{ "Event": { "published": true, "date": "2021-06-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-30", "timestamp": 1625097782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ea74e065-ece8-49f9-abe3-6a58912e27cb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f634c96b-d9cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625077277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077277, "uuid": "a19bb2a9-4b20-42a7-9d92-587748c96b5d", "comment": "Malware payload", "value": "f72c2ec4d30ac2255660c50ad4f3cb5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077277, "uuid": "b7482d91-9fb7-4666-8e5e-e2eb2f812f89", "comment": "Malware payload", "value": "005cdcb32ac1705413e9dd2049e791a6eb2fb22274ce4fece226f9010b6cff02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077277, "uuid": "8304bd3a-f232-4297-985e-93cfffbf237c", "comment": "Malware payload", "value": "2939b3b0e1e1c045aae7df308f667eaa02091711", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077277, "uuid": "3fbf8635-4fb9-4752-8119-c8aa86f800e6", "comment": "Malware payload", "value": "5efc644e87a2c7478e9b007d96decbe2034cb224ee54015defd5e1e3842cb29b93ba2ef8eaab7627b980ad3f8bc154a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077277, "uuid": "077ed1ae-1ad6-49c5-8e9a-c81b1014584e", "value": "A5B4011638E3ECB1DED7837307D1EA4A559FE8A10A21AB7B27A4338DE8711C45471A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077277, "uuid": "61b98d56-9c6f-4a3f-a71a-8a257e6b6aa0", "value": "c5061f564a0283b1f0fcad4d9984534d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077277, "uuid": "cde1932f-8d8c-4f41-93bd-0fcae281b071", "value": "12288:yyNiVYDIIYMfVL5Mhej1sMkNvdl+BcO2T6dVc:qSI9wp5MhepAVl+Sx+dC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625077277, "uuid": "a995e3ab-d853-4872-ae87-a5ed8ce0806b", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625077277, "uuid": "2663bb18-8cb6-4bc5-97cf-49bf4e75f830", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077277, "uuid": "bca06a69-d960-4f3c-918c-c1168693eb21", "value": "f72c2ec4d30ac2255660c50ad4f3cb5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a094a26-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018953, "uuid": "ffde2f86-f416-4bd1-b3cb-381366186fe8", "comment": "Malware payload (Mirai)", "value": "479818e07e3f8b2ea5f1dd48f8560c97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018953, "uuid": "1fed8063-d646-462e-bd42-50597695ade6", "comment": "Malware payload (Mirai)", "value": "00869e4ca1e3c0dbbf976e6d9a3d670491c2a3fc385f8dbf0547e9579ad81b8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018953, "uuid": "9a0d9bd6-ff68-4433-ba06-8dcb98d92af7", "comment": "Malware payload (Mirai)", "value": "d4bcb13c24ecf456188a3e408c9286a2036ab8b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018953, "uuid": "094df894-0225-4bb7-8e26-21158a730a50", "comment": "Malware payload (Mirai)", "value": "6f68499871c8f55aa9e7525dc6cbe29370aaaa42acd9a2c68fa18f650772c388427274d488029042d054dc043f178ca2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018953, "uuid": "d851cffd-31a4-4a4e-a5f1-0760bc2a6196", "value": "C6C34B46F7404F13C4D61776BAEF42453322EB91A3DB730699285FB43F8666B4E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018953, "uuid": "63ad6725-da89-4f88-be62-0f93ed80a841", "value": "3072:Km7w4PYRm9eWGb1QgSljPCn096LfCM/9j02mWXpAsV:Km7w4PEBWGb1QTlP6LKM/9o2mWXpAsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018953, "uuid": "c70aa7c6-86c1-496c-953e-66c585606f71", "value": 129396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018953, "uuid": "e0aad297-552f-4f54-beaf-7af6b09546e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018953, "uuid": "510a700a-0a8c-414c-9a3d-447bac71d3e2", "value": "479818e07e3f8b2ea5f1dd48f8560c97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f6bf16-d9de-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083310, "uuid": "eb496713-5d57-485a-b9c7-f9518d79a574", "comment": "Malware payload", "value": "0038301925ed068226aadb215ccde46c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083310, "uuid": "5396139b-0bb6-4784-85f6-1b5f7b5c0252", "comment": "Malware payload", "value": "01d95ccb2311edbb6725cd5b1c66fd5816ca686fdba6376dda7671232f73b684", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083310, "uuid": "6dcff4b6-fc26-4ded-bfe1-cf0d2a90934e", "comment": "Malware payload", "value": "9908793b91bdbc503d5c4e29acd922ea6052dad4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083310, "uuid": "a613c20e-342c-4c16-9ab5-097065e2cace", "comment": "Malware payload", "value": "c3b18436023f0958e84b122d9a2ba220ac13169ebc46f3fdc2deb0ae0aa92c75d0ef528bf0f9a1c5a17a11a57c0f13ec", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083310, "uuid": "9e02209c-5111-4d1f-a4e8-e73780577ff2", "value": "14241245D167E852EF8F5477BAF92AF11769482309484133A731342CE8EBC5FD2287BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083310, "uuid": "d6a16d43-f692-48f5-b858-0f33ffefc374", "value": "6144:fV7pA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56G8:d7u9l2pgxjt6XUyNW+Md563", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083310, "uuid": "fba0bdf5-177c-4a37-976b-ba82d69f5e50", "value": 217625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083310, "uuid": "373293cc-a5f5-4ab3-8fe1-cbf14f48810e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083310, "uuid": "9d0f0180-f475-48ab-9807-d6ea1ca60614", "value": "Order 7588173.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a049d8f-d9ac-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625062010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062010, "uuid": "dba1ea37-972d-40a4-ac4b-722356b9cb7e", "comment": "Malware payload (Mirai)", "value": "8af671777b02a5bff58a1be1fcf5a672", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062010, "uuid": "a6bdf61b-c97e-4ea6-bdcd-de553adfe00b", "comment": "Malware payload (Mirai)", "value": "020add9d86196ff5eeeb99c01645811e43b17014ea8b2c56d5c601999ed373fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062010, "uuid": "0868eb50-d492-4e8b-ae16-b3588f314dc9", "comment": "Malware payload (Mirai)", "value": "18fc9c906ce1cc27e6f5006731c2f25019787322", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062010, "uuid": "380ad66d-d490-441a-bf77-a18e9abbb607", "comment": "Malware payload (Mirai)", "value": "8af06e647ec7786ad158d410009b23371d2edb8969c6b73c76207922a7b3117a1d5f10229edb7ff467cf456d8355a63d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062010, "uuid": "78de220a-bf74-400a-aa2d-99e8d0bb2a77", "value": "D7A3BF21C528ADA8C0354574F5E08D355BB3B40952932EFBAA97C229D0979F8F06A7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062010, "uuid": "6bcceddc-5e74-4499-9a62-b62d3c4349c5", "value": "3072:Wm+ABNKC5RCtSv0SAvCe0/PdwEvu1xad:WQBNKC5R/00eMPd96xad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062010, "uuid": "d55b60af-8d7e-4671-89fa-aa0e485657e6", "value": 99712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062010, "uuid": "f4e279e4-9f27-4906-be7f-ba6982329392", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062010, "uuid": "5d6e397f-0007-472a-8a1c-4fab2182fa45", "value": "8af671777b02a5bff58a1be1fcf5a672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cacc38-d96e-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1625035614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035614, "uuid": "e055a074-2f6f-4d83-ab56-70b652267687", "comment": "Malware payload (Smoke Loader)", "value": "9f1daedea22a51085de9d6a0e5750c5b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035614, "uuid": "278631b3-bbde-4fe7-a6c9-b0583a3bfd4a", "comment": "Malware payload (Smoke Loader)", "value": "02382ceaa48910b77cd6566afb517a8511acaa4201e277007e2158e41e5bd9ed", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035614, "uuid": "94b08944-3c8d-4da8-a77b-c832a313fd43", "comment": "Malware payload (Smoke Loader)", "value": "9b87cc93f89fbb5a3a2b18659d274c0ae1ab5d98", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035614, "uuid": "e6004b19-12bf-4be6-9b93-28f23cd31b40", "comment": "Malware payload (Smoke Loader)", "value": "5a2fd274e0d73b236dfae8427b83e9fe2ed64ad16dce7eac267a0e48d6e8a50d1164e1268c121eee11f1fa94968a32c1", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035614, "uuid": "429a4b08-3fb9-4ac9-a930-b35e32df38bb", "value": "6A646C00BBA0C035E6F316F85A7993ADA53EBDE15F2490CB52D52AEE56306E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035614, "uuid": "86c87e88-cd9c-49cb-857a-9b7e9add2a4e", "value": "082e9d7628311472d52904fc98c0610d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035614, "uuid": "2ffe6986-1e19-4512-b8ef-27f167d1797e", "value": "6144:OH75r74YAXzzPk9RwThGOQ315NlvlEkXOCHK2mxJCEVmnt:ORgXU9RwFGD1lvlEeRKFxXVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625035614, "uuid": "e3bdc81b-3e63-419a-bbe5-b616a3dae196", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625035614, "uuid": "e668e45e-99ed-4267-aa8b-8c6cde5dad02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035614, "uuid": "bf306a24-fa40-4435-a3ef-1b4fdbf3181e", "value": "9f1daedea22a51085de9d6a0e5750c5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189980e6-d93c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013769, "uuid": "939411c1-5126-4b00-81b6-18883a2c6e84", "comment": "Malware payload (Gafgyt)", "value": "618c71b028816fcee6976f62610829ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013769, "uuid": "987c09f2-4a4f-42a6-a2c1-b58c0f03069a", "comment": "Malware payload (Gafgyt)", "value": "041db2cf6eac2a47ae4651751158838104e502ff33dcc7f5dd48472789870e6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013769, "uuid": "25346f0d-4a1f-4df4-8e46-b80e6b6c8370", "comment": "Malware payload (Gafgyt)", "value": "1f2538bf82f170470998d3ce1a7255395725edbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013769, "uuid": "60d0eace-f22d-4e08-be08-491a1b678733", "comment": "Malware payload (Gafgyt)", "value": "f38ef097adfb409c36a2a5db5e2a316e7dd2d8a39524f45bc1d5bc9f4237331afdb75b7d1b5d5525519f3eb767653bc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013769, "uuid": "0f7f3b27-1e2e-4371-b321-0ec79a503d96", "value": "A3D32996F800DFA2F40BEA7600DB0B21A630FFE50F435A6762573A679E761D53827E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013769, "uuid": "4182026a-0f68-44ba-97bd-c85e363aa32d", "value": "3072:/7qhxBMP3kdx+CElW0bozvyXQ2J32R37JmvL0CDYabQN88:/7qhxBI3Ix+CElayX9J32R37JmvL0CDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013769, "uuid": "c46d9e7a-7938-4abf-b690-1bfb78cff0f3", "value": 136928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013769, "uuid": "156ef3f9-4a07-4bea-81e4-a4d48fcfacb0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013769, "uuid": "5596e29c-ad55-4840-881b-ff715a6106be", "value": "618c71b028816fcee6976f62610829ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c40dd23-d94c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625020647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020647, "uuid": "fd601644-d833-478e-9b40-0b02805d6699", "comment": "Malware payload (Loki)", "value": "c1ad9625c60c49c71a540e73b82a1da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020647, "uuid": "472ca76d-2d80-4f9c-b9d6-d2f17deb7c4e", "comment": "Malware payload (Loki)", "value": "042745a4bcafbac658e73da50c2e281a3aaa9ecf81344e67b00d0c40e807621d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020647, "uuid": "f8e5bbda-0bd2-41ab-9c05-9707dab0669b", "comment": "Malware payload (Loki)", "value": "d2c3709fadd2f423b8b81bc5472df43efe51bf20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020647, "uuid": "513df97f-e4c8-4efb-83be-5b824c7e1526", "comment": "Malware payload (Loki)", "value": "e6ae9e138abfa40c76a6e16fbc9dea121732fe2526621968d7dd6edcc4d9e823c3557b68eb0780ba927dde6bdff0be25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020647, "uuid": "e0c86a47-2d47-4478-bc9d-bd4dcd7b424a", "value": "B4A4F1502106F82AE1AE91366493F0513275BF1115B1DEBA874B3B3D02763898AFFE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020647, "uuid": "9c19e5d8-bd06-4197-bbd9-d3b13a00a97f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020647, "uuid": "43a53bd9-0682-4b75-aa80-f546431addca", "value": "12288:A6EFVzMFq3cELKLlkFtDyG7vYPSRUnsHHJajp73y7:A/aq37K5W/7CiUkaV7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020647, "uuid": "f26d8ddf-16f1-45f9-9eaf-c798d40a0803", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020647, "uuid": "60903cb0-8a8f-464e-a7bb-ced675ec7c99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020647, "uuid": "03ce2d6d-a815-4241-839b-1746273f5f65", "value": "g0-core-ofr-gogreen-plus-infographic.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9953e440-d984-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625044909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625044909, "uuid": "0f55e1ed-862e-48be-b244-2ddbb5bcfb8d", "comment": "Malware payload", "value": "ece737e445645e8585e07a592d75cbc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625044909, "uuid": "a6cb8fb9-54d0-43e8-a9b8-6c595a256e96", "comment": "Malware payload", "value": "044b42b8f81ceff503fa504db9a10cc09dd22c456b5c79370a2165fe97bdcdc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625044909, "uuid": "d835b9e3-f86e-465b-b02e-b3df5b03a066", "comment": "Malware payload", "value": "bebae73f2f40491b8b7f3a39d3ef0c382aa994b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625044909, "uuid": "28ede3d7-ed63-4e68-b52e-3f4d6bb219ae", "comment": "Malware payload", "value": "69c1238bad37de64a8e9fc1e1c2d534e78c602d51b25c39d2a4eb6924f957f10df97a1aeb10d90490d291ef3efabe7f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625044909, "uuid": "ee60c3c6-935c-4134-8c5d-9d1166421266", "value": "FA05232022D44460EB75DEBA1DF8D4897571830EFD0AAFA82B41261DC66BB578B3317F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625044909, "uuid": "eaafaf5f-8f80-4817-b581-3a0729ad346d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625044909, "uuid": "f5364b23-e6fa-452e-8d03-2c16342a73ef", "value": "24576:T1fw+Jwz/S/6+4ck+lHv0PTMbUkIaMUcf/:Tlw+W7SClcXlH8Ps6Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625044909, "uuid": "5ae0522f-789e-445d-922c-863291c63517", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625044909, "uuid": "798e7875-a773-45cf-a6fe-6cac45cc1aac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625044909, "uuid": "a7107d86-edd3-47e7-917b-1952a51c6dca", "value": "ece737e445645e8585e07a592d75cbc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6344db31-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625032793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032793, "uuid": "a84bd97d-7152-4b86-b85f-2e6d9531440f", "comment": "Malware payload (RedLineStealer)", "value": "366b4f3487718bc2fb94ea8b66ca24b0", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032793, "uuid": "3734003b-6cf2-47a7-b15c-0ef999a4fa18", "comment": "Malware payload (RedLineStealer)", "value": "04a984d8cb25c19b040547d91e042ea7117a7cddaf2ed0a9da5fe9b862580b26", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032793, "uuid": "d3b57bee-9058-4112-aaa1-ac9144104944", "comment": "Malware payload (RedLineStealer)", "value": "341401fd107381f248f32d4bb4df5b29bce4e026", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032793, "uuid": "777ce8cc-0ac3-4dfc-ad33-b94cfa7ce254", "comment": "Malware payload (RedLineStealer)", "value": "45231e4d62c68acf48696f94daba7bccb6d97c7274f96cd93e25b00a4c32a741a4f6faa2465c2739c328e38ae67dee25", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032793, "uuid": "3843f05e-8dbe-43aa-8486-8cd325aff02e", "value": "3E84122864BFC019C4E7EEB52DDCA8BBD89A95E3640C743701B4632B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032793, "uuid": "bc3d095e-af14-45c3-acdf-4b7fd2b3f9cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032793, "uuid": "90c1ec28-69ee-4fbb-a4f6-bbe76eb1abed", "value": "6144:t3B5YqofbPN8MxO5+3hftL7pW6Tv/31b+dH9AnaR:D5Y3fbPN8AO5+3hVL7k6Tv/31b+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032793, "uuid": "e42548c6-f691-439e-9358-1934fd621a49", "value": 396680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032793, "uuid": "486517c5-3266-4937-82c3-8affc809382e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032793, "uuid": "72b01fa0-8868-4875-a8f1-3963e216d165", "value": "04a984d8cb25c19b040547d91e042ea7117a7cddaf2ed0a9da5fe9b862580b26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1374cb-d967-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625032462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032462, "uuid": "6321b12a-8b10-412e-b02f-7d7cef3d618f", "comment": "Malware payload (AgentTesla)", "value": "1ca9f25fae1aa6618420946685e16258", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032462, "uuid": "2ce05bfd-4a0d-4055-9cf2-2e839c5b7379", "comment": "Malware payload (AgentTesla)", "value": "0542f550c85174e9246ada3140a9101d4c6349c1594364dba607e441dae6100b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032462, "uuid": "846d21ef-9b53-4cea-adc6-b7d25716ce3c", "comment": "Malware payload (AgentTesla)", "value": "1e8ec2f09f1214078d5652aba237c75dc27af292", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032462, "uuid": "4e86528c-38ff-4572-b2b1-7ba76784970e", "comment": "Malware payload (AgentTesla)", "value": "e81a63c86bf2eaef1a7875f6af971d643ee73a2b29abd7c99040ab8978b641e2e4ec540c44ab90e5febf02c9a35ce99f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032462, "uuid": "389e1e93-b891-4088-82f8-e34abe7e80dc", "value": "69258CE02AA8D62BF3BA9F7D8560143143FDBE135B12D8587DB531D90733A71C9A123A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032462, "uuid": "9ceef107-2afd-4519-84c6-c014c9badd99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032462, "uuid": "459e1c05-361e-4913-95ce-6fc03badfba0", "value": "12288:pesQc2jKwuo3082iEi9+636b5CmR7O8gQvqv8yJ2mhkwDI3/j3Y0d676tKCkHdbE:pBQc2jSiE8PiV7O8tYBJ2GkwD66VjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032462, "uuid": "d2191d52-a428-4e60-a650-543d2dbf62de", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032462, "uuid": "4539ac4b-c979-457f-a82a-08ceba024dc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032462, "uuid": "e50f320b-0e13-40bb-850b-a02075dd8bfd", "value": "fbdNceHuIr6hYRt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518aa706-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625075712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075712, "uuid": "eedb63ee-8095-46c5-ab4d-f95a3c8c7222", "comment": "Malware payload", "value": "8c7690a365626e84e6c632046901ad7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075712, "uuid": "44f3d93a-900e-476e-908c-001ea29347be", "comment": "Malware payload", "value": "06bd4c75d04ffaf1e18e54e17d8939afe9d436769eb72038672465da1509e862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075712, "uuid": "99c13277-1ae4-4393-8f82-74018c2dccea", "comment": "Malware payload", "value": "cc23cc6d69a2e20a6bbc0af982c6f163b713cba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075712, "uuid": "395328d1-cb0f-4f09-8810-fc68793f5b8f", "comment": "Malware payload", "value": "e9b91380750bffb363bd8ee0052bb2678d8b6cabc64c69368d0909a91ed814c7df01c96371516d12ca7301aaf3618c2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075712, "uuid": "510657c0-56e1-497c-8050-21e92b2704b5", "value": "BAE27C87BEA58477EA921DF10AB0AAA7EBFAD5360C34DB1BAB004ECD7520441CD14757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075712, "uuid": "3a37e7cd-32ee-4e41-9a35-b5d0c47ea112", "value": "768:lsGPXyrvq/Sb6LbQ7eM468vxRu1rnd6ffMmKZS/5hK9G3/2o9+4gn61:yGarUa6LowvuhdNYh2Gf9rg61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075712, "uuid": "d225bbd3-4ef4-4493-b6d3-9548f2bb4210", "value": 33024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075712, "uuid": "5be8995a-1528-4a7b-b084-182a7fe12aeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075712, "uuid": "fdcc517b-2bf1-4e77-b59c-cddece8193bc", "value": "8c7690a365626e84e6c632046901ad7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dab8062-d9b5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625065720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065720, "uuid": "bd8c4d52-6248-4749-8595-ea6ce45ed823", "comment": "Malware