8c83b07d-ddf2-4876-87ba-3aab07b0b9ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630084613, "uuid": "753ef851-f083-4b2a-a0c0-fdda4d7f3343", "value": "bigs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075940f9-0715-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630054744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054744, "uuid": "ff10bf00-2991-4fb7-a782-93c4782531b8", "comment": "Malware payload (Formbook)", "value": "4793724aa393e35f8cf54797453a25d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054744, "uuid": "a6da504f-6286-4f20-9c13-b09a9694f42e", "comment": "Malware payload (Formbook)", "value": "99714288e33f3da9fd0bffa08767fc02aa0d014dba4352aa5ce5ecbe8f94f0f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054744, "uuid": "4a683940-af36-4353-b6f1-0b8733643f99", "comment": "Malware payload (Formbook)", "value": "b62a4f0b6a119ea7c629c23e4afb67a4b13f3f21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054744, "uuid": "5832d85d-a06f-42f4-b7cd-b6fe716aac74", "comment": "Malware payload (Formbook)", "value": "e0ed93bf335e2e9067e420ff9611a4f9b183643764f8f0ed59ab0d93674f00b7ed37c1b8ea2c34db768099553d66d57b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054744, "uuid": "b12b499a-10c6-45b9-9dd9-fefd03615dee", "value": "T11235E43D29FD2627D1B9C7BACBE09827F15498AF3111A96468D343AA4352F4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054744, "uuid": "777c1c66-f3a3-4e1e-a243-6d19ef42dc3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054744, "uuid": "693effd8-63bf-4c82-bee5-8741767de77d", "value": "24576:Ycgh6noMebNC6+S1+qkGLeKWvzLvpwgZeD6u:YqoZZC6+sPZLRWvPpwgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630054744, "uuid": "43f8c38a-f10f-4d11-8302-6ef1889777a6", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630054744, "uuid": "210e5a9f-3cd0-44d9-91f0-d79205c3721d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054744, "uuid": "a5d283f8-3082-4f87-aeec-fb1adfeb893b", "value": "4793724aa393e35f8cf54797453a25d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b030e3-0712-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630053583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053583, "uuid": "27afe635-6b9d-4fd7-bfbf-9264d5dbc61a", "comment": "Malware payload (NanoCore)", "value": "5679c7e70813483c6be1b8ab4fcc8090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053583, "uuid": "e3855cc0-c104-4e68-84b5-99b841038487", "comment": "Malware payload (NanoCore)", "value": "9b845ccbe4f688e6c5afb4cd90956a9be9ad8f72d78db289d63dd22f011c3e74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053583, "uuid": "f0c17887-ffd2-4f95-8851-fcebaa82ebb9", "comment": "Malware payload (NanoCore)", "value": "c35ebc0f8b8da619b5de547a9cd249a804787b2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053583, "uuid": "d69049ff-8480-4af9-9401-3cf674bc07e4", "comment": "Malware payload (NanoCore)", "value": "4e9a273e223eb7dc6f1f6185169f23c1230527d64979a240e4d20a8637c472655eca3f853de011850caf7047dec99a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053583, "uuid": "86d577a1-786b-4fb6-adca-a5b42899b101", "value": "T15E35E53D29BD2227D17AD7B5CBE09827F15498AF3111AE6468D383AA4352F4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053583, "uuid": "679630d1-2372-40d3-8ea1-e34067bdf827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053583, "uuid": "f3f9cbfd-d751-46f9-abf2-f619ecc6410a", "value": "12288:fbqEa9j1K+0Ey4eJv/qBfmzcVcJ6AfJ9bmlGdPF5HKeM9+NXeeDuR4QPujP:zqfJw+0EyZ6JnOcwJ9bXPF5HKreD6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053583, "uuid": "9d19362c-e8b5-4c28-ae3a-bc49485caffb", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053583, "uuid": "bc61d171-d615-47b5-99d8-e0f6b32dd508", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053583, "uuid": "f695bb31-c9bc-4ee8-b935-9ebbc42680e9", "value": "5679c7e70813483c6be1b8ab4fcc8090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7075503-06f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630040838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040838, "uuid": "9af6894d-f229-4059-b8a9-cf782d98f45b", "comment": "Malware payload (Mirai)", "value": "25268788253f10c2e7678d0df4b4e315", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040838, "uuid": "ef73c901-808c-49ac-afdc-82578a986852", "comment": "Malware payload (Mirai)", "value": "9bdb7d4778261bb34df931b41d32ee9188d0c7a7e10d4d68d56f6faebd047fe4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040838, "uuid": "870413d1-bb2c-4734-a978-e676f53aaa47", "comment": "Malware payload (Mirai)", "value": "5352b927a5b448bf8d1df2a00b329dcf39ad0c58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040838, "uuid": "d83a4516-82ed-42f8-bf27-1e42e93aa94a", "comment": "Malware payload (Mirai)", "value": "5f38a94058e0904a00d058437e47c2b0fa4d4346739f1eab60e7c1020c1f13b81f770b658c947757b560eac450a5371e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040838, "uuid": "21ed2669-029d-4944-aa3c-c174a6380a82", "value": "T15D53AE66C42D5CD4C15486B8A8348D390BB3E106A6F32DFB6A86CE61C447FB8F5087F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040838, "uuid": "83a6fb9d-57a2-4abc-96d9-4e32c00ecfff", "value": "1536:6hfsri9wt6rsCNfJ4paNd+HkJm7PXjdJCuT:4fD9jFf4pGdqhPXjdJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040838, "uuid": "435f7bb5-b3ac-4505-8c5d-b5f779da8d1e", "value": 60740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040838, "uuid": "38db984e-d232-495f-9269-925fe8522515", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040838, "uuid": "c142de79-7a0b-405d-b0b2-b93efd3b9cf1", "value": "25268788253f10c2e7678d0df4b4e315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0660a917-06e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630033267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033267, "uuid": "6ac9bf6c-7a50-434b-bf30-db4f3563d6d1", "comment": "Malware payload (BitRAT)", "value": "a155acff10e4cbb90591962276dd7e59", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033267, "uuid": "6b3a1494-655a-4c3f-94c5-552edccf7c7e", "comment": "Malware payload (BitRAT)", "value": "9f170357a947a0db05e2b9a8d558e942efe7d8e61c56cf4246f92b5ff95e3a84", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033267, "uuid": "0c276fce-b250-4a66-a62b-44cceff1cb03", "comment": "Malware payload (BitRAT)", "value": "c32b9b5352b0058cf0a457af077b8c0e26367080", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033267, "uuid": "e9ac1db6-30bd-49ef-8b50-72cae04b580b", "comment": "Malware payload (BitRAT)", "value": "1384acfcc3d4732f1c224e401507d7d8271963202cf07edaf2fdd2e77926a1e7a014513f13630dc242b70ea488c88fd4", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033267, "uuid": "de4ac9fc-2b83-498b-9afa-bca8119776b4", "value": "T1586533E15E5EA37AF6AE8C3C797A1D03CD78D561256B05017E6CC9BE20BFEA11884C13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033267, "uuid": "8b172d08-884c-4af0-9fcd-7f7480a54454", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033267, "uuid": "2163db3f-aa76-47c8-acb9-8cc53249b80c", "value": "24576:XndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkz1BKQHr9RjB:3XDFBU2iIBb0xY/6sUYYcBBZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630033267, "uuid": "eef96505-f014-4794-bf83-b43952a1dae8", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630033267, "uuid": "ce31017a-070c-4af7-8e73-2dfbb043b0e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033267, "uuid": "26cd904c-6723-4ae2-9c5f-623e5d1eaa33", "value": "A155ACFF10E4CBB90591962276DD7E59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f55778c-0724-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630061253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061253, "uuid": "029e65d2-bd5d-4f9b-93a5-94946bc1998f", "comment": "Malware payload (Formbook)", "value": "2c4a1dc4a7ffbd4e7beea5085bb2888f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061253, "uuid": "2a0e7270-5a3e-4eb9-b420-2c5ae902edcc", "comment": "Malware payload (Formbook)", "value": "9f7fd1dce816527266c587dd42767f0c39266055d10c36b50b08a2b8e3126211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061253, "uuid": "9b562fe2-cf8c-44d6-b8f4-e90a74c7b1fe", "comment": "Malware payload (Formbook)", "value": "729f195f603ccf69108fc22d83d3ace5d11a45e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061253, "uuid": "a192d945-6329-40b3-8002-a8a97fe4df00", "comment": "Malware payload (Formbook)", "value": "b15d9f7ab8a798a471c71a5b8d6c2958978bf552ed6010334673c67fe7a35a228a447a96154eed887a861de687292cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061253, "uuid": "b748edf4-5bab-4a6d-b071-a257a876644d", "value": "T1789401A2F1D9269CF4DA413BAFDE885141F169470E478D0390F11FDBBE9BA6503C0A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061253, "uuid": "2232f9ed-b8e3-444e-8b2e-ff1e592f148a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061253, "uuid": "6862d6ec-c5d2-4628-ba7c-34218aed4398", "value": "12288:V1zK/0SxUVdjjoj+wWiOjUeIKXnWUEHcr:Tld4j+wWcenG18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630061253, "uuid": "f3edfd66-064c-427e-9d9d-ef877b1b2312", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630061253, "uuid": "6d0ed412-22fb-4058-af19-73aeb8dc1276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061253, "uuid": "b51607b8-9e6a-4881-b697-457aea85789e", "value": "Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143518ca-06fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630043169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043169, "uuid": "d1454b93-4b4d-40ed-b306-b521382d8bdf", "comment": "Malware payload (Vjw0rm)", "value": "9a7ad3d3d82e36a33e673af5a6ad66ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043169, "uuid": "11a21ced-7b00-47df-9c9f-0465b1e88bdd", "comment": "Malware payload (Vjw0rm)", "value": "9fd94aca819af4ae40e78aaebc42c92af94539135ccd50839626a2565106f9e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043169, "uuid": "324de3f9-1397-42a4-b0cf-ed41e4a49e40", "comment": "Malware payload (Vjw0rm)", "value": "9b4683b9ff01722e54bca2b88789ff6304978e32", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043169, "uuid": "fa593958-734e-4a1a-b1d0-b6d3e1cfd196", "comment": "Malware payload (Vjw0rm)", "value": "6e2a538cfba751cc8fa6dac7f40e15597ad9fda592ed1925bca5bc4cc96c76b571e1ea4a6d4ab1864cfbe82c16e4ed00", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043169, "uuid": "4c85e3be-b6b5-462c-8191-253d9876f548", "value": "T15014BE70ADC0479CB65C431C90FAD28903B1D3CE97CB7B85B9EDAA709B92B10E70A55D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043169, "uuid": "26487599-d1b4-4f98-8c44-7c0dd403c0cf", "value": "3072:4q+Ly+xa+i9bNCmcaOz7M8UDFDV/n1jyC4cBchiD3+C5hKkjQXRJp:jki9Imca0MVRhZyNCYiDO1kEnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630043169, "uuid": "481effe2-9646-411c-b696-83319e1d42c8", "value": 205204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630043169, "uuid": "a144ce76-4fcd-4c48-a92b-186a8a6a0a15", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043169, "uuid": "57de75ce-12eb-4225-be0f-ce1b4f240123", "value": "P I09045090979.jpg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4f2d92-071c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630057836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630057836, "uuid": "092475f1-88b5-4c36-a24b-bd2b15cd3a2c", "comment": "Malware payload (RaccoonStealer)", "value": "2abbfbbf33d262f6ae44dd83df8d3e30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630057836, "uuid": "fda60f6c-dba8-4260-adce-ba56ffb8a343", "comment": "Malware payload (RaccoonStealer)", "value": "a17024fcd2de08eaddf6e1a317c3a9106410cd8d536fd7e9520899370f97e69c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630057836, "uuid": "357f73a7-9901-449e-a9f5-395ceed6c9f4", "comment": "Malware payload (RaccoonStealer)", "value": "665eb97ed95214627a1fb0e06ee5d3b7fe080142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630057836, "uuid": "e3651b9d-b0f6-49db-99e7-f5cf14d8b4b4", "comment": "Malware payload (RaccoonStealer)", "value": "861eeebf31189b05b88856d147a39591db6e604c828e2d8bf80ae842073396afda1cde305dbf901d0df286ca5179f4ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630057836, "uuid": "9f4655d6-bdcb-4629-bd0e-ad0d39643aeb", "value": "T151C4AF7675628077F17200B0AE6CA7A1167DBCB009328E9B73C9063D4FB55D2D722A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630057836, "uuid": "f09987d3-7e72-4db9-ab94-cf2f3f5ecbaf", "value": "35279f0bcb93fbb246a2ff5f9995bdc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630057836, "uuid": "a611a9bd-32a1-4264-bf2b-b4f2a84e86ce", "value": "12288:jh/yDN787IPelHo8BM2rMayvaD7Jz52548cRWipfx8BjaMQKbG7nU:d28y2rMDaD7j2581kQKijU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630057836, "uuid": "5fe37ffa-a59d-49bb-a9b6-c595464dc133", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630057836, "uuid": "a226c63f-8dd9-4e60-bef7-56274adcf4e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630057836, "uuid": "c75421ff-bc4f-42e0-8c93-6507a3cebdf9", "value": "2abbfbbf33d262f6ae44dd83df8d3e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c36a00-06ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630037912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037912, "uuid": "442b208b-bae7-41e6-9d4e-e4bc01fa85ac", "comment": "Malware payload (RedLineStealer)", "value": "5665f108965c55a2d3ebcbbb50b03786", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037912, "uuid": "5addeb1b-90d5-4be8-b6b8-83688a6453aa", "comment": "Malware payload (RedLineStealer)", "value": "a32770d46ee2ee5b91cc36e5159868ec3ff7f847e7516d7bcb952f7a94e347a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037912, "uuid": "e7c4c18c-0090-4efc-958f-8c7aec56da85", "comment": "Malware payload (RedLineStealer)", "value": "5f3500c5d5f646383e06033fb0650d9b83da98a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037912, "uuid": "fea5d5fb-3520-499d-8440-4e9bf58b34a9", "comment": "Malware payload (RedLineStealer)", "value": "526cacb59585fa5bf37695e2581431fa66807288b9a087f52aa98f5e2ece9eecace2151edcd730117c928318f82edb7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037912, "uuid": "59dd4351-51fb-43fd-a1e4-5cff0f531525", "value": "T12FB33B2163D8D629EBFE0B7574B0072047F0E19B6021EB5B8DC274DA1E76B81AA456F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037912, "uuid": "26ac2772-c63c-4429-ac11-48b771ba5027", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037912, "uuid": "d3ae9cb5-aea0-46e2-a578-f8b9dc585967", "value": "1536:Ot9pmCexBLOcBGdOjH5IzTUvpgnOnJPljbuqGdCnZuyq+dpV+dDjEuG6qTaoigl:8exBL1BKoHCzTQpYS3GCnAyjdpGYD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630037912, "uuid": "fadaff6f-31cd-4979-a9de-3133857cac7a", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630037912, "uuid": "867b58e3-8358-431c-9b1e-05beaa3b8a97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037912, "uuid": "4443fd96-35e0-4e6f-bb4f-acf65cc0aad3", "value": "5665f108965c55a2d3ebcbbb50b03786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52573355-0784-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630102544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630102544, "uuid": "d649bc03-4e7b-4269-b429-5c023aff2d95", "comment": "Malware payload (RedLineStealer)", "value": "38b782477680ba7e66c9b728a2de8046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630102544, "uuid": "6c9ac3c6-95ac-4589-b0bc-6fc4668c31cd", "comment": "Malware payload (RedLineStealer)", "value": "a345a58d67b17e5f35c9484ff4d6cd52061ddebb7fd8f4fd51c607698779018c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630102544, "uuid": "b7334158-0cd6-440c-bf55-ca4199eef1ae", "comment": "Malware payload (RedLineStealer)", "value": "eb16921dcde9582751344866be3766767521c93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630102544, "uuid": "7961d1f0-282e-4e87-8931-241367c91792", "comment": "Malware payload (RedLineStealer)", "value": "d89508c0e21c0bfe9bf4fcb27a91cecb027dcf139736a2280b1835dc9397ba29c7c3d5dad09b783d78b05a7f0c0f1ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630102544, "uuid": "7d5c0558-18f8-421c-901f-681f05d83e2f", "value": "T123D48B0E65544A0FD6741EF1B0BB4CA803EDADCA7B3E928F2A35F2DD2B7139199412C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630102544, "uuid": "8602ed93-eb6e-446f-bcb6-75a6988ff7e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630102544, "uuid": "0591bab4-ebe4-4639-aab7-e84c260ebf9f", "value": "12288:1EnScj9qlZTZHq9uEXiCrbD8cA/cMqOoW:E5iZTpox4cAEMqLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630102544, "uuid": "1b30bb8f-0816-4f10-be97-72b8a348eddb", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630102544, "uuid": "6535d83b-3f21-4bce-810a-7d6c7d9a3aa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630102544, "uuid": "611abdae-c39c-4e3c-9648-29ce09a4e2f4", "value": "A345A58D67B17E5F35C9484FF4D6CD52061DDEBB7FD8F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec2f4f8-0700-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630045817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045817, "uuid": "87390172-7458-4098-96ca-6a1330244e0e", "comment": "Malware payload (STRRAT)", "value": "80c80561e656f007aa888799f08da575", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045817, "uuid": "ae9df688-4f6d-4e3e-b073-5da6603de673", "comment": "Malware payload (STRRAT)", "value": "a47f071e8df4ab89b53b927edcfaa38a61b5c56fd8c9346cc5b0e5a5a1abf54b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045817, "uuid": "a46e5cb2-dc12-41b2-9da0-0abc94c70761", "comment": "Malware payload (STRRAT)", "value": "17567e2e1e359830412d1dca5315a143e0795983", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045817, "uuid": "0f41a13d-ae71-469d-99a3-df3acbf390f2", "comment": "Malware payload (STRRAT)", "value": "855b1f09ec7f5a7ce956cfc8901237ce208e9905e7adeef3c85de86d50519be14c51172dbc9d88fcfc9bd19903735c02", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045817, "uuid": "108c0354-abd9-4a96-af7c-a319aa97a60e", "value": "T15DA3D00FBF9A91B5D10B54324008C1EBBA4D82E5D51191BF25F848EA5CB1CFA6B06ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045817, "uuid": "7eafd653-f846-4b57-afae-5c46b3dcbcb0", "value": "1536:qcDy/IwhoFDhTaQRrTdPsm9Pfm9ZL7s+ib7keEEXniiC1O7BzFgO9WuDVLwCPq:qcDyf6VhjPnVyPs79Xn9C1ABxMcUmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630045817, "uuid": "9d9bd102-edaa-497d-a919-180fc297dc95", "value": 107376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630045817, "uuid": "32db86c9-13e2-4d00-b220-3a2fdab2864f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045817, "uuid": "c53e9040-cf52-412a-ba33-f6a8a4caf5bd", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5a989c-070f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630052393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052393, "uuid": "15c5b7f2-8aa4-4fa2-a00d-c9261feaa98c", "comment": "Malware payload (Smoke Loader)", "value": "f0ed21ec7e7fe7bb1cf447ea79531e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052393, "uuid": "e01aeaf7-81a7-45e4-b9e9-85a7d2246325", "comment": "Malware payload (Smoke Loader)", "value": "a485424686877052cdfd71f7f355f2de4c3f4f043e29159774997b71fa940679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052393, "uuid": "e00d3262-7d50-460b-8ba0-b71162c26f6d", "comment": "Malware payload (Smoke Loader)", "value": "82d2799147bc3f61f777246f8a3b6ad0b8a2f4da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052393, "uuid": "9e417980-2c2b-429f-ae67-6cf3b831df60", "comment": "Malware payload (Smoke Loader)", "value": "0185bcc0feb6150b851fa8fc22c88e27923d0a81167b50e1f98bc2dd9262381379a8a037e0aeedb4392769de3efd0d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052393, "uuid": "04b60a7a-1506-4490-9186-f08932d3145d", "value": "T1CB447D30AB90C035F5B722F84ABA837CA9297EB0677450CF53D51AEA16346E5ED30B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052393, "uuid": "bdbed48d-f730-41d2-8b2e-2ee91be70f87", "value": "67c13f8f6053dc802ad3289485f66709", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052393, "uuid": "12fbded5-d0c7-4952-b076-0a9fc54cffbf", "value": "6144:uIl8UdZCKeA09Z9aeEjN5EVap0n83gG5wirkRqT:x8pFA09ZHEjN5LpZwNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052393, "uuid": "2f938ddf-0f78-4519-94f6-6ff3b82418a1", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052393, "uuid": "4da0248c-ff01-4a0c-874b-0b699b8336c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052393, "uuid": "f9629923-f2c7-4af6-8867-66dbc7407a4f", "value": "f0ed21ec7e7fe7bb1cf447ea79531e85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379d63e3-070f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630052248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052248, "uuid": "c5525c65-6649-4384-b6fd-f10d3374885a", "comment": "Malware payload", "value": "665d21893d1c5965bda02bfc43ea6871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052248, "uuid": "082c668e-d44b-4d81-8840-996570519025", "comment": "Malware payload", "value": "a58198274fe278903f5cc16907437a6198725be5bc248d2b6155cd702caf3ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052248, "uuid": "adf015e8-8b1f-4d28-95ba-ec95fa071620", "comment": "Malware payload", "value": "5ad2eddbc8656a801ffde9ae8bee93ca5972834a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052248, "uuid": "bf0a2b1b-2378-443f-8818-15ffe20b2868", "comment": "Malware payload", "value": "4c0813533e80c03931dc0449bd69a9eecc9150972595e18fb73310a7b469cd8a155a58f6e686b735ddb8cccaa32213d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052248, "uuid": "b8decb9e-bf68-4242-b69b-d368bbee1baa", "value": "T1F39533E01D143086ECE4CFBC5676278024E7B6F63D24ED7D5C6863FDB181C429A6B4AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052248, "uuid": "642029fd-b5d0-477b-81d3-05e6a517a2ad", "value": "49152:UidLHrxljg+vatJsf+v7mltueHc0iSrhZfLn4qnAK:UiZrvUb9iseHc0lV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052248, "uuid": "f0ea8a6b-59a9-47f0-a0fd-c3cd8dea4113", "value": 2000384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052248, "uuid": "eace5dad-4246-4e2d-9771-e51d576d579e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052248, "uuid": "b9751a76-dbf4-415b-8165-24b953165940", "value": "665d21893d1c5965bda02bfc43ea6871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd085ba-070f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630052256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052256, "uuid": "82613fc6-d28a-45aa-867b-1659f305a50e", "comment": "Malware payload (RedLineStealer)", "value": "8f8742c63a8fa87e329e7921b0964018", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052256, "uuid": "1aab18c4-ec66-4e2b-9ded-362ef04483dd", "comment": "Malware payload (RedLineStealer)", "value": "a5c940653c3b19cacd1378f2081feb377f2791257fbef36cd64df3a0b1b7d4b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052256, "uuid": "ea583bca-5cdd-4bc8-97dd-16ab3c2779ab", "comment": "Malware payload (RedLineStealer)", "value": "fd85b41d5d563c5883b3d8b1847bf39a3c69f750", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052256, "uuid": "556e6533-81e3-4591-8cf6-66326bd6a310", "comment": "Malware payload (RedLineStealer)", "value": "c5bef234b6a71320e86d2f64f89625eb09a5e1effd830b85b6c720208a05a65f71661e8d627ae75e3a6d391a8ce0994d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052256, "uuid": "657ae23e-1c90-4d9c-97fe-a419589f8e45", "value": "T1CDB33B2123DCD529EBFE0B7574B0175047F0E19B6022EB5B8EC264DB1E76B81AA446F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052256, "uuid": "9e794f6b-a0de-41f7-9537-1a69003704b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052256, "uuid": "97080010-9d94-42ad-b06b-f92e71f0c95a", "value": "1536:nt9pmCJRdPOuLbdOz/xf6aJRwETqjnqKjbuqGdAnFuyq+d7VwdDjEeG6qTaoigV:pZRdPrLZU/xf6aJ5mTFGAnMyjd7gYzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052256, "uuid": "d68b91f2-7153-4c25-b81f-0ee0bdd34617", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052256, "uuid": "f5143e6a-0a0c-4983-8eb3-8d0e8745e4d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052256, "uuid": "384e73e4-4401-41dc-bb75-25b0a30a1a9e", "value": "8f8742c63a8fa87e329e7921b0964018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98269b61-070c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630051121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051121, "uuid": "06fe6baf-8dab-4b60-9c8d-53d831806e5c", "comment": "Malware payload", "value": "cb2e2252479f458415621bf40282df69", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051121, "uuid": "f10ea4e3-9e8a-463d-a16a-b41731741b86", "comment": "Malware payload", "value": "a65f7baa98cf908cdf8747bc1955bff881f358c04884b02e76de7afd451338be", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051121, "uuid": "9e3e5ef8-d84b-45ba-b05b-f2cb3e0461db", "comment": "Malware payload", "value": "d9d3d932ef8ecb023b01f9b66332059ca9a7411d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051121, "uuid": "55628772-a3b5-4a98-89bc-1a8f24831999", "comment": "Malware payload", "value": "7c2b439a11ac833878c906bb634f3cc3f4899fed56ceb92fc44d76a6dbb3446d4bf6d776f977cef3e11c6e70fb6866bc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051121, "uuid": "0252e59c-a993-40e0-8822-7d9dccf21f81", "value": "T1FC516A001AF60654F2B3A734A97F5150882B3E6E9732DE4F016C928D1BF3615996BF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051121, "uuid": "ba63a4d8-b0fe-4163-9109-2d19587d993e", "value": "48:84BpEXWAn9jy+kyNuIEu54kLyVP1g/ZeHeFqkaHqNWgAD6Yu/t8:8sp3Aa4uIEuNeVP1gB0eAkEqotDnu/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630051121, "uuid": "b25d8393-dcfa-4519-b654-4b65213571db", "value": 2810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630051121, "uuid": "6488945a-c183-467b-a7eb-a85401544d79", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051121, "uuid": "cc49c123-835c-40d9-abdc-7bf7f2358f72", "value": "Delivery-Receipt-99716997837.doc.