payload (RedLineStealer)", "value": "20aa42e0a85a9793ca33cd400d41d326", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065720, "uuid": "d799a258-5768-4076-a083-d0c6fb10f5bc", "comment": "Malware payload (RedLineStealer)", "value": "07f262884e4c62a48eb9916217a8adca460f41f7ada071f8a0d5fa524b812d47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065720, "uuid": "73bb43bd-c3c4-4685-8b54-dc2bd2ee97aa", "comment": "Malware payload (RedLineStealer)", "value": "e0ae7f7cfabad9c9228fea70df44d3f6e917e022", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065720, "uuid": "94ea3e69-9751-41aa-9303-e10615b5bc8f", "comment": "Malware payload (RedLineStealer)", "value": "92517b253625f7906bb80a11bc51977561c6e22e85931c85db30d35a75b4096c4ab6513ea04705bca1bccb4a62fd214c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065720, "uuid": "e8d39d45-4907-4095-a8d1-4b5e50c54ede", "value": "78E412A23660C173D062817094AAD73096BDBD655AB30547E7D82EAF7F331C223F6267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065720, "uuid": "7be3da7a-fc77-4dd8-94b6-5b8bc0c91a38", "value": "0eb60df333d8db453a6ba31558f96ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065720, "uuid": "d1bc2c46-d53e-4d03-806c-e15e5e59bc59", "value": "12288:+LQQDlyUTrPXSkLai/wZDx5MEg883wuKu0OPTu0IwHCB2:+kOXPXLLH/wZD8v3LKCzHCB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625065720, "uuid": "30672a7a-2fbe-41ec-af56-ada7dc517272", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625065720, "uuid": "9d3d55d2-e548-4c74-a0f3-882e1a33e63b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065720, "uuid": "ccc9b9fb-328f-4671-a8f6-51e11f2dfc69", "value": "20aa42e0a85a9793ca33cd400d41d326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da81ae95-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625019249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019249, "uuid": "d082d374-3329-4313-8764-8b717305cca3", "comment": "Malware payload (Mirai)", "value": "a00a61e3eb4b5c319dce9cc2266df944", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019249, "uuid": "79f11fef-fc7b-4b1f-9697-4361b67c715a", "comment": "Malware payload (Mirai)", "value": "081697410137f62aa6f78fae73a3a5b69ed7b761a0ac6eb3fd6f3cd986630cfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019249, "uuid": "f02782da-f62e-4413-8c61-a832acaee2a6", "comment": "Malware payload (Mirai)", "value": "e020fbb50ae3fc9f877a6bcf05b28eba729d1952", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019249, "uuid": "7245aac9-3ea0-4466-b58a-dd16278cafa6", "comment": "Malware payload (Mirai)", "value": "a6d505e6dc6470eb78f3337914f6e51d925001d5c3011707bafdad0b2fdb9644e5cc0fc8ff7fac17c0ce32f9c206ac40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019249, "uuid": "abd868aa-5a53-45d1-91a6-ead5d3f2ec76", "value": "C5338D75F8291E94D15642B4A4248F352F23E2C893933DF356A1C3B28017AADF91EFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019249, "uuid": "eca20725-bfc3-4618-905d-48d6ef905a58", "value": "1536:mamyClrLp7wnwib4dK7a1oZLXrXCr/3a10:mVyH03oNXrXmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625019249, "uuid": "bc5b9429-c65f-4673-9823-12e48573b91b", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625019249, "uuid": "7ef4c7fd-8082-46ba-a4fa-e86901ea05ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019249, "uuid": "7d61522f-7beb-4fca-ac1c-22acfa5020fe", "value": "a00a61e3eb4b5c319dce9cc2266df944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc9159e-d93c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013776, "uuid": "cf92df70-d9b6-47ad-8c0a-28768c43bfa0", "comment": "Malware payload (Gafgyt)", "value": "106b8adffd6d6b06619582dbb0a50764", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013776, "uuid": "d8c8953f-8003-44ac-a723-05cd44832acb", "comment": "Malware payload (Gafgyt)", "value": "0839b33e2da179eac610673769e9568d1942877739cf4d990f3787672a4e9af1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013776, "uuid": "71659223-f6b5-46e1-a8b3-0e1e9136aad0", "comment": "Malware payload (Gafgyt)", "value": "e9befd1470e9f28538865f4b8cb826c927f32b8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013776, "uuid": "9315c4c6-c86f-4b89-8e32-a7cbbea5ac80", "comment": "Malware payload (Gafgyt)", "value": "e95f02c88667e46fe03e86889fe70567855cd8887dacab311a8f289a2e2ebcd9d0f085267340417669beb85c01ba4755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013776, "uuid": "c84d39d7-abf7-4865-a38d-6dcdd23ff872", "value": "12E3E601F8885767C7E337BAEB9E438D773616AC67C733115A384DB42BC5B982A38560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013776, "uuid": "0914a1a5-6762-41e9-98cd-2b17f02261ae", "value": "3072:MEDfcOlkmQCnoV1iqGPls0KC/ZxUFpw5hLBNFvLm/QZrGoCODQUDMj4AFx8:Xs+/YHw5hLXFvsoCODQUDMj4AFx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013776, "uuid": "cd9c5a5a-e404-4d70-8058-1aa9aea1c5ac", "value": 145940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013776, "uuid": "649477aa-3412-43b6-867b-8bbf84e480c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013776, "uuid": "0c551b04-8d80-46d7-b51a-80fd18383b2a", "value": "106b8adffd6d6b06619582dbb0a50764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e8108c-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625059206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059206, "uuid": "6a1d9129-ef29-4ea4-936e-178c7c9bfed0", "comment": "Malware payload (Mirai)", "value": "6faf03592fa46e346b6f7e300f683eac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059206, "uuid": "2ed10c14-1960-47ef-b59d-37b30fd6c54f", "comment": "Malware payload (Mirai)", "value": "085a3d5818d5a9af43e81cb55d9700ab2f48218e56aa12ce2945901a08001fb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059206, "uuid": "804ad5f5-c2a5-49bf-80a4-329de2e5d0c6", "comment": "Malware payload (Mirai)", "value": "8906cc82adbbb58395cac4604b24af3daa965fe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059206, "uuid": "3c7f8ba1-e31f-4423-b41f-b686ca170a41", "comment": "Malware payload (Mirai)", "value": "75444723806c8fbfa400b714da4d7375b83e0e1cfbc1fe339ecea8a5f3a1ad529eb250d10c74e46a627b0542c7748cec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059206, "uuid": "36f6ba0f-0861-470e-aceb-703a597d9100", "value": "A2F2E1ABF8C93BCCCDCF8E7E916908F2AE91B5843585570CB39849919F4254B329E871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059206, "uuid": "e7681b8a-9bfe-45be-8679-1a5c8249de2d", "value": "768:X8SFrz87d8cyLSYhCcWYB/k5Y8wT6L8zWRO:X1FEZKWYhCmB/k5Rl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059206, "uuid": "a21fe374-bd8e-4667-b39c-8f1420b6a81d", "value": 35884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059206, "uuid": "50ca9321-5d3e-4571-b1a4-7204d87a9c4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059206, "uuid": "ddd7fa10-f000-49a0-99ba-a48dcb6c7888", "value": "6faf03592fa46e346b6f7e300f683eac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac4d0b2-d982-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625043999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043999, "uuid": "6875d72b-43e3-4e22-9c9c-9c5856132a21", "comment": "Malware payload (Loki)", "value": "b70e5ba1d460943683b625756ca68d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043999, "uuid": "fa3e4160-a3ce-4dd4-a01b-d8b07d2045f9", "comment": "Malware payload (Loki)", "value": "0970bb89de66cfb334d0d4d55f92c0f62aee871728218dd9945454697ba13252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043999, "uuid": "2bac2139-a187-4c9a-b7aa-e3145e00a2bc", "comment": "Malware payload (Loki)", "value": "f026a96e760aa565d6231305fe2027e92bb969b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043999, "uuid": "1820b6ef-34f2-43a9-8556-5b2637db223e", "comment": "Malware payload (Loki)", "value": "25802359f35863e0f3221a3665bbef5a0b2748661ddf3b8bb69f038a1a02a4ff60842a97657f2a41504f9f3fae5897a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043999, "uuid": "599c67fd-44cf-4ee5-a0e2-94f354805421", "value": "B5458D117D94D51AE0BA5F3D4AA5941462BEBE637F23DC5C3DB933DA0B3328388A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043999, "uuid": "a9bac8cc-0ccb-4ca4-b8e3-853c280d1e21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043999, "uuid": "c61b6805-4d92-402a-83dd-d1b9a469a895", "value": "12288:hdCxkBbX5TyA4y2pt+4y2ptd0mI4e52pB4ODFwSjT1yNu93FNhf+04y2pt:2kuyoyZu4ODHjr93FNky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625043999, "uuid": "4f32a1e5-3423-4f40-8ce8-75b09f54ecae", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625043999, "uuid": "765afc1e-e4e2-4866-9479-a4ebcc01a692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043999, "uuid": "177cb413-fe72-470d-a123-e3ada1c4ae3d", "value": "EOU907665787754.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626f4369-d9f2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625092062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625092062, "uuid": "9a914eeb-cec9-4a74-bfe6-0cd8ad44e644", "comment": "Malware payload", "value": "0b08915aa358ad89e747e934111ac525", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625092062, "uuid": "c1bdb7c5-2070-419c-aa06-aeba4364fc47", "comment": "Malware payload", "value": "0987fba05bd97de710a9455b98519d415ee3df41bdd497193fa772eadfb89496", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625092062, "uuid": "ec32c187-ed77-491e-ba6c-b6e0ea1ce176", "comment": "Malware payload", "value": "9200a10374cb2c2018fb9ef25cd17751da31b9c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625092062, "uuid": "a3cc4b80-c8be-4745-bc82-13f336bde226", "comment": "Malware payload", "value": "4fe869777ea792040398c1878ccb537af0919d38e0ccc5fb36659841f57995e62f3fcead1f5bbc86caf51e66a0281995", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625092062, "uuid": "5632dbca-03da-4a34-bfa3-5397720787b2", "value": "8985650176A4EE35F5B66A3E9DB9CAFC06A17CA5ED34825B34C03F5F39F06049860762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625092062, "uuid": "f8c5891c-d644-441c-aa4b-ce551622973a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625092062, "uuid": "18f7be27-cfc6-4dde-8a30-b293950d0709", "value": "6144:fAtdZkIj/ygZ4y3L5ShVOyh6PyhtM5VE6jRWswtv1iOvnufyHNMdN:eaIPceEOwswt9iOAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625092062, "uuid": "5dd93e8d-f267-4fd4-9921-d6731cd6cca5", "value": 1814064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625092062, "uuid": "a127dd76-e015-413c-9762-c81d5ee8dfda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625092062, "uuid": "1fc44214-ceb1-4ad0-b469-36b8f61e4c6d", "value": "0b08915aa358ad89e747e934111ac525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb69e7b-d9a6-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1625059435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059435, "uuid": "8fe0daf0-2576-4133-bb21-62afdd7d1c23", "comment": "Malware payload (RaccoonStealer)", "value": "51db0cf4a54e5e170c8bf1032dd32496", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059435, "uuid": "2ca6acd1-c173-4878-abdd-63cc722e203f", "comment": "Malware payload (RaccoonStealer)", "value": "098b845a6729ed490fc61e679a4d85bdf35cd71b463fdad56e08a60714a84e50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059435, "uuid": "ba6ee7ed-d541-4d59-bd7a-34cfe2ad9764", "comment": "Malware payload (RaccoonStealer)", "value": "f4e6428e6aa0b462cafdd3b09c83099a62e61859", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059435, "uuid": "b7f4c8e8-d7ae-423e-8d3f-0c1b34cba041", "comment": "Malware payload (RaccoonStealer)", "value": "cef3ddbe485ef7ed108fdb1ac2ed0f1c94af72d9572ca4c5a1275a6764b4cde537c4fbdc0799a7a81ff78c8d16c56753", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059435, "uuid": "c9351926-4c14-4fe0-9b36-08d5bb5e0f03", "value": "EAC401613660C433D49286305855C7A16BAD6D62ABB75047F3E92E7F7F233D06BE220B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059435, "uuid": "b01c094d-0006-428c-8e65-bd13c6d151d8", "value": "0eb60df333d8db453a6ba31558f96ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059435, "uuid": "1ee86245-2599-463d-93ea-6d595aeb9240", "value": "6144:cq71QBgRHkd3ZY8Li1TIdP0qcGXdJjiu+P3OhDlHMEF3T13ajLKBZUpmHP2v5B:cqorp7iBaJJjiu+P3E/F3TWmQmv2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059435, "uuid": "21321dd0-9bed-46c5-b057-14a6cc0607de", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059435, "uuid": "d34b99aa-b122-4950-a57c-4492b3a422c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059435, "uuid": "9d39e565-53b6-472c-92e7-06efad61cf24", "value": "51db0cf4a54e5e170c8bf1032dd32496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14de5599-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018917, "uuid": "cef73263-15ed-45da-aea6-a355e622179a", "comment": "Malware payload (Mirai)", "value": "4a03bb953e6486278b40c8de9ac2e6a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018917, "uuid": "45bfdab2-20e8-4ed9-aeb5-52e8571b1b40", "comment": "Malware payload (Mirai)", "value": "0be1e96f318d98398861217a9754bc003e6861d84de8553cdbd87531db66e19b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018917, "uuid": "88b036e4-4d63-4390-aa13-0ab8c65a4c49", "comment": "Malware payload (Mirai)", "value": "ed8fb100dfb8902672da6554bf784f0f33a11767", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018917, "uuid": "c921dc67-58b9-4f29-a2ae-855aedc76820", "comment": "Malware payload (Mirai)", "value": "4b68c99a3a3eacdfa2f65476c736d4a5403373cb2aa116146fd55d59ff5ece4b9b3b5a8f772ed1974500f259cd27d85c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018917, "uuid": "c6a5870b-e18d-4b66-a3a3-522236f5e2a4", "value": "8993D593FC01EFABF40BA77644E34815B530BFA60EA25A767213789B9D3A0D51823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018917, "uuid": "8676f7a8-8abd-433f-acaa-c0769b01bf4c", "value": "1536:AcpLOIVa0aIh8FuX2W4Wsyf0/zH1B3fc+iDwy8RAlU:AcpyqaId+WFMXxiDwy8RAlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018917, "uuid": "b2160b06-6cc7-4f3c-85b2-6e9fcdbb6783", "value": 89492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018917, "uuid": "0ad57508-1f6a-4e01-9f4e-e62fd3b6f5e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018917, "uuid": "42aecb5e-b3e0-4832-8dd8-c2d74172bee6", "value": "4a03bb953e6486278b40c8de9ac2e6a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d19fef7-d980-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625043010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043010, "uuid": "d55ba440-a72c-4e29-aeb2-bcfb726a5443", "comment": "Malware payload (OskiStealer)", "value": "705ad720b2435fcdb0aaa33b5ae1210c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043010, "uuid": "94fc4c5f-e03c-4fae-916c-c490c6ab02ca", "comment": "Malware payload (OskiStealer)", "value": "0cf6179c249f947e8eb37a0df9a02f4a43230b4e5e5bd479c81505a78de04e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043010, "uuid": "883d59de-3d5b-4cca-8ac7-5577c1dce352", "comment": "Malware payload (OskiStealer)", "value": "13d16a2b7dbc76ec64e87dc265a22b53f89fccbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043010, "uuid": "7efe5da8-c2f6-4b79-a376-bacb13bb1655", "comment": "Malware payload (OskiStealer)", "value": "a935cbc7cee27a6b97c15d9784549ae57e70805aac761663e630e03193e899c76529e83a084550896e6d766046d02774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043010, "uuid": "956016d8-6c38-4b67-8396-de1d9996041c", "value": "D4C4DF5231489D7BF2571CBA4C1EC1B215AB6C24406AE51CB1AA725F19F232213FFB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043010, "uuid": "b466ce18-3952-467f-ba92-4ca218ee70f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043010, "uuid": "fe125829-7c27-4a1c-9476-3d42bcd9812e", "value": "12288:uEFVzMFE4d+rRJox0l3UusuaQsE0jX8m6vOMjL8DP:raER3oIkU0jIW+cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625043010, "uuid": "82e4d4bc-bd44-4f0e-b3fa-614e0841293f", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625043010, "uuid": "1894fc75-0858-41e7-8e37-a0c958e07d54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043010, "uuid": "84f38253-fdad-4823-ac41-95c39140d696", "value": "705ad720b2435fcdb0aaa33b5ae1210c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815c13d0-d94c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020817, "uuid": "265c6b7d-77fd-4fc3-aca3-e225409fb2c7", "comment": "Malware payload (Mirai)", "value": "2b3a3bccc23adb57972ddfbef2284f32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020817, "uuid": "65ce4e23-793f-4988-97f8-7bf8846a17a4", "comment": "Malware payload (Mirai)", "value": "0cff6d66af2d6e37394d5976e1bcb225913b3abc0bad82be6a9331fa837b513d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020817, "uuid": "acc192c6-5dc1-4a16-8b5b-940d7f8adab0", "comment": "Malware payload (Mirai)", "value": "a8096a8a1b5335a1600161efef17ef60f9c2b3c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020817, "uuid": "494ca9e4-3667-4f8c-ad7a-dd79234fc978", "comment": "Malware payload (Mirai)", "value": "ecf7477a1bc4552615ae97afab28cb5f3b1c585f0e4abb630d3d834eb0a99067620076e827981f08869c8b625b2ee9c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020817, "uuid": "d7cc5063-468a-4281-b538-d053f5b9c98b", "value": "2EB2D191732160B4C6941E31CD78C1ED716B2989F3FE21233A190676F69658B27F868F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020817, "uuid": "91951e04-8496-4869-8cf2-1f286194ace6", "value": "768:qwBA1NjQwcThlYlYXoKrEas4ccUcfh5s3UozY:qwBA1NcwcThuuXosq4czcfmzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020817, "uuid": "2845d9ae-0dca-4567-9c05-25d0c9ddb951", "value": 25000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020817, "uuid": "f63ba3b7-f1e0-4958-b67a-97c574d7a9e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020817, "uuid": "c9ffb275-efce-4484-9d08-cd0be72fc7d8", "value": "2b3a3bccc23adb57972ddfbef2284f32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e857b3-d9aa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625060978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060978, "uuid": "f2eb6328-342c-4772-b9c3-ac7589496cdf", "comment": "Malware payload (Formbook)", "value": "6b7b4e83e6d406791fbfb8fff10cfa34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060978, "uuid": "287c6a83-322c-4e1d-95a1-d5d4293e0da7", "comment": "Malware payload (Formbook)", "value": "0e3ed29a7b0e14ac4eb4f2d85b24e63bbb08e8990a048db3846aa509da72955d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060978, "uuid": "86795c2f-544a-4070-a8f4-e650c7e6e00d", "comment": "Malware payload (Formbook)", "value": "d563dcd3247cec2898674ae192f7f6baaa52aed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060978, "uuid": "9f79ec85-8f8b-4c11-b54d-5c2bac3181ca", "comment": "Malware payload (Formbook)", "value": "c5abd84efc2705654e027a8b6515c4004d028c3d6cce18b0dafde71f260ea93a52a595f291f925277ba4e5528bf7456f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060978, "uuid": "8052bc4e-e2b3-45f5-9ebe-b80e2bcec9de", "value": "BFF47D202AF84629F0BA9F7E95B4610597FEF613AF27C95C3CB511C90713A41CAF172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060978, "uuid": "2bba12fd-5aa9-4ebe-9c2f-3defe7233f1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060978, "uuid": "299e9d92-1195-4634-b028-1caedb02d70f", "value": "12288:tynlBBbX5TyOaTEplkucHFCYIgCFneAKOOJD9gRKzlpoRs/xSx2V:+lBggp+uc4gCde5IMxp9xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625060978, "uuid": "da43c29f-87ea-4f12-8e79-17de7b4fb874", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625060978, "uuid": "eff04350-871f-42e2-9e97-dc3ef5e07c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060978, "uuid": "84891824-1ace-473e-ad50-793af56116d0", "value": "doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f9c05e-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625058988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058988, "uuid": "344aa797-d5aa-4dfe-a0d6-56fc36c7cab6", "comment": "Malware payload (Loki)", "value": "65de792976737dd35343b2f30ba93dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058988, "uuid": "3f13a588-2879-43db-9323-f5962723b87a", "comment": "Malware payload (Loki)", "value": "0ecc2f2a0346ca13361092909a8587927ab52b9532ae7b6d69367546369b31bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058988, "uuid": "382dfd31-7e33-437a-bb8f-b80c212a473b", "comment": "Malware payload (Loki)", "value": "390e26926ea70b4ab6774ab062313621779a4208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058988, "uuid": "4ee9c906-5d19-4b5e-9db9-353b49f837df", "comment": "Malware payload (Loki)", "value": "b430bb380ddca9c0b1d0cfecb2d9144b8140439bfca1a9f45944d1a758f87df1877c749b2b1eebd8d915cea38ee50291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058988, "uuid": "d8698e47-f833-41e1-b00c-20a4ee520052", "value": "67E47D302EA95931E0FA5F7FC5E5141196EEEE136B03C85D68F522CD4363F82D9B062A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058988, "uuid": "cac4112a-96e5-407a-83d8-8d4539ca96a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058988, "uuid": "dc2641eb-5e7c-4ae6-84d6-204a14585b2b", "value": "12288:uzXAN9LCyfELHNRa+dTloZiJeU88wooSIUtKOqBbX5Ty:0XAr8tRrlo848woDtnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058988, "uuid": "509a6bda-957d-4f4b-af2f-a65ce33968c4", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058988, "uuid": "fc6ce158-12f3-4d45-99a4-2c4b3c2b0fbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058988, "uuid": "19155b2b-c7a8-41a0-96a4-775964a394d8", "value": "RFQ202106VR2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afbbfcb-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625032725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032725, "uuid": "719731da-74b5-4063-bc2c-88739198020e", "comment": "Malware payload (Mirai)", "value": "cb10fcc9bea716d037784467e34ce2f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032725, "uuid": "13042142-4834-4cde-8339-387e84b05a05", "comment": "Malware payload (Mirai)", "value": "0efdb9ab02bd5778b1797cd3e8c355030d7ab1e2646fe9c4613680888d247bbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032725, "uuid": "dae9f43a-8d8a-4b30-960e-4c26a1551e53", "comment": "Malware payload (Mirai)", "value": "22a6d7f82eb433fdb2415e2eb9664b3c2e538255", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032725, "uuid": "b5728222-c3e9-4320-aded-7ff0cb34056f", "comment": "Malware payload (Mirai)", "value": "7721880968c109927d4f420bbd603df7b1d12b849455d8f94141a09be040007711044db7c83a81f4e15a4e5ebcd1f4e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032725, "uuid": "c90cc2bc-0937-44c4-b2d9-1951f669dd6f", "value": "0E539DA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA57C656845FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032725, "uuid": "2dbd0802-81ca-49fc-87d2-70c32d4a2b22", "value": "1536:K/ue90IlCalyZyuhx+vACs2U/SO/Sfs3zO/QSwtPlCXli:KGejAGyZyuhxaU/Sjf+iYdtPlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032725, "uuid": "8ac98462-462d-4488-9917-a0e6c34f680c", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032725, "uuid": "991cf8a0-2a16-46e2-bc8a-e6898552c165", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032725, "uuid": "621096c3-4215-46c4-872e-55e67d8c2796", "value": "cb10fcc9bea716d037784467e34ce2f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2345029-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625059232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059232, "uuid": "b27a28d2-236f-4dde-b1ab-948541ff24b0", "comment": "Malware payload (AgentTesla)", "value": "29d739854bf3e83bd22767581b07a926", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059232, "uuid": "a1384e25-0118-48f4-9803-03b4a5ae5fa2", "comment": "Malware payload (AgentTesla)", "value": "10770e39f241c74b803c08dacd93612bfa2cbc737f6a0698e0316cec7ca2f228", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059232, "uuid": "2ff94d66-d50e-408a-99d3-24be3bd8a07c", "comment": "Malware payload (AgentTesla)", "value": "5d73aa6be429cdb3cd7ddbc89c5fd7fd74434a9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059232, "uuid": "bcb4687e-2a91-4f1b-926b-5256658b8e17", "comment": "Malware payload (AgentTesla)", "value": "0a43488e345fee80f0a723b478ece941fcc371174d9a393a02cc45cb6818288aca2f87b907c39b630e3a758262cea9dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059232, "uuid": "2469533c-79e7-4509-84c5-97fbcb6ec44a", "value": "11156BAC325435DEC467C6B9CAA8AD74AA617C7A431BC107909709DFAA0DB93DF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059232, "uuid": "f21c4d26-d512-4db5-8472-54cdadd87e26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059232, "uuid": "987a41f5-b777-4206-a375-5145319533f3", "value": "12288:DIvMSCqVAiIkGjLzXkt6h5RcGB1lfCI3jZY24F2k1DuouqsVogz7gsz3LCNEoVoy:eNVAiszM6lnlCICH2wuouH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059232, "uuid": "25f023d8-7796-4595-8030-dcd3481f91ac", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059232, "uuid": "36897ca3-eb5e-46fd-be10-39cb8eb67050", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059232, "uuid": "7d97cb8a-8e8c-4e57-b3d6-69e10e030c8c", "value": "putty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56111ab5-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625075720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075720, "uuid": "f02d2f0a-e78d-48e2-a363-2ed978ee8f8d", "comment": "Malware payload (RedLineStealer)", "value": "592f088f8c14ef32b6eef5b87f6a00c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075720, "uuid": "3e7f5c85-350d-4e05-8daa-b2a92c78838e", "comment": "Malware payload (RedLineStealer)", "value": "10c557791bee29fdb6fb84c9e394a1f3966eee42d3ddd73061f9440e8d1fc332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075720, "uuid": "a01a8814-cba6-4499-9de5-33d9d0044600", "comment": "Malware payload (RedLineStealer)", "value": "2b11cb3ff885f5e6f6e20dfa0e8e247041e0c5a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075720, "uuid": "2f5879ce-fc20-475c-b93f-cafe9b4c1f23", "comment": "Malware payload (RedLineStealer)", "value": "3fa357e2fdff094e8e34c8515baf18efcb7e0fb9de2c2cebd61246c35642bb7ac850fe59615cd7d404b3d5b6f268e0fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075720, "uuid": "ef10d45e-9654-4473-b5ab-52dc2fca58e6", "value": "2A84E0413A80C832E661057148D2DBB55B7BBCB15A634643FBC46E6F6F3B2C29BE1207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075720, "uuid": "e3248d41-c9f2-459e-b092-2c3b8458da27", "value": "6c85a344bbe73254bc54e901b7fa4065", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075720, "uuid": "4070bcfd-2306-444e-897d-9d40b71cecaa", "value": "6144:d9u7bIUTIBCNgQu1VfOTUO7fU2WMSTOXKB7:d9IIBCNgHnJSQMSN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075720, "uuid": "bb4469a3-102e-4663-9036-783b99955b00", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075720, "uuid": "2ad54e22-32de-4d7d-bdec-1346cce052b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075720, "uuid": "6998af6d-8ef0-4a4f-aa16-25b7502a5b62", "value": "592f088f8c14ef32b6eef5b87f6a00c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5383d713-d9da-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625081729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081729, "uuid": "6c7a51e5-bf34-4471-88ad-066e2f984b31", "comment": "Malware payload", "value": "35bc7e8e168545658e6a52f0fd330a50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081729, "uuid": "e8ed2c96-3e5d-4db6-b65e-6bd4a4d77856", "comment": "Malware payload", "value": "1161c095c63b3b47494043acf049d9803b6cf13a453af90f6ed415d1e357291c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081729, "uuid": "088cc06c-08ed-4c0f-b70e-86f0b3858341", "comment": "Malware payload", "value": "fd9a37e271eccf9093b283645d27dcd2b8ec87e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081729, "uuid": "13bb3fd1-df4e-4789-b1c9-033d71d6be18", "comment": "Malware payload", "value": "cc3347b9b89a4014f32b41fa37a04811272ae56518c25b46a9c778e2c7c39fe62ca6cc4893b51a16f3c0461d51836851", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081729, "uuid": "f8b18089-96c2-449a-8d4d-e6fa425b85ca", "value": "27440282F1D184F6D5DF4038415A4916EB3B7E08E3B9C5936A9821AE8F373E2F539316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081729, "uuid": "7f283a0a-36dc-4c30-9c80-c997231e339b", "value": "ab6cea1cc57cbfd14bbb7a26003599de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081729, "uuid": "c2fa17af-0e38-4f27-8c4f-328662ea5e8e", "value": "6144:P0ha/tgBhq/IR3R4DPV6qPvsTgSold2CkTWA2JmOaql:chKtD/IR3SJrl0FumW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625081729, "uuid": "27839109-4cbf-465a-bbde-ec692f1bc201", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625081729, "uuid": "5fd529a7-8960-43f5-a5e3-fe0a34789d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081729, "uuid": "9e6faf41-877b-4049-bb93-b3321d33f1b2", "value": "1161c095c63b3b47494043acf049d9803b6cf13a453af90f6ed415d1e357291c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6758a627-d9da-11eb-875b-42010a9c0053", "comment": "Malware payload (NetSupport)", "timestamp": 1625081762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081762, "uuid": "c4c294ec-4c6a-4524-9971-56dbbb76a923", "comment": "Malware payload (NetSupport)", "value": "48bc546f483f07d5c61704b4f81debb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081762, "uuid": "8f444f1f-ec1e-4202-affd-877aff8b2f84", "comment": "Malware payload (NetSupport)", "value": "1187d88ef67786adc15cb0043534473589757f54e340c4b23691099aa979880e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081762, "uuid": "bff16b82-fb41-43a3-b200-59065a41d9a6", "comment": "Malware payload (NetSupport)", "value": "a693d6a894a96dcf12c6249452c9812c6f599b2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081762, "uuid": "9fc2e4d8-4fc7-4020-909b-eca15bfd9636", "comment": "Malware payload (NetSupport)", "value": "06ee3ac158e3c1d054c1f438b24f69b296e0fcd08dcecdada252e1c46d1f6c68342e0c120801a0ade7dc4484472a56b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081762, "uuid": "5a3ef575-a3ac-4eeb-b2f2-4d77a47f261b", "value": "3FA633EB21836AD7C12B81B5D8E332791FDB5C9018692A83D94C3DDFB8F0D4B96B1452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081762, "uuid": "221cdafc-0ec7-4c30-a018-946bd4c6eb77", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081762, "uuid": "8c91b00a-2169-4a2e-a294-966ec6bfc89c", "value": "98304:qm7FWF+7di2roMfdQuZkYhH0rPZ0PieeT0qS0xTSJThqHgJxnKodk8vOUDk5IUJm:qgdRquOJrB0ixTYPnPrOmkFYTsw8t6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625081762, "uuid": "2a987a13-46c3-4009-9298-95083aceb4a1", "value": 9736158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625081762, "uuid": "6c98dd5b-78e9-41dd-b577-59d2a4bdeca4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081762, "uuid": "00f26e43-3d94-4496-9f69-b329fedae822", "value": "48BC546F483F07D5C61704B4F81DEBB2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc71f490-d957-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625025694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025694, "uuid": "8e6d23a8-e6aa-496e-b073-773f0fcb434e", "comment": "Malware payload (DCRat)", "value": "c5d126dceb349f72aab6308233bc244d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025694, "uuid": "21bd0287-b47f-4fcd-b5c6-6017d58be082", "comment": "Malware payload (DCRat)", "value": "11a153c8afaa36b8af99ceb85f50b7b923ddacb921dfa9888e0c49d795933075", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025694, "uuid": "cf7e6d78-f5a6-40e1-a34a-f91e596303f7", "comment": "Malware payload (DCRat)", "value": "f7d1d0301e2d3340403a20fa4f1d56d4e904b0ca", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025694, "uuid": "3a96369d-d05f-4f80-81da-6d5409f2060a", "comment": "Malware payload (DCRat)", "value": "508237b2465088b45162bf2f612df40eb9d41a4c0080915d4438c5869dbf4ccc04e3e901386437a35c8c3c106d8c0228", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025694, "uuid": "90e29767-62d8-4ad6-9b56-ba50b3e7a758", "value": "3A55332C2FAC7941EC62B1BDD1494C77D369922DA653CBAF4EB5C5CC21A50A42842F8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025694, "uuid": "021fca85-d992-4360-b1f5-f6dfdd9a26bc", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025694, "uuid": "b76c03ee-05af-4b6d-ae00-cea4f195af17", "value": "24576:+TTBjpm13tsEAULugOpDL+xZ1IY/kOuC0fhj2utej5q568cKsD:I49+U5OpDL+x7D/SC0V2utYisD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625025694, "uuid": "cab81b92-d768-4a34-9642-fe81c1509d3f", "value": 1328640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625025694, "uuid": "df05b000-3abd-4bdf-9346-4d70cfd9257a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025694, "uuid": "7f2dadf6-7bdd-48db-aeac-2522796e27fb", "value": "C5D126DCEB349F72AAB6308233BC244D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e105e78-d9ac-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625062016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062016, "uuid": "a393c986-1af3-43ac-b8c4-250ee6a9aae0", "comment": "Malware payload (Mirai)", "value": "28f3f94bcc44104ddc62f7fbb25f5b73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062016, "uuid": "e67aa9c4-899c-495e-8e0e-d331ca754108", "comment": "Malware payload (Mirai)", "value": "129a05ab79db848db517ad6f377dc82dc75ca686e2c2882da97f2a1e97bfdfe8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062016, "uuid": "e5930541-37bc-4978-9059-759988f6d7d9", "comment": "Malware payload (Mirai)", "value": "cfaa7d965f0ed49acb3dd60b2410202603ea0062", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062016, "uuid": "87bfc9c9-3f95-4fb0-a416-3bad8b2164de", "comment": "Malware payload (Mirai)", "value": "9d7a4ef92cfadeed720f43195d5f0511aa9c03cfbd0283a6fc1bdb1a4adb3e28171a894f4f8e3616ceb023d21f8172b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062016, "uuid": "91232b0a-8893-414f-a7f3-f882cdf98580", "value": "2C13E06DF7503AC5CDEE897A469D02615E80B260765B9B8C57058CC9BB9DA8BF40882C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062016, "uuid": "ba340616-3e90-4d6b-b2d9-d2f62bd09bb7", "value": "768:g+crNK4pLMozflbH/29hkO6EY7O5yZhs5UgK5McRjzuAnZLCW0:g+cBZMozFf2rZnqO5yOUgi3daA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062016, "uuid": "871bb4f6-8949-4e73-8c1a-b260084f8bc7", "value": 42932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062016, "uuid": "a5281282-9544-4f2e-9233-0a059a35400a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062016, "uuid": "60f868db-6d5f-4549-94df-ef7abc805961", "value": "28f3f94bcc44104ddc62f7fbb25f5b73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abd50f0-d96b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625034013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034013, "uuid": "a09291e0-07a5-4c12-8466-cbe2a7a73988", "comment": "Malware payload (AgentTesla)", "value": "e6b3e75040c2f76b31406c0e21184f32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034013, "uuid": "b78fe7e8-9396-453f-a32b-208ddcf62699", "comment": "Malware payload (AgentTesla)", "value": "12e046ed6cb670148b7484e138b987c097dfa76009442216c037971600020da1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034013, "uuid": "cfff1e46-ddbc-4679-9abe-9b79e0cb60ae", "comment": "Malware payload (AgentTesla)", "value": "e5c6ab328b2cefd0093c53968153ddefac1f82ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034013, "uuid": "a3cb819c-7bce-41fc-adc4-552515bf3dd8", "comment": "Malware payload (AgentTesla)", "value": "2f544ce6510c92f3f5ccdff47659bf4a5671b2f8e30f9c77ec83f97ae7d0021bfd4d54dc80aa1a78010dc13b88e7857c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034013, "uuid": "a2a7b844-6fdc-4bf8-aee7-045060100d5d", "value": "39F4BF252EEC9635E0BA9FBD96E0205197FDF6236F1BD8683CB502C50713A41D9F122E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034013, "uuid": "1acb3782-adad-4f32-ac83-54f30e6098f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034013, "uuid": "86a13a5c-dea7-4547-97b7-91fa57a9aec4", "value": "12288:DrrWqY5TxaEAC/b5hABbX5TybOFlsHwVmsbcnmGoO/bYb2zJtFRGZjxZQFFkAs/l:c5ekGRVPGoCYb27FReQFFrs/HymkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625034013, "uuid": "38d245eb-433d-44cc-a68a-a88158a6f660", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625034013, "uuid": "86957b05-a09d-49e7-a902-f32d20a9c859", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034013, "uuid": "dfbf2840-19f9-44cf-a732-f3f9946d8801", "value": "e6b3e75040c2f76b31406c0e21184f32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78aae93d-d9ad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625062464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062464, "uuid": "2d405242-34e6-4eb8-88c4-4d242418761f", "comment": "Malware payload", "value": "8878f2a3a7a71b648afca597c3d907c6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062464, "uuid": "d8d65a6c-5106-4143-afd6-49c4e7356e6e", "comment": "Malware payload", "value": "14813f2f1c5a3dc1eb83a867d1a1537c38061af136c0d54e8ec0707f103b29e6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062464, "uuid": "5227aefa-430c-477a-aff2-b3bb3b11184d", "comment": "Malware payload", "value": "74c7a8657d80f0d4471010df9a24228e9b9fbbe8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062464, "uuid": "2f7cf99e-4117-48e0-9201-139e68a60e70", "comment": "Malware payload", "value": "e0b79a666e5894d84527613a6917f4b02631d579f597a6287cd89aa6bcb406c0e5e01383ecb78c66796350757a665255", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062464, "uuid": "aed6087c-1ba7-4804-afb3-f1d1d19d14a0", "value": "0D6432A4119F8272E6448E4D35C4B1895E74FE9230CACC2963AECA35DF65AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062464, "uuid": "1f6e885f-e92d-4364-aad2-84a5c4281e36", "value": "3072:9gBrB2BrBthK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHVlrdzFDr5RDAw5wfA:MVcVt1rdzFD1RDAUw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062464, "uuid": "ff765c2e-b2bd-45c4-a623-88c623c8525b", "value": 335739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062464, "uuid": "2890a463-f8c5-47df-823b-893f822ead94", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062464, "uuid": "6d63e6fe-7dbc-4116-8af3-bcdbba076848", "value": "Invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef16e5de-d9e3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625085855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625085855, "uuid": "17f73e45-461b-40de-b9be-857c178062c2", "comment": "Malware payload", "value": "d574746497b5aecba280e5efcb20b454", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625085855, "uuid": "9e6234cf-69f6-4985-af16-6d610de4c52e", "comment": "Malware payload", "value": "14a78e85a9719b24dd71fa5cded55f59c14d45211a18bf89f5196cd2e0cd45e5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625085855, "uuid": "76cc5118-f84f-4e53-b08a-3462de003a6e", "comment": "Malware payload", "value": "ca0beb8fde4cbea68a0410f650f3f20980270e47", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625085855, "uuid": "7cda79b3-f33d-43d5-bd20-9b1b1bcc6ddc", "comment": "Malware payload", "value": "b1f1aa90453c90c6fab2473aa10e7845becfc1605b87332a7b3032cc1ed69be0ac91056eaa1728132057e1449d383f6a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625085855, "uuid": "a1f030c0-367c-440a-8c8a-52c6b5d92e70", "value": "D5230A003BE9812BF2BE4F78ACF26145867AF2637603D54A2CC451DB5613FC696426EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625085855, "uuid": "8bc7b962-81b4-46bc-b4c0-9cc68b6b0cad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625085855, "uuid": "13072e1f-794e-448a-a70e-43159577ea2f", "value": "768:HuSgNT3ol7xWUpe+7mo2qLDw1lxY0G8PPI52ujbygX3ikEm4BDZjx:HuSgNT3K52Qw0l5pb1XSI+djx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625085855, "uuid": "2c2b4b49-7eb2-469f-8235-b5abe261e1d9", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625085855, "uuid": "f249ab58-deee-46f6-8098-fad15d3ee19f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625085855, "uuid": "0211ae5b-877d-49fa-bc52-095ed27917e9", "value": "j829zaxe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d5d5db-d99a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625054517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054517, "uuid": "0df921a6-7cc4-4534-aa7d-c02ab9be967a", "comment": "Malware payload (Loki)", "value": "6c5e4494254ba1e8eb6cb8cfb5e501fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054517, "uuid": "e0f6252d-e3ee-49bc-9b86-c0871a711f9c", "comment": "Malware payload (Loki)", "value": "15180ee9f6a8682b24a0d5cb0491bb4e09d457bfab5a24ec1fcb077dab59773b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054517, "uuid": "b06889a6-4b58-4f01-90b7-d9f123d76cbb", "comment": "Malware