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bb41e2-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630050679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050679, "uuid": "1cb7a32a-b1ff-46cd-a117-08f5109858a8", "comment": "Malware payload", "value": "206f39f36fb97563bba91eaf0ead9a46", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050679, "uuid": "e0412464-05cc-4879-a77c-84436c78590b", "comment": "Malware payload", "value": "a9e3ed8f4eec2bca9a8f2b2b33084439228f12c66d1d97f12d0f6c15bcdc9439", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050679, "uuid": "7988199c-174e-45cc-b56c-ccf0ba74bdf6", "comment": "Malware payload", "value": "93da36f3078586bf18ad5ecf06be64cdc0751a4d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050679, "uuid": "69308ce7-4e37-4209-9c9c-27acd4bba0e0", "comment": "Malware payload", "value": "20edd5d0971383c47bda0f0b09930fc7a52f3b4e5f5e082a7d0e790475de691b0a841261438ac0e253aa49b7d0ffc94b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050679, "uuid": "4c868354-4b49-4ac1-9efe-140b8eabb356", "value": "T186D4F228F27A6E29D161FBBCDB207F7A46A54C9A2386F8404F48B50581BD774F204D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050679, "uuid": "f7f6004c-14e4-4aa3-a104-555f044171ac", "value": "12288:odOgsK5qoUzBuwhWiZyJsXda0PCDJ3AdchZFRs2ToWYO8JN2k:YsOq1dDW1D1fsAf8JNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050679, "uuid": "72f43fe6-ebe5-406e-9554-33213e8fc996", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050679, "uuid": "9d510730-b114-4fa1-8f2c-9c859f1199a4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050679, "uuid": "00580f60-e2c6-428c-a42f-ce901f31cc2a", "value": "payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08557e81-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1630053027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053027, "uuid": "c4d9fa07-5404-4749-9625-937dba0ce73d", "comment": "Malware payload (KPOTStealer)", "value": "588810696ba2ccdcd33dd7219783cb07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053027, "uuid": "ac0df92a-1de1-4e54-aee0-ff2a9b6635b0", "comment": "Malware payload (KPOTStealer)", "value": "aa5ea4fe9cac4dfebd74b01ed1ac190c19d452bff1f7f1a3c69f38b3570aebb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053027, "uuid": "78c2b414-92cb-4790-afff-3f0ef112a26d", "comment": "Malware payload (KPOTStealer)", "value": "021bd5e1e1df213abd3fe7869add30396d8c9ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053027, "uuid": "5dd845c3-563f-4c08-8875-1ce04495c7fe", "comment": "Malware payload (KPOTStealer)", "value": "30bfc793ad0b4b46e0edb6614b6724187adb4e42457ad255a959a3e2d0422ff7d4b1b964c81cf3ee66924a54e0652f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053027, "uuid": "d3724a75-8f2e-4982-a743-ab5052337ccb", "value": "T1D294D030AB90C035E0B322F85ABA837CB5297AB16B3490CF52D51AED47346E5ED3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053027, "uuid": "8dd3fe0d-08ef-4c3d-864c-c1cf1bee6e55", "value": "bca655fc687feaa215487bc7467daf1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053027, "uuid": "d130a485-5ed9-4ae0-96e5-67061e93f589", "value": "12288:OE8XGgX4utJJbvEgRIq/OR0EeIw8JvyO1:WNX4CJOqEeIwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053027, "uuid": "2a7cc656-4bd5-43eb-a482-da84d0dd1499", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053027, "uuid": "42a32a28-92e3-4218-85ed-0fdb66d11456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053027, "uuid": "2da5fdec-8a1d-4fec-8439-9eb9f9718273", "value": "588810696ba2ccdcd33dd7219783cb07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75706d0a-06e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630034742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630034742, "uuid": "e7c9bbf4-bd6d-496a-850f-2feb90adc95a", "comment": "Malware payload (Loki)", "value": "8f25793db4280d061ce5c19d2d56aa52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630034742, "uuid": "b9503c71-db0e-481d-98de-ab07db4c2015", "comment": "Malware payload (Loki)", "value": "ab163346227b7520a1f31e2e0445e25e6b77e6ba7c5e79126cb7b736a9330714", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630034742, "uuid": "f2ea68ae-3a99-4620-a1f9-ff494b59f813", "comment": "Malware payload (Loki)", "value": "26a86b49f69b9aad13b178f681483a968609e7c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630034742, "uuid": "8074677e-b982-4eff-88e9-2b56be421929", "comment": "Malware payload (Loki)", "value": "96e100398606b967e791d9557a56ff21432d00caf10fb7dedfdcb6de8e810aca9f84eabbf3675effac1f04bcaf49c013", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630034742, "uuid": "f3b0edd9-fea3-48be-ac26-a7199e0147fc", "value": "T1CA25C23D29BD2227D1B9C7B5CBE18827F554A8AF3111AD6468D383AA4352F4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630034742, "uuid": "ec15890d-956b-4b88-9323-bfad1e85c702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630034742, "uuid": "34c7e784-de5b-44e7-adb5-b4806e9606c1", "value": "12288:QIQr/XGlccuy5uu+ti3vZhfbkJIjqAzvXREEXVAyzR/A2eruN4QPujP:Ir/XGlz87iTbkYJhjRI2ermu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630034742, "uuid": "98581c1b-7bca-4900-b93e-b165dfbddf48", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630034742, "uuid": "ee3e33a7-397c-4140-908a-751848e79f37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630034742, "uuid": "0b1bbb87-084d-4566-a64f-42d9d78bef40", "value": "8f25793db4280d061ce5c19d2d56aa52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697c8c78-074a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630077672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077672, "uuid": "42994c8d-464f-45c2-b814-8f7ceed4c490", "comment": "Malware payload (Gafgyt)", "value": "310b50b51bf83b27f3419e6a9babc928", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077672, "uuid": "55b2d3f2-0590-4d06-9c05-d3d21e5e69cf", "comment": "Malware payload (Gafgyt)", "value": "abff87b8617c44f75cc58e09e17239f8dd93ba30c990525ab25eba117f2b5d1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077672, "uuid": "36eee86d-ec91-4775-9c5e-31ddfc937e6f", "comment": "Malware payload (Gafgyt)", "value": "5aaf28dacfc8a82fc6e5583f19a8702c2e316ba8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077672, "uuid": "b0c899b3-0431-4e06-b2ed-ce1a0e280a49", "comment": "Malware payload (Gafgyt)", "value": "45292252599a0f89404f218bcf88b2b38827f89d20a0d77d714ec32b26cf15084c5c9cba0bb832b57210575d23f2af7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077672, "uuid": "84326b30-644b-4779-970f-6f9857b3e073", "value": "T1E4D34C4B94A15FBBC053A97524EB59300716E9D20B1F1B86B539AAF4038F5CEB01FEA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077672, "uuid": "4cdbc8ab-696e-421f-a924-c2644729c40d", "value": "3072:ta28++qOlZFufl6jXgMFFrPnFtc99d5hUjz/2hHm/BVyI4Gvr2TW:tp8+wZI7MzLnc9d5hUjbkHm/BVyI7vr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077672, "uuid": "9b861904-18ff-4f2a-b1f9-4a3b5d67ccc1", "value": 131917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077672, "uuid": "220814ae-98a0-40ca-9329-d3e8ce35a3d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077672, "uuid": "50cea545-c39d-4ef3-9b12-b56195669c41", "value": "310b50b51bf83b27f3419e6a9babc928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3e269b-0753-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630081407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081407, "uuid": "6d46cd65-e695-4fc9-9083-c431008adf0b", "comment": "Malware payload (Glupteba)", "value": "736900f03b1d15fe6959d01f697770a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081407, "uuid": "c84e3662-6885-4993-b100-bf11c5497e67", "comment": "Malware payload (Glupteba)", "value": "ae48763cf2dedf7372edf04c07c676ed42bfb235555f24e47282fd848de13a97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081407, "uuid": "bb6ffd35-94d8-4f6b-964f-482cadcd6b56", "comment": "Malware payload (Glupteba)", "value": "ec35dc01c81019824d3945027bb022907d257646", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081407, "uuid": "3e90d9b1-7c15-4eb8-a716-ef0ca2cdb835", "comment": "Malware payload (Glupteba)", "value": "74e06c9d14c40dfe50c182271b108e9e407dcd13f3e3c092e2e99d52a0f6acb8f472c659b4d690d20297ba559c561ffa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081407, "uuid": "23397cbc-6788-4647-a6bf-d5621f8f1aea", "value": "T1612633309782A039EBAB16F015B942BCE6393FA05BB450DB40D6A8EE43746F5DD7170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081407, "uuid": "cfe6804f-7b15-4a2b-864b-cb6ee1fa6841", "value": "e68f2e15edc1c604720a74f10b8483a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081407, "uuid": "bab31919-c579-4951-bdce-e5d725be11f4", "value": "98304:UsLTSLxXvNrw+GwNb4093ZIb3gepsHAIuTu8nT+LnaQIPdbb:UsLTSLRNrw+1hPFZIzgepsHA16OTCMPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630081407, "uuid": "1d3e4c5e-1fdb-43ed-b745-83e43786b3de", "value": 4649000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630081407, "uuid": "fdae3a0e-d230-4a46-98bb-830f25491021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081407, "uuid": "bff9e72a-917c-4ced-92f6-f88fa8558279", "value": "736900f03b1d15fe6959d01f697770a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2902e717-06cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630024735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630024735, "uuid": "762cea0b-679f-4a41-bad6-71a771d8dd85", "comment": "Malware payload", "value": "c72b7c54f6c676f76de4dc665e7eae64", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630024735, "uuid": "d9f54af0-bc11-4aa9-8d2a-24f7530fb48c", "comment": "Malware payload", "value": "aed723f13e53f8b8e86a6a4717d43f1a8715fe0e99fdbed67c47af933f291b82", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630024735, "uuid": "4fc31b39-8b63-4352-b090-8713f1f65b4a", "comment": "Malware payload", "value": "ced41642dc2fa45b0eef39712548f349b656fc5d", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630024735, "uuid": "53c9e8d0-28b7-4d7c-9abc-9ae5edd42e4c", "comment": "Malware payload", "value": "4e39847616f64f169b7188db4a5bdf6eca1c39358c44417e4452217a84814ed2c53fc8864f6a1ec93ec843f7519f642d", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630024735, "uuid": "5afbecf6-16e4-4917-8ff2-897eb1df6b51", "value": "T12F44CFEE89AD91A08F11A15903FB4ED5FB13292E37152A8F8B64F3C83809D8555737F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630024735, "uuid": "1217f0f0-5d87-429a-9ce1-5d0041d75217", "value": "6144:WhwqAnesKv+qTARoUrCq1DPnTYDSzUJOBkqE83WY+uhUnXeU7sWheW:WtAes63YomU+BmY1Unh7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630024735, "uuid": "87aec44b-7b11-4a7f-ae2a-6b86759d449b", "value": 263243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630024735, "uuid": "5a584648-3e1f-4598-a601-7e98786891af", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630024735, "uuid": "7e931648-315f-4b1a-bffb-0a809447f3ca", "value": "x64_beacon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b956b16-0721-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630060039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060039, "uuid": "b1e337ae-2bb3-4365-8f64-6c7179cf1c57", "comment": "Malware payload", "value": "d69ccb2050fa447b1ede2676ba069bb6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060039, "uuid": "26ab6442-a0a0-44c6-bd16-58ab340bcde7", "comment": "Malware payload", "value": "afba60125552729336ff567ec3f72571e84a823708e36e165eef19b395c9394d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060039, "uuid": "732c1eff-f1bf-4e98-928b-17456aa5cb51", "comment": "Malware payload", "value": "4aa2275926f1bd972c05994c18ed003ebf791a07", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060039, "uuid": "e960232b-422b-48d1-9532-c1e20c7038c6", "comment": "Malware payload", "value": "040861d30c2e55a3fc26cfbaf0a3692da728fa16cd0f6600226ed9277502240beb403e80be2ceac1df8f0ab20d1c6238", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060039, "uuid": "d55e9298-d6f6-4c05-b6a5-35d6474651ee", "value": "T1D8835A10F5C2C802D7EA52B12C6ED6DA7577AE1BBE60A21376943F0FBCF366144467A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060039, "uuid": "709ee355-33f7-4cc6-9ffd-877e3ce7d4d6", "value": "768:Ee84DfiACAEx5P0nXmMv4QGVp+BW87CuwJIfXAvFpjoPm/PGDQwMFN8Eji8+FCe:AP+srVIEfJTjGQPoQwMA8+FCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630060039, "uuid": "b61c4b41-7789-4f97-8eba-b959c8c1e890", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630060039, "uuid": "d45f1294-fda4-4ac6-9d25-30d04ee6cc0b", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060039, "uuid": "17a715ad-fe0e-402d-bdde-fc2a1aa0f21c", "value": "details,08.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f134e48a-077e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630100233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630100233, "uuid": "5011adfd-bf1e-47ee-a7f6-da793171fef2", "comment": "Malware payload", "value": "c280ce35bfc8c1455c205542a9fb8b90", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630100233, "uuid": "466d964f-0856-4851-bb35-1c76fd529aec", "comment": "Malware payload", "value": "b07e7d656bb4d8aea541c55a7ae023a23f67a1c891d7596a1aed55e1d67a452b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630100233, "uuid": "aa585b3e-3765-4032-92db-ab8c99f6a61a", "comment": "Malware payload", "value": "aa9debe177ead820eb79bf1ce9c7c686b507e8f7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630100233, "uuid": "49aec8ef-d54a-4e5a-a661-068ebaf3577a", "comment": "Malware payload", "value": "435342e636bb3ae71fa1d5f1540ebf041fc57534eeec1e10f45c015df4d8015fffe6382605d436e3217eee456c9cd3ce", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630100233, "uuid": "e3535dd9-f622-4a57-b014-9f041d0e3ae0", "value": "T1A8842334C956D114FE2E725B7F72422C86F6A249EFAE4A2342815727F090574AFE7E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630100233, "uuid": "c530b53d-a682-4969-8862-e6cdeb5cc551", "value": "6144:G6hOMIPqkmefTy15Qes6mWfzl+5Sf4uT1zcIp0CqEploouM/s5AFdzedVUjhK:GrykmWKQeXmWfZSSf4Y1zcZPHCUIUcVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630100233, "uuid": "d2287b14-8d7c-4557-ad73-fab28d5e4370", "value": 403535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630100233, "uuid": "12c2f176-b584-4edf-bf24-9240e581995b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630100233, "uuid": "d6aad8e5-965e-4a06-8a69-4874a18838db", "value": "Copy_Bonifico con importo 7640 europdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1a4098-06f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630041410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041410, "uuid": "ecf0e7e9-7b36-43ed-9d79-9203febadef0", "comment": "Malware payload (Formbook)", "value": "e8b1d358fb7f80a9a3d4cf79156eb585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041410, "uuid": "f54bd470-2d3a-477f-b36a-76731901429a", "comment": "Malware payload (Formbook)", "value": "b09fdc39338aacafb7eb0163757d2b9863f78e5467af017ff4ad2f09e0e266a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041410, "uuid": "1c34705a-c7ab-4f19-884e-feffb805874c", "comment": "Malware payload (Formbook)", "value": "da993079a89eb6d478a8df4cad7ddda4d6756aba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041410, "uuid": "bd95081a-49ce-4fbc-ab66-62ad317b68d6", "comment": "Malware payload (Formbook)", "value": "a9ef9ccb83cd1e75c8bcbf9e90178e6cee1abe9fefe7e704e7beab504b326a71d87e9bfecef8f77d4673c196431378f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041410, "uuid": "a2567391-a2e6-44d6-ab72-42a9cee947c7", "value": "T1FB8412165CD64C9AE6D4B7F860F18657253A7C6204248389EDF8FF2C9972213ECC24BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041410, "uuid": "eaaddac9-5b7a-4f0a-88b6-f6094310d600", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041410, "uuid": "d3af2607-e3f9-443f-8775-ce50ee91d481", "value": "6144:y4XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0Pze:pXe9PPlowWX0t6mOQwg1Qd15CcYk0Weu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630041410, "uuid": "9c6ea3b5-0d4d-44a0-8bd2-31f7dee48e96", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630041410, "uuid": "2e132ec8-e2f3-4510-afb4-7e1f98ced70e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041410, "uuid": "f97cc631-a7ce-49de-be96-05e82ee1ba8b", "value": "USD INV#1191189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0402c9ca-0715-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630054738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054738, "uuid": "bb625476-ec27-4885-9f51-cb5429ed245f", "comment": "Malware payload", "value": "73db2b58503ec0b2b56c4f9fdff3fe40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054738, "uuid": "6c543740-94e0-4df5-b6e2-b2a494dcc18b", "comment": "Malware payload", "value": "b143f984cc0745b1529e2253761eaff547509e7fa44d20c220d44d176a7952e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054738, "uuid": "205566fc-db26-4020-bdbe-8eb17f5a22aa", "comment": "Malware payload", "value": "42faf2bf97d57ab291519f4d9b6341fd28f5c473", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630054738, "uuid": "c1250c27-31fb-4af9-85a7-e2d1db13f2be", "comment": "Malware payload", "value": "8f96d129a02842acfce2f084e096e8924f6f59e55cc756d8921d5f6c7d574818b038fc2231c560cdd29dd178c0e5c54c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054738, "uuid": "9eec11a7-5ef4-4ad9-8adf-fcb06da66085", "value": "T193C40163644C95DAF59CA075B0A3D9BE97333CF3D81C8610B5E07FAE48F70635662622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054738, "uuid": "231f9d75-48c0-4fe4-bb5a-7805e4b90c6c", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054738, "uuid": "fc3faf97-654d-4dde-b416-98601b2101f8", "value": "12288:5Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1NPcOo+shpo7+:ghloDX0XOf4XPe+sk7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630054738, "uuid": "c8a03899-76a8-414b-8b9e-0e98f7f3beab", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630054738, "uuid": "fcd2b33d-b878-4ee6-b6a0-0c7d0cc64511", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630054738, "uuid": "96c23013-91f0-4d64-a4a5-1d6bbbb3eefd", "value": "73db2b58503ec0b2b56c4f9fdff3fe40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4172c622-075d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630085765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085765, "uuid": "1c022be0-ea6b-4388-8fcb-c1814359f69a", "comment": "Malware payload", "value": "7556c97f2ad6602ad560ddd8ad877940", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085765, "uuid": "594756f7-b536-4627-b075-18d7beca3e00", "comment": "Malware payload", "value": "b23360e8388e32799d7ffa2e427131a8d5d9aa0dfa9c46c1392c1de9032be54c", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085765, "uuid": "35e64e47-4a7a-406a-852e-8f500c8a5d99", "comment": "Malware payload", "value": "0f49c79147f6f3ce5f7354427b2b7eadf428e429", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085765, "uuid": "0c485bc3-996a-4d2d-a7df-71f4015c66e6", "comment": "Malware payload", "value": "f1218de154fb3057a6c72821a47ba42f19a916a3086881f7848eb2226992d9ad4ede43c0a6052ae09f5cd47ed1b932c0", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085765, "uuid": "093454b8-4e27-4eb9-9936-e94bfecac468", "value": "T15F94026EB9B97443FED468B8A0A2212779D27B37541DC78B22C8CAD07901EC372DED15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085765, "uuid": "56f20edd-1f20-4408-b4d4-7ddfb8e2e236", "value": "b211bec2627ea9b5322d60ef3ed97e1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085765, "uuid": "e38e9f64-dcae-483c-bca7-f53d65aea3f8", "value": "12288:fySr4fLSCPjANuw1gP4Oo6qJHelpotrKVue:fylLSCkNuw1gP3QJHelpotGVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630085765, "uuid": "ea18d724-c379-4445-9779-446fae4a94cf", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630085765, "uuid": "07d134ab-4023-4c2e-96cc-15d66b95e0d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085765, "uuid": "758e286a-3997-4295-8d91-68ae2bf46b36", "value": "30.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc92858-06cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630024747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630024747, "uuid": "59632228-053e-403c-9c14-aa735b2ae3a5", "comment": "Malware payload", "value": "c83edbc9c8db375ddd28677d4371781a", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630024747, "uuid": "b1f75897-1819-4de5-bc82-a44bd8338d2b", "comment": "Malware payload", "value": "b46198a099ff4753353da9b8b50885d9e8cb29456cbcf03db0f32edeb4305f35", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630024747, "uuid": "40b17c84-2823-4b03-be38-b0eee1a46a21", "comment": "Malware payload", "value": "edf84024e507c2c393725c3e382232d3e83a4eea", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630024747, "uuid": "746e6dff-44ff-4aea-974d-148f8ae9a672", "comment": "Malware payload", "value": "6f0ed6177ecfe1a78b8b31170cd294b1d841064d04b3252b4e9095467342000ee7805f7783719d8e837989d05374bbe8", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630024747, "uuid": "d8bcce9a-c853-4d62-822d-0e00bc7b7805", "value": "T11D24F124B53C667FA15C2B4C2AFD858EFEA85ED1010EAA46EDC10D6C57325670B2C3E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630024747, "uuid": "318562d3-0e9a-4dd1-b882-816745c04c32", "value": "6144:9qviJvlW67kFE5nK5nZ82masNrnKGArMnsLFWuUGS:auvc67kWJAnyaGrnKhrZWwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630024747, "uuid": "5483fbb6-57e0-4d95-8eb8-a189693441c3", "value": 211029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630024747, "uuid": "589202c3-735f-4cf2-af4c-5527a4309ea0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630024747, "uuid": "5b4d94e3-31b8-4cd7-b0fb-e7dd29796259", "value": "x86_beacon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e3ad4a-0718-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630056409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630056409, "uuid": "4417a83d-b1f6-4f8d-ab07-445b13bfa38a", "comment": "Malware payload (RaccoonStealer)", "value": "898bcf2cbd081113d17f17cd920adcd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630056409, "uuid": "d100576e-e17d-4bfd-acd4-21fc081c6f66", "comment": "Malware payload (RaccoonStealer)", "value": "b4a38cdc08d6ea14007623ffcfd4f58cd92f69bd5d5b338a887f654ac64bc70d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630056409, "uuid": "3f72efba-2e68-4ad6-a08c-b25ae6ff0779", "comment": "Malware payload (RaccoonStealer)", "value": "eb844ae665f407f2fdbed7d7251c2faea0e894de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630056409, "uuid": "89733877-47d0-45c8-aafb-260d1ad5e449", "comment": "Malware payload (RaccoonStealer)", "value": "4bcd05d8d5d3b836cae1d430612f23d396f927f04621042cb74c87f463632c2d1d901ff4a00c550d188d378ef4831d28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630056409, "uuid": "1721cf70-6105-4124-9772-7651c2f3e2a4", "value": "T13BC4D030AA90C035E5B791F45966B37CA529FEB15733D0CB42E12AEB1B306E4AD3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630056409, "uuid": "2cd71275-9ab8-4c58-b07a-2585f5a5c25b", "value": "60cc0daaa74806110a4d23b786f367f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630056409, "uuid": "cdd62a56-3509-480e-8a44-9f423910eed6", "value": "12288:s7E6ZYGXO7lvDZMQpVwuRteO4jns1fyxbZ9wSxb3aGjae:p6HXO7pDdVePjYabH5tqGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630056409, "uuid": "c23341cc-bfa8-41ca-ae0a-c1d1ce29f116", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630056409, "uuid": "f64c745b-262a-4b46-8517-453bd9c4fba6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630056409, "uuid": "ed79e99f-a13f-4026-a7ae-c6c83ad7c6c0", "value": "898bcf2cbd081113d17f17cd920adcd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25b2770-0749-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630077418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077418, "uuid": "c6d15c74-52c3-41c4-adcf-214efa7485fd", "comment": "Malware payload (AgentTesla)", "value": "95469d8eddda2889442f7ee47be926e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077418, "uuid": "4ccdf2e5-67ff-4743-9af3-17bc37618490", "comment": "Malware payload (AgentTesla)", "value": "b4b2063f3501d7c410256f4a809a4e1580ab9d9888da798e0d145f24a2442c03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077418, "uuid": "f47fbe29-1547-4afa-b491-cecca23de3ac", "comment": "Malware payload (AgentTesla)", "value": "75806ad6c15ade36d56f03977e256581bc0431d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077418, "uuid": "dbac4b7e-7f05-4807-ae23-171a47f597a4", "comment": "Malware payload (AgentTesla)", "value": "7c1a220470cabffc05c84a60593d0af982f9b4f0d7d8b59deaae0b36051dbf60144bf0d44c2146a2caec83ebdd692fb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077418, "uuid": "b08e7cb5-1fb4-42e6-9ba1-c3b228092775", "value": "T11C157F3D29FD222BD1B9C7B6CBE09827F05499AF3111AD6464D7876A8346E4335C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077418, "uuid": "4cb1d31f-50bb-4e7b-a86f-dd70076cfe76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077418, "uuid": "165bf745-9f5c-4328-9317-e4912578fbdc", "value": "12288:UI8S2Jpchcan8uW3RMJ/FzVneUCwtCSMLa9Cg8nCK:YS2vchcan8uWVUCM2kCgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077418, "uuid": "60a563b2-8f6c-41ac-88c6-c8a9440b6f7d", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077418, "uuid": "5f71cb4b-682b-4c07-b191-e1e0407f34a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077418, "uuid": "842d6a25-4e27-41c4-b58b-ff97e7410caa", "value": "x4pisPgHdXsVvId.