payload (Loki)", "value": "06a98b3236ffec54ac0ad79036a02c296d31df20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054517, "uuid": "948c87fd-9281-4655-9536-668a9836d518", "comment": "Malware payload (Loki)", "value": "d593a7c0a156afe18e7bdc7d2da25a832c9e0a92c2ddf5f4b7829a0ef609eaa5ce1f46345ca41f6c01a6c7903a298db6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054517, "uuid": "aed08dfe-b24f-470b-8f3a-e90ebe02262b", "value": "00155A3D19BE113781BDD3998BC88C2BF840D67B31617E7898D743A5470AA8379D223E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054517, "uuid": "5b767aa3-3fcf-4a13-bfa4-e4e1a2588d71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054517, "uuid": "eac4214a-9e3e-45a2-8d32-c4bcf598f826", "value": "3072:alSqfUfxdsspPrK4t60vMhppufd7RKaep8uajS7XIffIsgzQgi6zts1mhS+GNrEm:5qAxJpO4Ut5uZruoGIosTgNWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625054517, "uuid": "e98890e0-cd8f-4533-a03f-c4e3db413b75", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625054517, "uuid": "cad142be-d95f-40fd-9530-1e86f8b9176c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054517, "uuid": "a151c17b-726d-49c0-8f60-2640e37190be", "value": "RE New Order PO023012021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b738d3-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018351, "uuid": "ceae8d81-fc25-476a-8c08-a1e9056f55e6", "comment": "Malware payload (Mirai)", "value": "6652be8ca4517992f19b914cc830e75b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018351, "uuid": "6a7bcaef-136b-4a53-a6d5-e37d431b760f", "comment": "Malware payload (Mirai)", "value": "15c48d1133f994942a1fbe17bc955356893197783875ec15b9677229cfe2a543", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018351, "uuid": "747ed154-226b-4e15-a5cd-c0021675ba88", "comment": "Malware payload (Mirai)", "value": "1402d9f02daeddc2176d460dae677b15b9f1cf6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018351, "uuid": "da8a456f-ec1d-4d30-9264-526960f7b12a", "comment": "Malware payload (Mirai)", "value": "97836762ebad972053d34aab0357e6f88074eb09ee89a56863ae1027f5c37c92a53ea8be3722ae8dce9d8685b8cac522", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018351, "uuid": "f7ce465d-6885-4468-ab29-386679f6bd6a", "value": "62C2D0AD2705C6E9D0A850FE4344277A5E210BA5AE83EC020AE5F6D7DD0DCB0B4C7DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018351, "uuid": "5bf4c612-e95a-43cb-b1c2-a4194ef30353", "value": "768:12G214DFyos0+aOIRRa3bkz2uEJd6JgGlzDpbuR1Jb:12GdDgosnanRRaAz2uEeVJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018351, "uuid": "f62f56a7-7b84-4140-85f8-3ed7fc6d9cac", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018351, "uuid": "43a71020-16cf-4579-832d-b344c81f92e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018351, "uuid": "458d749c-7699-4b39-88ee-79a641478279", "value": "6652be8ca4517992f19b914cc830e75b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97f437a-d936-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625011543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011543, "uuid": "c95a336b-d1aa-4a62-9737-bf5f50d2bbe4", "comment": "Malware payload (Loki)", "value": "d9a1b7c56a0a60987977fd59aa419c06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011543, "uuid": "15c77347-c15e-4392-ab13-bd2f9a66578f", "comment": "Malware payload (Loki)", "value": "164d8d2e1460f1398f81879e94bb1702107981c8a3ed08754c8a83a7ee088e47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011543, "uuid": "8f6c009a-fbd4-4ba5-a74f-c99d353cc640", "comment": "Malware payload (Loki)", "value": "ea05f3a19714b4346d9533e4a0a947c877c47c8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011543, "uuid": "b9dc1e38-27d7-4584-a3c2-5bf1b12c07f0", "comment": "Malware payload (Loki)", "value": "8228223570dfd19a0b1d31959660004dc018566bfa75963caf057481eda27382dd33e8334450e0e5abf92966d3c026ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011543, "uuid": "b1382282-6c3b-4cf0-9d57-e59a1d105b86", "value": "7D846B00E750C039F5F622F48ABA92B8653DBEE19B1460CB63D52EEE57756E0AC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011543, "uuid": "48ab92bc-9bb0-45ea-8145-7cefcc451312", "value": "7461691a308c2c87b8767f89c812e062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011543, "uuid": "9a10cfe1-f247-40ba-adb6-54910c357642", "value": "6144:uIDqSUxZdrnYd9nNGQppxIT9CiFfQ5V5iGPc6HsAalYoXhlC:uIDjUDFE9NGQpvITdFfQMac6MAaCohc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625011543, "uuid": "1324fe3b-4f13-4791-8f87-44401748046b", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625011543, "uuid": "032398e5-418b-48db-b314-3f8d7ea05f6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011543, "uuid": "d443e4a8-bb8c-4c4c-8a01-96324ed3b6b3", "value": "d9a1b7c56a0a60987977fd59aa419c06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5026e759-d967-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625032331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032331, "uuid": "11f4415f-c0fc-4b33-9757-04e51c3e5658", "comment": "Malware payload (AgentTesla)", "value": "a65fb419fa22bd427c0869814f265dbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032331, "uuid": "e5c50077-d362-4b23-893e-26c1f679d3d4", "comment": "Malware payload (AgentTesla)", "value": "16fc370e530afdde05fe41e38822b935747c784ac8b6bbc8a3f7623915aee083", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032331, "uuid": "966b7079-d8e3-4f03-9fd6-35f93ef690d5", "comment": "Malware payload (AgentTesla)", "value": "46001bc2e3fd01133aa6f3b6f8d32c5565e12ec9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032331, "uuid": "fdf21994-4f5a-4509-8f37-f22d7d12599b", "comment": "Malware payload (AgentTesla)", "value": "63a1751955d242704de661ba6a9818a8f1a25beeab9cf3022f932070b72ac8bbe7a049609b69ee2f2b2c09b8bc177b5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032331, "uuid": "b1d8dc18-ade2-4c34-8d92-180af15db553", "value": "AB157CAC325035DEC567C6BACAA8AC74A6613C7A431B8107909709DFAE4DB93CF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032331, "uuid": "d9214f97-67f4-4c29-ab54-76a6175a9b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032331, "uuid": "753c8bbb-38d0-4c4a-a701-ee5a11fa1c49", "value": "12288:6D/2ZQrYy6TTvMsgFNLihltz/q5RfwsxRyIGvKzyl0N1a+SaVB0PJ2HP27SJYJPe:NZQYrvHgFwlBm+2Ryj0i0N1aa0PJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032331, "uuid": "1febf623-8878-494c-b651-23d55ce66b6b", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032331, "uuid": "829ce3e2-b0ff-4c0a-823e-15f7b103e0b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032331, "uuid": "1912286a-89b7-4fe7-b885-1e72813c6b61", "value": "INV_00000009_998.pdf(82KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d64831f-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625075705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075705, "uuid": "8dec5981-e16b-40bf-b64d-d13cd531ec59", "comment": "Malware payload (AgentTesla)", "value": "ba468a0078941954eaccaeead660f8ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075705, "uuid": "25916ddd-c162-4d5b-92ac-882ebd2dd205", "comment": "Malware payload (AgentTesla)", "value": "170ae1c29843cc1f147208dbff774a0feb16d25890add1e8f4609668caa85c8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075705, "uuid": "23b4e517-10c8-49ad-8ab0-6320ab7ecdf7", "comment": "Malware payload (AgentTesla)", "value": "4d9b01c403975c9e13a6cdf2f1495b1ac84706db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075705, "uuid": "63de2a6c-9e3b-42f2-aa5b-50c9f195f372", "comment": "Malware payload (AgentTesla)", "value": "5e8a551d5764c06d9fb0f36b9d74788a96637728aeb0029b7e9b41c32762e27b25ee2207aaa508a8217bd69ba7db0207", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075705, "uuid": "412f5173-e137-47cb-b362-852331ad3a6e", "value": "E3557B3D59BE113781BDD3998BC88D2FF880D66B31217E7998D743A5870AA8375C213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075705, "uuid": "cb72850e-f5eb-4652-b6fd-8a4954028c0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075705, "uuid": "4499f464-c4d0-434d-a418-0be300d838a7", "value": "3072:tlSqfUfxisZpXr64JiTv1ZpuuLd7TWfmpku3zYW7FILfYsVzMgYTzeH2kmIU680o:6qAxDpW4IZ2u2Tu3k8IUsCgCPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075705, "uuid": "70691da3-945a-49bb-ab16-876e1a7fef08", "value": 1315328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075705, "uuid": "19f54522-0e4e-48d4-9b0d-b3d6e793b684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075705, "uuid": "c8437009-dc86-4410-a4cc-4fe9c2feefd0", "value": "ba468a0078941954eaccaeead660f8ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d12e02-d967-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625032252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032252, "uuid": "f889e26b-26f9-42dc-a3ac-d6d03e4bde78", "comment": "Malware payload (AgentTesla)", "value": "f246e0d57dd56b0f822b1ceb9edb5b21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032252, "uuid": "bb5f36e2-1038-4909-b6b5-4cd8638f6503", "comment": "Malware payload (AgentTesla)", "value": "1716fb9522debc0dec5a177f2d295fb7a0dbec1439c59f02a4643d749b065024", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032252, "uuid": "055cc4f2-a39f-4222-8ba6-8b23e6906aba", "comment": "Malware payload (AgentTesla)", "value": "87c0fa2afa646c4a8ad1746342080a78a01d387c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032252, "uuid": "cc0fca6d-ed99-4f3e-a36e-d4e299d9a866", "comment": "Malware payload (AgentTesla)", "value": "2f44a2af7362b183dd17c2e55cc1a8f20ef9115643b38a3d2b27693b188f16782e8610f54d638e6791d8412dec3f8c7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032252, "uuid": "4bf5408e-64f0-4f71-93a1-4d5bdbc3e71f", "value": "09156CAC3150359EC567C6B9CAA8AC74AA613C6A431B8107909339DF6E7DB93CF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032252, "uuid": "25fc4f43-1775-4990-b0ad-7ffc43914f23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032252, "uuid": "3236cf47-b49a-4d9a-8714-3da9eca568cd", "value": "12288:cDGaB9M1mP392Vuy56ZQO9LoGtzSF4YSMHssMx5Ft2jj9vW12Vn0dInmWtTvGWwA:J1mQsZQOZ64YSMHssMx92jpvfn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032252, "uuid": "be3416b0-e7ba-4744-8595-262e3ca923f1", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032252, "uuid": "7dba9021-a833-4a65-af70-468347b330fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032252, "uuid": "0517f2e8-af66-4a0d-82f4-df8c228c95fc", "value": "Purchase Order RFQ-HL51L07.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5e881c-d9ac-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625062044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062044, "uuid": "6913ba2a-b079-4768-8d88-85fb865a56d6", "comment": "Malware payload (AgentTesla)", "value": "af3e6a151c9986710803fb48db0fe32e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062044, "uuid": "be0f6c13-0f8d-4515-9cbc-5cedfb27ca25", "comment": "Malware payload (AgentTesla)", "value": "17c1d562b8785c520bc6e5cb44c7c229e565d8c715ca19057d25faca59352ffc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062044, "uuid": "0542a7d4-f997-40bf-bd5a-e072563bc870", "comment": "Malware payload (AgentTesla)", "value": "8e2b02311f245488f09fbe8f9627b6db7361e7d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062044, "uuid": "c9cf22e9-32dc-46b4-a9e3-2551e911b34b", "comment": "Malware payload (AgentTesla)", "value": "df4e9beb5d3ced42c2cecce869168007190d7518de3da1fe17fbc4b92dbc8ffa26452cb63b5bb7377610a0b00d7e4957", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062044, "uuid": "99a39ebd-e225-4651-a1d3-1a6e83e8a78b", "value": "12156CAC325435DEC467C6BADAA8AD74EA613C76431BC107909309DEAA0DB97DF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062044, "uuid": "e37d08c9-e758-4b95-8245-4aa00f51af67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062044, "uuid": "d02834f4-8345-4562-bcc1-67dcfca913b6", "value": "12288:+wPeZsjwFEsKdT0iS/yX8uJr9ar68uO+HqjS2eYM/d6BNoZx4vzBizLZPT2S7TAP:heZKIirJamKZjSA06BNoX4Uv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062044, "uuid": "bdbd5456-9e09-4576-b3ff-95c6cba6b464", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062044, "uuid": "838f1fe6-9c14-4829-a001-3adbc365239c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062044, "uuid": "256dd94f-5ab8-4aea-b609-3de94d522490", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6474c71-d9b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625066433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066433, "uuid": "ad5c98ea-3488-4cd6-8c09-6ff9a6c8c9e3", "comment": "Malware payload (Mirai)", "value": "f526236438f412cfa8872da52c14a52b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066433, "uuid": "d685a947-e466-4f01-82eb-992770818bce", "comment": "Malware payload (Mirai)", "value": "17fa04ae180c5ad8fedea3aa1abdf5006d5529110b44ef22565be139eaaca405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066433, "uuid": "d314ddc8-3d92-4765-9623-eb450c562df4", "comment": "Malware payload (Mirai)", "value": "5327289a29c73223ff2cbc01d886a13093f36410", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066433, "uuid": "6fe01e08-3d30-48f9-80c1-d3eb31530c4d", "comment": "Malware payload (Mirai)", "value": "662f30cb9a17388ee53853ff9a8a3b230f5fc0b51ea175ddd32aa6fda7d1b8199c138ab5cc740a8ac89a9add3bd0d076", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066433, "uuid": "a8c7c44f-1aa1-4f48-baa0-cc4dfabf278e", "value": "E0C2E12A0250E9E0C9F4657798A34EC3EF9727FCE087B8C23B3C55D428966429CE90D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066433, "uuid": "55c53b26-c5e9-45de-bf79-f2e2bae5baf0", "value": "768:vscWiglXVwfV1iTQSuByb3AJCycwOgLrHFM0nrT9q3UELjsX:P0ITiTQSu40JbGgyL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625066433, "uuid": "c8f89a6f-4fcf-4ad2-872d-150d173c5a14", "value": 27480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625066433, "uuid": "c37c716e-8f0a-4685-89ed-4e09f8b3c2a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066433, "uuid": "46b215e6-ac1d-41e0-b5d8-95c0ff466e56", "value": "f526236438f412cfa8872da52c14a52b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec01e2d-d9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1625087734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625087734, "uuid": "eb41c99b-ec26-442f-b22f-aa33097d3866", "comment": "Malware payload (CryptBot)", "value": "afa1f2052272a3e1cb2ea21ac03d004d", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625087734, "uuid": "5176de6b-9b2f-4d73-8cda-1f9fec711d01", "comment": "Malware payload (CryptBot)", "value": "196b4e5b120de3e2bc0899eb8191fbb5a0e23f11177a38a3da6830f6190797ec", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625087734, "uuid": "925bca27-a706-44a8-919a-5b3325559a12", "comment": "Malware payload (CryptBot)", "value": "e4af1543557af5e552b09c64cd17564f6ae16dac", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625087734, "uuid": "11939fc8-c980-43f6-a595-cf7fd80b332a", "comment": "Malware payload (CryptBot)", "value": "44ca1ed8f34679b74fbbc00959984c723eea093b057b70f0985fafac19637b3f382439d2fa75dd2f19ee152004f4d912", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625087734, "uuid": "b4b60f36-7dc9-4ca7-bb45-49c121b9709f", "value": "39F412217581C9B5C452423056A2DB6057AEBC3296B74A0BF7A01FBF2E3B6C15BF6307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625087734, "uuid": "5cc621f4-33a4-4648-8fb6-ccee2fa94593", "value": "56277425cc4e9198f16e54164d30a11e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625087734, "uuid": "9fb59e50-b32b-4c76-afa1-7b64072a2a43", "value": "12288:NiLLLd7VO4MW9HDKFEyMjG/X30FA0eZnmZjvS3nqrf3YKgM5kuECF:NgJOy9jKFEyM66ABw9SQYc9E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625087734, "uuid": "56ecaa46-1a2c-433a-93b9-9c51f1392fff", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625087734, "uuid": "fa8c8e74-1953-4d94-84cd-8a17f5c92757", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625087734, "uuid": "3d777935-ac09-4e52-9a4f-2559ee569a51", "value": "196b4e5b120de3e2bc0899eb8191fbb5a0e23f11177a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a40f87-d9df-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083855, "uuid": "4c07b5e1-9704-47ee-ac46-367ff1261201", "comment": "Malware payload", "value": "19eebafe3a1884f2621cb7ede5c250bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083855, "uuid": "430f5ea5-59d7-42b8-84cd-f0d71a72004c", "comment": "Malware payload", "value": "1a70c382a53e0da5c0943a1d7de845dd2c1e2106827d379d1c1e143c111a2435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083855, "uuid": "6a43d7d5-b90e-475f-b2d8-6eae205a05ff", "comment": "Malware payload", "value": "17db366f769348edea907f2042e2a5e5fbb531af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083855, "uuid": "236cb0aa-3117-4eca-87a6-7a7a34e4275a", "comment": "Malware payload", "value": "69e290c53f10853b5183a00b2258b09850e8d6c16fe48cf51702d04b5ec64c9e01ba47ae8916ebf2485a4a559e3c7dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mettle", "colour": "#D545E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083855, "uuid": "3febdd27-6516-4722-a4fb-f531c77029f7", "value": "86255C09FA43E8F0E172A171058FE7B6952558394123E4B7EF1A7E7CB43A3119E0D36A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083855, "uuid": "328ac73e-a4e3-4b3d-8259-b80bca475a84", "value": "24576:jHMKV9YElym1LMY+QEG78dvJs1rH9UjlW9rTcrs+:jTyqL9EAqOTcrs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083855, "uuid": "01ccbd7b-2648-4531-b991-a717ee577bfe", "value": 977205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083855, "uuid": "50b8c094-b66f-4210-95dc-8841596def14", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083855, "uuid": "5a5495b2-28df-423e-a868-f6b0d8d30bf9", "value": "139.224.105.96_666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a804a959-d993-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625051376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625051376, "uuid": "b6dbc00b-af0e-4ce0-bacb-e0c858edd26c", "comment": "Malware payload (Formbook)", "value": "ea9dac7924879bf7102464b3095e81bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625051376, "uuid": "5da99363-eb45-479e-be81-d4ba9982a187", "comment": "Malware payload (Formbook)", "value": "1bcb33eed3dc2a21fba05a84a06d63d2313c4b69e0eb6db6e781ffa7a7732b03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625051376, "uuid": "9f992208-d496-429f-b95c-291e55767f5e", "comment": "Malware payload (Formbook)", "value": "4b9f4e1aeca94984f57767be2d8c32d62b8907c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625051376, "uuid": "bf4a3a03-df28-48f2-a109-4239789f5962", "comment": "Malware payload (Formbook)", "value": "26ba0f04381f8e17fc2e399381b4305af52a03ceb58c815893b3185c72ddd28604407d3a0ea89830b273637c9761bfd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625051376, "uuid": "6c22d07e-2af9-4e30-9ee0-58511f0e2927", "value": "0CE47D311BA95A36E0BA9FBDD5A1208197FDF6236F03D85C78B511C50712E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625051376, "uuid": "fa3bf8f7-e59d-4032-ba01-8f762d6addd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625051376, "uuid": "7687c0a5-2491-4b45-b9a5-df7bc869809c", "value": "12288:P4W2vwGBbX5Tyg1Ve6d31WrYQtULq/7nrTvDBzjq6a:P4W2vbX+6d38rYQtxjrxzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625051376, "uuid": "cd7de6a4-7709-401d-8afd-59d1bf46b746", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625051376, "uuid": "085ec0b0-b17c-418b-80eb-1ababe54e792", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625051376, "uuid": "05f06f54-a08f-4500-810e-0bfd192d5fd0", "value": "jsc_PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ac7d4a-d9e9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625088279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088279, "uuid": "18d05c17-9a1e-42ae-9e4a-40d5f6bca3ec", "comment": "Malware payload", "value": "a8876fe7e7708034f35575ec5c9da418", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088279, "uuid": "50937a3b-5030-4ff4-8bc8-cc7b8f216fb2", "comment": "Malware payload", "value": "1e27c9a92d5613081886fb0a2cfcc6f346aa743e966fd489d00fc9cbbd914483", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088279, "uuid": "fd6fccfe-05f4-4f53-bc8c-fd586200535a", "comment": "Malware payload", "value": "ad28f807c816499e33d837d69b4cdab04344db7e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088279, "uuid": "28279897-87ff-4ebb-a7f8-e5604624de74", "comment": "Malware payload", "value": "c6e5eae7040fab2cd9f69af214604099e72f983266a90d925aa5fe2f2ba222616da41d3429acaf3e324d8740f308e824", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088279, "uuid": "d52ca975-16bc-4bfe-9dec-6b7e8e8022fa", "value": "71A3CF1EBD9A83E8F0179833214C43A3ED6D049DE445E02F2BFD59D90D72C6D5612AEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088279, "uuid": "3b33eb09-a333-4e72-9a0b-1a003b3d848e", "value": "3072:ZR8ZSM6irU7d/tGlA9g7WHW6rYzA3ZYQx7ddW:ZR8Zv47ttBg7WHSzOHxpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625088279, "uuid": "828a2fa1-683e-4a36-8e1a-0a89c3015651", "value": 105899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625088279, "uuid": "0caf2285-9d5b-496f-8791-c1d1d06b2514", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088279, "uuid": "e726b514-1a69-4cda-ad6b-dcc6a7fb7778", "value": "DOC000309-06-30-2021.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0a95b0-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018929, "uuid": "b5065fe4-c582-4bae-9739-2a27b8082b76", "comment": "Malware payload (Mirai)", "value": "be510f98533c6d327cfec3054505e7c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018929, "uuid": "5e7f8ffe-f4bd-4258-9b65-807d35b04aaa", "comment": "Malware payload (Mirai)", "value": "1e5b8007122817f9387d59b8201505299ada843de56a0f8ecdf9feacab0a1735", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018929, "uuid": "e84b1448-1d58-4e05-b679-2e8c6bbddd96", "comment": "Malware payload (Mirai)", "value": "db056dedbcd72a557a73f3e83260e8fd352f6ce6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018929, "uuid": "71ccb0b8-2083-409f-a1b4-e7862c0932d1", "comment": "Malware payload (Mirai)", "value": "c3f178f4614fb3fe1c0f7761965bc19fbba731b9f07149666f71ab025bb698a9a5428fbdb12ff5adb2ce20fd3f4f1e34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018929, "uuid": "b6f4ea26-b4cc-4e8e-b0fb-c0752ae84cc6", "value": "D773D715FF651FB7D89BCC3309A81B0628CC665A22B93B367E34C918B54B15F19E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018929, "uuid": "2bfb563f-3ba6-47fa-bff1-012a3c022808", "value": "768:lqwATxpQ5e+y4rWC5YOZDSfqGcOee2etJeG67t/kWDrXilvo2KXZY10UQn:lCTxq55OEDSfqX/74JVyt/HJ26a10H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018929, "uuid": "59276a8b-9478-4015-b185-753f75158d13", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018929, "uuid": "9da3da83-76fd-4aa9-b4b8-bede6019d816", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018929, "uuid": "33f27c35-ed07-4e8d-be65-de4a4dfda4f3", "value": "be510f98533c6d327cfec3054505e7c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f343c686-d9cf-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625077272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077272, "uuid": "a879a99c-7df0-40f0-96d9-3caf1338901d", "comment": "Malware payload (NanoCore)", "value": "6fc65c14ff61433c356bfda77e0c6e41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077272, "uuid": "d054ef79-df16-4ce6-bb24-4b8a75400d94", "comment": "Malware payload (NanoCore)", "value": "1feda728feb0187e19e099ddfcb542c608b3ec67149592520c1515bc6d3ada03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077272, "uuid": "b58b0838-16f1-4c4a-b07f-64591dcead4f", "comment": "Malware payload (NanoCore)", "value": "c8b4c809ab7bcabe1c29dc0c901e3af6ab779493", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077272, "uuid": "5ecc6f97-f116-4332-accb-3f4ed9cba1fa", "comment": "Malware payload (NanoCore)", "value": "10fc91c24501627874af5b853f7431959998c99309c895a061486b9cd96eaf13b07d8c51d7624c16ac36cda3025927fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077272, "uuid": "b9b953c4-9ccb-4721-ab46-8daf5284ac0c", "value": "62F3F1A8D3BCBCD7F40AD0F99EB3B5A5961AEA5950240F1A3C2A3133547235338A5D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077272, "uuid": "6d59bce0-956b-4317-a3cf-ebd2a3fd08ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077272, "uuid": "31503ed4-700a-44e4-a7d1-3a3a01ca2476", "value": "3072:RsH8hiUNcplOhMdWZhEVJaSHlmx/YDWDK88g888AhdrZMs25TAkqXeQTbC3PTWSB:RsH8hiUNcplOhMdWZhEVJaSHlmx/YDWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625077272, "uuid": "d28c9c1b-ede8-4be8-9168-c137320fbccc", "value": 165568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625077272, "uuid": "53c9f6f9-5603-410e-9c07-d9e8b91806f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077272, "uuid": "4c94236b-da1a-462c-9590-f595d766a7fb", "value": "6fc65c14ff61433c356bfda77e0c6e41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5146344a-d98c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625048224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048224, "uuid": "d09986c3-5713-4f4d-ae88-3091cd505553", "comment": "Malware payload (Loki)", "value": "856700f6c736e84c1b4ab9c2269a5241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048224, "uuid": "6d3875df-151c-40a5-9d91-23a5897f4abd", "comment": "Malware payload (Loki)", "value": "212791a3925114eb9d9aa02d0d9bfd9376ec4b3728197d813acc461f8f42fac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048224, "uuid": "7effdfaa-b6d3-4428-9eee-eedde2769202", "comment": "Malware payload (Loki)", "value": "b31575cc629db4c29e07423482ec694405cfc20e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048224, "uuid": "93fc6218-c610-4c98-a9d1-bd52cb34dee4", "comment": "Malware payload (Loki)", "value": "b04c062f316b6ffac5a3ee346a469d8df7a01dec8879102a5f12aa45b4fbb6921caf1bc83f56027fc738b695e071302e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048224, "uuid": "2c6dfc75-84f2-43b1-b71e-4f7ab09e88f8", "value": "1FC4ACE1648D7285ED8866F19F26CD7B07225C1A68A8D0EC56D73C077FBEE834D44A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048224, "uuid": "acad2a83-4615-42a9-bab4-4bdd12d650ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048224, "uuid": "cfb69c12-9b74-45d8-aba8-879e74c8027a", "value": "12288:9eS9qEFVzMFJ3ZwIw7NoH9j7IctvxSTn/f1FalWj3U29tNcscmm:9laxZwIwxoH9jMcTufrR/tNcscm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625048224, "uuid": "f8313043-4df0-4fae-abeb-b273e71e1eb2", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625048224, "uuid": "d545d614-ca26-40d5-ae09-590684aad2a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048224, "uuid": "05c33bc4-65a0-48de-ac50-567fd3e06634", "value": "shipping inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0b959f-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625059191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059191, "uuid": "8202ac1c-ae15-49f8-91ee-ce180a6d3eee", "comment": "Malware payload (Mirai)", "value": "7558b3a3225455d6156bb284a855c95e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059191, "uuid": "4ed02414-8759-44b6-849a-7bd3caad6cbf", "comment": "Malware payload (Mirai)", "value": "2566a1dd6ca0567f401159a20d9301a9831e92156aa30ac8ee24c21e3d04a0d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059191, "uuid": "a40245f4-f57a-4138-800d-d9c493e059a6", "comment": "Malware payload (Mirai)", "value": "cc57e728bfb80715402a92ea92595efeed2d21a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059191, "uuid": "d5f7b0a6-ebf9-472c-92e0-eaa244fb1bd0", "comment": "Malware payload (Mirai)", "value": "17c76d25756bf4f4cd6202be8fa95a712e539550923dd42a0c6f0dad0e2ad9c503ed4a1ac840c7c46254af2e85d551e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059191, "uuid": "9c213477-cd07-490f-9bb7-9f7ffcea64ca", "value": "B613F121914DCE32B6F3AD6169EC87C65F88D75841EF370817C71928FCD6504AB78593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059191, "uuid": "73d1fba5-ee03-460d-9b15-4ea4ed110b90", "value": "768:ayMQQtciXkq365r2Jbz60qK5qQjhyp1mun3T1bOdq3U7X:ayatFqEJiEqQlyp1mE3BbOxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059191, "uuid": "802e86a7-1d31-4f58-be93-1f72069d1b24", "value": 42468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059191, "uuid": "6fbac221-16b3-4b63-835b-23da8d9c5f20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059191, "uuid": "509ff603-3f2a-4888-aaad-46a08f78f713", "value": "7558b3a3225455d6156bb284a855c95e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5266832f-d981-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625043502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043502, "uuid": "f45e335d-7e1c-47d7-91cd-62fde137ace5", "comment": "Malware payload (Formbook)", "value": "4c273ea74257fef4e25796421320b5fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043502, "uuid": "2d1a287b-fc91-425f-a009-4cfb0de1db05", "comment": "Malware payload (Formbook)", "value": "25839ba93d33dda960d99110ae98f42e89056233264f11d18b65727a79e4bd62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043502, "uuid": "943aabd8-b79f-445b-b4ba-5ec74da8d990", "comment": "Malware payload (Formbook)", "value": "bbfd4f5e701d99ec2f258a1585c0ba511ab33c2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043502, "uuid": "94a9897c-93a4-4260-94f2-93ce8a231684", "comment": "Malware payload (Formbook)", "value": "6737f428f39b2d7da7c843f352c31f3e22e6813135ccdd671104a79210f0c1eefb7c4258ebae0383592d200f94149f9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043502, "uuid": "0ae8b45e-f760-4564-9bc7-2e1485b8a81e", "value": "C3C4DF6231589E7BF2031CB64C1DE6A215976D24609AF51C64AE374F19F232243EFB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043502, "uuid": "a2559002-4474-41b1-8930-e9231814f33b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043502, "uuid": "6d3cdbed-5e40-4a01-83d0-f40b740fd446", "value": "12288:sOfEFVzMFzYvFbbGC/7+pM6xnkQc5Q13JGpKbjL8DP:Fka8RbDD+pPCQc5Q4+cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625043502, "uuid": "7973f42e-76e9-468e-94c0-eff73962424f", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625043502, "uuid": "14532ccb-6fb8-44f1-85ea-41cab0556772", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043502, "uuid": "7b44bdcc-3f4b-4e03-a878-6f4d2ab1cd83", "value": "4c273ea74257fef4e25796421320b5fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a9d16b-d94b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020529, "uuid": "1b204cf4-26bb-4c24-9cf6-ca1d1d381499", "comment": "Malware payload (Mirai)", "value": "d38533e9c1d5b4eb477c024b448ee562", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020529, "uuid": "a48b99b6-9c2f-4082-886e-0c2231339226", "comment": "Malware payload (Mirai)", "value": "259bf45b31bc1c0a9fc7d946e53b5400abcd76e2de6e13a8160e5ff85049ecc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020529, "uuid": "bfe501ba-529d-4662-bbca-eea0da3f76b9", "comment": "Malware payload (Mirai)", "value": "04739bc744b5142a2c0ae7dc58e32351ee670beb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020529, "uuid": "173b7629-2d58-48af-8548-2357de77d7b5", "comment": "Malware payload (Mirai)", "value": "1cd40dc22d841f886f70664f05287593ab4b6bf35acfef3ed76d72add7b71d4c1e5cd0d89fbc518b28ff665b0671f286", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020529, "uuid": "852c7dbc-3f70-47f3-b0d4-fe94ab53a312", "value": "75A3944ABF215FB7E89FEC3745E92706288D611720A93B79B934D904F21B31F19E7860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020529, "uuid": "ddce1726-4c6c-4f85-a597-993270f0ec33", "value": "1536:a2fsCDpMtQagM6PkH406j5Tb06wnDQhPqf/Jc+n7bdEgvchgp/:a2UCDpMtQagM6PHj5P0tfJEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020529, "uuid": "00e7aee6-0ee3-40de-9714-1d02315b8d60", "value": 101676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020529, "uuid": "cb784c23-bdba-4c5e-8def-20d8abfa4ac1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020529, "uuid": "604113fd-611b-4ec2-a55b-b54dcf4a2bca", "value": "d38533e9c1d5b4eb477c024b448ee562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ee1375-d9a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625058678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058678, "uuid": "eab654cc-96c1-46ab-a973-c17b3bd4704c", "comment": "Malware payload (Mirai)", "value": "12a336eb0a749670be10e2329eb9aa67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058678, "uuid": "806d1e21-8952-48ae-b13c-9973c529a28b", "comment": "Malware payload (Mirai)", "value": "2750e68d4dc4b81bad1480bff4a553be75bd9a55805295bc0f1d1a830fefee88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058678, "uuid": "2cdeeaa7-540b-418b-b46f-142ab44cd862", "comment": "Malware payload (Mirai)", "value": "ff0bdfb17607a84f6d2a251dad54264417aee14d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058678, "uuid": "0cc19320-9404-4597-8b9a-48e901ea09d8", "comment": "Malware payload (Mirai)", "value": "0da1e0284410591562dc3bb9193477c46760ced1d9f32826aef68770fd4003cc2443e8955d68d77b3b4c49a9710141f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058678, "uuid": "5a3f6500-2595-4a1b-b468-8705025b1af9", "value": "D9E2E0239A4775F1C0D01CF7F5E2064F57460F7CE89F254856A85738D9A70D22DF8A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058678, "uuid": "502cc658-0ffd-46ac-99b6-032e7a7c63e2", "value": "768:B62RZBykWxEZlb1XY+VUxTlr9kjnV5Aq3UV:BDBCEZH3ehr9kHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058678, "uuid": "2de8f114-066e-4227-9d2e-b6a2bfdb1999", "value": 32452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058678, "uuid": "28eb1152-9d04-4265-a7f0-715a6ab76ee4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058678, "uuid": "8ec257a9-3827-4afc-80b9-136ec049c65d", "value": "12a336eb0a749670be10e2329eb9aa67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113aaa84-d9b5-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1625065726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065726, "uuid": "b85a4992-a2a2-4c22-8e4a-5ce66bc58bd6", "comment": "Malware payload (RaccoonStealer)", "value": "214236955ebc3924dc9dfd683b09c6e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065726, "uuid": "4bc24cb0-685d-4698-8580-a0f78d292a68", "comment": "Malware payload (RaccoonStealer)", "value": "290161d5869781e1109033aa0932dbfcc7500e9b27f8140cce150040faa63a85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065726, "uuid": "56056696-21e6-454c-a553-d6ae578761a8", "comment": "Malware payload (RaccoonStealer)", "value": "345407c23e580cb0bbaad9d407428d71eade119a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065726, "uuid": "89614a4c-bcff-471f-bd2e-422364dd6c57", "comment": "Malware payload (RaccoonStealer)", "value": "2ce46c970fd0553a8265e7808bd53df36621afb6acc4114bc9167bb32f3a1a1a49faccb710421fcada76aa755afd0029", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065726, "uuid": "c8a6f2cf-6daf-43ee-976e-c632306b79c8", "value": "3DD4DF10A691C034E4F231F4997A936CA53EBEF15B2461CBA2E52FEE47346F0AD31617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065726, "uuid": "0b5bf1d1-8470-4242-9e76-6f41fe77f385", "value": "b147c7cc8fb1e18a18e1be0df596d10f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065726, "uuid": "0e7283f2-53a3-4790-a883-4bd0f1d4d1d1", "value": "12288:1i/GLR5Upb0sFf+aGkuF/IjlrEtKNXHMwNVf:y+TSbpFWm8/IZoI8Sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625065726, "uuid": "4f09681e-a3bf-4020-a6a0-e9c42b2f9255", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625065726, "uuid": "40fdc7f1-b1ff-4ee0-92e3-983fd29bd4c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065726, "uuid": "53e31db1-7f02-4c49-b43e-90ce784320e1", "value": "214236955ebc3924dc9dfd683b09c6e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342f6241-d96e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625035291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035291, "uuid": "08165007-e241-418a-a9f2-248910d495a9", "comment": "Malware payload (AgentTesla)", "value": "f19cc99b96d8ae74c58ed4ce1c499596", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035291, "uuid": "5abfb02c-fceb-4313-8eac-90564c87f999", "comment": "Malware payload (AgentTesla)", "value": "2934c326f147637310d64612d1304d4f6a0013b8f494821414005c293dde1a38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035291, "uuid": "58c53f4c-6760-436c-b242-c7897a359ef8", "comment": "Malware payload (AgentTesla)", "value": "ae853237cb916a524397f32fb8b0fc233fcedf3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035291, "uuid": "1dfa66bc-99ba-4953-a5da-0c25de9723ea", "comment": "Malware payload (AgentTesla)", "value": "812f18a65972c2e1049c74afc9697c113d4fc14786373c833751ac081a4f2a2d7f4f150695997ae91c9562e9be58f246", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035291, "uuid": "8b372a18-1bac-40f3-9de5-3e47d231a1ee", "value": "61E4F1A0718E497DF29FE134033512EA4ACFCE4562294E01CA7E39DFEBF4A58D125C99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035291, "uuid": "2cf08aa3-eb23-4f37-966a-bc6484240695", "value": "12288:LdEcRQJtplE+jNrwyQsebWtlpjILAs7XnWYuZ17gRw:LdEciHU+jJwy73tj1s7XWYqpgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625035291, "uuid": "7eda5b64-2ebf-4821-a782-2268b2647780", "value": 665960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625035291, "uuid": "8456806e-f72b-42da-b9a5-0503001025c3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035291, "uuid": "57bb9c5b-5f5b-4a27-9c47-1102cd8857c3", "value": "BOOKINGFORM---UNIONPO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2904a2-d93c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013752, "uuid": "8ebb4017-cd42-4219-8101-03a26b1f2542", "comment": "Malware payload (Gafgyt)", "value": "c01116cba10e891c0af94632e04a4703", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013752, "uuid": "c3656a88-3b2c-4770-9926-db3eba1fe909", "comment": "Malware payload (Gafgyt)", "value": "2a1c1a22ed6989e9ba86f9a192834e0a35afec8026e8ecc0bb5c958d2892d46c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013752, "uuid": "78a4f8b9-1a3f-4847-92f7-beaf47d11d2f", "comment": "Malware payload (Gafgyt)", "value": "67030b78ad6d0fe4fb3c5c3398a3ed34e9a2a847", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013752, "uuid": "57d1d392-6f0e-4d22-af3f-c95d6652a218", "comment": "Malware payload (Gafgyt)", "value": "5b4c9ba98b036ac01bd353c48a436052f1b314aad23ec6f285b4d3cdfa8ba3eea00b568b3697803f64adf5629b3aef9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013752, "uuid": "470141e8-37a4-4794-aec0-50f3ef6cf030", "value": "A404506AB7719EB7E80ECE7305DA151210CCD68642D97FAFB6A4C518E78B80F05E3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013752, "uuid": "d224b04d-eb26-4406-ac24-496c9b9530a6", "value": "3072:ROjBmENI92yBVHAWX085hqtW10AguHTzFxRxu6qb1cWgdh8:ROjBmENI7RrE85hqtWB1xRxu6qb1cWg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013752, "uuid": "f5697430-6a57-443b-8291-9182edb18580", "value": 187465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013752, "uuid": "4a4730e2-fa79-4e60-8744-0c38ebebf633", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013752, "uuid": "00a83ae5-a5aa-4c4a-8350-ad7ecd38e828", "value": "c01116cba10e891c0af94632e04a4703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70387a3-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083265, "uuid": "754d7bd0-3164-47ae-abf4-91424b44f057", "comment": "Malware payload", "value": "ff46a7d9844b4b0d896d776248477987", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083265, "uuid": "a0c20ea7-7827-4099-828e-d0ee947444c1", "comment": "Malware payload", "value": "2b859d38c6d894f8fe9f1198514b19227286c8757477a305d6c4603cc4990496", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083265, "uuid": "0eb8cf71-8722-472b-bdbe-1f4d0defe3cf", "comment": "Malware payload", "value": "36f16798e2f30063cf4f5f219cc95a603336abc2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083265, "uuid": "a2f9bb96-e1db-4019-aec6-96be8febb834", "comment": "Malware payload", "value": "f58bd7cbf99bfa8bf06201ed007831cbd81316476925c7755597f56d5b51b7b355a8eed78142b1b54c2694b1b060f8ce", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083265, "uuid": "09bd933a-0b1e-45e0-9574-d30cf9551c50", "value": "04241245D127E822EF9F4077BBF92EF61365482309491533D631386CC9A7C6E92287BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083265, "uuid": "c54d886c-c5c3-4394-af82-03eaf0628bb7", "value": "6144:ffipA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56RF:Xiu9l2pgxjt6XUyNW+Md56H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083265, "uuid": "ceedf93a-2f46-4f35-ac22-84264331beac", "value": 217864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083265, "uuid": "0ecfc061-00cc-445f-a941-76fe02a27ff3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083265, "uuid": "e1cf04c1-f158-472b-b376-7e584ca16e5b", "value": "INS 14583345.