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05bfcba-0741-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630074032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074032, "uuid": "03cb5a95-0b2c-49e9-986c-74cb364de590", "comment": "Malware payload (Formbook)", "value": "b2bafd32e0fce3fc29be04b2781fb09c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074032, "uuid": "4faa88ba-e30b-4299-aa01-8bcffee2ed9e", "comment": "Malware payload (Formbook)", "value": "b4c38c13fa5c4e7789b534da669f6aff46e9faa41ceac97ed3deea7ca94094ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074032, "uuid": "bac3672f-b99c-4909-b6d7-d13627d1545e", "comment": "Malware payload (Formbook)", "value": "ec6991d91ed7165a4090bf16a017d35a763fcba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630074032, "uuid": "2b871a6b-eb45-4d80-bdaf-3109c93b62aa", "comment": "Malware payload (Formbook)", "value": "b7b5e00a2f13367b093f7b42a29c5695e27b4377d1b0916403f4b42c892f02af8e43def7ea5f77f91d7e3ce87676cea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074032, "uuid": "60bfa888-fdb9-42ba-bed7-5554f1c96829", "value": "T16425A13D29BD2227D1B9C7B6CBE0C837F4549CAF3111AA6454D39B6A5346E8235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074032, "uuid": "308828c8-d4e9-49e8-a28f-f760c3b9b50c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074032, "uuid": "3b4bfc43-5967-4482-b2c1-fbb98e2a2c1e", "value": "12288:XC5a3WRbpQzUT+/HTF7z6EH+AZPo/gz0/9iFiyjS1H/6zS0AJ0AMM:XQWc+/HR7uAZigz0cFiyjU6zS0AJ0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630074032, "uuid": "b0ff5509-f457-4a46-b493-4241b6b7ac30", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630074032, "uuid": "f6b0b779-bd5f-413b-b2dd-9cb62d2d2c90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630074032, "uuid": "aaa696d2-3194-46ea-80cb-8df8d852d948", "value": "Pending DHL Shipment Notification REF 82721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417caf1a-070f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630052264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052264, "uuid": "a4ad4e93-e4ef-442f-bcc5-8a1d7547fa5a", "comment": "Malware payload", "value": "221e25b401ebbb3d1e716f71c83cbd9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052264, "uuid": "5701cf8a-66c5-4d39-bc3a-a6c841afa8fa", "comment": "Malware payload", "value": "b5ec12c4a9c4110b60db7766315641497ad11f31ecaf9de0cc71b605256771d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052264, "uuid": "6b7e7512-205f-4c4f-b6ad-c1881fd081df", "comment": "Malware payload", "value": "4c3bf3b256a39c1a1656e79300a681bd43b30930", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052264, "uuid": "2c2b079d-fe8e-421d-b4ba-8121f855dc3a", "comment": "Malware payload", "value": "d85e3fbab313058303d2a2d43a88898a60f5dded06ff282da438499aeecb2c8f6b269e44f0f11a00322e11a6df456a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052264, "uuid": "d1271716-d989-4b62-b3b4-4338248f4586", "value": "T1829533DB43E884C6C46FF3F051AB157056494D724CABC66F4B04CAF3A9588FC9A2727A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052264, "uuid": "6e430cca-b8ed-460f-90b7-4dfe8730e089", "value": "49152:6nIPGsWPBxUcynyYYukbTD0h5W/QKNmIAyJWcuB:itsGxE/Y90XaBJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052264, "uuid": "e94cc1cc-60a2-4ec8-b33d-83eee3475cfd", "value": 1995264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052264, "uuid": "9908f879-9b82-4676-9f1a-40f73f45779f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052264, "uuid": "c2d56eba-35a8-4814-9613-b9436d3052c8", "value": "221e25b401ebbb3d1e716f71c83cbd9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63370952-0712-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630053609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053609, "uuid": "e695206d-d91c-4c87-af7f-2bd69899cee6", "comment": "Malware payload (Formbook)", "value": "2c356c45d2225329917f82e98ce0d980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053609, "uuid": "064bd2e6-e5e9-461c-a867-e41be3d387f9", "comment": "Malware payload (Formbook)", "value": "b6265825a201f66e512e8288a49c0112b0dcda84fde2904152b2f525edd32fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053609, "uuid": "4280d8d5-8cdf-4d12-827d-1892dcd378e0", "comment": "Malware payload (Formbook)", "value": "6552125a845fd688fba91bb3cbbc18acced89222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053609, "uuid": "d0912916-5af1-48ca-b062-dacffbcf35b2", "comment": "Malware payload (Formbook)", "value": "a3eee0b0c20785459bb11b3adb9f0962ff12cfe89dbead2d171f7cd4adaad375f518930a27a3e501951b004ed06f1664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053609, "uuid": "bb33829c-af11-4d5d-836a-e0722f975e66", "value": "T1D284124548C5CCA6E719B371D0B3CF9819B57832CCD56B689718EA2EB870343B853E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053609, "uuid": "c2b84e64-760c-49d5-a98b-01e60795c9d1", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053609, "uuid": "42a94771-5705-4ea2-bc55-a00353bcb27f", "value": "6144:Y4XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0PzF:HXe9PPlowWX0t6mOQwg1Qd15CcYk0We1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053609, "uuid": "da35571a-b862-4689-a96f-a9d2a0e18a84", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053609, "uuid": "da8e00c8-bc3b-4e99-b5e5-125b345237b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053609, "uuid": "a8585ee3-c048-4239-8986-3a6319db8040", "value": "2c356c45d2225329917f82e98ce0d980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a150272a-0731-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630067028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067028, "uuid": "757a51a7-8bea-43c1-9be0-01b8f72ba121", "comment": "Malware payload", "value": "044afe0fb3ceefc51f0d8c7aa9506fa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xxx", "colour": "#98F0EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067028, "uuid": "3ed67a5c-c6d4-4d99-a76e-558231883a84", "comment": "Malware payload", "value": "b9936494de2b2c86c4f5778bcf342bad05a5eff93b09e1ff850da76e4af2e788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xxx", "colour": "#98F0EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067028, "uuid": "d9981734-ec54-4058-81a2-409da2d0479c", "comment": "Malware payload", "value": "c46fe6b181408f8f4308a4da6579b89b024f7273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xxx", "colour": "#98F0EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630067028, "uuid": "40a6f091-3133-420b-b17e-efbd6673c0e7", "comment": "Malware payload", "value": "91c5dabe34cf4e51cf4f4583f53ef59566064af3272b4cf7d62eaac0c6d631a53da6ba8040c12f308292f10721f7b68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xxx", "colour": "#98F0EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067028, "uuid": "89a68513-587d-4f42-b6dc-3671198b50e0", "value": "T1E3F52842F89254F6C1BEE130494152A176713CA917306FE71EC5B7AA0B7ABF46E7E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067028, "uuid": "285736e0-ee43-4691-862c-39afd4bb7abb", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067028, "uuid": "1e8a84f8-eeea-4b58-9d53-92e7dd30399c", "value": "49152:T7FYXJkbhOGoVN0cBQ9tW9L0OtyDEB9MxxkU1:CZyhOGoVmcC9GyGiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630067028, "uuid": "9ef25b41-9ac4-4503-a904-81489791a649", "value": 3538944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630067028, "uuid": "caeaa9f9-575f-4b73-b9ff-e3a325f3741b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630067028, "uuid": "e96d5908-3e5e-4a82-9fc6-736d2c726cef", "value": "xxx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1e84ad-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630050863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050863, "uuid": "e1d089cd-2e9a-42de-8ff5-e0bed8edda0f", "comment": "Malware payload (BitRAT)", "value": "de9d83e9a67ced396ab8e8fb448f57d1", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050863, "uuid": "3b140139-2694-4ebd-9b7b-911e105dbfa7", "comment": "Malware payload (BitRAT)", "value": "bae698af7ff8400180c79998640f08fe1cf616fea7f996d292e4206c6f0c705d", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050863, "uuid": "002ab383-9615-43d4-9e1c-9321871fc196", "comment": "Malware payload (BitRAT)", "value": "5f42aaf7a273e09832a406629052c63cc1e478bb", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050863, "uuid": "136a9b2a-a5ef-4a53-a4c6-19d1be7e80bc", "comment": "Malware payload (BitRAT)", "value": "3ef27e0b7f66964e55da74c4bb819708328dff5575f3066ce4c711e8613d584f93c8ec330070ac9befb897e3ff620d0d", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050863, "uuid": "afe141e6-1bd7-4986-8c24-fff977d9515c", "value": "T1594339D46781E40366CD1A83BF177DEDF16BA8B269C8A60786A47B9C24BC507C5B0DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050863, "uuid": "fce8899e-7294-44bb-b1fa-d90d252c6ca6", "value": "1536:w+6SWAvtqsUEhtlKIKAMVhQIseofinEoqwcJ1dBDrAk4P5fn7a:XW2tqshhtlKAMPQIcfKqw+zZ4Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050863, "uuid": "298fa888-16db-46d5-8c97-606f342e0cc7", "value": 59058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050863, "uuid": "0ccf3a10-847b-40f2-8fe7-950777d0826b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050863, "uuid": "fc4ffc36-9bf3-4eef-884c-3962d1fbd9ab", "value": "shipment reference.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be895820-074e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630079532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630079532, "uuid": "280a045e-ed26-4662-b006-068d77117a2f", "comment": "Malware payload (NanoCore)", "value": "e73e4fb9bc78473b8e8d9d4051cd9380", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630079532, "uuid": "b71c7330-d1e4-4762-a7f0-6d83836c1d2f", "comment": "Malware payload (NanoCore)", "value": "bb1ab7a145e7c7b78750e24b879c8382e7186fcd26d0f488487ec7a66cf41481", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630079532, "uuid": "7d0d4b48-1d0a-47aa-a687-8f7a1256c2ee", "comment": "Malware payload (NanoCore)", "value": "5f8bede50681a504e232d9cf0e22c44c54e96cb1", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630079532, "uuid": "97932d78-59b2-4a3e-9af9-31d2d5cd3291", "comment": "Malware payload (NanoCore)", "value": "944c7e9cfcb54d1c48596ec94b58334e828529db01b7a566498cf24362ee31a32ed70a6407dca03687574a326950e35a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630079532, "uuid": "6834bb97-7d2f-417d-9d20-f30ac4602b07", "value": "T1E7B42335CFC5CA8B4B0728895A53DA6F15CBAD26DBC51690C9BFBAA60370CF4FC61148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630079532, "uuid": "d60fe68a-4a5e-403e-bb05-6b505e660c0e", "value": "12288:bwuTLnVonZaoeD2Zc5WJjNViioW4Iv/qyvNek68I/3:MuTLn6ZjeaZc5WJjCWHvCye8I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630079532, "uuid": "83b863e3-4557-4d75-9589-72fb43eb3497", "value": 509291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630079532, "uuid": "d8ccf263-f972-430e-98dc-41b64f2c9311", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630079532, "uuid": "2ee9b0f3-d7eb-4e8c-b80f-f298159c38c5", "value": "Swift Copy.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb04d4e7-072c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630065004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "e5eb0e97-9552-4a97-917b-3952e63d6b1d", "comment": "Malware payload (Mirai)", "value": "0ca0e7f942075042daede9eae80a0506", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "9cd527e9-54ad-4d03-8563-4cf1bb775078", "comment": "Malware payload (Mirai)", "value": "bbf950f99d9d77a00c21a15f01f1ab7c136f2aa551f840e6668b18ce889d5375", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "63fe5840-43ee-46b6-8a50-d49c6b64e5a0", "comment": "Malware payload (Mirai)", "value": "4490dae97d60f56e43038f80db15d4dda022f89e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065004, "uuid": "be797a21-cc2e-4c6e-8f4e-14bc05d5e2c5", "comment": "Malware payload (Mirai)", "value": "c554b270866f46130d9296ebc316dc6dacdb963449fd6c2f02091d4c536205816166f5b2e78e6b706a9a25772526b5d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065004, "uuid": "8ed15997-d3ea-4a02-8f2a-bf6df2a35523", "value": "T19EB32947EB418B03C4962775BADB42463323EB54D7EB23064928BFF43F827DA4E66506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065004, "uuid": "b20a2270-2f67-41af-a206-96f9fab28455", "value": "3072:ogE2lONdbsuZNsJlGwU4PZJMZM/96YZqZ:o+s/bsuZNs3GoPL2M/96tZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630065004, "uuid": "6104199f-6b68-4779-bfaf-7f7968efd134", "value": 117235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630065004, "uuid": "bdcff02d-d95a-4526-a843-edb0e51a0d32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065004, "uuid": "53f11dbe-2284-46ce-b77b-4801462bb091", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edffc617-0710-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630052983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052983, "uuid": "ea3fd2ff-debc-4691-b888-3bea50d2143e", "comment": "Malware payload (AgentTesla)", "value": "6c1d1f99c1ce8a9ff72928648ce272fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052983, "uuid": "977315ce-37cf-4e3f-b4b8-91e0163e2ade", "comment": "Malware payload (AgentTesla)", "value": "bc013f50d759ea8829f8081a038a19782b826a6fd7478f3c22b23f1cb244df7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052983, "uuid": "7bf32988-8c58-4c72-8663-04781d649a20", "comment": "Malware payload (AgentTesla)", "value": "d3efd8650cafb5d011fc0621a00c1c618923fe29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052983, "uuid": "e1ee383e-438f-4a84-b401-34acd9763599", "comment": "Malware payload (AgentTesla)", "value": "f60fcc06e3a1cb0256bcb71d26512f2617a52842cf83659320b3e669c510a1536f71856e5bc73e095f592cdfda7ebf22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052983, "uuid": "1c687b73-1b35-4f9b-b9c9-879ac6ede0db", "value": "T18B35D33D29FD2627D179D7B6CBE08827F554A8AF3110AA6468D343AA4352F4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052983, "uuid": "cd0948e2-2726-4d83-b6c9-3abf6005776a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052983, "uuid": "d11f8673-1170-4347-a257-5d8b2634c2ed", "value": "12288:J1Y6uJ0bHxho2Gq+bZYK8Latm6zgMPrp7Ay7XOEE889Nmizokp2bdRSkeDuB4QPW:rY6Rwbq+9YpL9KraHHvNmkCeDKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052983, "uuid": "9e5eead1-03cd-47c6-95e9-e682882be76b", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052983, "uuid": "aa333545-aff1-4bd7-b94d-a08308c04be5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052983, "uuid": "a30a8354-dec9-4356-ba5a-f5d63de48f03", "value": "6c1d1f99c1ce8a9ff72928648ce272fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac2a857-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630053112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053112, "uuid": "71b8bd23-16a1-42d4-bd0f-953d21b75226", "comment": "Malware payload (Loki)", "value": "3a19efef5c95aef6fa18403eab73c30c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053112, "uuid": "9c8235f1-600a-42b3-ac02-78f96b0cdd79", "comment": "Malware payload (Loki)", "value": "bce59dc35407ef6fb0189206cdf64aeb937f55a4b944f6183893df5e9bd1befb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053112, "uuid": "140a48f3-46a1-4cb9-ba10-8ae2bf17a9d5", "comment": "Malware payload (Loki)", "value": "b0d5ec8dc894ce563deda277497128d5c73f7bbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053112, "uuid": "0bcbc815-ba22-40c5-bf0f-653aeae2ce57", "comment": "Malware payload (Loki)", "value": "7200ed3f836163d1b250332e9128db2f696b12fd50dae30ef3a8594bdc19f1e7aae9b07f1ec3cc0643eb3262de777dc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053112, "uuid": "69ff9186-78ba-4413-9519-dfa9afa64ae0", "value": "T1FF14123D29F93627D169C3A6CBE09823F21498AF3114F9A458D353AA4356F8275C327F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053112, "uuid": "67618016-cc4b-4f51-a099-a271dc3364b2", "value": "768:AxaIZMQopyhuz9VLLaq4GOILC9/nyPIVeyanXsVlQDdbhie3UfIMnZGJdZ41zquZ:rpVZVfvcisVlskIgGdZ4R68MUlfEhFt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053112, "uuid": "cd12d87f-3976-4efc-8e2c-d245c03d136b", "value": 206733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053112, "uuid": "a7cc4fb6-827e-4b05-9df5-afedce04ec26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053112, "uuid": "a5ab3916-7b6f-4d28-a16e-d5643b3e1da8", "value": "3a19efef5c95aef6fa18403eab73c30c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ace91bd-0744-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630075150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075150, "uuid": "2ddc7bcc-85b1-4fba-aa62-46551648dc7e", "comment": "Malware payload (NanoCore)", "value": "da8a881ee519a7631de3abb233f5d84d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075150, "uuid": "2ead3faf-b67a-4a17-be4f-92822af4d858", "comment": "Malware payload (NanoCore)", "value": "bd96132f8ac03c3f5f64032e7d400a96bd1581e481c1bd6a13e74997d6be1ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075150, "uuid": "1c75f0fa-9519-4306-b0f9-5c6fad23e2d3", "comment": "Malware payload (NanoCore)", "value": "eac499d101639def001910124e1f79193716c27a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075150, "uuid": "59b77b5f-4192-4f00-904e-c32dc195916a", "comment": "Malware payload (NanoCore)", "value": "545dac947cba0b172bdad081fb35447aaef125e7f8b0dbc63f9c15168dc8c0e42697d127ed868a85bdf728d558141f4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075150, "uuid": "a15e1801-f3ec-44fe-91e0-025646916e11", "value": "T15F157E3C29BD222BD1B9C7B5CBE0C837F0549DAF3111AA6464D78B6A5356E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075150, "uuid": "7ad0b9e8-b31b-4c6f-ba62-c59c036667e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075150, "uuid": "7c3fe874-55a9-419d-8249-3daef41b7ab7", "value": "12288:EqAlGucRX3601iogAkGGVRN2i5yUR2iygBUykE5QS+NEqe:4GuYXMo89x0URHJO1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630075150, "uuid": "56dddf5d-f29e-4d89-9d98-a7b2848da5aa", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630075150, "uuid": "0169cee3-6af1-4c67-8584-748e45ad8e19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075150, "uuid": "d4abdcbf-4a7f-41c5-84a2-1c545e06b691", "value": "PURCHASE ORDER EXPORTO52022 IMG00987066 SCANNED DOC_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ba8d3c-0747-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630076404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076404, "uuid": "c3bb0c7f-de16-4fed-b378-9a62c90e4959", "comment": "Malware payload (Mirai)", "value": "bbda8c1e89743021d16f193d5020905d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076404, "uuid": "3b512e74-6d68-48d3-aae6-15db9af214c6", "comment": "Malware payload (Mirai)", "value": "bdb6f158c7a2a5d02f6f8c9f4b052ff89ddfbec9c71e7d8c2905d56c2188834e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076404, "uuid": "eba8fcc2-2322-4774-b42b-7911bd22bd71", "comment": "Malware payload (Mirai)", "value": "68bb8e74b7ebdaa39623cd1f7905f07e8966b5d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076404, "uuid": "a6e9f58a-3327-493a-acf5-77004a6f1155", "comment": "Malware payload (Mirai)", "value": "7603c8ee5da37dae0e8e19adb7b8d0017ce50b472f1c1ec7b249d0ed73711d38f85ef889560869f2cf87e28d487eabba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076404, "uuid": "4a88896a-41b3-4964-801b-61e33500827c", "value": "T1B9E33B46FA418B13C5D11777FAAF514A3322D79893DB330689285BF43F86A9F0D23A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076404, "uuid": "1ee0d2b0-e98c-4ac8-a103-2f433206f33e", "value": "3072:wGvMRqVx8dxOAr1zKfXMdGDmkmkkL16HFlf0cNM/9C26XJP:5vMRqVx8dxOAr1ZcmkmkkB6zf0CM/9Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076404, "uuid": "9d0fcb85-3007-4da1-a18d-0a84195c6cd7", "value": 144770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076404, "uuid": "f7b82fa6-71f4-4600-9375-b2f41b4c50e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076404, "uuid": "358361e1-38ee-45ac-9f88-0b366b8aacd7", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3478cf33-072d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630065127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065127, "uuid": "e4d3f0e2-f13c-4c07-b41a-f0d26528fed2", "comment": "Malware payload (SnakeKeylogger)", "value": "a232dde55b7ab96c74d5d35d9073ca4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065127, "uuid": "4785d4b6-1995-4952-bb1f-ae4b8fd00ac1", "comment": "Malware payload (SnakeKeylogger)", "value": "bde8228507038aa1a2b4678654376c76a59657be5ef718eccbbeec586e7a6d55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065127, "uuid": "c4dbc771-5ede-4ece-a75e-c43b925f6ded", "comment": "Malware payload (SnakeKeylogger)", "value": "cc272c021b2b6a9333530badeca4bbbd6eeb21a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630065127, "uuid": "e2c2b70d-5d89-41e4-bc70-6ebc85b33fd2", "comment": "Malware payload (SnakeKeylogger)", "value": "46c0866a57b8adec60f9605040ac72eacc5130f08487ef4c364bd0af78be34f67f5a023cbcb3568a30bf1f66180286a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065127, "uuid": "49ce873e-1753-40dc-b410-d09f9809cd0d", "value": "T12964F1691BB9BBB2DDED0FBDF464810007F8F5A61843E7285B4865F118737208F616AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065127, "uuid": "7e662ad3-c685-488e-ada7-eeb2e75df435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065127, "uuid": "9ccafc29-e902-45dc-b18c-31213bf8d6d5", "value": "6144:nr/b4/xtvJ/xa2IJkumvAycRkqP1Br1W5dm5+sXk/6l0bGKPTv1:Y/jFxieNvWRLPvr1WvmsYwbLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630065127, "uuid": "6321c5a7-17e8-4362-85cd-8431b43f9053", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630065127, "uuid": "ff14e0bc-f8d2-4d4a-8b70-32bfc5353628", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630065127, "uuid": "d7032b47-1f9a-456c-94ce-7b9f04fbb473", "value": "ATTACHMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765c270b-0721-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630060084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060084, "uuid": "e9936933-3ada-46d6-be6b-4679841ca7f3", "comment": "Malware payload (AgentTesla)", "value": "9d7190845bdcbd27c5f037565185620c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060084, "uuid": "24d9661b-4772-4478-bca5-20ca7ab3c84e", "comment": "Malware payload (AgentTesla)", "value": "be02ffa4499a221f7fc03519b17abb417dd0c90d6f4354bac04336656c8f6273", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060084, "uuid": "dc0395cc-ba13-4ba2-9213-ca56fb056ee0", "comment": "Malware payload (AgentTesla)", "value": "5fa018dec7f406fe4c17618f3810616539f015ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630060084, "uuid": "bfc365e8-8534-4f1c-8a2f-a99312aa9144", "comment": "Malware payload (AgentTesla)", "value": "fec157630d51ed45de8a55a5cc4d70bd352d938eb7ae9092ccfc9f00687f2ea9faee330f373a65087eda6534301ea30c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060084, "uuid": "89bd97fc-7c78-4f0c-8fdc-03b821c68f79", "value": "T14CD4F194A34C546BDADE65B491D0E034A7B18F638182FB850EC0BEFB72663C19606FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060084, "uuid": "30a3a1dc-0bf1-4f4b-9374-806efd28ffee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060084, "uuid": "f9d0dade-329f-4176-a6a7-701a060ebe48", "value": "12288:3b4qRJouF3k7yYv4sQeo06q/EqgJ05XeGXyBHsUIz2YFOtw6NbuPkr:uQFVebhcDJ05lMyrFOtR5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630060084, "uuid": "f35bb213-ddc4-4eba-9d0e-54714e23896c", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630060084, "uuid": "0aedcb73-0dfd-4718-82ad-d1969fa1d9ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630060084, "uuid": "1cb20977-a5af-443c-94f0-4aab2553a6e6", "value": "tJOjCUp75nu8sUi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8b11b2-06ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630037658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037658, "uuid": "5d48d328-35ce-4aba-ad2e-a6a2a4d65eea", "comment": "Malware payload (Mirai)", "value": "6c2a230db56a59f7cfde2e6f6524dfad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037658, "uuid": "305027b0-ad41-4f72-b0c1-8342bcd6740a", "comment": "Malware payload (Mirai)", "value": "be6706ba14cb70b9e15d529f033622b56290a02f6a8ef478fd9f56f4c7a18337", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037658, "uuid": "bd2f41e3-3fac-4543-9df8-d29975a3a28c", "comment": "Malware payload (Mirai)", "value": "c32629c6451fe9b08500fd4fdfad421d511ab74e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037658, "uuid": "3e63b0fe-3de5-484a-ba26-140e3c34a802", "comment": "Malware payload (Mirai)", "value": "5569892e4b69caebdf25de65c406b8125e376e6fb57ca0508c324602b03d57a389e64bfdcadc0ac7623410d12fee31fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037658, "uuid": "1788077e-e2ac-49c2-a953-4a439276d08b", "value": "T14064E08AED41AF25F9C516B9FA1F034973B38BACE3DB7110E62487143ADE64B4B35184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037658, "uuid": "9f01c00c-7da0-4cc6-ab2e-2f9c94cd8579", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncpBa77oNsKqqfPqOJ:78QpZsKCaipBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630037658, "uuid": "bfaf7eae-6b71-40b9-892b-a40f9402d4f9", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630037658, "uuid": "4de41c98-b59b-4091-a241-7dda807414c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037658, "uuid": "c408ca95-f10e-4ca8-9bae-c572697b09f7", "value": "6c2a230db56a59f7cfde2e6f6524dfad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3123bdd6-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630053096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053096, "uuid": "3d3b2e65-8747-4fd4-8620-d39ccda9bca4", "comment": "Malware payload (AgentTesla)", "value": "700a021908885c05ef227a55452d9ffe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053096, "uuid": "ca69541c-a123-498e-8cec-27cf62ea904f", "comment": "Malware payload (AgentTesla)", "value": "be9589f2adcbadc925774b3b70cbdde42a8955d687ecfdc2018cbe0544e82a88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053096, "uuid": "b827ff27-e589-4852-8547-bcd54c127e61", "comment": "Malware payload (AgentTesla)", "value": "2e756ba21a4062e3006c49ec20eadcae51bfbe7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053096, "uuid": "fd00324d-0dc0-4eda-b758-c6da6e839f39", "comment": "Malware payload (AgentTesla)", "value": "1697262df9efa0a1c24eac1cff0d24533f411ca623cafe2cc6643cc3dc74907349283da4141a2951cc93a2b1ded82e76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053096, "uuid": "dd7ed2f1-aa11-48b1-95c4-3e2a2a788a0d", "value": "T1B045EA3DBD252633E7BA86F8C4960D4EE69414CB22734DDF42D2A7892107617B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053096, "uuid": "bfceff3a-290d-4e2d-a753-21f6739ae7c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053096, "uuid": "4106fd8b-5c64-444d-8e03-c05393af8d85", "value": "12288:p8ubK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoys:pWCzQ94uK5l4i3BMVYoydArS5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053096, "uuid": "4e208f6e-9e40-429b-8ca8-a3704f61a71c", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053096, "uuid": "df44836b-4086-4d07-9baf-5d9c9685252c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053096, "uuid": "768f41ee-7c6a-409f-b956-1a0b34473eba", "value": "700a021908885c05ef227a55452d9ffe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bc464c-0729-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630063363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063363, "uuid": "cc625657-ccf1-4c88-8f69-a467b28d54ea", "comment": "Malware