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae6693a-d9e9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625088345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088345, "uuid": "7a93510d-a8ae-4672-a0e2-f95090994891", "comment": "Malware payload", "value": "9da43332566527a6871a99dd9e007dd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088345, "uuid": "cb0e8202-3ad1-437e-b91f-705c51d1d4a1", "comment": "Malware payload", "value": "2bfd86b39753807205e4394a7cf8255bf2456983e28e55136d18a83b8a37e632", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088345, "uuid": "7ea2b9a3-8eba-4a0f-8e5e-6179ae695915", "comment": "Malware payload", "value": "19806c6194bdf56ed4c1f10a75ac91c6776cecf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088345, "uuid": "1562a320-23e5-4226-abd3-6c895d60a29c", "comment": "Malware payload", "value": "4b6d8663af5c20f5e52d9b6e2ec0c12481e0309429bda976b8a9be749449b07cdb0110f4bb774cc6fba0409301d3e298", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088345, "uuid": "40246500-0f6f-4e80-a698-d7b385b9ba74", "value": "33850A0176E9D151E6BA2A30DCB9C5FC4A22BD92EC39D21F39D03F4FB971A509824772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088345, "uuid": "35410dc2-d39e-4c0a-935a-3816156d9d67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088345, "uuid": "bcfb8a95-b3f0-48b2-92f7-9eccdf5f09df", "value": "6144:tWBJ6PntG5LpR/Ze7+P8lyrRYwzS21zOyh6PyhtMTXcQjRWswtv1iOvnufyHN8dI:hvtWLpRdk68fwswt9iO8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625088345, "uuid": "938aa624-8a32-4a2b-9c68-69943365f608", "value": 1827520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625088345, "uuid": "d643a4c7-3209-481d-b0c0-6e88cca6de3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088345, "uuid": "4da9e1dc-2f58-4733-84b1-6dd0e2b13a78", "value": "9da43332566527a6871a99dd9e007dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bfb5b7-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083263, "uuid": "65028374-dd42-4ecc-aeaa-5dce3ef3850d", "comment": "Malware payload", "value": "5c977390a996f56ebb5dea112f97aae3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083263, "uuid": "fb33c7a4-736f-4eb9-bbe1-f544ff6dbd01", "comment": "Malware payload", "value": "2c0f3068da419e01554d72b0455dd18fad270b15d09a8f5abbe5b667f61190bb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083263, "uuid": "541e56d6-c9e8-48ed-b1dd-8544b8297ed3", "comment": "Malware payload", "value": "59ea478e842982b7c139f6384fca46f67083226f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083263, "uuid": "02c6360d-c64a-45dc-9e5c-09b0eac102f7", "comment": "Malware payload", "value": "dee4580a805df01a11b078b4a6d15546d964a0c1f4998ffd67a2351ada31be0749a8e52e2a77b1655d8bd138afb48e52", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083263, "uuid": "2ba1961e-eb7f-4fd1-a925-704afaf5fe52", "value": "F1241209D13BE862EF9F44777AF92AF11765482309491133A731346CD8EBC5E92287BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083263, "uuid": "522d0897-4fdf-4091-9d62-37d479d6f223", "value": "6144:fupA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p568I:2u9l2pgxjt6XUyNW+Md56P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083263, "uuid": "525e8f77-c202-4620-9dfb-d3a754fb47dc", "value": 217997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083263, "uuid": "b2e13bad-861b-4bdd-bf81-340003dc02c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083263, "uuid": "08cec620-e1db-4b0a-8032-9685ca1251ee", "value": "Order 2522592.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def38264-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625059199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059199, "uuid": "4d5ceb58-b92a-400d-8d1f-9e3b287b10bc", "comment": "Malware payload (Mirai)", "value": "e8ded529a96c4f044f671f8f1a120f7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059199, "uuid": "52fc5e9d-3b46-49e9-8910-855a5e7ad8e3", "comment": "Malware payload (Mirai)", "value": "2d049876c256e55ae48a1060c32f8d75b691525cd877556172f163fe39466001", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059199, "uuid": "79bd6499-0cf9-49ae-ab74-c0168f3d1bd0", "comment": "Malware payload (Mirai)", "value": "102efa857c25aa819ea40c3e777f17e22c90eaec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059199, "uuid": "e5e4bdcf-f73a-4b0d-9159-e5057b8f209a", "comment": "Malware payload (Mirai)", "value": "247c9e20bca1ddc5dee40c9384d0245271b70d6540559bd977dfa2b03212b4ea805fea858de934163fdd92e385706a57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059199, "uuid": "74100ada-5ae1-4251-a860-1d20571430ae", "value": "DC63188299629FB7C016A4B161B55E740B16BD922E1F1ED97038FAE4427F4CEF00BB74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059199, "uuid": "b67d7c8f-39b9-4a3c-a9a6-ac50f014a7d5", "value": "768:fT4IqJBUqK3h5bKDDcJMYXNGzrKdQXHaNI0oAOTkmzbWsmSfsVOt72t6+GCdoCK1:fTvqUqYOUSYXcKdQX6iAJmvQU2v0CKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059199, "uuid": "fa2c4129-7c28-4c9d-beea-caad0d41c0ea", "value": 70184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059199, "uuid": "ad05412b-5f6b-4f89-857b-fda5dac11589", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059199, "uuid": "f76a42dc-6845-460b-a024-b164b38855c3", "value": "e8ded529a96c4f044f671f8f1a120f7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73707544-d963-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625030672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030672, "uuid": "238cdad8-0d03-4ad9-aa75-ae0ed79f0c9c", "comment": "Malware payload (Dridex)", "value": "3d667e436ccd2ee3f6c46ce7ab4000d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030672, "uuid": "93f97a3f-3fa7-4ca6-8b6c-a086909bfec5", "comment": "Malware payload (Dridex)", "value": "2d48da6c7c1ba4f027ef6cfe07624339a5a4329db5bdb632f87b375d703de0d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030672, "uuid": "5665d82d-4c69-4b73-b064-6c31b56e5cce", "comment": "Malware payload (Dridex)", "value": "9747b2fd14e4558fdc930a68d806e7a89590664d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030672, "uuid": "8a401d43-7697-4fc2-bb73-6a46b49781d2", "comment": "Malware payload (Dridex)", "value": "cd3a1fa871e07954b365980d820d346511103c4acc441e37ad25382b88a36e68c1f5a39b837c9e3980e728f972596c3b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030672, "uuid": "26fb7353-74d5-48ed-a7bc-1c07ebed6534", "value": "BEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030672, "uuid": "1c8f78df-70e6-4192-9d66-6dac90110333", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030672, "uuid": "c0b9036b-1337-4ada-8e41-0abd0e8ef25e", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625030672, "uuid": "4a04ba35-9633-45f1-8240-ea4f8bedaed3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625030672, "uuid": "fa97da01-a965-4577-8533-7d20fce5eaf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030672, "uuid": "0e0198b2-61cd-45cb-8655-56cb90c8c09a", "value": "3d667e436ccd2ee3f6c46ce7ab4000d4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcbee12-d966-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625032193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032193, "uuid": "f68c29a4-7d4b-4a4d-a5bc-dd9148af07e8", "comment": "Malware payload (GuLoader)", "value": "a247bc660bdc40059e8045bdd4902dc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032193, "uuid": "e77cadd3-4baf-4690-b785-8709ace5b058", "comment": "Malware payload (GuLoader)", "value": "2db81b7d26dd94fc6033be69bf9e0ec1a5b0d0f5dd4889e68382ad36b0f5d3a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032193, "uuid": "016f033e-796d-4287-8b1f-d778f77fc8c6", "comment": "Malware payload (GuLoader)", "value": "9f68f043d54169a50fd645392fb1715847a0940e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032193, "uuid": "7ebcd738-ac7e-4c5b-969e-b6deda012c29", "comment": "Malware payload (GuLoader)", "value": "71734683a4e17128c726b836e7516b3a416ee4f173e311afd2f468eac7c4a3cf7dbb672a35af8722bfd821c8af8c9e14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032193, "uuid": "79c3b917-4a95-483e-8e4c-791826f2cc16", "value": "A5A3F6D2A7D78F12E2A74AF01A250D5FB2A57CFC18678D0B05C854193BF6B4B86B1327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032193, "uuid": "3991d387-b471-462d-851a-26ddc4795890", "value": "e3e4c9cae99340ffbee12b193d7b6357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032193, "uuid": "33f03706-0065-441e-9e5f-6071443a8c4b", "value": "1536:tE5E7kiAci+Rdi3O1GyetuMnzM4jTr1CUz6KwsypKGbD5:tDT5ibOQb1r2KwHQGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032193, "uuid": "c0be47a5-9a2d-407b-8bd2-e755e2eb5a4a", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032193, "uuid": "b6d181a2-3fa5-4109-93c1-45e3644638e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032193, "uuid": "6e06b045-8332-455f-8ad9-d3291159f9ad", "value": "Order DWG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2048dfec-d9e9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625088085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088085, "uuid": "e96ea982-d3e9-499a-86fd-d449ef46546f", "comment": "Malware payload", "value": "d1ae1618e12b6902371719dbfe9805e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088085, "uuid": "795fc5d0-5e78-4e2b-ab23-6a107aa5980b", "comment": "Malware payload", "value": "2dd7a0f3a8c01338b500b88c023560f468c8d3c61e13fb5a6e55eab69087e7bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088085, "uuid": "9ace3158-acc2-47ef-91a9-80c0c5ca693c", "comment": "Malware payload", "value": "5bf1ca48ae57ba2795669cac270bd9ac798440de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088085, "uuid": "2cc44f1b-43b9-4461-af0b-f03f98aaffd8", "comment": "Malware payload", "value": "c205aaded374c62ce248debb3fb7d58a18fbee7148d9cae55a977bba253e9d88ffdacb9e05ec3b6f1908ba0f4d405c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088085, "uuid": "e5be2bb0-9bc5-48cc-86ed-3e92561b4a0a", "value": "F3D423617A14E4E1E5880675E1DB61904670EE4A51A2EADEECCF33FF04623FA454EF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088085, "uuid": "7230492e-9efc-408b-8117-aad07ad42dff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088085, "uuid": "11fdacd7-316c-4eeb-a2f2-8324df0332dd", "value": "12288:TEFVzMFGBlfH4YoaJoTTS1Fu66M+ioVWnQhJqyx+r3LAao4p3MANVy3H4c4:AaGBVH4YozTTWiMToVWnQvq33L5o4Gc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625088085, "uuid": "ab753b72-5cc6-41c2-a0ba-717f97038e3c", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625088085, "uuid": "dfec3923-3efe-439e-9bcd-4ca83c800507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088085, "uuid": "dd411aa4-d29b-4c50-b67c-89f0ce69505f", "value": "ConsoleApp3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f277816-d936-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625011418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011418, "uuid": "7a429bf7-3104-4ae8-b53b-d41f78801900", "comment": "Malware payload", "value": "13425d8c2a86e68dfa44e213590f9bd2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011418, "uuid": "08974b5c-0874-4ba7-9abf-f4b2b12f78cc", "comment": "Malware payload", "value": "2f199ced0ad1b99eb6937fb81f629faebcfe66d9a3942af92acd8a006ad51a7f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011418, "uuid": "778b1e31-d386-4a00-9aba-7f4cacbdbce9", "comment": "Malware payload", "value": "c4b1f7db0b32a1ceec85b276d35cc5330c5e29a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011418, "uuid": "d5f526cc-b1c9-4eab-8ef4-6b78573cde09", "comment": "Malware payload", "value": "50e59c60fbbd456b6c57b04d64a2c88db1632cf96a43b949cbfca9e3bfe9a44ac691e5a9f09778f51f3bc84e3d1d0697", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011418, "uuid": "d52e6330-9740-4c0a-9603-ee8e777bd04e", "value": "74D2C063C0860A98C7AA0832E82F3D0C6578BB0999BD06B4AFEDF1058D71F2517DCB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011418, "uuid": "b3dd193b-4283-49b3-9303-2a4a8e8c4d35", "value": "768:iYicrAqMzfOwAHnMZvPFInoL1FKQTCEnoOOnbcuyD7Uryqo:1zAVfgHMZvPWovnTepnouy8mqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625011418, "uuid": "1a53f654-2313-40e3-8321-ba979bc15875", "value": 29508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625011418, "uuid": "b56f3113-8ec6-4b56-bbb9-e05fc62ec0a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011418, "uuid": "3b1f1938-3026-4423-b259-c336dd959b55", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b71b5cd-d97f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625042685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625042685, "uuid": "9a891e6a-5069-445a-b485-10009fd2ee93", "comment": "Malware payload", "value": "90a2fd7bc45623939ac8e886cf37195a", "object_relation": "md5", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "notflubot", "colour": "#D5E22E", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625042685, "uuid": "95d66b1c-2e7e-48c8-9372-b5d2ea141bd8", "comment": "Malware payload", "value": "308854628ee791468c30ec49a0f48bf46a1ee9d615c3efa444506b43a0615e4d", "object_relation": "sha256", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "notflubot", "colour": "#D5E22E", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625042685, "uuid": "0b87c309-393f-4f6e-b85f-1ccbe9b40fe0", "comment": "Malware payload", "value": "07954951921de3848a0da02ea019b0b55a124845", "object_relation": "sha1", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "notflubot", "colour": "#D5E22E", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625042685, "uuid": "173df3e4-7904-4e46-9210-4bbba3c2031e", "comment": "Malware payload", "value": "5bb9dbe2c547c069aa09764c230fbef8e895f5d93735b6aa2ee1449d46ba3b7afcb483913d37c3c600561939c663873e", "object_relation": "sha3-384", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "notflubot", "colour": "#D5E22E", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625042685, "uuid": "d17115fe-6152-4a09-afab-59c2088fcd75", "value": "E706338A9177C889E4AFC674401A7B6FAD245A1D0D71BBBF1B30309C24EBDD1A344DE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625042685, "uuid": "d3a8c065-b9aa-4634-9ddd-7e6ac4b708b4", "value": "98304:cbnNIQ3gphBl7dCCiDtooMaVtQjqtj9T6:cz6QwpbhiiaV6jqB92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625042685, "uuid": "7ae36aed-4622-47c1-8b51-a58c8d7d1986", "value": 3878450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625042685, "uuid": "fd4da847-5da4-4166-bf16-e83f0a4c5fff", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625042685, "uuid": "2c3bb50d-e575-430f-8ff8-37d7e7ed2a5f", "value": "308854628ee791468c30ec49a0f48bf46a1ee9d615c3efa444506b43a0615e4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1141754a-d93c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013757, "uuid": "b0641d20-250a-4ec9-91a5-cd213135cec7", "comment": "Malware payload (Gafgyt)", "value": "fe693a3c9e53e552d9ebecdfc929b195", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013757, "uuid": "e22e552d-1ecc-403e-b700-0f31e93777e7", "comment": "Malware payload (Gafgyt)", "value": "30b682ee7114bf68f881e641e9ab14c7d62c84f725e9cf5bfccb403aaa1fe8f7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013757, "uuid": "aedeb91d-da06-4ab8-9549-43ed17a2753a", "comment": "Malware payload (Gafgyt)", "value": "5cb24d8d9b90014fd53a470673db55800f3c8637", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013757, "uuid": "3401ac00-c4d6-44fe-a7ec-ebf15c3013c8", "comment": "Malware payload (Gafgyt)", "value": "9f039e6e2ec6b938b569b1090c366f9b5ede1ce74502d559a3d863232ebadfaacc37cfa6cb3a986a1ab6ae567b73e8f0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013757, "uuid": "b1c53e7f-33bc-4ba6-a733-a929c4e09dab", "value": "F8D3083772E1AEF6C04351701ADF96A2C432F5FD0731A11B2394ADA43F0DAF66699B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013757, "uuid": "1d4ba1f3-379e-40dd-86fe-599174eb1030", "value": "3072:TY2nwI2eUn2jf2pbECHNMUVS954phabFwKQPCOV/XUa9uMU8:YIUn2jOFBNM2PphabFQPCOV/XUa9uMU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013757, "uuid": "352a8c78-5627-460d-a09c-153fb3f3dc65", "value": 137614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013757, "uuid": "cc54b2fb-4959-4a37-9fb7-6a609826c03b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013757, "uuid": "e9c1d376-7055-47e9-b273-1194f4f6dd5e", "value": "fe693a3c9e53e552d9ebecdfc929b195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e912df8-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625032811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032811, "uuid": "5e60d081-dcdc-4eaf-896f-e52b27471edc", "comment": "Malware payload (RedLineStealer)", "value": "a6301e3117c7a82c941bf8b96ca2b998", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032811, "uuid": "269d3805-4972-48af-b992-0b1f917443a5", "comment": "Malware payload (RedLineStealer)", "value": "3194e2fb68c007cf2f6deaa1fb07b2cc68292ee87f37dff70ba142377e2ca1fa", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032811, "uuid": "11886a34-9137-4d90-a1aa-3650bd0d4c66", "comment": "Malware payload (RedLineStealer)", "value": "75c8cffac87a1a14ff3d372e070e5afa7cc47980", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032811, "uuid": "9ba825eb-10c1-4976-b1ab-d22b271acd52", "comment": "Malware payload (RedLineStealer)", "value": "97e52bd7cc8d4bbcb2610d9b2da0e1daa84447caf23e67e6d0c39cc305c0f17a66a8a144af7a955a1cca281f3514caf4", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032811, "uuid": "c89b6195-1729-41d4-b285-7662bc5988ed", "value": "BF740246F3E142F7E9E50A3110A5B62FEB756A248B10ECD7C71C3C426942BD55A783F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032811, "uuid": "cb1b24d0-a570-46bf-aec5-651dc7b4934d", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032811, "uuid": "1cbc51e1-cabe-41e0-92b1-196b234627ff", "value": "6144:4ldk1cWQRNTBUrGmHQFdEh82D4azVihe8fMevAVY8S5uInvGQ4SkTlhHsrhMTaR:4cv0NTSqq6VczViffMNK18IvsSkZhMq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032811, "uuid": "64f03b6f-4d69-4df2-9cdc-0e16cac37b0f", "value": 360840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032811, "uuid": "882e6643-32f1-4b5f-b349-d0224220bcc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032811, "uuid": "d72059d2-ea6d-4fa4-b8c8-ee1f1b87e5ba", "value": "3194e2fb68c007cf2f6deaa1fb07b2cc68292ee87f37dff70ba142377e2ca1fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dddfc76-d947-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018530, "uuid": "cf13bf90-bc69-4862-bcbc-f8868fe186a6", "comment": "Malware payload (Mirai)", "value": "88157dd12a4f53293b566944e6d7750d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018530, "uuid": "ba8686ba-1c17-47fe-a055-eac0df53fd99", "comment": "Malware payload (Mirai)", "value": "323fa8c80e941d3b7a2f44356ee9dd815f183d9bb4ab60a1d5119d40ea502c05", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018530, "uuid": "7a4d0fe5-a4de-4b71-893e-e18d368646c5", "comment": "Malware payload (Mirai)", "value": "9d8bff607bda6cea53c38a3d93ea56610f086182", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018530, "uuid": "04e92c3b-b822-43dd-9aa5-792f46d5c768", "comment": "Malware payload (Mirai)", "value": "77bd6a6c213996ceb783381dd22984b434abd248af1b67dcf2fc639671350e4b9558434dc2d4554689ac130a40876d61", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018530, "uuid": "35472165-09fa-4961-a989-e2791c5629a7", "value": "E964F1CAEF11BD3AE9C4067569AB074DB3B59B99D3C3F140F190C61E39A9285AF610C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018530, "uuid": "5ffd37d7-5a89-4def-8d52-cdc72325a5fe", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio7qqwPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiuqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018530, "uuid": "626860e3-bebb-4c5f-9736-c5c34ee1b53f", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018530, "uuid": "bc3cb937-1b6c-4bb0-84d8-2d22643d37d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018530, "uuid": "78f05f38-a8a8-43db-a64a-706c9eaf284b", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a56d5f-d969-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625033380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033380, "uuid": "95895161-6ab1-4b83-b826-50196221b337", "comment": "Malware