payload (GuLoader)", "value": "233056a20a9944dc97b3d41dbfcf52a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063363, "uuid": "bb9c0941-acfe-42d6-9638-381edd165153", "comment": "Malware payload (GuLoader)", "value": "c003caf05b2078bcd299453a6126410c88ac45aa97146e213c7707dc7450d20f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063363, "uuid": "ebcec894-206d-49de-8cfc-274a0f3e3af6", "comment": "Malware payload (GuLoader)", "value": "f6803bdf560f819e49cce8774ff077ab4e2bc9b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063363, "uuid": "a34e7e9f-8773-41b5-9077-18995f1c2879", "comment": "Malware payload (GuLoader)", "value": "c20b987112bb778cda6c43c2568afcda2594b06afbc24fa56a619b276d5cd52618ffa79e19a49927c3575712c18501da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063363, "uuid": "14e8fd22-0498-4a53-b9b8-caf7c5f85077", "value": "T1B0B36D18B2DC5442E06A5A75386FB9A9C251EDFF87038E87A02CFE0D34F2E955063797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063363, "uuid": "d24f5b44-3507-4c28-9897-e215d25dc713", "value": "7222680ddb4e451832a15109209579c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063363, "uuid": "674538e9-4cc6-43b1-95fc-5b45cc5fb9cf", "value": "1536:L6GCzSsEO1URaupDVqQ6tT+gIzT7O0UlA6tQCbfTL:bCPpaRDD77/T76tQCbfTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630063363, "uuid": "46866905-6a0e-48e0-94ef-c0b8f287f4a8", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630063363, "uuid": "9d0de85b-d70c-4fb9-bdec-e454c3e86ed4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063363, "uuid": "d11fc4e8-7ed7-4c4e-bf19-1d9487170000", "value": "Einladung zur Angebotsabgabe GYTK894 26-08-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd23530-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630053167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053167, "uuid": "923903f3-150c-4992-b77b-2df28a212093", "comment": "Malware payload (RaccoonStealer)", "value": "47b571474f710823fc3a71dde751a6dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053167, "uuid": "b462d796-cb14-46aa-bc38-eae14be68b3a", "comment": "Malware payload (RaccoonStealer)", "value": "c08a3a406e2dee6102e6871f211c446c800973c747c4ff450ba4cd7f0d6fecb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053167, "uuid": "2206942f-c5a6-4b3e-a091-419bbd24c6b4", "comment": "Malware payload (RaccoonStealer)", "value": "2d5f8af893213b25320aae39b1da62e77982bf6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053167, "uuid": "2d11b1cf-537b-4b60-beaa-baa917c22d7d", "comment": "Malware payload (RaccoonStealer)", "value": "9f5d2794262e84b49b4ce3dfa07e3dc80f3d7ab5f7c046cc0f2ef98fabf92b7053e96e6315f6ea419f2889779de76c43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053167, "uuid": "617ec682-f278-488b-a2ff-b652a706e1d0", "value": "T1F3A40200BA70C576F9D249754C79C2616A7BB8E75F2482C73B484A6F3F212C04A2DBE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053167, "uuid": "5203aaf7-de26-4c8b-8957-a82a2e494470", "value": "fba9890240e2d74de09008aceb2a49ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053167, "uuid": "e725c89c-6267-4dcc-a0bd-0ed502895791", "value": "6144:OoLHWoxH+YSC4iFDikonIUD2VGf1e3ajZjBoXSx+7nZKgWUVvo4olql3XMqZn/h3:OPY+dIUD+U2ajZ2DbWuwDElMm/hPec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053167, "uuid": "3446026e-22c6-4c5c-8a8c-9fdf03198dee", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053167, "uuid": "88d7b1fc-3855-42ea-ad1c-94e65a4df932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053167, "uuid": "a072bf56-1e1a-4b1b-828d-3b985b39c3e5", "value": "47b571474f710823fc3a71dde751a6dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b24504a-0756-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630082828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630082828, "uuid": "fbe6bb3f-d944-442f-9867-446c44dc7138", "comment": "Malware payload (Vjw0rm)", "value": "0982fc211767a61d7a3ef26ad2405be6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630082828, "uuid": "6ba6f563-4950-4765-938f-244540f718fa", "comment": "Malware payload (Vjw0rm)", "value": "c0d0da52fab57a9a3ac346e9aa1427c6f08198c2ef8f1f4ed9f556abc736cc52", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630082828, "uuid": "f726e07d-bfee-47ef-83d6-4b9e3a38f337", "comment": "Malware payload (Vjw0rm)", "value": "e00d78a7ac396441217c133ba728af2a7aa67c9d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630082828, "uuid": "60fb5cfe-522c-4e6f-a233-aae46c91613b", "comment": "Malware payload (Vjw0rm)", "value": "d59ada15712adcb5c2b5c2c2698da97216b9908e37f28c21116267deb1921358b0b0450f05afa603f1e55a194a87fb8e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630082828, "uuid": "3cdf56f3-1f21-4a8b-8092-3e540c754854", "value": "T1BE14CFB4D880EA45D71DB03B91FA1E0C13B013BA91157D8AB52E6E80DFA7F30C7DA599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630082828, "uuid": "1170aa23-12e8-4f09-a38a-7045e1b3b13a", "value": "3072:MIyNq6qDEs1LBG0J9DaDr0M4Uf+XZ8qwivPZUheXdvoX3FOL3oReKN:+bs1td9DaDKU2JVDvRU6dvSOsIKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630082828, "uuid": "0e921533-23df-40c5-8635-b74df2af8266", "value": 205206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630082828, "uuid": "7976325e-dc76-40e4-908f-5f9f5aab3836", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630082828, "uuid": "6f1c4bc2-e061-45e6-8d3a-e60fb2384a6b", "value": "cotizaci\u00f3n______________________fdp.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24a2f29-06f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630040830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040830, "uuid": "561cf715-04b9-402b-815c-7d8602f88915", "comment": "Malware payload (Mirai)", "value": "eff79839a24e8acc414d13c1ca9d0e5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040830, "uuid": "aed379de-ecfd-4f0d-8475-2e8a7780b48b", "comment": "Malware payload (Mirai)", "value": "c4e2fbdd8abd13c606fba8d0287869a8b6aa9a1eb29a31fb7aa0e624a3b99abc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040830, "uuid": "211e0279-ef6a-4a93-a4ed-2cd0b8939559", "comment": "Malware payload (Mirai)", "value": "7812ea6710f01b7be339968e104292ca5d7604ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040830, "uuid": "6eabfdb2-ec39-4de2-ab82-8255bef7f87a", "comment": "Malware payload (Mirai)", "value": "3e7708a1f67004185d1a9c5e9156d4535b27dee098263c67798723cb8bd829ede56fa8e1883f797fcfb433ba41ec9200", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040830, "uuid": "ad83cba0-dc43-422d-8174-77b9154f3c1b", "value": "T128535AC5A643DDF9E9160AB52136FF325A7AE13F602CE953CBD59877E802D42D20329C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040830, "uuid": "f0179a6c-3bfc-4ae3-b27d-1bbddbdb0ff4", "value": "1536:XFBJsaul8jbdOMbmBb1BVInXC4R3NsEK4BHaM0qo:XH2aq8jbdhbm7BVInXC03/K4NJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040830, "uuid": "31693554-084f-4e28-9d4f-41da3b697cee", "value": 62044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040830, "uuid": "775e0ef6-967b-4901-94a8-ae5b7e5f849a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040830, "uuid": "3aba6596-0af8-410d-881b-4a50c53a6232", "value": "eff79839a24e8acc414d13c1ca9d0e5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f7675e-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630050580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050580, "uuid": "9ea04029-bd91-4cdb-a1f8-27bd72a12530", "comment": "Malware payload (Loki)", "value": "a9072df610fdea0abc549f13b5aa1ac2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050580, "uuid": "da7b01b0-ad2c-4253-8f4a-f1a2860afaec", "comment": "Malware payload (Loki)", "value": "c5f3feba1650557f3e44119133e1c7c35ce2c314d0c98ea3ca33030d75adf591", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050580, "uuid": "32b2e82c-c79f-4bfc-b78c-f15f34d50a95", "comment": "Malware payload (Loki)", "value": "1dd5b954f175983d4f8ca01de084a2c0c8bd2d40", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050580, "uuid": "2fc31df7-69bb-466e-9d60-75c2f1d6676c", "comment": "Malware payload (Loki)", "value": "5a459e07e69cd220d57221adf1cd73f7fef8672ffc95e4509689b10d64c39df214d2072d461c15a3f10e503a85462165", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050580, "uuid": "a948e92f-52f3-4a7d-b7b7-b826c63a6077", "value": "T1F05512959ECF9B04CA06727376410A3E6F98DF1FFA546B512B373B220E216AC07C56B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050580, "uuid": "fa290f40-943a-4c36-9a06-65ae8403d938", "value": "24576:5vQdHjAtOS9pkSTBsKlbj5vKj9YxPxw+mBNKM5Es8vCed1zGnD:9QNjAcS9uSWKlbj2GPxw+mKMs7d1CD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050580, "uuid": "39652183-26ea-417d-8062-dde3ff2e6177", "value": 1351680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050580, "uuid": "3200ac24-2c8a-4c8e-9600-78ce34cb9eec", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050580, "uuid": "36794bab-c92d-46d9-9117-9cbe13f0b22e", "value": "Freight Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3117a71-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630053421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053421, "uuid": "67d5c8f2-9613-48a3-9c6a-8629989dcedd", "comment": "Malware payload (AgentTesla)", "value": "fb956464dc3117824451537f5212c276", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053421, "uuid": "3ebc88a4-f112-41b2-9617-9ee05e55a84d", "comment": "Malware payload (AgentTesla)", "value": "c7a75e30a847461f8dc6c7a1de39e25b3110d56afdb1a6ed1eb438965a4ee411", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053421, "uuid": "57bf91b3-cd19-4bd6-add2-93502bb7526e", "comment": "Malware payload (AgentTesla)", "value": "81621ddca708e81c7d2f3645a6f9a75474653ca6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053421, "uuid": "c2631364-45e5-494c-b4c3-26c0202efa65", "comment": "Malware payload (AgentTesla)", "value": "1e18245ee562938dc645f43c2b5812a91eb3bf00da764e3c024bdc4e8e0a614a2ab89cdd18ecb251aa5d9fde8a10a59e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053421, "uuid": "86648919-76bd-455d-96a7-a6ded54aa318", "value": "T1FB35E43D29FD2227D179C7B6CBE08827F554A8AF3111AA6468D343AA4356F4275C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053421, "uuid": "2531e12f-568d-4495-aa13-5e73cd30784f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053421, "uuid": "d826ac75-e27f-45e7-a33f-ecbe0572c588", "value": "24576:Ljvm64SwrBvxuZHOOf8XohFVwMPCIMQJ6sGMGc/lheDKu:LD4SwlvxuZNf84nV7tMQJ6ozdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053421, "uuid": "ed225fd7-e4c3-4c4f-b78a-3081030dfd9f", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053421, "uuid": "fa91dc79-6f4a-49a2-be4a-9b1ab47c5a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053421, "uuid": "3f8483a1-0019-4451-806f-76fd21aa4ff0", "value": "fb956464dc3117824451537f5212c276.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d24d2b1-0728-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630063021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063021, "uuid": "604ba827-e782-4e18-b480-95259dc4d1bd", "comment": "Malware payload (Formbook)", "value": "df2594e69bd26ca34e5b9531ebcce1f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063021, "uuid": "a56727f3-ab95-41a9-89ba-6ba0effd3901", "comment": "Malware payload (Formbook)", "value": "c9debd6df5b79a499fd3ef785efcc1de6139ea74e7696c7cf40809228877c466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063021, "uuid": "c792eff9-c214-4bc3-8e28-7a89c32e3917", "comment": "Malware payload (Formbook)", "value": "67327a20694b05f130e75bff454238f41d017441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063021, "uuid": "90cae1bb-7c26-42a3-b0c8-939b0100d743", "comment": "Malware payload (Formbook)", "value": "26ee146318089ca3094e78d8be64f348cbf6aee6f48bc3834949e02c0ce493e3339d74a1db8a43924f463b705e270a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063021, "uuid": "ba2141c7-33eb-4a39-88bd-d6fdc260f9ef", "value": "T19D054C3C29BD2227D179C7B9CBE0C837F0549DAF3111AA6464D78B6A5356E8235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063021, "uuid": "99257151-14c1-4022-b0a6-f0f7fa6e7f99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063021, "uuid": "fb8e1ca7-5cab-48c1-9290-41dddcb389a0", "value": "12288:b1zYW9bZhjrJ/sv3plinm5Z5USlCZ7+aTGGxXS1aSXA:5YCbZprZsPplthgZHTGGxXiaSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630063021, "uuid": "4802e0f9-d48a-4453-b692-f18a49beb82f", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630063021, "uuid": "90f163ed-2122-4bf6-bf55-fb97676c70f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063021, "uuid": "998d12de-ac7b-471f-885d-d091692093f0", "value": "order comfirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775fd85c-0747-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630076406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076406, "uuid": "8c3eb89f-ef53-445c-b582-b9bfa81ab01c", "comment": "Malware payload (Mirai)", "value": "595c019533aeff3859ed6492ee57e62e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076406, "uuid": "553656e4-53f0-4d1e-b795-4d75c594cb15", "comment": "Malware payload (Mirai)", "value": "ca05e955de439d145db5f0c8310db3aff5ac01405d895303da8435ad1e02876c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076406, "uuid": "0913c208-19e1-4173-b40d-ab18c2bf2c40", "comment": "Malware payload (Mirai)", "value": "08e3c7b21393341d3ec84022685ad855f4e6e1b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076406, "uuid": "988c2f3d-6e39-417f-a57c-55dd67a8ab9a", "comment": "Malware payload (Mirai)", "value": "b950951487cc2fe8115079cb93a207d622418ce79f9fd70e86b17082906444fc3b7b49553ae2d33c3098554550916aaf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076406, "uuid": "6cf37216-1b58-4560-9c6c-c030cc31473a", "value": "T1205339C0B187F6F1D811017C306AEF329E33F0B6613AED9BDBE59573A851E06951A68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076406, "uuid": "eb4e229a-b09e-4870-ac0f-a1d067feef64", "value": "1536:1qau0MdqOYdrqXehwsP/sKifzU2v1oPl+dsE7RGj45oXG:1qHrdvYdrqXehz/sVfzttoPlesE7Aj4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076406, "uuid": "5c8065d5-9151-42fd-a205-2aa737b8851c", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076406, "uuid": "dd8090c7-4387-4309-a920-79838ea3c1e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076406, "uuid": "f4791638-d83a-46be-8efb-c7ba139a3c66", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707e3d71-0786-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630103453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630103453, "uuid": "2d8f3c8b-725b-4aab-a1fc-2ead173726b9", "comment": "Malware payload (Loki)", "value": "3dc081c3839cf01d8cb6e6ea04bd4594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630103453, "uuid": "cf38063e-bd97-4033-8455-15f6d2369db4", "comment": "Malware payload (Loki)", "value": "ca5606627e5af653647b74e407fb048aedba15dd3f20cbbcaab0aedbaaeda887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630103453, "uuid": "5b0195be-a7df-4b09-94d8-8ff33919ee5b", "comment": "Malware payload (Loki)", "value": "c15bf7f1405ce14883cb9eeaa3e43bb10d767d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630103453, "uuid": "d473797c-6685-4df7-81a5-aaea6406ad28", "comment": "Malware payload (Loki)", "value": "36377e3c44516a1cef0d6a4dd937ea19a3dd7dc7ff9fa153b433c2452a2f7b22e57664d9ac01f3a8228997bcbaa643c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630103453, "uuid": "80957db0-72f1-42bc-bb02-f31c7cc858c5", "value": "T19EA4E1404F6672A1C146F93C0EF9B740B3B6FEAB03DE72964EC5BB9599B0E83C595006", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630103453, "uuid": "bf9206b7-6ff6-4d39-93bc-c2a392ff3b29", "value": "03130d03d727a704d1f69bdb7f6a5888", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630103453, "uuid": "a77c7ed6-d411-4542-bc99-d90aacf63aae", "value": "3072:0aguaEYCUg/xX/0ob9hSPc9hn1yKENSxbU8VmfkUCXEY9406hBSAj9:EI7vX/0oJmc9e0X2kUte4fhBSAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630103453, "uuid": "025add7d-ceda-45f7-ac60-186e107906fa", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630103453, "uuid": "58db45ba-a784-4722-9037-3dcb76367dcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630103453, "uuid": "7295c5e4-45e9-4501-b3dc-6cdcf43fc5fc", "value": "CA5606627E5AF653647B74E407FB048AEDBA15DD3F20C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9347cdb0-0729-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Anubis)", "timestamp": 1630063568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063568, "uuid": "aa10d29d-fdf2-408d-9c10-3f9a54ebce58", "comment": "Malware payload (Anubis)", "value": "6917af5e4ef1b8c77cd156cec6f3565d", "object_relation": "md5", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063568, "uuid": "3220790f-c33d-447c-83cc-8fb82c0025d0", "comment": "Malware payload (Anubis)", "value": "cae0c0d33e68be9cf81099680b815eb714d8296cb219b7a6247f7f081820f39a", "object_relation": "sha256", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063568, "uuid": "74d929df-e6f6-4765-8795-7709de35e701", "comment": "Malware payload (Anubis)", "value": "d15f1c90c61970ec69c4ef29b18468c68bfac7d7", "object_relation": "sha1", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063568, "uuid": "1fabb2a3-73b9-4d11-b812-6227ed5b9c77", "comment": "Malware payload (Anubis)", "value": "188a2343b9aaa75eda731d13eb4ad44a160408bee381ca0d48ffe7afc3340b8156a9ff276e70ad049599b77fa39f4c91", "object_relation": "sha3-384", "Tag": [ { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063568, "uuid": "977b8838-c092-44ef-be86-7aef3bb95da6", "value": "T1D0D3F14753A0142DD0BFFBB94AAD63A23BB29AC4B7E057D32A0150585CB23A71F4DD19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063568, "uuid": "bfa3137b-72e3-4041-b833-19d54063f7f6", "value": "3072:UYTezq67EMK+PXEhUrOa06ixO+00luLuIQ2XzXcvvE:U7vEeEqrOaxixc0lovQ2jsvvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630063568, "uuid": "d0e85dd2-f4c5-46cc-bc00-6c9bd66fe111", "value": 136628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630063568, "uuid": "b20a7ed5-a4c3-47f8-bd7a-9134f63e7bca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063568, "uuid": "ebbd9968-1991-4b74-a7ec-b902d2fadcba", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1e8921-0772-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094748, "uuid": "929627a4-64c9-4888-ac2f-21c76e076187", "comment": "Malware payload (Mirai)", "value": "d87519aed39aef718466c151d2482dfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094748, "uuid": "4afac050-6c24-40c0-96d0-f9de8d677879", "comment": "Malware payload (Mirai)", "value": "cb1fe0e9900356fd469b69993fa44f8a30d6012e64ed029e7b12c7555446dce5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094748, "uuid": "0e8d665b-968f-4e83-976f-196a83dc3e2e", "comment": "Malware payload (Mirai)", "value": "dbad730876b7313ed23e0b169c72fb000dd972bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094748, "uuid": "a0960a9c-54f4-4781-a4c3-54dd361408a6", "comment": "Malware payload (Mirai)", "value": "98e73ee09c0235ab5de18cdafa9f51d6d41d775e01857387bd2ab507ee27c63283762094cf379f15465ff99b92147046", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094748, "uuid": "04e18b73-7404-4981-8651-88c438cf6d99", "value": "T13DB31977A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094748, "uuid": "343d0321-03e0-4624-9196-3c8508875fc4", "value": "3072:MDVLSItJP+Xsp4JlN3H5jmH1cuEgvniuN/:MDV+ItJH2l3H5jmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094748, "uuid": "0cab0a2d-3721-4eec-9031-268e7b35309f", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094748, "uuid": "b7829d07-34bd-49bc-a716-9139bc4914c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094748, "uuid": "fa7a73ac-a59f-4ea3-895a-fe33a0919fc9", "value": "d87519aed39aef718466c151d2482dfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5087e73-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630053424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053424, "uuid": "247c3519-6d9e-4f2f-9b19-44d432ad2e8f", "comment": "Malware payload (ArkeiStealer)", "value": "19b6d08e079830c241b79b1f9739d24c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053424, "uuid": "f22b5789-689c-4cca-bc80-192e7cec6e5f", "comment": "Malware payload (ArkeiStealer)", "value": "cb65c5e0d84f555486afbac88df9cf23bc5886d38b313b51bae31dd28f08baef", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053424, "uuid": "ec0200cc-a317-4a82-89f3-102794d89490", "comment": "Malware payload (ArkeiStealer)", "value": "bf95767f6013345e19cf7959637268a4c89b0acb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053424, "uuid": "99d41443-9414-438e-b0bb-defa106d52c5", "comment": "Malware payload (ArkeiStealer)", "value": "1bd4adbdabdc7ff9b540335a75ff096459993579475ed9ecf53e1348f976fb06a97aa54579d98a3e41794077e03d84bf", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053424, "uuid": "4689448c-7eac-4424-8c2c-370d3a1ad09f", "value": "T18B04BF1136B0C97AF9C609314839D761A63BBDF39B62858B3744276F3E312C0962DAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053424, "uuid": "b24f9653-80ad-44b0-b070-f56df1e70499", "value": "a70e187b34266b8bda252cd2ef2d0837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053424, "uuid": "5b31eb80-3b67-42ce-a863-8b22c053d45a", "value": "3072:vD7JUW3IYUT3OR5fatvHwhZoWC9sI5/DuT61m:vRB3IYVatvHwhZU9sI5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053424, "uuid": "d65e5ec5-76ae-4446-9b96-9ccfb3b429b8", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053424, "uuid": "7933d172-2884-4fb7-aed4-eb6bf6462a9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053424, "uuid": "8354afc5-f880-42c7-a4d9-490297e1ae37", "value": "19b6d08e079830c241b79b1f9739d24c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce28a37-0744-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630075154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075154, "uuid": "e2ba4d26-9ac5-48ed-b165-83b8d848729a", "comment": "Malware payload (GuLoader)", "value": "e0abb87a8941de75f962951b9d8af7cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075154, "uuid": "ea3a24ae-9bbf-481f-9199-c94054b7f34a", "comment": "Malware payload (GuLoader)", "value": "cb715c8079356ac7b27eeaf4145aaefbf8592c656a9dc4c606b4d22f41ce6299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075154, "uuid": "e56ce4e6-3598-428f-8ec9-93caa8e18339", "comment": "Malware payload (GuLoader)", "value": "ebf3caa3963783214967e5ac994c4f274a6475a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075154, "uuid": "665c8b60-ba51-46b6-88ce-32469f10519c", "comment": "Malware payload (GuLoader)", "value": "cb4e7451ecb965e65b4de304ca9d2090a233269b1c7bd7546d7d63ee1d159a2a8c72197466b15853c6d8ce258919a10c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075154, "uuid": "22f32f3b-fff2-4a92-a2db-9cb47b068295", "value": "T1C5E33A917829ED3AD2B47EF2E81575A612C95C0CF760175A90E9FBBC72302E22C15B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075154, "uuid": "a18cf4a2-c508-40d7-b7e2-53837cb4752e", "value": "bed9663374908bd3d333e862f8415a61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075154, "uuid": "597d979e-c751-4dc2-9eea-2ffa723de860", "value": "3072:ei+8B9ZAeM3EKjMttNf8WVkHFu5PwKTGbymk9:eMB9eoMcTf8Okoebk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630075154, "uuid": "1e4996a2-9742-4caa-86e1-8e5b09df72d2", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630075154, "uuid": "6967af12-5eeb-48d2-8532-9aab7df61083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075154, "uuid": "63588498-5602-40ca-9cdf-61fe7fbf3f84", "value": "PO#765439862382-DSME-76838623002-20210826.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af958ebe-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630053308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053308, "uuid": "1698a3a1-842a-45d4-bc1c-a5faf8c44f69", "comment": "Malware payload (RaccoonStealer)", "value": "72e7c39c1be42ae6de7fd0f1f5d76567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053308, "uuid": "5e2367b8-d9d1-484a-a72f-fea7b958d542", "comment": "Malware payload (RaccoonStealer)", "value": "cbb0fe7bfdb3ea7f08a2c55becd1d442c11b790d02e57518657a3fe6065ba92e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053308, "uuid": "01d5d586-4545-4d46-bab4-8b18420c0475", "comment": "Malware payload (RaccoonStealer)", "value": "b123b67dac6862cf028eb1fa6716b180b6480ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053308, "uuid": "43193bf5-3d50-4642-8181-3f3845ac3eba", "comment": "Malware payload (RaccoonStealer)", "value": "e3fe7756f65f25c3235550c5d75a3914258013132db342fea940a44ee4ce720a808a9e15313366c214030c0e42245740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053308, "uuid": "a6e218ea-7a97-4e75-8bda-af729b3ad49d", "value": "T131A40205B771D97AF9C549324C29D7A0242BBDD38A2452C73A881B6F3FA12E0065EFD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053308, "uuid": "1aab6d26-6e17-4019-9334-b9c93942de35", "value": "a70e187b34266b8bda252cd2ef2d0837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053308, "uuid": "c9b7b9ea-603b-4003-b2e7-a0167d2f5ea6", "value": "6144:EEnh7621TOntR+/+OJctVAtenk+Sgy3zwEokAWoQcOLQOldbq1TCcDCtHwhZU9so:Ehb7I+rtPkzjb1fovzIVqdC/tec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053308, "uuid": "d4d45a15-5023-47e0-ba36-cdab79aa029f", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053308, "uuid": "5ff3de05-0210-4755-94c5-0fabc36336c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053308, "uuid": "9b8d3e3a-070e-4e2f-9fa1-7ab8726f218d", "value": "72e7c39c1be42ae6de7fd0f1f5d76567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26348e35-0772-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094739, "uuid": "8876bfca-3ce0-4000-a4e3-54beff319a47", "comment": "Malware payload (Mirai)", "value": "0a5522d4cd19ce237bc52530abedaaec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094739, "uuid": "cfd9a31e-00d0-406a-9871-a7d0e2d22c60", "comment": "Malware payload (Mirai)", "value": "cc193d0663c66473bb07cd43601fd2ed2736a138f9a5b0f57feb0ad1f40fd6f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094739, "uuid": "98f6f0c2-b134-481f-84e6-b7f948949066", "comment": "Malware payload (Mirai)", "value": "be5d1507c06b54dc1d84e7b23fa354960e371b38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094739, "uuid": "7b2f7934-1a6d-4750-966e-6b27d187ee29", "comment": "Malware payload (Mirai)", "value": "a8241e43583c8679ee5c2386b51fd9324edf6f20ade7ac27643a3bd3f3bd077ca8d80f5a11342f8f9aa7aa7c03f0a2eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094739, "uuid": "87d31471-5f82-4c2c-aa38-900922b0c114", "value": "T1E2A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094739, "uuid": "e566a248-111b-44c6-b9a5-e2ed4ebe490d", "value": "3072:VK1z13U6HzHoXRtmTUhQogPEmmFVcqq0GnDZT:VK7DDeKlogPEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094739, "uuid": "2354d9ce-6247-428b-bc90-62621558660b", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094739, "uuid": "bcd27f02-5c5f-4fc1-9d0c-3a7945c1da56", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094739, "uuid": "a1fe59dd-a755-46af-9961-8a1223841814", "value": "0a5522d4cd19ce237bc52530abedaaec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63264d8-0770-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094202, "uuid": "cf522af1-ba51-449f-800f-4818d8f792c4", "comment": "Malware payload (Mirai)", "value": "e14aa98a18bdf09507bdaf5608d9bbaa", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094202, "uuid": "51c44803-ec0b-441e-95e9-0ab97d702193", "comment": "Malware payload (Mirai)", "value": "ccb6f1e8cd05573a78832025e21550621725d8de2e9c95e182d99222bab11428", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094202, "uuid": "227426ac-0aee-4c54-810c-682325bc5724", "comment": "Malware payload (Mirai)", "value": "fc7f32fbc0594b1205f6b8f2ee6ae05f8bce9724", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094202, "uuid": "9616724f-ef54-474c-bbac-ddc0d3a48e83", "comment": "Malware payload (Mirai)", "value": "59d8e93b768a9c2d8132e3d3f28caf171a50d6719fe14b8738a65f4a8770517cec9e592debe67ed7843a14cdbe435d64", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094202, "uuid": "3db41afc-0551-45f4-8f5b-5fc7f9e1514c", "value": "T194B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094202, "uuid": "97f55864-646a-48d5-a33b-f6d1223d1cc7", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAB+TRCm7FnVqfJXFWbNb:T9a2aLqkrMcsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094202, "uuid": "3ee649eb-1284-4b6b-9bdf-c6f7205ea60d", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094202, "uuid": "05eeaeae-2948-4794-be2b-45df87ae175e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094202, "uuid": "b45de0be-5493-4fce-bc02-145ff581a2e2", "value": "e14aa98a18bdf09507bdaf5608d9bbaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293e3553-0772-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094744, "uuid": "5f3a547f-7da6-47c7-acf5-5d85cf45e153", "comment": "Malware payload (Mirai)", "value": "ff90295493181cf748fea587e97f078f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094744, "uuid": "ca585914-9ca7-4452-b292-d8391823a30e", "comment": "Malware payload (Mirai)", "value": "ccd5a29f375c8df692cc46afdb81c5b041a7fc5065edb5822ec84f58a5d8f751", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094744, "uuid": "0693fe06-584b-4c56-9be0-96643e909921", "comment": "Malware payload (Mirai)", "value": "4758fb62c54aa5b2908eceb4e37d8fa896281dda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094744, "uuid": "d0aa030d-adc3-44a7-af10-d26bd749260a", "comment": "Malware payload (Mirai)", "value": "982f63b542dcdf53d06dab671abb3f07b7fbffee4b3595171e75c33db1a942239fd2f565a3c4d76b3ea7e08fc2f14928", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094744, "uuid": "b9f11abd-dff5-4968-8c4e-5d6e34b2b4a8", "value": "T13CC3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094744, "uuid": "e70847a6-c63b-4896-9acc-3fd98a583ec4", "value": "3072:6jVlyaL5JCrIpv04sdbttiEiTmP46aQyfPlfKsNb:yoCJCN4sdbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094744, "uuid": "d1ca916c-ab63-492c-a31d-818fc27b9a2d", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094744, "uuid": "99b6580b-c4cc-4c98-833d-faa16c80e272", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094744, "uuid": "669c0773-e698-48f6-ad71-88da76d15ce7", "value": "ff90295493181cf748fea587e97f078f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fcc810-06f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630040222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040222, "uuid": "2d5ec362-96bc-40de-b77a-f06dda3917bf", "comment": "Malware payload", "value": "fe94bd33da50d2116b33efc5bd321cb5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040222, "uuid": "5f3af52d-2963-485c-8e92-d2c5c0d0ba40", "comment": "Malware payload", "value": "cd3813a56c648286116a38572e98d6a02fef400df3e248650ed804e3e68943f9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040222, "uuid": "86495384-56f2-4310-9f11-7f22ad8a97b8", "comment": "Malware payload", "value": "303920602fc2871b0a32e582776676d55c1cb889", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040222, "uuid": "bb7c113f-3f9f-4d3a-8105-a4b7a796930b", "comment": "Malware payload", "value": "8d4ac2c54bf4d3395bdfb0d824afcd878b8c85a175fdd6eab613c72b98fc553205736ac01e78bc800693e96ad3137f09", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040222, "uuid": "4afbae6b-42f8-4720-9227-9662f510d9a5", "value": "T17534EAE4684F48B2D2498C5E64947144AE78FEE334C6987223AFD434DF5ABF29EC4583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040222, "uuid": "47733099-1221-45ee-a2eb-2d130e9eb9f2", "value": "1536:iVDjDqYV30HUl0pTmCo8Y2nRFyxfrjgdzFz76mAg5eeVhMDw5wfL0:iPFRfHgdzFtr5RDAw5wfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040222, "uuid": "7793aefb-c357-44cf-89cb-2597baa74772", "value": 232676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040222, "uuid": "b0c1dece-d792-4410-b775-cce89fea7660", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040222, "uuid": "768516e2-e780-4e6b-9c4b-2857c47ec692", "value": "INVOICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18badc16-074b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630077966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077966, "uuid": "6710b12a-e31f-4c18-907d-7b39ebd3a5a2", "comment": "Malware payload (Gafgyt)", "value": "5dad23b028d5faa3eeccb246f3a625bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077966, "uuid": "86c9b799-2b89-4391-92fc-8e542511ca7f", "comment": "Malware payload (Gafgyt)", "value": "cedfd1eea481ab6645b11fa0c5e5bb99b26627a94c1224afa1dc4e9e3d7033bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077966, "uuid": "2d5ea658-1c80-483a-97ea-bc951bf66951", "comment": "Malware payload (Gafgyt)", "value": "5599523ac5ec69ed0370961f81a2ab4c4f9a7223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077966, "uuid": "1db56f38-35b2-4609-9544-a7bf6d479418", "comment": "Malware payload (Gafgyt)", "value": "227d49341b9c1cc9a417cd1f3bec3056ee32e428cb880ac79a064aac4e59c553d6befc896a182a4ff14eae6ea2aae441", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077966, "uuid": "c0cce510-1748-4b22-9ce8-64e6c4699b68", "value": "T154B33B86E703C5F3C8430A72029BAA5F4A21F9BA4E2E9F45F75C6CB49B134C5B215F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077966, "uuid": "ad58f7e7-6084-4dcf-8bd8-354d63a0e99c", "value": "3072:1it3bIOyylHGfee4K4d8Bzj/WNx0sjSvWlCH2xgFyBcossS5hokiqE/9nNmKPVdd:1GHM0lssS5hokiqE/FNmKPVdbrV/rl88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077966, "uuid": "90ec1778-c0ac-4741-80f3-b35a987859c6", "value": 118065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077966, "uuid": "bffcce97-a82e-4523-aa19-08f3a61568aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077966, "uuid": "a9b6c6eb-e58c-4e90-b4fe-c3dd06598a91", "value": "5dad23b028d5faa3eeccb246f3a625bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdeac0f8-075b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630085141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085141, "uuid": "1026aa9d-058f-4580-a935-655a0935081e", "comment": "Malware payload (njrat)", "value": "4320c5b907236570d9327d599609fbfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085141, "uuid": "44dbfd93-5a7a-47f8-9d20-47878c7cd433", "comment": "Malware payload (njrat)", "value": "d0b8bb3c3174174273f797a86915b23799103d11885d20d408df8d67f12fa20a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085141, "uuid": "05df2164-8de4-4e66-95b4-6434c6d78dc9", "comment": "Malware payload (njrat)", "value": "e686bca0717f9e20aeb0fc1d191f9e15fbb8b67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630085141, "uuid": "e1543b32-5685-46ae-b8a4-1e95df397fd1", "comment": "Malware payload (njrat)", "value": "6298a4cedb5f1b8a52de43f6b2b78ebcffa1b5440115b660daa0c97ba446db1b22bac9b57a9a1813b40b9c275356f9a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085141, "uuid": "709b4cfd-650e-423f-8eb2-06b378d6c766", "value": "T1F5C2F86C37B68232D1EE067E5562EA5042B5D44BF227FB0E0CD958D94B1B7C90B42FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085141, "uuid": "0c2ad906-a66a-44bb-892d-7fd1df808c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085141, "uuid": "4f185802-eddb-463a-b3fe-1b8953467154", "value": "384:oLEi5SRvT/nmgEiKB5jHw/SORsP5emgMlAQk93vmhm7UMKmIEecKdbXTzm9bVhcp:WEOdt5oYlA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630085141, "uuid": "0a1b7206-ac36-434e-9148-f11f8cd62983", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630085141, "uuid": "69bc4bb8-f7c8-4225-ba75-b66e789f7df1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630085141, "uuid": "beb7d1b0-f6af-4362-a152-056f409a93f2", "value": "4320c5b907236570d9327d599609fbfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e4261e-074b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630077959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077959, "uuid": "8dcf5ed4-1ac6-4afe-ac9e-d3512ce6b6c6", "comment": "Malware payload (Gafgyt)", "value": "4f75854f2c53667d2eeb8aac9704b26a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077959, "uuid": "66fae99b-398d-4143-ae82-e825240e93d6", "comment": "Malware payload (Gafgyt)", "value": "d2404f263c9c636ed906dd8c8bf210b1187dbb5a1461cc0c65c80f5d38e8f48d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077959, "uuid": "92972735-76a9-40a8-8c52-b988c8e37ef9", "comment": "Malware payload (Gafgyt)", "value": "6941490c27d9b7b5581bb027d20ae3499e0e8747", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077959, "uuid": "9aa9b47b-5d01-4f47-a04b-6e1e6ad035b8", "comment": "Malware payload (Gafgyt)", "value": "ac87120c9cc4dfeab55d60e097697acc744ffbceec96f114da30a42859101f78898910f20de94aef0c02e52e116a3d3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077959, "uuid": "c997c9b0-43ac-4fb4-ad06-5c198e9c6434", "value": "T14DE3F73B2B270F63C0C6507116E31332A9BAD7D834B983D7A9D06D9C2F1AA943456FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077959, "uuid": "b4777e2f-4d76-48c0-8b6d-ff46239f6295", "value": "3072:aGSgHgYBENPYm3oOhfphar9bHrImKYFyaKvG/rUtq:OOgYGlX3NpharFLImKYFyaK+/rUtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077959, "uuid": "1e2276bf-96f6-4175-9896-28f950ac206d", "value": 153410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077959, "uuid": "ebb8e249-b2de-4358-8c2a-4aa5068c4160", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077959, "uuid": "1a47d4fc-1e5e-4308-b1b2-4bf5e3712a6b", "value": "4f75854f2c53667d2eeb8aac9704b26a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3939db3-0717-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630055865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055865, "uuid": "ebf03fc3-1d72-4f1c-b548-d74712517637", "comment": "Malware payload (RemcosRAT)", "value": "0f8f3c508e4bcda6108dc61714e94d07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055865, "uuid": "ec9a51fe-7982-4bbc-bc2f-946fe508093b", "comment": "Malware payload (RemcosRAT)", "value": "d2890c754ab95d16d9d1d93f680a850db565a61c68bbaf0337696bfbb485e8fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055865, "uuid": "8e0b4b63-22d4-4081-b14f-df219f674fa9", "comment": "Malware payload (RemcosRAT)", "value": "fd262760bc91d1d7762f3f1e453634a2c0af6c0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630055865, "uuid": "6a544f7c-9ec7-4554-9f18-8f1fdb4c9094", "comment": "Malware payload (RemcosRAT)", "value": "9612a7f8b7d0b2ec47d28d261df5cadfe8df8fc88d74506f6f7526df6b7139761148d292f33ab26641f4b6120da7f408", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055865, "uuid": "eba779eb-12ba-410f-ac9f-e4adf4f8019a", "value": "T1216401C03B228551C7ED4A3AF6E35654CF68D0AFD253CD0948CB9E8E29A2770F979472", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055865, "uuid": "371ee59b-dc3a-48d4-b599-dc0f93796d65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055865, "uuid": "2867ae48-7059-4e07-8272-6c57a9fb64c6", "value": "6144:+SQotL9LF5vJf5ikeKVFLucAF7ngy0QF/ENp7bA+a7EZW6ZDjpncITi97U:/rF5BfHeCuvgypFKU+ACLDdx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630055865, "uuid": "67edd02c-f33e-42a3-9bf3-455877fdebcb", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630055865, "uuid": "5390f916-f3fb-4e57-a548-397d42276381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630055865, "uuid": "72ba66a2-1559-44f6-9dab-29c4856a0646", "value": "0f8f3c508e4bcda6108dc61714e94d07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4f66f3-06eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630037032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037032, "uuid": "68c38d2d-e9b5-41c0-9291-a453e5d511e5", "comment": "Malware payload (DanaBot)", "value": "7abd12f4c0935b02395fed41d3eabb22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037032, "uuid": "d42bf0c0-3840-442b-be36-51cbb34540c3", "comment": "Malware payload (DanaBot)", "value": "d3657dd474e857255ae3ea6f0faabb6f9a6f7bf77423042e5eb827a9cb72d17a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037032, "uuid": "490e8572-7f33-4622-8af3-cbf7f3c0111f", "comment": "Malware payload (DanaBot)", "value": "ce09d720002bb05e8c0353dcd472c5cd10ce49df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630037032, "uuid": "2b2ea94d-0895-44ec-97e0-bb2c9e65d9f0", "comment": "Malware payload (DanaBot)", "value": "4c4bf84f2cbcf420ae1255c4533df3243eabea4b38c6dbcdf06d7e7d829253749b74576f2ca6a7ed9e26ac33c6427ec1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037032, "uuid": "48c137d3-7a19-4f22-b3c3-ad348f0eb0ca", "value": "T1674512306790C039F4B312F856BA82BDB53ABAB12B3454CF53C516E95634AE5EC30B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037032, "uuid": "7b8897ef-fb29-4167-a174-1462edeab9f3", "value": "bca655fc687feaa215487bc7467daf1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037032, "uuid": "4a361aef-d4ac-4455-96c9-fe8470187cdb", "value": "24576:5j3U3V+/lHGb+KKbLJzh7pgyB92I4cl6vZPMUgl:58MphbLJztlcI4Yccl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630037032, "uuid": "cab49fe1-e363-4266-b955-7cb9c0b6f5c8", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630037032, "uuid": "752c4464-eea2-4861-a080-45e1f6948f13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630037032, "uuid": "606d1190-085d-44ed-b176-1ff7929b8295", "value": "7abd12f4c0935b02395fed41d3eabb22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a3415a-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630076073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076073, "uuid": "ecadd1c4-1fa2-4430-acb0-ce0153b5322b", "comment": "Malware payload (RaccoonStealer)", "value": "3f12dbf8de3b68065b216ad769037378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076073, "uuid": "f4ecbed4-3e97-4c6f-80ac-b6d3b3c2d448", "comment": "Malware payload (RaccoonStealer)", "value": "d46a51a36b6baca339e499669cb4fa6562f7e6cd5e687af81115d48c6bd6df5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076073, "uuid": "9efdfc1d-0b62-4163-aac5-7356e19c130e", "comment": "Malware payload (RaccoonStealer)", "value": "1b28a1c62aabbe710507088008004467d7af038d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076073, "uuid": "138bc2f1-2d30-4a32-ba12-59ae06b783e3", "comment": "Malware payload (RaccoonStealer)", "value": "e7785800e4a73e10b6fcbc7e0d7367c039582982440ea2bbe375365f286742324781a612af5a784ba012329188b12275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076073, "uuid": "01031cdd-f2cf-46e4-8057-95da754df046", "value": "T192B4DF30AB90C031F5B712F899AA837CA52A7A705B7490CF52D516EE1B346F5ED30B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076073, "uuid": "d2b0d2fa-4051-41c9-bf89-748c29134486", "value": "a3712f5292e4f38ef3a6c28b5ac50fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076073, "uuid": "0f078380-6355-41d4-b2f0-af55ef457fdc", "value": "12288:xa07RlMXMyq8ZadEubbPBDiHFfiacsJwoK/Gw1RM2OXHEhw:VTM8/LcncIwXxgHE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076073, "uuid": "ec2c55b9-b8aa-4d9d-bd72-371c8b6457a6", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076073, "uuid": "f78c9344-d6d5-4149-99a4-79da1a735f56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076073, "uuid": "f21cbe5b-7b4e-4c20-ab9e-33be23b125f0", "value": "3f12dbf8de3b68065b216ad769037378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b252233-074d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630078829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078829, "uuid": "9c7af71b-7056-4d6f-880a-dd6bd3c12d7f", "comment": "Malware payload (Mirai)", "value": "4342960d9b82d1f29c24241ba79027d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078829, "uuid": "6740dbfc-8ed8-46b1-a950-c409d1cdbb7b", "comment": "Malware payload (Mirai)", "value": "d4cddf78f7e15004921b9c1d62a685e1e87349554d72b3dd4044c1086be790db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078829, "uuid": "18e5f459-7251-4ba9-9d8b-2149ba34718d", "comment": "Malware payload (Mirai)", "value": "74d842671204cfc184dc441a77d37f560db8b174", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078829, "uuid": "9f168189-9b80-4805-a3f9-e95c90813261", "comment": "Malware payload (Mirai)", "value": "406499a1d830bcb341a4f91ab77c1ab5005eef361305bc32e1ba847b1cd41f5050f6d9b56b91640d676d0c6ed3d713e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078829, "uuid": "e338f2e2-9520-4d11-97d9-2bdf2093b506", "value": "T110732B36B9761F26C0D4B57A60FB8B15F9E1238E26B4C50A7C720E5EEF157006902BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078829, "uuid": "6d70b843-c85a-462c-9027-42534f66de1a", "value": "1536:96oGPo5c8xHV4SkSQOV9gm5BYS53t6v32cNHNk9Q0:4o3kSQ6OA3Ev32kCe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630078829, "uuid": "ba2734a0-ff77-44b1-821c-2566cd30fb41", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630078829, "uuid": "7edaca9d-8bfb-45c9-90ad-e7e8111c657b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078829, "uuid": "0c75f18a-eda9-47cd-b866-ad80a0a0acff", "value": "4342960d9b82d1f29c24241ba79027d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af80b09-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630053032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053032, "uuid": "cdac64da-b84e-4484-b066-89e5cf194cad", "comment": "Malware payload (ArkeiStealer)", "value": "949ac057724019c6b5c25f3b2cf1cb32", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053032, "uuid": "621b19a9-536a-4ea5-9f8e-024f01924985", "comment": "Malware payload (ArkeiStealer)", "value": "d50cf3ccacba38aabf141d37818a7acd166542b6de738172f8bb4a87f75424be", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053032, "uuid": "48cc5555-c10e-4ade-93b1-eea5af685e3e", "comment": "Malware payload (ArkeiStealer)", "value": "72ef37f5c2bd4e9d0254013244f8e49fb8b7b9c1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053032, "uuid": "33e8b5e1-ecaa-42dd-9391-b780aaa85dbe", "comment": "Malware payload (ArkeiStealer)", "value": "7f9570a76ebbe0ef0c2b7df866ce2a1a7fb41c5c769d1d482a557e0313eaeced8f78f836858da3b475bdddf425d70a60", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053032, "uuid": "704c7f15-e8fb-4b99-b7d5-ddb7f7723427", "value": "T105448D30AB90C035F4B752F856AA83BCA42D7AB15B3490CF53D526EE0A346E5ED30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053032, "uuid": "7e4d3b4d-7bf1-479c-9584-42c07244778b", "value": "3b142de1de00907afa014d92f674693b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053032, "uuid": "93a7b003-0c73-4bb1-8118-a1e53752d3d5", "value": "6144:uP66EYr0VyyzVRG7wAxtQ1syw3MK/jQgSqPBwGEpog:r6LEyyzVOwA81B0MUUgfPBw/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053032, "uuid": "bfbc7e66-f2d0-4922-9e42-38f9c282e9ad", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053032, "uuid": "1e556fed-5b53-42f4-a230-df8a4af10243", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053032, "uuid": "21693262-562d-48de-93d1-680ca6f071cc", "value": "949ac057724019c6b5c25f3b2cf1cb32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cf67cd-06e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1630033476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033476, "uuid": "5c21da79-8e89-41b7-b2d0-fba8b8572218", "comment": "Malware payload (DCRat)", "value": "39a9f2301fe7d248acfc198317f0bc59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033476, "uuid": "9186e300-3dca-4fca-b264-82d9109e592f", "comment": "Malware payload (DCRat)", "value": "d7fa1b64c4a5a79700791c113b5b2594a2194a8ca83bf18494337ef12d88fdb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033476, "uuid": "0e6b2f7c-3adc-4a68-884f-4b2c49ca2f74", "comment": "Malware payload (DCRat)", "value": "4a46183df3d85d5c1e2c4fa63f77664e12065bcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630033476, "uuid": "7c916e01-c9ce-4149-b840-aaa3a42bb579", "comment": "Malware payload (DCRat)", "value": "91d6aa043e839e2753b3761078c6d7fcc34258cea6e5b3643b549a5bebe0c6490c15bd1420e267b064ea0c31f10a7630", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033476, "uuid": "6241a79a-23f1-4535-a1ea-9ab11d25e28c", "value": "T1A9452712BA66DD02C0291637C9EF943487ECFD017BA6DA1A7E9F335D64123A74D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033476, "uuid": "dfc534d1-a8ba-402e-9538-1699eeced94c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033476, "uuid": "1c3f5c77-846c-40c1-b9b0-d02d34db6c3a", "value": "24576:i8FkW/FVP+pgiGLUwKQKkI5BC1oo1KQDELu+4:RTFcwKlkmo1a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630033476, "uuid": "bc621452-221c-4004-a116-18e33bcf8f78", "value": 1241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630033476, "uuid": "0c1a2836-e7f9-4ded-888a-4e875220a114", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630033476, "uuid": "1a34ba4e-c34f-4c66-b1e0-a5d0e09a273f", "value": "39a9f2301fe7d248acfc198317f0bc59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a169141-06fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630043393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043393, "uuid": "97a4757b-258a-43b1-a26c-b2074018bfac", "comment": "Malware payload", "value": "0896a7fe81a06f0526647003c0eee29f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043393, "uuid": "b0702fde-3442-41f3-8321-7e2ba1f3e1f0", "comment": "Malware payload", "value": "d87c2b0fc814ba65a14a5f16b2f2ebed913e88c6946e436121e424e9bca8439b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043393, "uuid": "3778387d-e4a1-4623-a4eb-1ddbeb57474a", "comment": "Malware payload", "value": "407befde4592566fe2922fe40c579d906ee8dea7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630043393, "uuid": "57292580-5175-4f86-bf0e-cc486a717290", "comment": "Malware payload", "value": "5b73398b0d4d14540f18ad7034c80f959864cede6a12f6a05674fe2bd8d21590a7f7749621b3a099d82e33db730552c2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043393, "uuid": "c94ed1d7-b812-433c-ac08-e8727f583037", "value": "T1CA11680A4C148CDA9305E14101C36DDDC250A7537FC029792477794BDCAED3E1D8D84B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043393, "uuid": "54f231c3-6b44-490b-8d7c-0e0a97338ef5", "value": "12:tatyE7AfwVIJrwFWN94XNodnAbOJk8/fecG2bwELP/dg3Nfd+WVaiTC:0tyRfwVYwFWNKXyn55G2UE7/kNEKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630043393, "uuid": "84bf1e32-ed7e-4e62-8200-ac16a18d07eb", "value": 897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630043393, "uuid": "86762fcc-1f0a-4e78-ac9c-60dc20f3a8b3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630043393, "uuid": "83b91bc5-ec5d-4f50-b348-7512697049a4", "value": "FEDXX7453530379.