payload", "value": "84aa66d2c064023684bade323366de60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033380, "uuid": "131180fc-f5e8-444b-aec4-8c2baca61832", "comment": "Malware payload", "value": "32e64abe73b4a1466ff42d4ae193b93a27dd38469fe3df1aea02727db34d8c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033380, "uuid": "77a010bf-040f-42e8-88a9-c493890908a1", "comment": "Malware payload", "value": "b931223781cc4fc54d966510aba6a734c7e92191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033380, "uuid": "d5697406-691c-4693-952f-a3cd2e8e2671", "comment": "Malware payload", "value": "dde795891e70608ff36540a7142c0f7a452d253f9587b8f7e7bb3e1a26528b50f3db2dd134c4d74871b7275e4c69ef33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033380, "uuid": "c0b1eddd-0f25-455e-9a01-c5d2f798b955", "value": "32F45BAC315435DEC567C6BACAA8AC74EA613C6A531B8107909309DFAE0DB93DF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033380, "uuid": "d3a482f7-cb68-41f7-90cf-af822a0b39e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033380, "uuid": "bfea40b7-6afd-4759-895c-2e8dd0ac4e94", "value": "12288:rIXG9+iP/Ofa9eAn9oKjX5OFKrQ1zz4MKjFAz/KbvSywpJim6KBbxHM+S0EAw5Ip:wG9+G/8awjsc8rQ1H4NQkSpHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033380, "uuid": "dfc84f17-aef8-4a12-89ec-03d13a6d295e", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033380, "uuid": "9c922414-c9c0-43f8-bdf3-329da0570301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033380, "uuid": "303251e4-e626-4110-8910-65118b553515", "value": "Um652VtV3sX2eyy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab2f9f9-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625032805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032805, "uuid": "57f6d47d-04d8-4e59-b028-bb12b07e4298", "comment": "Malware payload (RedLineStealer)", "value": "fe42ac08d01f09b27fb2fa74d13f6981", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032805, "uuid": "8d114095-6b8d-403a-9f37-208279de3df2", "comment": "Malware payload (RedLineStealer)", "value": "338de191c1976086e1b2df7a176f9810c0e3fe782f8bfcc0c146c9c3e601cc17", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032805, "uuid": "d46bb5ab-72c4-4756-9fb9-6e53edde942c", "comment": "Malware payload (RedLineStealer)", "value": "c69d1dfa321a8da2d61e40331ef13a3f7b982986", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032805, "uuid": "1d3c0437-465a-4e60-a9c7-78b135ba6ccd", "comment": "Malware payload (RedLineStealer)", "value": "3a679d3399189f02c88b9325fe16eccb1385433f89a2b883761a9f62af8cb016be76f4003ee6a5e3cdbc1196fadaee98", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032805, "uuid": "6b07a2f5-7277-4880-9bb5-0f0547299861", "value": "0A94BE10FA91C036E5F221F95A7A97AC953D7EF15B2010CB62E52EEE4B742F0AC31617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032805, "uuid": "aa7d9dca-4d50-4cd8-b08d-ae8df4798308", "value": "b147c7cc8fb1e18a18e1be0df596d10f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032805, "uuid": "3ee6784f-45f5-4c69-b188-e34eb3fdad20", "value": "6144:7F7Syz9Xd/9JeWElfkaYoCYqju9WCg3EYMbXnPYVW5+ha2NnCMVRKxeR:7QAJndElMQCYIu9Wb3GA0Mha2NCMTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032805, "uuid": "f9440026-6fb3-4033-8633-255da7748bd1", "value": 426888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032805, "uuid": "9c6de393-b9e2-4633-9622-fc3bd5ad9402", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032805, "uuid": "7371cefd-0d43-4c0e-ade2-893f6c16aab2", "value": "338de191c1976086e1b2df7a176f9810c0e3fe782f8bfcc0c146c9c3e601cc17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852f9a9a-d95a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625026836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625026836, "uuid": "6eb78db3-4966-45c5-88c7-ff08f42cd8a1", "comment": "Malware payload", "value": "cc866d3251c6cd37a7e9a489de14c247", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625026836, "uuid": "64d03002-f319-487e-b706-267fafd592c1", "comment": "Malware payload", "value": "3397015ab153e8861ff9cb6e4adddb32fe0dd853fa2145b2fa66d6628ac5ebf6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625026836, "uuid": "ab842f75-937d-4f81-9088-36ab54bdb480", "comment": "Malware payload", "value": "6b5414f453514132471fbd90d8a7ac0c8199df87", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625026836, "uuid": "010606f9-b157-4dcb-956b-760c8f167c37", "comment": "Malware payload", "value": "0aeb1655e04567e1d9e9cea4aaf3d4e0dfb7a04fddc1e75887585ba8c984b2c7bf527f1d54a5cab7fc91bd10b221f1bb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625026836, "uuid": "f39260b4-250e-4119-a851-9c1c6cd5b626", "value": "58173347F32DA52FC5B7D1338EA6467905428C4A8887E7172968B21C2CB7AC44F9EFC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625026836, "uuid": "b1c21995-3843-4abd-9fe1-3e5abe662a13", "value": "393216:R+L3nnVyQEQKlIlFMDksNwyYk0k3BWoTAKlE3xTwHJXhHijeH3yx:Re3nEVlXksq+8oMKlgxiXh9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625026836, "uuid": "2675036b-ec95-4245-9f7e-bd9436a1abd3", "value": 20072063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625026836, "uuid": "418227f3-97ed-4b20-a751-c4c7de50103b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625026836, "uuid": "41d5e9ca-0722-4a55-b910-bb791158db90", "value": "kidguard.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf63d3d-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018364, "uuid": "4ad31f88-9a5d-488e-b11c-f10593b8f10d", "comment": "Malware payload (Mirai)", "value": "970e3ed9ce510d94633acd20c34ce781", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018364, "uuid": "d1d2bfe7-6c45-40f5-b3ca-d35c95263cd9", "comment": "Malware payload (Mirai)", "value": "33a472733bcc0a52c7ca1748956e3ebe319d9cad6b76e61a6c07b3145cf53eaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018364, "uuid": "f556bd18-e32f-4a80-9aeb-a0a2626b580d", "comment": "Malware payload (Mirai)", "value": "7bca4bdba84c979aea5addc393d7b1989b7e2dd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018364, "uuid": "4a83e56f-bd2b-489e-8233-7e53ae92e1aa", "comment": "Malware payload (Mirai)", "value": "d45e7d2fa148c600e43b611aa16199b3e3754fddae648fdd5339008a1dc1e7a1ee486380be0604e767d09a9bb11bdcff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018364, "uuid": "bad29665-0263-4fa5-88ba-f92def0ffe37", "value": "DF531956F8814F21C4D512BAF92E254E371617E8E2DEB2239D201F257BC792B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018364, "uuid": "9b34b498-9680-4f6d-9043-615e12c43766", "value": "1536:90nmKgn9ugqgJIplv85d66wX3UMqip3B2Hoqja10/q:Og9uKgKdgl3B2Hoq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018364, "uuid": "37be9023-577b-4a32-bf3d-1ae3b8fdf361", "value": 65564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018364, "uuid": "d3d77848-398f-4c91-883b-5dae7c12032d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018364, "uuid": "39a5c5c2-429a-4a38-aae3-c8d18e86602a", "value": "970e3ed9ce510d94633acd20c34ce781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5854e586-d992-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625050813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625050813, "uuid": "bd2ad688-8ceb-4c91-bc22-4cec83fbc419", "comment": "Malware payload (Gafgyt)", "value": "457ca25794d8a8071eb8ff8dacb19bb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625050813, "uuid": "d9d1aaa4-2ec4-4a98-bcf4-c2a44c686a5e", "comment": "Malware payload (Gafgyt)", "value": "34c8b7c9b3c879abaddc0a422dfee6a133b7e8cb9ea48e657fb4b9d19284ed50", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625050813, "uuid": "2cd0e5ef-0176-4d3a-9d0d-8a5b54b5f8ed", "comment": "Malware payload (Gafgyt)", "value": "ec88de1e33197ac14f2609bb884e64ebd4f710d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625050813, "uuid": "6f591e11-2176-44a4-b8dd-ff91fbe1816a", "comment": "Malware payload (Gafgyt)", "value": "f4be3ef0e2a4d8e63dce68c660d616f37376da7243652d11ff35398695763346a345b582df0d075ace8bb38f5f2647b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625050813, "uuid": "a8364da6-11c3-48d5-8f6a-7593eb95cb3d", "value": "D682C03317BB9BF1C3388935A476C44323FE91B8D4B7B1A328109994378154B4AFD6DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625050813, "uuid": "64f5f1db-1b33-41e4-b173-8d4553d796d5", "value": "384:7cHYeQTzHrKtnErDY1qQDAIhc15flJhymdGUop5hEK:+YJOtEytDA115dJs3UozmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625050813, "uuid": "9d8af21e-c81a-4146-84fc-1c9bd9087af6", "value": 18252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625050813, "uuid": "f85ec86d-7486-4d28-ad59-d2f832363f99", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625050813, "uuid": "9b53d845-3c07-4ce6-aac7-f26952f7eb19", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bd5689-d997-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625052856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625052856, "uuid": "ee251a7f-0560-45d8-ba5d-dce16bc8121b", "comment": "Malware payload", "value": "1cb1975849dc1c988556a6905b0bfae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625052856, "uuid": "210e26fc-8244-47d2-aebb-f79a50bb7c14", "comment": "Malware payload", "value": "35172ab6305d472bdb80b184996326c826d2da83d3c9e750b53575faff6a27ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625052856, "uuid": "a0df6242-b21f-46f7-ae1e-8094b9e041ae", "comment": "Malware payload", "value": "9a641f3d3c4a40a318c1da28c276da035c4c9f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625052856, "uuid": "850c7d89-a78b-4280-9800-b67db7ba7fde", "comment": "Malware payload", "value": "946236f8688541033064dda5433b8c8bee90c7e5addab80f76458a45fea215dd55c073ca7534c43dd51146150a24f42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625052856, "uuid": "a6035a9d-d349-4616-922d-3e5420e01ae5", "value": "404458BC15986D56C33BC3FEC286F63092B4BD590196E51AA6D26CCB3E06BB2F0110D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625052856, "uuid": "9836f6b0-67ee-40d9-a13a-b72e064f38b7", "value": "3072:HnxG2IbtOup3pzwgHYUn90/BpSLN9/k8+Zu45kJkZ4Qo0f978g9Zqkva2:HxG26xucYme5pSJeukky4Q59rBv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625052856, "uuid": "cc9b561f-a682-4c76-9af7-4473c5d4732c", "value": 258868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625052856, "uuid": "c045ede0-9cd0-4787-9022-789a457fe0bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625052856, "uuid": "c36dd76c-70b9-4734-b5ae-80b8f0acd179", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05629f13-d9af-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625063129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063129, "uuid": "98f2bb89-96ab-4229-a69c-afc978ef3161", "comment": "Malware payload (GuLoader)", "value": "5e10c7083d03393fc7c0b02d990ca16b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063129, "uuid": "f8953909-c662-4b06-a8b3-8a17a514bdcb", "comment": "Malware payload (GuLoader)", "value": "35287cc31b6f2cd7bfc42f0fb0b5510719a4bb00af3a9e30df68232d28cb243a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063129, "uuid": "7922abb6-10da-472e-b019-ab497856d30a", "comment": "Malware payload (GuLoader)", "value": "6fc3d0d66a66f2936d2fbcd6f03777a115485edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063129, "uuid": "40bb643c-5e88-4895-aaed-9d59f462c79e", "comment": "Malware payload (GuLoader)", "value": "2ea9ecec7aa78f371edf748eaa57142eda887baddb1d09997bf39fdd4552a1c7d8af522c7e778c8b8dace56d57e1c33e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063129, "uuid": "5ba45915-533c-4733-94d8-bc41df02ceb7", "value": "11837C2363A62D51E2D683F28979FD717BDB6D220903CF0B68416E6D3831543F0B6A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063129, "uuid": "4aa8094e-cc21-4a7e-b4fc-5fb06b998902", "value": "3f93623b9b54de473e83cea8b7333254", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063129, "uuid": "7c0b3a33-ec1e-4777-aab3-1f9d620f9d09", "value": "1536:+zn5VqIKH5Vr8VNfsZFmIQIZjls7Qs8/wsufEEBUgqpsIw7TuOMT:e5VqISVZFXjj52WpNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625063129, "uuid": "0d6fd7ff-61f0-4f58-a510-9072d1229f04", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625063129, "uuid": "9e87766d-4d41-48ff-98c2-12778fca7144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063129, "uuid": "cb6dbeb8-4b49-4a7e-b8c2-bafe7f449b0f", "value": "INVOICE COPY 2722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033715c3-d9de-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083312, "uuid": "ff5672bb-fa54-4875-bc4e-39f80e0f2303", "comment": "Malware payload", "value": "d2d71b3fe8e7221758bd639cbed1ae5b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083312, "uuid": "e72a4e2c-f98d-4151-8f6d-bcb3e49718f5", "comment": "Malware payload", "value": "35b258bd0ad35bde9b88915b5b9b8e06af1a56f54428dc82b9a4e82a53c9e201", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083312, "uuid": "04bc91f4-e2bb-463f-af53-6133ef4254a7", "comment": "Malware payload", "value": "b5598a2d37275274eb70a200366b88336373fab2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083312, "uuid": "02245b99-89e9-4ed1-a202-c0c573163600", "comment": "Malware payload", "value": "ceb5603f45ca51e21bf3bf49a54f92b030207fe9d0c5563b130a3dbf7b7de951482e57aef71247fbb75a167a660ab0cc", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083312, "uuid": "3b9b0998-664d-4135-948d-2c4e4a9d823a", "value": "1D241244D227E822EF9F5077BAF92EF11766582305591133A331245CD8ABC5FD2287BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083312, "uuid": "01e30c52-a819-4982-9387-03dafe7a09a2", "value": "6144:fv0pA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56BM:Uu9l2pgxjt6XUyNW+Md56G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083312, "uuid": "bc9e62fb-b68e-4943-878b-a5559e75a2ab", "value": 218020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083312, "uuid": "99316335-072e-4809-af49-73cc2260d5c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083312, "uuid": "b614da55-ff19-431f-a760-1c07083c07ba", "value": "WO 2308349.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7be3416-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625059187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059187, "uuid": "8c418585-96f5-4e86-8a89-f80fe2be7a46", "comment": "Malware payload (Mirai)", "value": "e00cf55ade16af5f3c76c93412a29643", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059187, "uuid": "cb81a731-46d6-45a9-b46b-83e254914015", "comment": "Malware payload (Mirai)", "value": "3637f0a6c883da9bc7a3a0efc7dd98111c13d5cb3b4e5f90d28ac87c2b43b17b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059187, "uuid": "ad3184c9-9268-4abb-9a8a-c0da1da9e845", "comment": "Malware payload (Mirai)", "value": "4cce46e9f70e8b03966d6b9add2276bac47b4860", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059187, "uuid": "11e0ad63-ce21-4a69-acdc-6f00455775dd", "comment": "Malware payload (Mirai)", "value": "52a3e1d2a27215a9e6dfc91f73d13e43e932e0922ace7dc3132bbc75b5e09dea497b03c66aa486ba48a588d8007a26a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059187, "uuid": "8a1a1297-2f0c-4b6c-9241-d658f68679cd", "value": "52E2C050B3A65BDDC06A41BB1C7F7E5F4A18259C075D8012D698362BDEA6FD0293C6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059187, "uuid": "c676768e-4e6b-4137-8bf7-62b661c0c3c4", "value": "768:OV7uGrPWtlvZH0z6VLDV5tLDQEQeXNvJj4nbcuyD7UryqG:C7uGrPW7vB0z6RxNvJknouy8mqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059187, "uuid": "84310a91-b2ce-4f55-998f-d5fe25fe48c1", "value": 31776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059187, "uuid": "6fa5e1bd-e546-4b35-a49b-bfc49968de47", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059187, "uuid": "9ec166f4-0068-4aef-b148-f0af8e1ab627", "value": "e00cf55ade16af5f3c76c93412a29643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d02dd5a-d967-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625032218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032218, "uuid": "1e8373f4-e7d8-47fc-b961-38db835e9502", "comment": "Malware payload (Loki)", "value": "09f56854c8b59ade72cde79601362bc8", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032218, "uuid": "22affa0d-1d44-4fd4-89d1-4eb4628166cd", "comment": "Malware payload (Loki)", "value": "383fbb091ad9f15959afb535696848a514d89ae1aacdddf9ec3e82d3bc889771", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032218, "uuid": "1bf93c90-e756-4ef1-ab08-961790f4aa31", "comment": "Malware payload (Loki)", "value": "33b866fccd8fd8380921f837800014f837338570", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032218, "uuid": "7a79a842-844e-41ad-abe1-90a41ba5d075", "comment": "Malware payload (Loki)", "value": "024346a62710929ef63ad1832c2e4aca1744a8e77e5687406af74651e35d2324b2a9bbfda96bef4c4914541fda7761af", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032218, "uuid": "757b708a-5781-4b38-a10f-5dd5b607792a", "value": "4143F28254B1B603ADFD13959ACB166B262D7729F582D4C2BC8E01444B8EBCDE0691DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032218, "uuid": "a2e15f8b-a992-40e0-ae4e-7762cd48e25a", "value": "1536:aPFjEjhzM+TIk8XuQRxqm0zRyxCjhQw0kceDz7:qFjE1Mnxxqm0zRyP7kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032218, "uuid": "0fcb1172-3947-4e20-9a54-6eed44ff273b", "value": 59906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032218, "uuid": "5515dd23-057e-4829-b729-9c2e8721bd13", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032218, "uuid": "ab901d11-1743-471e-8ec6-f1bcd1a67f78", "value": "DHL_9073782913.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12407fe8-d96f-11eb-875b-42010a9c0053", "comment": "Malware payload (YoungLotus)", "timestamp": 1625035663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035663, "uuid": "ee1ef67f-13ab-4f19-9d40-fe52bee9ebed", "comment": "Malware payload (YoungLotus)", "value": "7991fdcff40f0fff588a43cfc5aa80e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035663, "uuid": "32f909d2-d4f9-4702-b611-c271f2ba6a01", "comment": "Malware payload (YoungLotus)", "value": "38590535738c42247dc06b18dc9bf011859942183a2de27e2f0fa2400bfa38d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035663, "uuid": "481c588f-baca-4a5f-9983-8a627c0f23b9", "comment": "Malware payload (YoungLotus)", "value": "d9e0cbef3f4413c5e1e246ac81e1912f8598b8c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035663, "uuid": "aa03f1a9-924d-4915-be3f-2d9cda65737b", "comment": "Malware payload (YoungLotus)", "value": "66fa25989608db26b4006a26b2bf88d800a512e66a20967f8c9ab02956256d7b85c3cc3bf15bf07f4cd858531ae747fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035663, "uuid": "8749cdbd-bbfe-4ed6-9dcc-075b849fd101", "value": "A575D3109A15952AC967167DCFAF3ACC7209EFC10F0159F3628C3E295BBA4E27B3544E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035663, "uuid": "d96ba2f3-d306-45aa-82c6-a7f402a1d678", "value": "d3caf3770dde39b6f41c11fbdf6a27e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035663, "uuid": "b3c26ba2-a04d-4ad8-b64d-13d4fd963f94", "value": "12288:OVaNuzzEGM8ud2hUBHj5kY3RndM8XjSIl9FbrMwtFmkW58kxaVnqrhGa4+hQwW8i:OYNu3MIhUBD5Hndht9FkwUekRGR0M8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625035663, "uuid": "fbf2b9f3-3b7e-4e78-b6b4-4be7d2f86bac", "value": 1638558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625035663, "uuid": "6073774b-55c4-4d58-90c7-a1a2529851b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035663, "uuid": "4afa11dd-0d3c-4487-83e8-8d2512c4dc04", "value": "7991fdcff40f0fff588a43cfc5aa80e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdca4113-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018368, "uuid": "35cb1057-06e6-48b7-9c32-8eae1a2fe119", "comment": "Malware payload (Mirai)", "value": "0c1d69a8c501fcaaabe5c5cc7986cfee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018368, "uuid": "ff0bc677-bfba-4144-92ae-0657e2470f04", "comment": "Malware payload (Mirai)", "value": "3862b506b38f34bef4bd2db21e1c4a66bf400f063f3a04a4a2024219c285c39e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018368, "uuid": "36808ea0-6479-4135-972d-17c44fc6f56e", "comment": "Malware payload (Mirai)", "value": "860a1494e1f53696e6b678c4444522080ee8d123", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018368, "uuid": "219ab84b-cca0-430a-816a-98e894ca748b", "comment": "Malware payload (Mirai)", "value": "02ba2a947b10c9944fafb8840adef6768609c256b564541c7461002d1219268b9111666ed8952f4606f638d7abbff160", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018368, "uuid": "90746e2e-107b-49e7-9918-d02ee9069024", "value": "CA23021154530D92D810FCFA80C04FCCA7FE90B9E1AF9BEB054689B56D599CBD87874C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018368, "uuid": "353586fd-298c-4cc9-9e84-2b8f8eab8f01", "value": "768:PK7y1XGOC/p3l81xe1849E5Ljhket9q3UELct/iw+kAYYQcp2SFd1MN:n12Omp3l81V4SlhklLchiw+kXYflFd6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018368, "uuid": "8b9abe59-69d3-42ce-ac72-1f6457376a28", "value": 48712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018368, "uuid": "25b150b8-4960-4011-b516-ee1c82fa632a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018368, "uuid": "db655863-3277-4b77-b46c-d37ee9e075ae", "value": "0c1d69a8c501fcaaabe5c5cc7986cfee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11242425-d985-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625045110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625045110, "uuid": "e969b2c5-1b7e-48ed-a480-116b6ce35dfc", "comment": "Malware payload (AgentTesla)", "value": "be5d09d1af62d97de40a5e4d0a7f24b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625045110, "uuid": "94cead24-77e3-44c0-b9c1-bf2a4911ac66", "comment": "Malware payload (AgentTesla)", "value": "389fc9424985a306542e4ede78ca51b0ac295e9cc2ac20ba8dbd711b889a3cf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625045110, "uuid": "3ca665f6-eb70-4664-8fff-6df75aedebb6", "comment": "Malware payload (AgentTesla)", "value": "78852ecd7300cac2e9f9acb15a4d172660b89245", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625045110, "uuid": "00de4b17-101d-43d0-8cdf-c34d81a61c25", "comment": "Malware payload (AgentTesla)", "value": "41da351d4f17d5c458c8dca002784e6e80888ac5a087cdeea1d7613b070d811a0bc9ce90ee53196976d84e19c8098b53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625045110, "uuid": "4263f467-a280-4191-8c02-d394bcc9254f", "value": "1CE48D311BA95A35E0B69FBDD5A1208197FDFA23AF03D85C68B511C50713E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625045110, "uuid": "9d0f67fc-943d-46e5-9fce-6a982215e80d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625045110, "uuid": "91a2cc2c-caa2-41d2-b2b5-d63fc988d462", "value": "12288:NGkTJbwiBbX5TywU26DCUNCK5GQGzmhCeUyxLqDI673GfNO:NGiJbDM9CId3h3UyxWrG1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625045110, "uuid": "8d8a3a86-b288-474f-8540-3af00866b455", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625045110, "uuid": "565e5b46-e2cd-4d83-9996-5484d4c5428f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625045110, "uuid": "8c4bc601-a54c-4ec9-b87e-e401dc65ef17", "value": "RFQ INQUIRY 20210630.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c20ca5-d9b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625066427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066427, "uuid": "7606a0ee-0223-4c76-8ccd-9df629e68ad0", "comment": "Malware payload (Mirai)", "value": "0635d89a0ac4ea972f682e572fb31494", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066427, "uuid": "a3e92c99-f04b-44da-add8-aadfd5a72166", "comment": "Malware payload (Mirai)", "value": "390bf3be924557a017ffeee474d7fc3cf81f7b4aeaa1b559e7f1f9001f98fd67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066427, "uuid": "d0f7914f-277a-40f0-8240-e227e3754d94", "comment": "Malware payload (Mirai)", "value": "55f0133173037e107e5db7b7e99668caf29d30cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066427, "uuid": "9ba4ea62-bbce-49dc-b77a-f5e6ddb8a875", "comment": "Malware payload (Mirai)", "value": "fa380429b7aa5326f8de70a7072ebcee386157b73c06cd48ec4e5e22e61c9af8bffbe2cb3b8524f1f01f3cb2443b06a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066427, "uuid": "ada515c1-f71f-49da-9afe-fe40112eb95e", "value": "FB238D77C8A91ED4D7968574A12CCA3A1733D418A29B1EFA1A07C579A00BFECF1093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066427, "uuid": "1d4a1773-9e5e-4a31-8efb-f41f245bb5a3", "value": "768:ya6Z21e8m0fzVhb1VQLsCWuWo3Zm9zMCYAuY4/:ya6ghDzVhb1V7op30wCYBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625066427, "uuid": "2573c474-636e-4022-9e2a-1b9ee94ac5fb", "value": 46116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625066427, "uuid": "800de5b1-7129-4dc8-927b-91fdc09eb3af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066427, "uuid": "f60d4608-5134-4f56-bd18-85da34518405", "value": "0635d89a0ac4ea972f682e572fb31494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a015a6-d9e9-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625088361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088361, "uuid": "720ae93b-3578-41c9-96df-d620cf4ac5e7", "comment": "Malware payload (RedLineStealer)", "value": "af3b7ac573064fd6aae9ee671d9845dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088361, "uuid": "f4242cc7-e6a3-46e4-80f3-510095b7a769", "comment": "Malware payload (RedLineStealer)", "value": "397a9d3c6ab82e63d2e43ac487367931d7b1a6d68f35decf6a598d9504dd074d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088361, "uuid": "20926c4f-f7e8-498c-9ee6-b383ac0ac2af", "comment": "Malware payload (RedLineStealer)", "value": "2a7d03b8191cb230fef34b1bb70e9f2779aa2356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088361, "uuid": "102dce30-8fdb-473b-bfc6-188d365ab46f", "comment": "Malware payload (RedLineStealer)", "value": "277ffc11c3eec669bbfbd84047372c93b9a4b8f249e33e65c634beb8480ff66df9435d86f0e40bb5194c780f04a29164", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088361, "uuid": "95f77143-d548-4508-b1de-e0d40924c286", "value": "B884262864BFC05985E3EEA12DDCA8FBD89A55E3640C743701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088361, "uuid": "97aeb154-0192-400a-9398-697e934f6c80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088361, "uuid": "8150f826-e3ed-467d-953e-14c597e013bb", "value": "6144:Qa5YqofbJVTNhLHVxJjAmLyYg6Tv/3KrDZI:Qa5Y3fbJVTjLHVxJjHLyYg6Tv/3KrDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625088361, "uuid": "ceaf2fc1-adf9-4a7d-8562-f8616bd30de5", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625088361, "uuid": "bf8d587c-3610-48c0-8cc3-41e4f45e66dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088361, "uuid": "788b9747-a60b-4886-8b0b-1f3eb0e050f0", "value": "af3b7ac573064fd6aae9ee671d9845dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0137728c-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018884, "uuid": "d9d67eab-bf05-49e2-b230-f38b7b15cf5e", "comment": "Malware payload (Mirai)", "value": "0eff2a456831aedbc173e02856d72fe7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018884, "uuid": "ace0416b-6fde-4f8a-8031-9f08b5f29016", "comment": "Malware payload (Mirai)", "value": "3a45f6b1014397746fd6dfebb1c25f72a0666ecaa30778239fbfb4b85c568b99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018884, "uuid": "f4660e09-b2e5-4ed1-a701-0b3b5661508d", "comment": "Malware payload (Mirai)", "value": "d927d1662bea0e9becef262a149602a51d61f740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018884, "uuid": "a9b43b45-9e7e-4a83-af54-1734922f174d", "comment": "Malware payload (Mirai)", "value": "1a09b19a2be1f6935a0c59739e6add1e3ba2cd0ab2b24bbf974386d70e2bdb256fe0f3a443e50543e45eee66c827902c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018884, "uuid": "0232a44e-53a3-4c18-8312-e02f98a5b4c3", "value": "E6B2D055C2195AF1CBFF8C3419A146E0B3D80F8E8B31CCA2F2D2DF239195D6A41D4ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018884, "uuid": "101fb13b-952e-4306-8dcd-dc51449f54ca", "value": "384:on+fhb79/cRN66PJEFpB5/aWKgZqAkjCjnHkrygv4p67MstxpCVHdfM4uVcqgw08:3fht0X6oErB5/aUZqAIsnEpXiHd04uVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018884, "uuid": "3c3a5ff9-7d99-446e-ba1c-90ef9d7deaa3", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018884, "uuid": "3576eef1-0796-4c75-b335-7c29450a70ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018884, "uuid": "5fe9b013-46b1-4556-a57c-9c8fbe95efc9", "value": "0eff2a456831aedbc173e02856d72fe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d805bf-d967-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625032387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032387, "uuid": "bc6e3d08-520f-4973-a71d-5c005f812345", "comment": "Malware payload (Formbook)", "value": "21b9eb5bf5a26e5a7e63d09a0d294261", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032387, "uuid": "6240f457-d129-4bc5-8b4d-47ae8bf2d2a5", "comment": "Malware payload (Formbook)", "value": "3a5be6f5c48b666b9af57bc9705f4493bceb0b574fe2e31a748ef58e1fac0beb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032387, "uuid": "37170e07-bc83-4c54-9df7-04e41abb5849", "comment": "Malware payload (Formbook)", "value": "fb2a10d21f1142e4d357736126291c34d938b1dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032387, "uuid": "1b0f1cf4-2238-41fa-ae04-ad330e397238", "comment": "Malware payload (Formbook)", "value": "d7d15c9d0e43807e1b2c277910587bcac9228e3461c0a501d7448d9eeaad9bcfe4e30e1874ce2fee005e3c5882e9dd66", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032387, "uuid": "48d30027-0ebc-457f-a593-bbd50e39ec19", "value": "FD71752233E0C2E4D48C17392A82075ADA7EB4309362932927AC6C1E3D7B1912C2DB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032387, "uuid": "f17b3fa1-d8d3-4600-b27c-86d392cf2a54", "value": "8a6783d41510870ffcab3b87afeb8775", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032387, "uuid": "fb95b91a-7122-414f-8e15-60548369a14e", "value": "48:ZvtkCAn3xvdQV1oRTlk67y9xWFvrBLz0R:Z1HAn3g1+a/jmTZ0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032387, "uuid": "12c2ac9b-15cc-4c16-807d-6c2228dec912", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032387, "uuid": "e5faad21-ded2-4228-b6a4-6ee13b59287d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032387, "uuid": "69d10026-5124-4d9e-9df1-74caaffcd129", "value": "PO_49275388.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08e4d9b-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625059095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059095, "uuid": "017e278e-b2fa-45dd-a5fb-a52c818228e9", "comment": "Malware payload", "value": "b1b2351dc302abfd0683a069458e03da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059095, "uuid": "9eb3a39d-8a74-4475-aa8b-dd103d3cbe14", "comment": "Malware payload", "value": "3a8d7d3f0b126389e9c2175265dfcf4b86c1aee695364cd6cb92587602ab41cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059095, "uuid": "4d38b56a-dc15-4f30-97ad-3cd33e817831", "comment": "Malware payload", "value": "feb0568c9c1e4ddb2ac998945d80bcf18ca88362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059095, "uuid": "3383e7b4-bd3f-4a70-88f2-c47ca52ffcdf", "comment": "Malware payload", "value": "0cdec6daebea12c39cfed2a9dfb49bd3bfa4160262c638e7ca0c03be6a6fd5d051d4d4450c2a11c826d4c54cd2d66f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059095, "uuid": "66ad8d0c-41f9-45c3-8028-3f49cb0d750c", "value": "DFE47D351FA85A35E0B69FBDD5A1208297FDF623AF03D85C68B502C54712E83C9F162E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059095, "uuid": "f1b414d8-af68-431d-a0d6-084562e1fd03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059095, "uuid": "31cc71e2-c2ac-4f8f-8900-8485fcd423f8", "value": "12288:e6yfGwH/BbX5Ty/5SIOFTpJnxnPoQvHJc6CYPQq9E9y8VU:e6yfG6/CLY1BRFvpcPaQq9EgMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059095, "uuid": "3b064ad9-33ed-4718-b942-b3bae18cbff2", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059095, "uuid": "70f585e1-96b2-45b6-93b1-ad50e8c3c591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059095, "uuid": "aefb5849-0c75-4d31-94de-9e4fde7f54fa", "value": "Payment Advice -.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d111594b-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625018374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018374, "uuid": "89f5ac8b-c346-48ce-be8d-0ae562671114", "comment": "Malware payload (Gafgyt)", "value": "96a1a755251e2f1ec0f156c66a9a589f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018374, "uuid": "7cd82959-1b7c-4728-8011-d0804c242b49", "comment": "Malware payload (Gafgyt)", "value": "3b9a35f7a0698b24d214818efd22235c995f1460fc55dd3ebd923ff0dca5370c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018374, "uuid": "64e2a36a-d6da-444b-a387-97503923cc45", "comment": "Malware payload (Gafgyt)", "value": "84ece45889e73aa22ab62db46ddd39ac0b9fa720", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018374, "uuid": "6ae8c6f9-2ad7-4296-bf63-335dbec08dee", "comment": "Malware payload (Gafgyt)", "value": "7dae4915b6f3a25fcb9b84d3c79b549561627aeee75d58877597549f5417219ac5df1b76fb9f66bafa24e946844cc4c9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018374, "uuid": "0244a35a-d680-4ba6-906a-b9267190818b", "value": "2E833A276391C67AC047A1F027FB9972E821BDBE0A36B15E33D0BE615F39DC11A4A711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018374, "uuid": "b378af58-332d-4a93-b6ab-5a19f5266321", "value": "1536:aVnirf3qAhHvvX6YbESLAvM0gLVxoOOqjYum0Hi1pczCf3k:ahir3hPvX6YRcvapOqjXLC1pUCvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018374, "uuid": "4c5b9bb6-33be-4dea-8a99-2dae803ea810", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018374, "uuid": "25b725dd-4ee9-451e-9045-983a6638222d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018374, "uuid": "32fb04c4-47b2-40ac-bc7b-9ecb97c83c37", "value": "96a1a755251e2f1ec0f156c66a9a589f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7434a59-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018384, "uuid": "f1d32748-0e10-4bae-8c2d-05a272616c09", "comment": "Malware payload (Mirai)", "value": "a54405dff9e20dbfdbcbe6545d8214ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018384, "uuid": "49a201c9-80f9-42ab-834d-b7d02f99363a", "comment": "Malware payload (Mirai)", "value": "3cec26074fab98097e2d0181e2a3d004e4c8c084adc154431deb86d9ff75907a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018384, "uuid": "8a33baad-1374-4e22-b984-6dccfdf300cd", "comment": "Malware payload (Mirai)", "value": "de73cb0a0dfc013fdfc0ef0f9493e4786af9d7af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018384, "uuid": "c55a5836-6677-4e5c-b7f3-03fbb0140b3e", "comment": "Malware payload (Mirai)", "value": "27d2950cb91e20ec3e5d118c2a5252db19df9353b11d77a8d7bd862eaea46b6a3e0f567bda534dd2ac564d204298697a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018384, "uuid": "61fba706-38c4-48b2-b747-c488327a35af", "value": "9C334BC4F143D7F9D84900717036EF369B33F1FA226DD997D3995A33AC92602A506A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018384, "uuid": "58df0191-101f-405f-9467-f37270fd2a2e", "value": "1536:vbxZ+QmM0P+IWFWidh8dsGbLMuW80iIBYF0x5L:dZ+QmBto9lvBuEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018384, "uuid": "640c9c22-d72a-438c-a011-5b8dbc89c74c", "value": 51508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018384, "uuid": "e72f5db5-f1e8-402d-b95d-2eecf875d0d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018384, "uuid": "9808161b-b111-446c-b82e-f9fd2b3f3fe1", "value": "a54405dff9e20dbfdbcbe6545d8214ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4400cf95-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625058939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058939, "uuid": "b0324876-c2d0-4744-b38a-729770b599ba", "comment": "Malware payload (Mirai)", "value": "9a8c5738101d8c9fd7f682ac82487d6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058939, "uuid": "85806ca9-c240-4de6-9a69-e798dec72947", "comment": "Malware payload (Mirai)", "value": "3d8194b7853a1edbaa5d14b4b7a0323c5584b8a5c959efe830073e43d0b4418a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058939, "uuid": "5d02c94b-af83-4401-8f6c-09613a985028", "comment": "Malware payload (Mirai)", "value": "5ccffd6d1035f7d539b206bb8c19c189ee32ddcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058939, "uuid": "fc7a9fa1-371d-40f9-a559-8a83de34c303", "comment": "Malware payload (Mirai)", "value": "c7f19b9fe23a812ba0b64c74bbf3fa12977a9d0c782f2d1309bec9f724fcaecbdd9b19769cb43e0037357f8781abc23e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058939, "uuid": "e29fa282-8246-4daf-9707-bfe1d1f09461", "value": "1473D587FD01EFB7F40AE3B644A348157530BFE61E921A76B227789AAD360D41423F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058939, "uuid": "67de7e09-4371-48aa-86b9-b9b3f0c66c25", "value": "1536:/DbqTs6yprqs8Fw2NzmgFRSG7YjPxJ748ce0yA+IR2:/DbnrqYQ1FsAqbce0yA+w2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058939, "uuid": "f7359513-c23a-4541-abf7-e8a5253c987f", "value": 79672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058939, "uuid": "c521f951-23f1-4c47-a0a2-e9b66df9a2e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058939, "uuid": "38558ecf-8bad-4926-8111-52360123c986", "value": "9a8c5738101d8c9fd7f682ac82487d6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d127901d-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625019233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019233, "uuid": "51863347-7986-473c-a76a-9d1a6e90002f", "comment": "Malware payload (Mirai)", "value": "5b40876d42c9ea91058f6bc627093ac9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019233, "uuid": "f0b1faac-4c38-4e10-a08f-5cd3da08bae1", "comment": "Malware payload (Mirai)", "value": "3ddddebe0491c9faacd0ee51fa38cc73f9c6cf7a586b561474228832ea49ca88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019233, "uuid": "ad9da202-8255-44c2-b04f-e79492d66696", "comment": "Malware payload (Mirai)", "value": "231001a3e454b8835f62d29cc00be8bad084552a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019233, "uuid": "3c613b72-5629-457e-8afc-2df18d15466a", "comment": "Malware payload (Mirai)", "value": "47d98f8fcd7996abbadac4822731746d3ea8aa20f307058f4e30d6089af353b94cf53d2198601c2cceefae3cf31f03e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019233, "uuid": "0da736c7-161d-41e6-9792-139ee40b74c5", "value": "70338DB5C579EDA8D1544A78BE248F749723E100C6932EFADA44C6699083EFCF1583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019233, "uuid": "8a1f0895-05af-4e55-a569-8ed558dd9add", "value": "768:rauxBwtHSMsas4UQebjEjBTIztyWfs3IFG5eFUA/qwCqaoys1Cb:ra8BwtyuVTIz9fs3s0eFR/qwln1Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625019233, "uuid": "bd243631-c99f-424c-8deb-72a0f75adc72", "value": 51580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625019233, "uuid": "c767a57d-d138-4313-94db-8c59e125a846", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019233, "uuid": "02ba8029-558a-48b7-8156-3d2f0498adb7", "value": "5b40876d42c9ea91058f6bc627093ac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a2bc8a-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018965, "uuid": "71cf001c-2f40-4521-a9b0-3c90fe1dd11d", "comment": "Malware payload (Mirai)", "value": "2dc84202b0cec681b7ff344c9ea9e598", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018965, "uuid": "77a0a5f4-f269-4053-b657-8e5b5a61f8aa", "comment": "Malware payload (Mirai)", "value": "3e4b768f2a657cf5dad8c9e6f76b970793681abfce45998badab8a5946418357", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018965, "uuid": "a06960cf-afd3-4b93-9e01-6bd7e8cf02a9", "comment": "Malware payload (Mirai)", "value": "1bb733fe08201f99fe785d99a70fb5a31eb5be6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018965, "uuid": "afaca7ca-e320-4fe8-95ac-00fda396beb4", "comment": "Malware payload (Mirai)", "value": "4e8c9b0c29b90006047931f044a72c14c22f6628f063923011a0780a43de0ddd6e7f767866f00f17ea4f98cbc27d81fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018965, "uuid": "4f467840-343c-4cea-97fe-10939a6e6cab", "value": "23333AD6B902AD7CF98BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018965, "uuid": "12db89d7-7d8e-46b6-9200-667017b8ae73", "value": "768:ACeKEfhe5XdrbenXI2fNFQnnwdgFH+8iPuvWeffpqmUJTBr6Lu380Dn:hsfIBZeBlO1F+8