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895ecf6c-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630076007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076007, "uuid": "8a5e265d-c55a-41c6-8a7a-72bce1632bef", "comment": "Malware payload (RedLineStealer)", "value": "21411f87a83b6e37f3cb43c0b258644f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076007, "uuid": "33a45c62-0122-4ed9-b37c-7b1863cbf8b4", "comment": "Malware payload (RedLineStealer)", "value": "d95c33c6ce941728a0d113c54a98c4828b3ced9273e01418db32dfabce1b10c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076007, "uuid": "41a33da6-ac3c-42b4-8ef6-c0d29489fdc9", "comment": "Malware payload (RedLineStealer)", "value": "a90fc424bc6d839ea4c504ef22ad3f93ae85717d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076007, "uuid": "0041c5cc-02b9-4e75-b8e1-5d0f3fd84821", "comment": "Malware payload (RedLineStealer)", "value": "115bb1fbb23e02439864aa1e66b743ec3f4837c880836c954d086f631bccf999e3dbd8113e5c839e25feee8042b37244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076007, "uuid": "2f35b0bb-b22a-4d34-b530-e5d8e421befb", "value": "T166E1E811A7DC477AEDB65B386CB323209274FA13D5938F2E7CE5151E6E563002E527B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076007, "uuid": "411db007-1edb-4b7e-9eb5-144e20412627", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076007, "uuid": "21505789-18e3-4abc-8998-47941d469a19", "value": "96:+/b1UkSvWpCKWIVJsEpNxaeOy0JIvvaGR6eyTluzNt:+z1UdOCRIVemPaNeCYMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076007, "uuid": "4afe14cf-1605-400d-9340-4d2aa58e3c1f", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076007, "uuid": "c0f43f22-2d17-4092-a9dd-e370c0a47a05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076007, "uuid": "777baafe-7ffc-4321-b343-d787456fecbc", "value": "21411f87a83b6e37f3cb43c0b258644f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3803f3f9-0748-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630076730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076730, "uuid": "c9f85a0b-afb2-4f46-8399-8b20aa1aeb77", "comment": "Malware payload (RedLineStealer)", "value": "a61e67c58e058cdd20fa32fe7c8f1a1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076730, "uuid": "e2223fc4-6914-4417-902c-ee4f93d24740", "comment": "Malware payload (RedLineStealer)", "value": "da6ac43a55078044e756120cd5a38fea372040b2db5524f29ff7dc9471118ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076730, "uuid": "cc85b3ed-0183-46ca-88dd-0c211a717d72", "comment": "Malware payload (RedLineStealer)", "value": "23880d7a8673c68e8fdc7e263ad9454e34e896be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076730, "uuid": "c8307aeb-c21e-4c15-b7b6-f6585b303604", "comment": "Malware payload (RedLineStealer)", "value": "1e40e5442f9236de31c95f92699525d34e76c0ba880bf8713acb718078a2947b8045c67d0104cbfc1e8e4cada89550b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076730, "uuid": "000e4c6e-d021-49dc-bb8b-c527bcee2f5f", "value": "T1FCE533C12427D34EC4159131FE14E7074EEA3DC6C648E7AD64BCB4987AB1393AE1B4AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076730, "uuid": "cc6c1259-bf23-4347-b413-a4b535743b3f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076730, "uuid": "191ed845-63d0-4dfe-9f79-f40d3bca5769", "value": "49152:CQtTFkB4eSz6u5fRpktgdO5vw6mjhTB1ZV2cUcM6jfpLbTIuL490iM5tVPu9:CQtTFu4dJ2IjpB1ZVB9lLbkQMjia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076730, "uuid": "f94ddf33-8f41-4bf4-82a3-2d59aa3d6da7", "value": 3230624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076730, "uuid": "163fd9f7-7bc5-4869-bb39-56034c2ae385", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076730, "uuid": "ae76095d-6134-4c07-b4df-8bd4dcde479c", "value": "a61e67c58e058cdd20fa32fe7c8f1a1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20490c14-074b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630077978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077978, "uuid": "7b70fd06-9309-4177-84a2-23103895b332", "comment": "Malware payload (Mirai)", "value": "ddf5f4d797863c570d96aca670a0f2a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077978, "uuid": "4c7445af-c1c0-40c4-886a-3f5f55b918f7", "comment": "Malware payload (Mirai)", "value": "da8c9a354e5d88c1347821895513b6efd4eb4ebe85c812d329c928e1617adeb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077978, "uuid": "bc210867-b3a2-4a29-b723-fccbf9f5df44", "comment": "Malware payload (Mirai)", "value": "b7bb7ac6ecb5e422a7d0d9c5956ac19587e71e7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077978, "uuid": "35d42503-d97d-456a-8f45-a11d7f1d9e8d", "comment": "Malware payload (Mirai)", "value": "c9d2891e926d83f891651da43b23dcc269ed0de0295b044f49ab57647bd03e8c342b69c3c6ee134b3b1a2fbeafc2f373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077978, "uuid": "09e78f85-7356-453a-99e2-2ac79ab45621", "value": "T144533B02B6280A4FF9D30AB0343F5FE0C7BEE9C035E1BA49695E97598535E372481E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077978, "uuid": "5a5b55fc-613d-4b7e-a432-b05fdc2db399", "value": "768:DwAAY6NRJTJ5ibU1HTeBmezmvdPfeIMXu6VqI6zjrfBylEpYnXBqSgIubgwG:EAAj4U1zeB/h/UI63cCYnX5gII2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077978, "uuid": "cb651c40-6066-4260-b814-bd5cdd4d8ccd", "value": 65184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077978, "uuid": "b6cb2317-7675-403e-989a-9e23f2fb31e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077978, "uuid": "7c9d7216-606d-4f35-be8a-ac92a37c3385", "value": "ddf5f4d797863c570d96aca670a0f2a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6b366d-06e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630034215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630034215, "uuid": "f3bfebeb-e13d-46cb-bc15-ad364f73cd44", "comment": "Malware payload (Formbook)", "value": "7760a3d9ef17a66544149d4564afb06b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630034215, "uuid": "f42ba999-f55f-4093-a1aa-82dfef34d4fb", "comment": "Malware payload (Formbook)", "value": "db33772c98a3b201320bf4b88830aa7ec9e2c85797cf4460ab67f8d4d93964f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630034215, "uuid": "d4790e25-0d60-4c53-b3ec-6c6abac04f29", "comment": "Malware payload (Formbook)", "value": "5778fd582c9eb9d511d522246aba0c3ca6a769bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630034215, "uuid": "2f75cba2-7eda-4991-bf91-bfdf297e5364", "comment": "Malware payload (Formbook)", "value": "5e07969dc4b92e57f9881663376f854b46ccc8b9addc5fe8424fac462761258759f8bbb3d9250ef33f12ce6046f01f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630034215, "uuid": "16308169-e1c5-4f67-a775-18bcf71e344c", "value": "T14435C63D19B9222BD175C7BACBE08823F5649CAF3111A96458D373664376E42B9C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630034215, "uuid": "a7985110-f045-4c3b-8097-2e2e727ea5aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630034215, "uuid": "403a983a-b3cb-40a7-b400-08a34f05f46f", "value": "24576:kuevOGAT5SQZFVgVWNgatOfJg+aJSY6u:kziHFVuzatOfJg+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630034215, "uuid": "c9b2cc32-014d-42b7-bdef-8ee6ed270e42", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630034215, "uuid": "985fac80-9e1e-4479-80dc-21edc79f1653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630034215, "uuid": "707bd4f0-afa1-4501-98dc-430e3285e4dd", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28696b74-0729-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630063389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063389, "uuid": "bc5915d7-ff57-4c9e-bd5e-af76b38545a3", "comment": "Malware payload (GuLoader)", "value": "76e87f3eb8e64eb451cd4963eb131a54", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063389, "uuid": "20b4114d-f01e-41bb-8a49-03dc00b7b9bb", "comment": "Malware payload (GuLoader)", "value": "dbe5ce9715d489bd6d7b86ef703aca19e858b8f39e92341873d46987d73db040", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063389, "uuid": "7a8e6e01-af65-490b-bce1-6e4af752ce31", "comment": "Malware payload (GuLoader)", "value": "7adc37c1f33597490539817c40d7f0569f2c31d5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630063389, "uuid": "f349485c-f28e-4774-8079-0eed152dea68", "comment": "Malware payload (GuLoader)", "value": "88cef6384ad8003f77304a310ff06bf24f68ed215aaea8ce446a686574d5774f62e26b902c05431b7f380952cfec9598", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063389, "uuid": "ee9de814-b103-4539-bc77-8caaeab3782d", "value": "T15123024A762C0FC6DCD96B7530626377B601958C4EECDA5D7BC9D40C8342AFC9DAC868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063389, "uuid": "21ee4a75-db36-4676-b76a-8b64f8beaab6", "value": "768:o6q7HvenzZH6z9dL5ctSZ/d27m4zAFi1KsmP8LNJOIjtPmtiZ46gS:P6Gncl6taVkzsu1JYStNZ4ZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630063389, "uuid": "928b3ce4-7d26-4f09-9d3c-3b2e0d62d446", "value": 47090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630063389, "uuid": "56275f09-b0ba-457e-82d4-f89f1110f9bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630063389, "uuid": "ba316ec1-db4c-4b79-87ac-bc165ca61c38", "value": "Einladung zur Angebotsabgabe GYTK894 26-08-2021\u00b7pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cb49b0-0701-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630046250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046250, "uuid": "6fbea225-e932-4062-94b3-2a6a7294e412", "comment": "Malware payload (RedLineStealer)", "value": "b770d8b2f9350573826f9ea566260e7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046250, "uuid": "1a7e2b24-f399-40e1-9f5c-94a2c89c4a9f", "comment": "Malware payload (RedLineStealer)", "value": "dcb25316bc3b1978f4acb2cce9804787843d832b46939195550ccdfc2f7f947c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046250, "uuid": "ab69df55-d1c5-40f4-b047-26d4985a6b98", "comment": "Malware payload (RedLineStealer)", "value": "a3c8dcc616f9595e7eb7c3f17cc1293a95cc9648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630046250, "uuid": "b7789a5f-60ad-48db-8099-042875c19e01", "comment": "Malware payload (RedLineStealer)", "value": "6d707ca6ec32d0fcc51e9d6d6f33da5e7f1977db49ee2637c494317eedf7cdecab918f367950db7f5a8c3139a73e65dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046250, "uuid": "28cf7534-45ee-46fa-8dd0-2908a2216366", "value": "T192B34A2563EC9A2DF3BE4B756470151483F1E1DB6001EB5B8EC264DA6F337826A446F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046250, "uuid": "2c5ed7a0-88ee-4428-810a-9d8384652a2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046250, "uuid": "85c6530b-9e40-4933-a4b4-1f7d0ad7ceff", "value": "1536:IxPQVLAufQYcrA/M+UePwN0oKfDRjbuFGdRnQuyqlddVsWOE5G6eRaoigK:KkAuIYuX+UaZxRn3ywdd/Jy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630046250, "uuid": "56c2d492-dbc0-45e9-929c-5393a845affc", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630046250, "uuid": "b9c773a5-140d-4a93-a737-1684b3337175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630046250, "uuid": "5fafd224-c3fb-45a4-becb-29e109c33700", "value": "b770d8b2f9350573826f9ea566260e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52424ee1-070a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1630050145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050145, "uuid": "1fc2f034-fc25-41cd-8029-c7ad5799082a", "comment": "Malware payload (CoinMiner)", "value": "0f23f1451e66b86bc3e56dbb714da989", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050145, "uuid": "ea24ba91-872d-4337-9735-3a52d3f35d23", "comment": "Malware payload (CoinMiner)", "value": "df47c9d6c0bcd204919cfd8d495a22ff35f8506cd328410393a724f3548ff828", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050145, "uuid": "67729d5b-e232-4759-bd28-050febf6ab9b", "comment": "Malware payload (CoinMiner)", "value": "5b3fe22cf137f66d020aabbbbb894aab5bd96d40", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050145, "uuid": "fc02285b-4e75-441b-aa4d-6821b7c2c048", "comment": "Malware payload (CoinMiner)", "value": "90f74d66dac15a7887ef74fbd42ca845fffce72a37278535414908b23f4afad664647d6d991b12f51779976242b04298", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050145, "uuid": "a9e86061-96f3-434e-90cb-984843ae9cc1", "value": "T16323E122B36D8DA9FE3F583956EE3A02266ABB663106CFCDC484031D1D55F48CD61E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050145, "uuid": "05c9e79f-600a-49f7-9df0-28dde86e60b7", "value": "768:nCD690qErBM3lqW2WbXP3hzy96pPcx4PwyAiBln2ckn1Ixp2vqMmzwvhbF9Y8NFh:nCiErylq3WTJ+IpP7PN/27mp2iMQwhbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050145, "uuid": "f67f6d8a-50fb-4af5-852a-902a04bac000", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050145, "uuid": "8731d265-df87-4fc9-a5fe-b2c43a6b5fe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050145, "uuid": "902282dd-ef9b-4237-bb0a-104c321127f4", "value": "SecuriteInfo.com.Trojan.Siggen14.64783.7506.3679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b175111-071e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630058669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058669, "uuid": "59b51767-6582-4aa5-92e6-6eeb4035790c", "comment": "Malware payload (Mirai)", "value": "8a694818f499cd76bdb85a1888902837", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058669, "uuid": "66004ec0-1081-485d-a1ca-e17c0bba5ae2", "comment": "Malware payload (Mirai)", "value": "e0f31eb4afbe0c30b23de9a9bcc5daba7086561277f361d87cce64ff0f719df2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058669, "uuid": "1a08c2ae-60c2-4469-ae1c-421cc497ef66", "comment": "Malware payload (Mirai)", "value": "5d08331c6953f608825ac2c5096e44585c9eff00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058669, "uuid": "f2874147-daaf-4536-a3e8-232c782e0ddc", "comment": "Malware payload (Mirai)", "value": "55840c78103c6fe7ad498666c2fca249312abc43d1223bc1d11581478b8699cd62acd81cd6f08a476f83c3c0abc10125", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058669, "uuid": "393c058b-3d47-4d96-b8c7-c22ce2a39377", "value": "T107A31A47BE81DF15E4C612BAFE5F43083313BBA8E3EA7102DE249F542BC659B4E26511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058669, "uuid": "8bec3dfd-97a6-408b-9461-a9bb1c60d05d", "value": "1536:AEnEHJpbEmUVzIaX4hwRZ5uj7llEYi07hoDTCY7NonwrNehut82yhdj:U8zIaX4hwRZvS7hoDGtnwrNeIt82yDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630058669, "uuid": "dd2bf0d8-e7b1-4e40-a63b-96cd6f4b80c3", "value": 105596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630058669, "uuid": "f69bc412-9431-4fad-b773-2b8645ce3147", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058669, "uuid": "9dd15c2a-31ab-445d-a49a-0e98e159c536", "value": "8a694818f499cd76bdb85a1888902837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dffea08-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630050594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050594, "uuid": "eeced8a2-8a37-4aa1-91f1-86d9f8d65d04", "comment": "Malware payload (GuLoader)", "value": "b6264ace7a879f38bcc0725ae27c3510", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050594, "uuid": "394428d6-3e62-453f-9059-816695864890", "comment": "Malware payload (GuLoader)", "value": "e15bebd2d2bf5e1f9835e4cc1c85e0f0984971145316ba674729ad895f13c654", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050594, "uuid": "2f2799a0-cef8-4eac-9c42-7f668bb95198", "comment": "Malware payload (GuLoader)", "value": "100559dfe91f4f59f007dc010376f8e6a707fae8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050594, "uuid": "d8f20f53-5bdf-4130-858a-39091b85d6d3", "comment": "Malware payload (GuLoader)", "value": "4b58469453f0027297f1522090c0d31fbb0e9eeb8bc2829597b7eab7d5b124c4f1272f4d6c834ccb0be50c61be5e5672", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050594, "uuid": "3f3d0f68-3737-43b1-99c9-80bb68bda696", "value": "T187D4F1BAB3E4976BE1B7E47260575F94C3F65FBFC668C40971A93163C4B6B281C00A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050594, "uuid": "8f270f68-9e5f-41ef-aced-54447f9c74ed", "value": "12288:wtsu35WnFGA4kUlpvbVjohAIRpBa0AAjCX7UyvDLAjGsBBUw5:sxWFbUlpvxCAIRpBpjCYeD8Kw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050594, "uuid": "fd578d0b-ed29-4353-a1b0-6df772af0a33", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050594, "uuid": "350c17f8-c676-4092-942e-4eda31aa4079", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050594, "uuid": "4a5b938b-b716-4023-b940-83339acb8f55", "value": "CA6E8FEC4B220118E0540A0087612C95.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2a7184-0724-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630061516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061516, "uuid": "3d17b94f-5604-4af8-b558-6c077870c1e7", "comment": "Malware payload", "value": "c5334091df500f6c58b8e33faf32c354", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061516, "uuid": "4d25e9f5-aa25-4c1e-90e2-c8466e6a3a67", "comment": "Malware payload", "value": "e24d3044c9010db0037e5bebd8d23b6cf4f566b712d641c24a855a405164a98d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061516, "uuid": "04a9948a-dd29-4477-b608-079acf75b003", "comment": "Malware payload", "value": "3537a8b346fcfa86a08aebc77c9a2ef2d56a8f13", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630061516, "uuid": "aed2ed0b-2ef8-4014-b062-ec11e8c4c058", "comment": "Malware payload", "value": "321075b62a8e8377f694cbc304445c8ad87dbea587b6d5d5f2dfd47b75f77c408a90707050d2f8c1db45f8601ea20eeb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061516, "uuid": "5938b158-c8e6-4de5-9c95-7009118da4f9", "value": "T198834B0CB249DE53E50962359CB6EAEA63963DC92ED0E18F36913F1EACBD6701533311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061516, "uuid": "ef046895-690d-40a3-81f6-618fe497b374", "value": "768:wKP0nXmMv4QGVp+BW87CuwJIfXAvFpjoPm/PGDQwMAgd0Tk8+FC:wKP+srVIEfJTjGQPoQwMAY8+FC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630061516, "uuid": "9defc91e-d846-4caf-a966-44dbb181bae1", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630061516, "uuid": "ce1dc04d-2676-4aa7-9803-f97a9c241b9f", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630061516, "uuid": "6761357f-cc1d-4650-b410-7e3682648c3f", "value": "question,08.26.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59694e03-0705-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630048009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630048009, "uuid": "1a2e93ce-43c5-4ef9-9b03-3e358c6916ae", "comment": "Malware payload", "value": "5dfe7518e90cf015690f06c4855f2a34", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630048009, "uuid": "99c09e53-6670-4742-a66b-bfaf9d04b1f5", "comment": "Malware payload", "value": "e2b7ba18db2097df37697ba00124aa3cbb322da2cbae67f9409e4759ca386db9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630048009, "uuid": "66b7fc54-c9a2-4fc9-b9b5-c5b87cc8c3db", "comment": "Malware payload", "value": "295e84e6b3647f14cd31782d6354dd4b4a120f7a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630048009, "uuid": "b7214e03-598f-46af-a9b4-bf854f94179b", "comment": "Malware payload", "value": "bce465d0103a18d77b4b736e6f0408356ea87fcb62aaa4e6776b2ab81e2e6de59c2ede7b15d094f73bcbb58dd8121a7d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630048009, "uuid": "ff2adfa3-ce62-4a3a-a003-8e9d8b747fba", "value": "T19B773310A68344F5820DF73A949205CFB7C9A86DE80EA971C26F9379B70527B506FB3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630048009, "uuid": "db3cc2f9-54b9-41c1-89b4-7233c89e6fcc", "value": "786432:ScCexL+EPtAVB3btagmWTUQT6wqZd3pihVl/t03JgHxeL4z9M:CellOKNQTgT5otcJ25q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630048009, "uuid": "4b0d0380-a7a0-41e9-954c-c9617ae83f99", "value": 34770162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630048009, "uuid": "d441f946-2d9b-4400-a9f1-0280492947da", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630048009, "uuid": "b7fb3cb2-629d-4d85-93b3-d5622a6c0c6a", "value": "UniswapApp-v3.01-release.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5613e0cc-06d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630029106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630029106, "uuid": "ff84041e-c5a2-44be-92be-526a744cba2b", "comment": "Malware payload (Loki)", "value": "6ed79c453d269ce6e6ac5c68576eccdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630029106, "uuid": "ec9c1ae7-7b9a-4390-8605-72e82d6c26fe", "comment": "Malware payload (Loki)", "value": "e2f835236922d54bbb86341de3ec49d714cea450971fec087f1551acd41a8b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630029106, "uuid": "b74ed615-5cf9-42d3-93c2-ce5de946b5e1", "comment": "Malware payload (Loki)", "value": "c8cf92ad6b6cad1f852742904e11c9f45581683f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630029106, "uuid": "d66fa28b-1ff8-43a8-932d-2d9eb72b8bc2", "comment": "Malware payload (Loki)", "value": "bdf2142d62d54785e6995a918ec6e54ddd8b131df684e66a0bcf7716847f1b9898be88fc5c3552b5a372a9b73c5aeb5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630029106, "uuid": "e5e6915b-630f-458b-86cb-dd57f73f5a13", "value": "T15A25C33D29BD2237D1B9C7B5CBE09827F554A8AF3111AA6468D343AA4356F4235C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630029106, "uuid": "52bca85a-5a6c-40fe-9c0a-92fc9ada831f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630029106, "uuid": "16100b51-d786-4e68-8abb-cf7796125ded", "value": "12288:cCk3clJR0oe6y8EuwXkrHJBAn7YneXdYrfJ1mS5lBQ+qIBeruJ4QPujP:lk3c7abF8EuSSJSYmCrfjLEEer6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630029106, "uuid": "9dfa5876-936a-4156-80a1-ddadc3d6266b", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630029106, "uuid": "e4e34192-68e0-4999-a857-6d99abe8b881", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630029106, "uuid": "6985c44e-3ba2-44fb-91e4-417d2a1e6be2", "value": "INV#202170607#SGNBM4809600#BL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170d0dcf-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630053052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053052, "uuid": "d2eaea3c-fbdd-4975-9763-243f37e05c04", "comment": "Malware payload (RaccoonStealer)", "value": "62946bbcd071b884923bf882737dfd22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053052, "uuid": "0b4efaf5-504d-43e5-ae9f-25561cf6b414", "comment": "Malware payload (RaccoonStealer)", "value": "e48a841a4644b0f4e0cc7cb7cd7785443b2a3c297e2428a3b7315a5e865fe21e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053052, "uuid": "6ef8dc83-b8ba-415f-ba93-8e64cf7f23f9", "comment": "Malware payload (RaccoonStealer)", "value": "9d48ba1857d813156cb1986d4a69e4222d428b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053052, "uuid": "1abfda3d-de4b-4ace-aa71-2087cc6569e9", "comment": "Malware payload (RaccoonStealer)", "value": "77b3a960c7e45f1d698852a32b05e6266f327575786622ae0b5b4dc8e0e7d689dadbc2317dc495f34644283eab5be4f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053052, "uuid": "d09f0329-a1f4-49b6-8d55-bdf7bac42063", "value": "T196940246B571C073C9C249BA8C59E7512B5F6E216E6246CF3E8C0FAE3D622C0467D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053052, "uuid": "26044a46-710b-4c7d-89e4-8c36fb8072d1", "value": "1a5fe3d7e91739366ce1a49344f056ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053052, "uuid": "5cc586d4-f3c8-4a8e-bd88-a602d3149e88", "value": "12288:kN2PqK86s3kNV6WyvRLc8U7rc9b9RPoaXc:CAeQVKxc8mcvRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053052, "uuid": "8b3e96d8-df0f-4364-b8a9-8fca23d21899", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053052, "uuid": "41e8a7c0-9deb-454a-8660-6b4f51fe7c68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053052, "uuid": "0b34f585-7cb7-4a36-a9b6-f91b9d3be749", "value": "62946bbcd071b884923bf882737dfd22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d731c06-071e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1630058727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058727, "uuid": "05c240f8-e166-4f6b-9f01-d870871db9a0", "comment": "Malware payload (NetWire)", "value": "e9978425a024bee8daf9b6ae88d1d967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058727, "uuid": "badf010f-32be-4b95-b811-da6c245329b0", "comment": "Malware payload (NetWire)", "value": "e4b66d8eccf8e0ec2f33afb880b23e1a5dc131028bf91a4c5cbbbd883331fa65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058727, "uuid": "fda557f1-2fa0-47d5-8c25-440ac880ed66", "comment": "Malware payload (NetWire)", "value": "8bb64106e14c7ece0e6478a73169d7cc520c18ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630058727, "uuid": "53e2dea7-e102-49e7-a0c1-9a7e6f82f672", "comment": "Malware payload (NetWire)", "value": "7862681b1ff28ef851a1bb8044758e32795a0db791dcbc4551f882a0c20197df617bdfe89d5e82c555a23c8dc692822a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058727, "uuid": "ea8ca781-8644-43f0-90e2-5198b3d3b818", "value": "T18E156E3C69BD2627D17AC3B9CBE0D823F014ADAF3111AD6864D7572A4752A8235D323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058727, "uuid": "47792330-e49d-403d-a96e-5e38c3949b4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058727, "uuid": "e2ac6c07-e857-436e-969e-17fe33b67156", "value": "12288:bwaCSZ//mZ11r/JJ7q40+eUe5JtgFUIanV:jCC/ulqzjflgFUxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630058727, "uuid": "db1354c1-8746-4c7e-bcea-601a5c308b2c", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630058727, "uuid": "a847867f-4cde-49dd-8808-8ef3eab50ac2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630058727, "uuid": "402273ff-15d7-411d-98b9-3e726ad68796", "value": "Payment Notification.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586c0bce-074a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630077643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077643, "uuid": "25c935f5-3578-418b-a0d7-843fac88fc61", "comment": "Malware payload (Formbook)", "value": "dad8ab1e1bd10ab4dca7de6f5ebc1404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077643, "uuid": "463a4571-f7f7-4554-8e84-8d62ffbedcaf", "comment": "Malware payload (Formbook)", "value": "e4c51cfe125602ab5cd33e751d121395c59599055a8294a5234c37a399ddf582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077643, "uuid": "d098d913-53a3-42a8-8833-ac8944aa24b4", "comment": "Malware payload (Formbook)", "value": "0de7912186b54ef2c22d8266c67be7573cdba3f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077643, "uuid": "ef6869f1-9fa6-4707-a105-054a4d6479d6", "comment": "Malware payload (Formbook)", "value": "5ffbeb0e972e1c6b6979cc573beed0fdf6172a51f7f318d624307bc5425b14a5c84142a88f84076f99b74aedf830b89c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077643, "uuid": "cc56cc76-49e1-477e-8ad0-4fcb8ad40ea8", "value": "T1EC25A03D29BD2627D179C7BACBE0C833F0549CAF3111AA6454D79B6A5742E8235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077643, "uuid": "d0a82356-4df9-4ca0-8e8b-cc52a898335d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077643, "uuid": "1f8a2604-3a41-40ec-bb62-ddd0c33d3142", "value": "12288:AcgDMzo/RYxwBVu34MaU4ui6KgGKd7QBeamsNiBprti+8H1Fo:AYARkwB7/U4uIKhHl75iJH12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077643, "uuid": "629abf90-2c0b-4646-a97c-297041d0dd91", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077643, "uuid": "c7a07693-18fa-4306-9835-9fe14467fd5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077643, "uuid": "d30b2eb5-65d0-4ebd-a4c2-b592e42e3885", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11992c84-074b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630077954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077954, "uuid": "a76da386-0cea-4c5b-b8c3-1c86e5d9ea52", "comment": "Malware payload (Gafgyt)", "value": "bc13d7f8d842fb048be070e9bd521b85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077954, "uuid": "0d4f5927-ed0b-4d26-83af-bd991c01eb94", "comment": "Malware payload (Gafgyt)", "value": "e59fbb55a9657848d38b6d755a214c91231de5d84f24247efc1a45803f1fab5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077954, "uuid": "cf308ea2-4ad9-48dc-a298-7899531e394d", "comment": "Malware payload (Gafgyt)", "value": "fe6b3ffa6daabfaccd40611669144e3dc054563c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630077954, "uuid": "8bc16565-c2a2-46c3-9111-b109f64e14db", "comment": "Malware payload (Gafgyt)", "value": "cf14a0aa4f86221d1b238fe206e25130a106445e3822829b4691a538927357cbf52b66414c889d0966c6f98dd2919185", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077954, "uuid": "1a7d8915-e2cd-488a-950e-f0c865a20b59", "value": "T1A5D32997F801DFA6F80AE67244D34B14B371BFA20F521622721B7967AE362D53827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077954, "uuid": "85687642-8c28-4cf2-b6bb-3ed3ee6909e4", "value": "3072:8k8qeEx+2BXqxFwIrMynbwJ3O2+lfwmKYVyeWvG/r2oq:8Jc+2BXqH2ynEJ3O2+RwmKYVyeW+/r2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630077954, "uuid": "225ee4a1-29bc-4d11-8e76-f7198c025eac", "value": 136372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630077954, "uuid": "50f28b6a-457d-4ba7-b971-eb47463f01ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630077954, "uuid": "c8ab9910-c7d5-496d-8c78-f1af4767c8e6", "value": "bc13d7f8d842fb048be070e9bd521b85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f86c713-0739-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1630070434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630070434, "uuid": "fb1c1c20-7429-4ef6-8a68-541495f74b5b", "comment": "Malware payload (OskiStealer)", "value": "654d41002dfbde29e6a38986c5fd0c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630070434, "uuid": "feab75b2-4b3c-4ec6-a384-0f2f91380e15", "comment": "Malware payload (OskiStealer)", "value": "e63dd4ac236eaf7093fd6a468fa5675ff5fdb3c41a0b75d5a3f525267209ee34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630070434, "uuid": "30786165-1c57-4f93-8eef-43ea2a0daf87", "comment": "Malware payload (OskiStealer)", "value": "8db2af4d4bf37288bf8e7c015bdd07cf0db24f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630070434, "uuid": "a2f3cd12-e9b8-4903-9209-ea59f1be9bb1", "comment": "Malware payload (OskiStealer)", "value": "80446023849bca7023b27a0f47ab560702df855d112d7bf6d2965601ba145bb48bd91a1c3b48a93153b2e8564ab9e91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630070434, "uuid": "5dac8283-37fd-477c-8963-85006097a53c", "value": "T15DC4DF47B24D4B4ED6DE44F2B4B0E13483A59F235241E6847EC4EE6FB5613CCAA06AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630070434, "uuid": "20e41179-ea4f-44e4-848d-f4c112a0654e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630070434, "uuid": "cd079b0b-9709-4e6a-b2f3-b9b12483f2f9", "value": "6144:DA24q+8JMn/BVk9OlBiGpgJ2YAK0WSaJDHbGPOmqdUoO1awIfHJEH9ir70UD:DX4qZJ6mwrU2bSRGPOJUz1awAn70y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630070434, "uuid": "b364553e-ef8d-4506-aafe-0912c971f827", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630070434, "uuid": "d1555ebd-13bb-4854-8e66-91fdc43963cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630070434, "uuid": "85dcd4e0-dcf9-43fa-a79d-8ce0809f36c1", "value": "SBAEIDLApplicationDocumentsPromNote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37eb6407-0781-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630101211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630101211, "uuid": "632ba934-bce7-4fa6-94b3-9d705db3273f", "comment": "Malware payload", "value": "ee05142949822c73d4e44e9a87151956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630101211, "uuid": "d9d8ade3-e039-4a1b-8a3c-6e851be87ebd", "comment": "Malware payload", "value": "e6dff2db44b1150aca66ea21e90c653b895e6adcbb0cf2135e9b59bb41c1d480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630101211, "uuid": "74439426-32f0-434c-bacf-8002fb0d28af", "comment": "Malware payload", "value": "ca49e59c05ccf34c472d1ea6cd895c7e5a6e3605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630101211, "uuid": "a23dd495-f952-4927-b16a-e5bf49d13378", "comment": "Malware payload", "value": "994187b686d82708f551b373e385ca2fcc8cd107fb26f793fe7ceb28faa380346a243d3c9a0bf5f6387f0e28e94ac161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630101211, "uuid": "5c98c118-3a53-4eef-94c1-da53ffd3c90b", "value": "T1BE75023839DD900AF2F2BB39AFD0E8B15768BE167606555910E41FC73E7F643AC42229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630101211, "uuid": "380121db-68da-4360-946b-3e8e57607626", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630101211, "uuid": "41ded281-5ef5-4657-a4c9-f0b327fb1f1b", "value": "49152:LdLdSQVL6DSbx8cdsXjDFBPre8tBzPnO:BBSQVL6maFdi8PO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630101211, "uuid": "f528a92d-9d8a-41fa-a6bb-c478f52cb737", "value": 1598976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630101211, "uuid": "4de58985-f8d7-4f69-9731-35dd41c3b3b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630101211, "uuid": "63fef62b-c8d8-4ad2-b695-4f0b27bc85ab", "value": "Application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6207b48a-06f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630041152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041152, "uuid": "89abf0d2-44c1-4bb6-b1fb-3b2ed060eb53", "comment": "Malware payload (Mirai)", "value": "e91096fa660881ced7b763042deb133a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041152, "uuid": "3ef2c574-702e-4445-addb-807b15e607cb", "comment": "Malware payload (Mirai)", "value": "e7ee441d36cc7c2205b5fabe82cc9801d22c3eb25200cee0c03d14038eada923", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041152, "uuid": "d4857ef0-123f-47a3-a349-51c398a6c8be", "comment": "Malware payload (Mirai)", "value": "2c2890782b5462160ae41c560bbef87cf3a9a0a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630041152, "uuid": "800ebe6f-e78d-4059-814e-5c4a16ae1984", "comment": "Malware payload (Mirai)", "value": "56c184f04f18888bffe810027619f6b0ad1f3544dd173d71c8565aee0115398613fab44e3548948ee14a525ee298f646", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041152, "uuid": "44e99db6-5b72-46c6-80f9-8e9e89d39a40", "value": "T162534AD5B4028E7CFD9FEBBA58210A0DF962620151930F3A52BBFDA36C731658D23D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041152, "uuid": "1b7a8bd1-430f-4de3-89fd-f6db8f2f8101", "value": "1536:AEvB9zCmxG6d/4A+OA4z77YBD/LkBw2VH8mQe3sZQYh:I6dQz1V96mTZrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630041152, "uuid": "d7e7c8d3-06f2-48f2-ac9b-122e7ad84e01", "value": 65880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630041152, "uuid": "e8d90789-2987-47b1-a262-0f776ca36bb9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630041152, "uuid": "f6f7effd-8b52-4fa0-91c7-bfd2c5407bf4", "value": "e91096fa660881ced7b763042deb133a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac320ff-0720-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630059662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059662, "uuid": "e8ed2bcb-5f86-4162-b5ca-2b56947876b7", "comment": "Malware payload", "value": "e516feadf3e585a557571c4a79690b74", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059662, "uuid": "554012da-076c-4483-94be-d790041db49b", "comment": "Malware payload", "value": "e7ef286500c594792914f2b554c79fee54eb4b765197349a55e711c7ac7f184d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059662, "uuid": "94612017-8092-4c5a-b750-4607779a20cd", "comment": "Malware payload", "value": "d85b41d53f4b02bc1aae216a6f6a919aa8a213a5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630059662, "uuid": "4aa43836-c9e2-4811-be2d-3e8c0ecf3ead", "comment": "Malware payload", "value": "bce6b96049a055d1aaaa575452d15f3812341c95d6be3d6419708cb22b9b15dae2e9fe7e1bef96c7da05182aa19a3720", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059662, "uuid": "1105be72-6722-4c08-90aa-13d6485de5ef", "value": "T1E0773308CBD785F893B5FCD122994F8F6F96D0B34C18EE45D8AE316A57218C7AC49239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059662, "uuid": "d6de1426-003b-48f9-b09e-203d81c8146c", "value": "786432:qZwoqA5RG8auQSb5mBQr10CGo8xhlgOt8EuOD5vmZRed5m:qui9FbwS0CGoChlgt4qRc5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630059662, "uuid": "6c242118-6732-466a-8788-14993bd09dcf", "value": 34755935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630059662, "uuid": "75a1ea6d-5ee8-4ece-9e6e-b48a9a535772", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630059662, "uuid": "c9c4990a-34c3-4f50-9e93-73fa3ad3f279", "value": "Terra_Station_Setup_1.2.1.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d559afad-0718-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630056378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630056378, "uuid": "be7add24-d85f-40af-8777-d254747292e1", "comment": "Malware payload (Formbook)", "value": "5dee264e7b7d41cb0f579860a618c144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630056378, "uuid": "7fbc2ec3-800b-483d-a81b-a3bf93c23af4", "comment": "Malware payload (Formbook)", "value": "e9714695528eb1f8786fe8a7250f952f23b3205a4e2a60073668717eb2f5dc2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630056378, "uuid": "0d1416b0-c7bd-44d5-b8f4-a8e2d66177d0", "comment": "Malware payload (Formbook)", "value": "9c7aaab804bf2416e7e2ca87cd088305fdef8b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630056378, "uuid": "9313131e-0316-4828-bc15-6eca0852cdb2", "comment": "Malware payload (Formbook)", "value": "06fc3bf33b38d26ceea0e0df53f8d01ae9c8bcea69f8cb8cb51d10354c3918adfd906c8b6de78d212114b003afe1d6c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630056378, "uuid": "203b5272-f734-4c08-a3d8-f3fa2f0592b3", "value": "T1E3741222FDC94CD6FAFBD0BA5DC68F392D2EB1C7083547BCB598CD6CA6540152CA18A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630056378, "uuid": "bb7f4101-1466-46aa-ab69-dcd343813c78", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630056378, "uuid": "e2b5d90a-365a-4d20-8b78-d1070ce94d10", "value": "6144:S4XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0Pz5:JXe9PPlowWX0t6mOQwg1Qd15CcYk0WeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630056378, "uuid": "b698e75a-18e7-4bfd-a382-cc33e1549795", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630056378, "uuid": "1e41ca37-7c12-4ed4-a341-e2fec338b522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630056378, "uuid": "1b1762f0-c01d-46a6-8e48-d142a31e9566", "value": "SecuriteInfo.com.W32.AIDetect.malware2.21078.19431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e3a8dd-076e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630093238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630093238, "uuid": "65a755f8-72dd-4321-8700-c6dcf2a85a98", "comment": "Malware payload (AsyncRAT)", "value": "2fd93e3c6ce289531feac32a7a03bada", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630093238, "uuid": "e9ee3840-647a-4f98-80fb-0fdbdbea1b08", "comment": "Malware payload (AsyncRAT)", "value": "ea5e5aa5934e32b998d57fcad62ad6b0ae02cf9de3b0a9de5b56dd8261311432", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630093238, "uuid": "4cb89bbc-74b6-4822-adf7-586ae1237f0d", "comment": "Malware payload (AsyncRAT)", "value": "38aed0a04aa969a03c9226dc982d95a44288dbf1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630093238, "uuid": "9bc6b4d8-77fc-4ff9-929e-3b633e6bcb7e", "comment": "Malware payload (AsyncRAT)", "value": "ebf2b3c4f0f892030436e5f617cf1efcfe0af7464b612b7bd3bdac642522d100acb56aabbcc5242104a3deeff674cf5d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630093238, "uuid": "c09ac95b-8a43-4109-8d93-cd2c42ef0aaa", "value": "T1E6849D7EA6A346ABF14921B50E956C6CE040BE7026DD90B730FE786F4F1B7A4CC19E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630093238, "uuid": "2433edf9-c5c8-4b04-9de4-0d133c409508", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630093238, "uuid": "823fd6c6-6d47-4006-88ac-e95a7ca7b400", "value": "3072:8qUB+qAq89pftg14/aFrrarjEhhV5UTruoknus8MAKu1q8rugLgOI/3+TAoXUbhI:8Cj9VK55wsusju1lUb3+caNEt3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630093238, "uuid": "c294d84b-e578-4374-86a1-99467654af28", "value": 376320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630093238, "uuid": "9901ce1e-93f4-481d-b795-f278ee99ba32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630093238, "uuid": "92ec7a76-2f9a-453f-8d65-6bb4f93b1504", "value": "2FD93E3C6CE289531FEAC32A7A03BADA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202945af-070e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630051779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051779, "uuid": "c868e413-7d8f-44e4-8990-7133bc486123", "comment": "Malware payload (STRRAT)", "value": "eb3d619cba462d77977690934d4cb413", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051779, "uuid": "29ebe2cd-c79a-4579-9038-9cdd9de4b0f9", "comment": "Malware payload (STRRAT)", "value": "eb32e9398f56cbe2b3f0a1d827808e9252db0d91fa6c477c773500af733d4ca3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051779, "uuid": "593e160b-c872-42b2-9543-5b9deb7fa2ca", "comment": "Malware payload (STRRAT)", "value": "9d60b4ab4cda0c6693de417dbb2db72c95a73663", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630051779, "uuid": "a5d46a41-ee8e-43f9-a0bd-b648b65ff15d", "comment": "Malware payload (STRRAT)", "value": "6bffb38d8fea3a11baab570fb6d813ccc2748e727e94ffbff762a4b08b990cc63cf3e6a8157cf89ceb805164f2f6b7bc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051779, "uuid": "db43edce-1da2-4f44-b29a-6967c83a854a", "value": "T113A3CF1F2D5FC0B9F44B0033801AC533AA5D12A99607A0BF2BFD49499DB9E395A139DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051779, "uuid": "6ea1ce78-f1af-43b6-acb5-fd9bfbe14c0d", "value": "1536:i36NYptd54f5fLZZaSF7dnxrzwufJO/Tg7b98KChFkiPVpg3dmI:i3Sstd5MfL/F75hU/T7KChFtPVpgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630051779, "uuid": "79cb3eac-c48e-4f72-af11-35c4de6ce269", "value": 101946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630051779, "uuid": "f3d2cc08-42a4-404d-b3e9-6a0c5313b7a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630051779, "uuid": "611165ec-ef4e-426e-9343-af022086cedc", "value": "attached.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f2e65c-070a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1630050146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050146, "uuid": "6f459348-8299-4f9c-8edb-4835f9b96df4", "comment": "Malware payload (TrickBot)", "value": "581652f23fdfea0d67b3451540e0d421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050146, "uuid": "94f6e770-ea51-47ef-bd68-abb6604abb5b", "comment": "Malware payload (TrickBot)", "value": "eb8a74d8f5a93d86a431a8a4c47d3be79ad4330d12bfbcd533338498cd9af94d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050146, "uuid": "893b0dc0-df14-4289-b2ef-82b30e3e1cd9", "comment": "Malware payload (TrickBot)", "value": "232db045403efe4a67de8b175e856e2013990410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050146, "uuid": "faed0b5d-b017-40de-81db-00a50c5821f6", "comment": "Malware payload (TrickBot)", "value": "dc300b57522e90f2ef87baf350eb40a43a63a485e26de1e4444ffdb0f4700e3f2a8fe6b1f3a0203175c1bd362b00232d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050146, "uuid": "6a391a5f-3e03-49f9-8816-aa91516b22e0", "value": "T12B0518D0634C8A7FD2D33130F7A61233D6579B4E1B9B618BEB58F19AA86E4463817307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050146, "uuid": "b1ccf420-a7d8-4626-b475-d9f91214b106", "value": "884c251bdbb51e23564add248435ff5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050146, "uuid": "f54a6d88-e12e-4db3-9bb8-3d13a6fa82e9", "value": "12288:QPcdp7ByGGLWwJe55I0tP2qood3bfFeGByUZbGkM:QPe7ByG4Q37B2qVd3bfkGwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050146, "uuid": "533452c7-4ce7-4cb7-8d56-84bdf13379d1", "value": 839733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050146, "uuid": "d060def2-d6a9-4ad5-97c0-f60fb9878f10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050146, "uuid": "f257ade7-0e20-4ecd-ab46-45d6b47f0f37", "value": "SecuriteInfo.com.Trojan.Packed.140.24880.7360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e785638-0754-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630081841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081841, "uuid": "f3d7c9f6-3eee-4e7e-8a5d-94f37000f3a8", "comment": "Malware payload (Vjw0rm)", "value": "d9cf0592d6515534cb8efa5b63cfae5b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081841, "uuid": "0c0c72a7-4fed-4fdf-ac70-2e52534c59ce", "comment": "Malware payload (Vjw0rm)", "value": "ecb06a64c672927554eeb66d6b0552a147e35eb85a30dadf28d4a2f92d8cb45d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081841, "uuid": "f95fbc5a-9e58-4245-9070-8a56222126ee", "comment": "Malware payload (Vjw0rm)", "value": "93764956ad2a38d3f70dde3ac0410b367bb8a92b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630081841, "uuid": "ac798a72-7041-4ba0-9659-c78fb99667f4", "comment": "Malware payload (Vjw0rm)", "value": "b491797cee40e080aff040a78bf327dac436d9505b921c4fcf0a33e3c113b78154a56a86f79bf9b216542c56f518ec4d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081841, "uuid": "50913d3c-6f65-4df0-9ad9-9163dcf6138b", "value": "T1F242BFA7D394BCBACEA5D35F033D2CA7154BDBE15067C8240095D060689478D8F4751C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081841, "uuid": "1ddaef3d-2999-4f74-ae52-0fc3a6c0f62a", "value": "384:ejR9K9E0ugyt6yOPjHe0hcSI0A4KbL5j0YVX6gKUhs1:ejR9K9E0lS6tr7ySIxD0sXzdhs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630081841, "uuid": "be266c30-899c-4ca4-a7c7-19b01d1ce5a0", "value": 12728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630081841, "uuid": "e09c6df8-935d-4851-a5a4-be7a50b9dfe1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630081841, "uuid": "ae3343ba-dfca-40e6-9def-f771a14b4456", "value": "#W0091.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9180c7-06fd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630044819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044819, "uuid": "3d4a8fd8-dc88-4117-85be-4e44298c5fac", "comment": "Malware payload (AsyncRAT)", "value": "eb847438f988c2a2d52bcf0f0b439980", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044819, "uuid": "2a2a341d-df64-4886-8639-2c336162765f", "comment": "Malware payload (AsyncRAT)", "value": "ecfaef9e7fc7c83be8beedfcbef268c3d5a91a904ed211fa553c9e9b6aaa9c42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044819, "uuid": "9ba5497f-6543-4d7b-9a96-a1984804c8e8", "comment": "Malware payload (AsyncRAT)", "value": "4290e8776f135b3f768f0ef219a41f40d58f96e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630044819, "uuid": "370d971d-102d-4923-914c-d3ed9c11ed12", "comment": "Malware payload (AsyncRAT)", "value": "ad2206ed1c194f2dbfa25c58530ea1b34e397cb94a3a5621431da51bdb58fcdc02616cdcd5ec055eaebe548f6f82bdb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044819, "uuid": "98bf7dd6-52fb-4366-bfce-2d246d4b16d4", "value": "T1CC235D403BD8C13AF2BD87B4ADF292058275D6276903C65D6CC825EA2B13BC596436FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044819, "uuid": "74ccbd07-bda5-4245-bc19-9310b4b7f77a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044819, "uuid": "0777b035-46fb-4e87-80e1-321c960f4c4e", "value": "768:D89DILA+Es+bii/ji5gnYbFSgesc9Z0vEgK/J3ZVc6KN:D8DUiVYb/LcL0nkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630044819, "uuid": "4e3a9c8a-9890-4974-81a4-2846ee936718", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630044819, "uuid": "1b97a876-c6f6-4990-bdd5-448cd8ac1bf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630044819, "uuid": "b1f8692f-97c1-481c-a6cb-698e7c2af12c", "value": "eb847438f988c2a2d52bcf0f0b439980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1a6280-073d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630072092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630072092, "uuid": "c345422e-6dbb-4472-b50b-10d15973e9fb", "comment": "Malware payload (NanoCore)", "value": "e65dae60752214a6a2dc9f742cb64cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630072092, "uuid": "efdd7416-053e-484a-90c8-db809a461369", "comment": "Malware payload (NanoCore)", "value": "eeaf549c52e04bffd4520996b1b10fc166411eb0636226360df05c20433846a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630072092, "uuid": "b1c5cfa5-78d7-43bb-ab93-41aef18d16c2", "comment": "Malware payload (NanoCore)", "value": "3ad66ad7b4317b72d89985b18d2355a79c9012ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630072092, "uuid": "f9569d69-6b7b-4412-b16f-9050af5ec94b", "comment": "Malware payload (NanoCore)", "value": "e64a32ff6183c9e52f097dc43cd187829e5a84c518f3a385cc1d170846a316604ce24f80e0ae5acdf9a17f3ea3230555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630072092, "uuid": "7bb562a9-37e7-4f61-8551-0846363e5b56", "value": "T17035B13D29BD2227C1B9C7B5CBE0D833F0549DAF3111AA6464D78B6A5356E8235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630072092, "uuid": "8acc1e51-a323-4fe0-b704-82c5393652ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630072092, "uuid": "70b16f2d-2306-4207-8e54-8261e2c13ed8", "value": "24576:XBgbRZOHAaJ9KwMYhJJP/RW59pDw2lfg:RgbsrB/RW59tJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630072092, "uuid": "c3bfea4d-fca0-4316-bea4-49ac6374b3ac", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630072092, "uuid": "fb3b354d-0ca6-466a-a755-5c5ccb9741f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630072092, "uuid": "b32c5430-46b2-48ec-aece-928c7be85537", "value": "Project Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1fe35c-0710-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630052602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052602, "uuid": "262dad18-0704-4ff0-ba2f-b2771a0a9d6e", "comment": "Malware payload (Smoke Loader)", "value": "b7e27567f201a840d0f9c12cf0a2d734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052602, "uuid": "ad25571c-f5da-4f4f-bc19-2499ccca9315", "comment": "Malware payload (Smoke Loader)", "value": "eedbfa19e0dea5bf1cb8ddd108ecc4ddc8a67481fafa759e588da3125228992e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052602, "uuid": "5cd06f67-44b5-4c70-8995-615ceac64e40", "comment": "Malware payload (Smoke Loader)", "value": "1bc2fd9116bffab627b0ea37ff0bb7c49726b9a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052602, "uuid": "2aa57374-dcbd-4816-88f9-09183e2ff84f", "comment": "Malware payload (Smoke Loader)", "value": "821d0a473fa32bbf33f0bc7f49d48b34650391db61cf4d6090ce0b62a0c1b764ba7a24d00f1f03b796883063e31239cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052602, "uuid": "c4474e8a-46b4-4321-b82b-05dd6f233708", "value": "T10F448C30AB90C035F5F711F85ABA83B8A92D7AB1673090CF53D526EA46346E5EC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052602, "uuid": "e3a1ded6-d192-4a1b-94e7-c0b9dcaee170", "value": "3b142de1de00907afa014d92f674693b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052602, "uuid": "5e69d790-b5c8-4f5f-9cb2-cf404571b4f1", "value": "6144:MuT4E4r0VSSzM/pGewA8JSc1G3PKArAdld/6Vl/J5FA:H4rESSzMvwAiSWmPYP16Vl/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052602, "uuid": "3f4e912f-4376-4c84-8490-65f12c5d0e4c", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052602, "uuid": "3de4209e-5a58-4d06-ad62-69df09309246", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052602, "uuid": "3e7129e7-37b6-4d60-9eed-55e860a6316b", "value": "b7e27567f201a840d0f9c12cf0a2d734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee66ea1a-0770-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630094215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094215, "uuid": "b15419fe-5e17-4af1-a749-7c3b57c2fcd2", "comment": "Malware payload (Mirai)", "value": "43254c90c9ffbc3afd3793bd569f28ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094215, "uuid": "465405fe-5440-4fee-bc76-01b5cd525768", "comment": "Malware payload (Mirai)", "value": "efae10209ea52e930c8a9b5d967326f909c8f16c3c42b5cbb783bd37bcac2c0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094215, "uuid": "777ee7af-d5dd-4a9c-9112-7ca7c3265e0d", "comment": "Malware payload (Mirai)", "value": "8df9c11753d18c22aa0ec45f06e1f755b4ff4923", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630094215, "uuid": "d3297379-6542-4834-bf24-2513fb60fe7a", "comment": "Malware payload (Mirai)", "value": "7ff5d890a0db9f5d300ec9fc39131fbe278eee1468e0391c13118ec33fcd37dec1aa276ca0d6f76f7eb93ac6edcdba31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094215, "uuid": "9b316aef-02ee-4ebd-ae55-aac8ee5ab4a8", "value": "T1A5B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094215, "uuid": "e49189f1-4e78-49da-9f09-28e35bc7698c", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZSoamm/QcuLB1niDNb:YuFX0GIk1MHyphHamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630094215, "uuid": "05941d31-1f01-4740-b32b-16617bef41d8", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630094215, "uuid": "637a8197-d05d-41e4-bf1a-e3ad79d008a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630094215, "uuid": "013f09cf-5c79-419c-b72b-7b1ffc7e687d", "value": "43254c90c9ffbc3afd3793bd569f28ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f65c96-070a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630050287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050287, "uuid": "7fc29200-e689-4db9-b3b6-1b40645c0c51", "comment": "Malware payload (RemcosRAT)", "value": "1a1fcdd8d3bc67b2513d2bec6ada5b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050287, "uuid": "b2b24e77-b7fe-4787-be17-3b9e1a5debf0", "comment": "Malware payload (RemcosRAT)", "value": "efb8a01422e4878a75c28f13b9607184285834d20e5301c870b373db744d7c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050287, "uuid": "d3b34868-5c57-4763-a9b4-9ddc9f848136", "comment": "Malware payload (RemcosRAT)", "value": "c83c19fb58b79f7297c138a9a4af00923c5940a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050287, "uuid": "faaa65ed-f5c0-4d2f-a75a-e742ac19cbca", "comment": "Malware payload (RemcosRAT)", "value": "a70d507dfe79295740763fc3f90c8013c9823967f33f23a19f979bcfe090a4f1bfc2bec097e191f7620b2c30d0d324a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050287, "uuid": "3e74a03a-1c01-4946-a2c5-eb410a55d395", "value": "T14FE44BB675500D3DD52B1F7AED8FBA684525BD013C10FE8BAED43D4A16BC2A4321A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050287, "uuid": "c1ee2d58-5b58-45ff-b3df-921ba45d587d", "value": "7f96272d7334ea5c5b0f297a4213e926", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050287, "uuid": "ecc6676d-6dff-4fc2-96b7-a651a96ef8a3", "value": "12288:R+i5kuKF/CFs3c7WaNipAfofysLefr8jdv:cEKF/P3c7rMAfo6s6frg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050287, "uuid": "4cd34709-c45b-42ae-b965-4a8bb3bd1fa6", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050287, "uuid": "4d70d94b-e251-464e-8084-9272997e2a90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050287, "uuid": "7a98c5b1-00cf-459d-a395-0b1538d73569", "value": "AD Order Confirmation-7645,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17413499-06f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630040167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040167, "uuid": "0b8c8f64-284c-4338-9895-2e28388413d3", "comment": "Malware payload (SnakeKeylogger)", "value": "79848070748b41bd7da88b85e6a2d377", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040167, "uuid": "f39ca257-f332-409a-a242-e75e3fee8c74", "comment": "Malware payload (SnakeKeylogger)", "value": "f04fcc5e3bacf644a1063cf8186101612ee96c7070f533ebac408b754f2b9ac8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040167, "uuid": "25fc37ef-3375-418e-bc3a-71794ffe168a", "comment": "Malware payload (SnakeKeylogger)", "value": "f0d5e231a978c359365258a42d0c76c762fd5034", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630040167, "uuid": "7ed7db5d-420c-4a9b-b1f0-5c8de2b3cd64", "comment": "Malware payload (SnakeKeylogger)", "value": "4f1d5730b013d6836dea009e572016a78bf8b422d4ec01af1648fe71c327a13660e900e21e465d39f9f7205901cc66ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040167, "uuid": "dff1059a-b1dd-4e44-bdfb-ce56af26b62a", "value": "T16FB2A1BCD1A742998F426BB8272BAF41009DB61DF3D9A63275789B3967D2C36441383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040167, "uuid": "7d221895-868c-4c24-9d0d-afab7578923a", "value": "192:Z5Ll4I/MXAa86MjS+hIHELY+GjTbLp9yWuJEvEXccYghxv57OVgtJAc1Eokh:75OAaXOSYIHjjTzE6qZZ57OVgtJAc1Oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630040167, "uuid": "feb300eb-504e-4ced-b7a7-cdf5517dcb5b", "value": 24567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630040167, "uuid": "c483639e-9e47-4262-82db-66eb6010b8f2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630040167, "uuid": "132d6b18-b55c-49c4-ae4a-aaf9cc08db2b", "value": "HSBC Slip1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a688bb-070b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630050625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050625, "uuid": "b38bbe3a-78f0-4763-b995-db3de4118b11", "comment": "Malware payload (Loki)", "value": "e884ff7cf6d4d5f68a6c73f71874c31e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050625, "uuid": "83fc02ba-7faf-4f5b-8005-2b21be349719", "comment": "Malware payload (Loki)", "value": "f08c0dfbc93cae4d8306af7e7d0eb56eb01ca5ac86a3c9a0eeb216d76a77ce47", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050625, "uuid": "faaafa9a-3f0d-49fb-8b92-97185e57db6b", "comment": "Malware payload (Loki)", "value": "08fc8137451cb9b53eec149f306f1b30bd167c8a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630050625, "uuid": "304d1748-9392-4fe0-8717-182a56521d47", "comment": "Malware payload (Loki)", "value": "068c726e31fa482531aaf21fe5e3e97560143e27672f8f4d6d08c3efe3e31282e589c7c8cb7f5a9835f41d1ef1db85ae", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050625, "uuid": "1d9bdbfe-402c-4556-9e38-3dc0d675f875", "value": "T198D4F161BA6A6DF8D04FDEB1142A25C83C2AFDCC85975D31A063335AEA7631C00977F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050625, "uuid": "5827ccbd-20a2-4545-a0d5-8b8f752a836d", "value": "12288:D72QvaRY5zhFQuqeBivOqul4dM5RmF6la9jTgIilgRQ7LSa:DT4Y5XXqet4dM5gFGa9jTgX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630050625, "uuid": "deab7db7-e85c-4d1d-8bc3-fb485ba5c663", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630050625, "uuid": "01907e21-bde6-464f-8769-30c3a2072b5a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630050625, "uuid": "c7a9b3db-c168-4721-bfb6-04099bf9742e", "value": "SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227ebfb4-06d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630028160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630028160, "uuid": "c655c741-ea2e-40e9-8867-e9e3cac5649b", "comment": "Malware payload (njrat)", "value": "9c6621bb00d8206ec5db7f4c0698d1cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630028160, "uuid": "4fdc4241-02a0-4cbe-8d73-5415dbe9bbe1", "comment": "Malware payload (njrat)", "value": "f0e5caae10e080bb08a9304beb019ad21d1abc6ed1ddc052804f42e033f0389c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630028160, "uuid": "d2ea8bdf-44b2-4095-a565-995db5093524", "comment": "Malware payload (njrat)", "value": "d6186fb237f243e637832e3a830e38e8c91f1950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630028160, "uuid": "5a16e277-bd95-4cb8-bb04-214f2dd7433d", "comment": "Malware payload (njrat)", "value": "751b05c61eb896572c298f5efc944f511afd6c42fc733c3d676741250ca2be3469bf1d9a2e1d2594579ebdd733b0e9d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630028160, "uuid": "3452e3a7-269e-42e0-94a6-2dc0892c17a3", "value": "T1C136E01316086F11E67C8335641B9A6C5BF6BE15E381DA4FB99D5CCB7FB4B820A0F01A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630028160, "uuid": "1f68ab10-3e57-46bc-8e42-baf5402daf47", "value": "cd74c16e19de02339ba1d593de4c426e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630028160, "uuid": "0eb2aa00-1844-4dc9-8a2b-a65e04077eec", "value": "98304:qbuUno8Eg2VvzXfN/HvqOVJONv3iTEkfelAbKW81HkGtaONPjA8lEf5ygHXGLoJB:qbuUno8EgKzXdiEiKRfelAbp81HkGtaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630028160, "uuid": "15111484-f2a3-4d5e-842d-a2a0d55b72fd", "value": 5342308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630028160, "uuid": "973a9c31-f164-4f65-b193-aef1d0f71fdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630028160, "uuid": "245d1355-8b8d-49f3-bcaa-4207a8f458fa", "value": "9C6621BB00D8206EC5DB7F4C0698D1CF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c98429c-0745-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630075368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075368, "uuid": "ea57a69b-4157-40f9-b8ed-0c4f392282f5", "comment": "Malware payload (AgentTesla)", "value": "f98699b14920260d75462a9839615eee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075368, "uuid": "0abbac3f-9cdf-43c1-8163-9b1456e88945", "comment": "Malware payload (AgentTesla)", "value": "f1a4a20953699eae11ba3258b1101a7b0e150be165ef0d0a157620a17ba924bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075368, "uuid": "775a3904-bb1c-45be-b550-ac02279e6ac0", "comment": "Malware payload (AgentTesla)", "value": "4e4e2fd4ecf6d07f775f0bab453d13301f8a29ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075368, "uuid": "7fbcd84b-48cb-45f6-b279-14acabddaac5", "comment": "Malware payload (AgentTesla)", "value": "6665b06a53448fe6fcee0a9c8a04a3dd798f17e2b3e0b6161e774046a58ca7ec908af8e1c9ecead47bebb961168bde61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075368, "uuid": "ec905947-e10f-42e7-8d23-891f75ad269c", "value": "T14E5512309DEB6B09E1EA82742A36516511EA4D0FFF2886727B0A223B10753F4D4FF657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075368, "uuid": "b92b2026-b94f-46ad-8015-28b43e6ade58", "value": "24576:hWQaVakwsrdGydXVfi12J8nCUwSq8N4oFnAsayLMPPQZZdsCBrItG:EQa2srdbdlf/SoSRFnLMPPQ+SrI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630075368, "uuid": "dfa906f8-c030-4740-977d-2e78bc981aff", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630075368, "uuid": "dcc02d0c-1a6d-4b98-9808-ef579621f427", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075368, "uuid": "53468035-2d83-4560-a114-ad62de7f8247", "value": "PO KIPO000903 ( KIND122822 ).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820e06fc-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630075995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075995, "uuid": "429f498b-6513-45c4-bc28-492dc9baea8f", "comment": "Malware payload (AgentTesla)", "value": "d0901ee7c46a1ea975288494b66e3c50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075995, "uuid": "5ddb6be3-3f48-44fa-8f54-0c703a3f4925", "comment": "Malware payload (AgentTesla)", "value": "f4477e23618e060b77747de0b2990b114bd476f24dad9707849d0127a6a46963", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075995, "uuid": "7b8f5d71-4e26-47d5-8331-780af54c219a", "comment": "Malware payload (AgentTesla)", "value": "517057482881a971adbb3d6c60238556defdbdad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630075995, "uuid": "1e5b7e22-72e5-4fb7-b4ac-0db9bd9787d9", "comment": "Malware payload (AgentTesla)", "value": "7af3a527f08d6bc9a87eaa89be5a67c1ca59bb7a3e3d9a1fca67d5fc33333f27ae359bad0a2eae87a8cc093b5f6556dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075995, "uuid": "02650255-25ca-422c-971d-9447b948bf4f", "value": "T14B156D3D29BD222BD1B9C7B5CBE0D833F0549DAF3111AA6464D78B6A5352E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075995, "uuid": "d514a646-6e5b-423a-8d78-6634442c6b10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075995, "uuid": "eec04652-9355-4d8f-b92f-202d85c7480a", "value": "12288:Sr9v3999NWm+W4euA2pQan2FxSlRE25UUypvC1Z3sKuqEjFiD:sv3H9Nujok9n6SHEo/yZC1ZXfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630075995, "uuid": "532000b5-6c7e-4cda-a6d2-17fe1ac514af", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630075995, "uuid": "079b02e4-b94b-4766-8d78-f513101f6013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630075995, "uuid": "2fe185c8-b12f-47d1-8415-acf239181f2b", "value": "d0901ee7c46a1ea975288494b66e3c50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68990cc5-0726-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630062208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630062208, "uuid": "5ed281bd-ce20-43e7-b64b-5483e3cc69f0", "comment": "Malware payload", "value": "af935ea48e33924f8d68a22a96ac811c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630062208, "uuid": "85a2aaf8-fb18-48fd-b7ea-7b6df9928c0b", "comment": "Malware payload", "value": "f4914c162f5064fcfe9012ffa8a93972a1cd268bcaee0a7d2346b8757f553d2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630062208, "uuid": "3373d997-484b-4c9e-ac62-96ca116352c2", "comment": "Malware payload", "value": "c0bf9094820c3fa33529ce90933018361c11aa37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630062208, "uuid": "04bc433e-8b29-4c7c-90b6-4eaa06b7c093", "comment": "Malware payload", "value": "ad8248583f96563bb55514cb9ee32c839b07d41fcc3127b98374b20429dfa3e397672598697e0f75fa0c0edfe40cec02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630062208, "uuid": "e0a704c8-0300-40e5-9e7c-0ee0d2837797", "value": "T1A3155B42E39FC284D362D173BA5EA7927EBB7C244A3C75FB2E54083866D0621531DDA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630062208, "uuid": "16900d6e-1eb0-4f94-9438-b3b1a681de46", "value": "12288:P1auaKKCWWWqG/iOG/IukoySsOkCZYYHSO69ciGIt7fWd:P1auaKT/eZSTYzzKipc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630062208, "uuid": "93055fcb-8251-4c31-a57e-5909fb1be25a", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630062208, "uuid": "0ba2188f-444c-4e83-baf4-bfcf7b770fab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630062208, "uuid": "887c10b9-501d-4519-bef3-078e6cf8a34f", "value": "SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.15603.30702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069038ca-070f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630052165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052165, "uuid": "64c9dddf-c22d-4c46-80d0-0db4104194bf", "comment": "Malware payload (Loki)", "value": "7f99e713dd46e95521c9dbaf26677e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052165, "uuid": "ab6595cc-b685-4bd5-91ab-e4b5ba4fa18d", "comment": "Malware payload (Loki)", "value": "f5a4d6669dc361190f84a2b689dc58e2d775b8d2215f5d4d5be2fe14c7a7cb51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052165, "uuid": "d42435ef-3942-4cfc-a0bd-9646db6964a0", "comment": "Malware payload (Loki)", "value": "9e6d774f9dc68cc4bec21e584b914b5935623004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630052165, "uuid": "1daeb358-992b-4bfd-ab4b-98ddcacb5f6f", "comment": "Malware payload (Loki)", "value": "710cf50f3ed1b80df77ae51209c43d51c02588e1ba4b648b05e76a796abb1c3bb6c2a32641de674fec5b96da63e0c89f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052165, "uuid": "c9c0f408-44aa-44f5-9f2a-e142c386b59e", "value": "T1D115913C98FD2927C066CA76CBF4D827B004D9AF3226ADA555D757264353B8330D3A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052165, "uuid": "3d5b32ac-6338-4a57-a152-5cce6e4ac850", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052165, "uuid": "dcb098e1-c2d1-4746-a4df-4ceeb0657eae", "value": "12288:S+hWuU+0d052ukNh83nQqy5QHhO5ETCP1X:S/r+A0Eu68XQqyBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630052165, "uuid": "2b97c170-b23a-400e-a855-b9641ffa6a19", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630052165, "uuid": "6f76d4b0-6f4d-4ee1-8b2d-017cef266c35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630052165, "uuid": "93715814-9051-4f34-8b3d-d798f2a2f562", "value": "PO 210821-31A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56c4917-0711-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630053291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053291, "uuid": "ec4a9bc3-8c10-45db-864c-8e65aed1819a", "comment": "Malware payload (AgentTesla)", "value": "b4a68e8bf413c273b4edfdb502bbc6ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053291, "uuid": "14d75039-bd74-4025-b6c7-720ec14be793", "comment": "Malware payload (AgentTesla)", "value": "f5a79a4d8bd9b5f06090f96413c5976236eb12bb8a1086e215898c86c4dcb417", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053291, "uuid": "337aa16e-b228-43d2-9d2f-e362f605e4af", "comment": "Malware payload (AgentTesla)", "value": "d2ae62e472ecb2bb770f17cd910adc17cfa86742", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630053291, "uuid": "edb2998d-3ad7-4be8-b5f6-eb7583a36665", "comment": "Malware payload (AgentTesla)", "value": "2ff554b2cd0354f22b13d8c5b921ef3c12e5b8521a764385bb5c70b11e8d06cff60b85dc09e6f12c851fde56c3a37c10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053291, "uuid": "aaf1ba83-f0b2-4450-a5cd-61d79ebd2927", "value": "T13E55063C29BD222BD1B9C7B9CBE59827F05499AF3110AD6458D357AA4B13E4235C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053291, "uuid": "15c5eded-5866-49f9-a806-6a4bc09cc9cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053291, "uuid": "821a6624-b9dc-4abd-8aaf-f38bfc2276bc", "value": "24576:LhRKWIura8EhMYW55GpbWZFBjvLdWV/Nm/y12Nhmw:LhbIwafMtgpbMFh/yY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630053291, "uuid": "401470b9-a9a6-414b-94f5-6e30ff44ffd4", "value": 1291264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630053291, "uuid": "a269e9bc-d4d2-4399-8d45-731e01a913df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630053291, "uuid": "968c4eb2-eb87-4864-9515-3b9aaa02a536", "value": "b4a68e8bf413c273b4edfdb502bbc6ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f484145f-073c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630071892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630071892, "uuid": "7eae8638-bf87-4084-b987-a61c5dc19809", "comment": "Malware payload (Loki)", "value": "109cb0f053f97e77077abcd078d19951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630071892, "uuid": "e8a6318b-caec-4232-9f1f-ee5a612761ee", "comment": "Malware payload (Loki)", "value": "f6c80fd45ffb6d6410584e354b55caf6ae7657436db901384732bf9987058110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630071892, "uuid": "9d09849b-e17d-40d3-8095-507ca599ae9c", "comment": "Malware payload (Loki)", "value": "9ab48f500abdd7c84e1d946704ec8a81680feecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630071892, "uuid": "cebdddbb-845f-4489-81c7-e94adc75fe44", "comment": "Malware payload (Loki)", "value": "b33c2302999abd0aa08ee7f26f7ea22e101a90355a61db375e3a0c2209242752eb29b901c2e143fd28671d62e50da575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630071892, "uuid": "c947027c-2079-48e1-a8d0-a114bf220d5d", "value": "T128F42B3C29BD262BD1B9C7B5CBE0D837F0549DAF3111AA6464D78B6A5342E4235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630071892, "uuid": "abf544e6-4760-4344-bc7e-ba3c138da385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630071892, "uuid": "ae5d1b83-5588-41eb-949e-268c4db0097d", "value": "6144:H4ItNXxiZc96phR4GzkonLWhTFWcGWtBQwtQ1l+pEgHCArS4YtHs+eGSR:H1NhEc4phaon+R3dk/1O7HNSnNDSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630071892, "uuid": "33232b1e-6d29-419d-ab8a-b42def5f081d", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630071892, "uuid": "887b293e-ebf5-4027-96df-8b6bdc24cde6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630071892, "uuid": "e58d5af6-fedb-4420-b157-a77515e8f5d2", "value": "gOERcdn70k2VuKM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac9b022-0746-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630076036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076036, "uuid": "785d6106-08a4-48a0-84ce-11e25dd5b462", "comment": "Malware payload (RedLineStealer)", "value": "766a2475ae22dae5b40e9d641e61a9d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076036, "uuid": "16c2cb6d-2177-4383-a5c1-10523e4fdc02", "comment": "Malware payload (RedLineStealer)", "value": "f925e19d4597fbb4242a12d6957632d45838a3cc643473a19793ed614c5c2f07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076036, "uuid": "96972c4f-4547-4aa8-8815-b5f98ea5fef3", "comment": "Malware payload (RedLineStealer)", "value": "cc0451967619369c8666ffcb9843bdab75c3f624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076036, "uuid": "5af31dc9-4202-400b-a739-12d2f6d7d89c", "comment": "Malware payload (RedLineStealer)", "value": "416b8f0f197a82a0a6b3307f664d8edfa6a9f72e024ff613cce2b4959efbd6c2800b9e8523b780a4014376d7e6d1380a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076036, "uuid": "3085e697-76f9-42a8-8dd6-0c97ef80f446", "value": "T11BC533D81F7E7A43E1C0F376D4A0EA5DBB36C36BD4347862DBC266414143A25B32B4A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076036, "uuid": "0f82c1e4-a13c-44b4-931d-7bdab7752d24", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076036, "uuid": "c0f480a6-4ddf-4097-a4e1-bbfdff273bb0", "value": "49152:8ebStKzJSVduGEA85ieOHm5zHDoTf14dbRzbW9sFwZyTWcXFVku6zI:8ebLEVwljieOmNdbRzgyCwFqu68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076036, "uuid": "293bc356-9714-4a66-b74e-4a23decc7567", "value": 2573995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076036, "uuid": "a2749e18-0805-4aa0-b5fc-df4a04bfa50a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076036, "uuid": "09357fb6-5897-4d69-bc2a-a56dc22c1ccb", "value": "766a2475ae22dae5b40e9d641e61a9d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e3ae8e-06fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1630045042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045042, "uuid": "f8ac90b8-f507-4dab-a281-d5b18fc206a2", "comment": "Malware payload (Gozi)", "value": "e579f0ef08f2efa63c8c9fc887a33506", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045042, "uuid": "3e6bd09e-b0a7-4898-88e5-8c57790c6793", "comment": "Malware payload (Gozi)", "value": "f9da6de639fe892c2316a6612b91123a5eb8785f6f5b4022805b14bccd75322b", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045042, "uuid": "9131b935-0f7d-462e-bc17-d2e0f295d0da", "comment": "Malware payload (Gozi)", "value": "f22a5ee70d58c3b5a74bd528a31ece2003f822ef", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630045042, "uuid": "3abce28e-79a3-4415-b200-7671a9cbdbbd", "comment": "Malware payload (Gozi)", "value": "03ede9de44ceac79c8ddc028eb10576dd4ba3bba866c1818af73b138e455b8a6a3eb804bafc7942c53e61a2636fdd1ce", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045042, "uuid": "12929f87-005e-4adc-9b03-6e1da675d999", "value": "T10AA50E3F8A846394746D8F87391CA98F584F0E8A55FC2E8C2DF5DC20B4AD25D65EB243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045042, "uuid": "3e79d532-3881-4aa8-b50c-62ae5741df71", "value": "49152:+2c+//NW40/w02I0B7RKT/XxziJaFahwGSUqQ+5jS3Rw4hkY937wluFlyljzYO6W:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630045042, "uuid": "7553d8f1-3de6-4bb5-9233-e18effa6e932", "value": 2209711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630045042, "uuid": "7d55e431-b7b6-427d-a3cb-6bc8274f089b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630045042, "uuid": "8f03eb89-b495-45c6-8160-2c0470ca25e0", "value": "ursnif.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce01a1a9-074b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630078270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078270, "uuid": "d29c8db1-e245-4e29-aa8c-7fb8e90847a8", "comment": "Malware payload (Gafgyt)", "value": "d72531cccf317146ad136ef2f216f76e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078270, "uuid": "ba2c3f08-90fd-491a-90aa-eb5c448d462c", "comment": "Malware payload (Gafgyt)", "value": "fb04c07341ea5cde26d7e771de48799807341a25f4d704c7869387e012534013", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078270, "uuid": "5bfcccd7-6a1b-45ca-af8f-51884c90d489", "comment": "Malware payload (Gafgyt)", "value": "1410bcfe92900a058689c0633ca2fb9389aaf339", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630078270, "uuid": "cb479060-9f9e-4e83-bf06-b0540d3b6311", "comment": "Malware payload (Gafgyt)", "value": "9db14b4985ff45935c2b037a8412545714892a9b1e5f609fe97651f528409706f473ccfb4cf3bb51ae32452e341f70fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078270, "uuid": "5a7f4bd2-bb56-4892-a2d9-29f690731266", "value": "T12EB34B8A7740C1B3D44306B222979F160532F6FF1A5BDA8AE77D2CB4DE15185B222F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078270, "uuid": "b1c9ccdd-df18-4655-8502-d3420b6a4b3a", "value": "3072:IL4QeKUHUrUdwx53y4GvBpOybZ6/0ov5h0kgsIRmKPVdbrmG/rl88:gGI6wLGTZov5h0kgLRmKPVdbrV/rl88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630078270, "uuid": "c4c290c2-84bd-4286-9745-30fe8b3e8af8", "value": 114289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630078270, "uuid": "803eb2b1-d794-41fe-95bb-5a5255fd7033", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630078270, "uuid": "0fd201c3-f51f-4e87-aaa9-0e92d02b67e2", "value": "d72531cccf317146ad136ef2f216f76e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c15945-0747-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630076615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076615, "uuid": "157fe910-809c-4582-8259-8a253c2292fd", "comment": "Malware payload (RedLineStealer)", "value": "9d1f377189e3c6a5cd8c73e45276dcd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076615, "uuid": "ee32edf9-914f-41a5-be66-9e5f370b2fe6", "comment": "Malware payload (RedLineStealer)", "value": "fc74a606002bec67a486927a5418d679db586e5d7313e1a21e1837d7d353fcf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076615, "uuid": "95561e0e-6fdf-4cf0-8ffd-5ee588eef6fb", "comment": "Malware payload (RedLineStealer)", "value": "9fcd0088d414e33f9f985b3d8a57fb71d5e06b8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630076615, "uuid": "f8cfe68c-66c9-4c43-b2fd-7a8f96454374", "comment": "Malware payload (RedLineStealer)", "value": "0d42e304a74105cdadd769e76d479036b132f82e333ed4f5e93815e4e3ed2172c3e8c11be393253f355900d4f0529a21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076615, "uuid": "5a36259b-2bd4-4fe2-a624-b48a3f1f6487", "value": "T182D4F130AB90C035F1B715F8597683BCA9297A71AB3491CF53E41AED1A306E9ED30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076615, "uuid": "7a7969a9-ab45-427c-ac8e-7c1dee684e12", "value": "a3712f5292e4f38ef3a6c28b5ac50fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076615, "uuid": "40723739-1951-4f57-a28f-1adf22b3ed48", "value": "12288:VtR7o7/wwvwzpdp1ZSexHIHNKhCXCRhWko+OL5oL5xVO23:B0/tGksHIteCiUk/OLKL5bO23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630076615, "uuid": "5f268052-d666-4b29-a37a-057590142b89", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630076615, "uuid": "6067830d-a664-4331-8a47-27eb4815181a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630076615, "uuid": "8a2f0666-921a-4ef6-9a36-9ae25f3510a9", "value": "9d1f377189e3c6a5cd8c73e45276dcd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b5d1c7-0703-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630047007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047007, "uuid": "6dbfb279-358d-4e26-9a6c-fcfb1cfd5b55", "comment": "Malware payload (Mirai)", "value": "40a6c38b672b916325239cb07d7d3c7c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047007, "uuid": "b50d44d8-db34-401b-ab31-3a827d069943", "comment": "Malware payload (Mirai)", "value": "fd9f0c59919e9672c589ce8150b9611cdd720ce29880c1fc2ac6db9430cb1c90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047007, "uuid": "02ed840c-2446-459f-9564-da83127eefd5", "comment": "Malware payload (Mirai)", "value": "c5c173eb97ba0c5d43c40696f849e98c73ccdbd5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630047007, "uuid": "d6b165a3-3c7b-4ab7-a2c5-6b0811b8102d", "comment": "Malware payload (Mirai)", "value": "22de35e3f0b8dcfc490fd8015a44827628a4bcaa9cc66ca5da55bb79a028b04472cd4119e2b320878426a7a809e415c7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047007, "uuid": "603b876c-a4f7-49ba-9e6e-46d39ccfb649", "value": "T15E433B59BC929B02C5C151B7FF1F4289772A43A8E2FB33039E256F20378796A0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047007, "uuid": "3182e508-1762-4e4b-a950-b19d830e8399", "value": "1536:nrS6jlb1FNUCkXRkPOO8N5PdE3xKvGTJ:pFNykq5muG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630047007, "uuid": "0152738e-bb3a-451d-ac42-ba1d3fbdee44", "value": 58696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630047007, "uuid": "97741ae3-ffd2-4ac7-8ca5-f12a18235aff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630047007, "uuid": "359442a4-c93f-4699-88be-79914c87f6aa", "value": "peach.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }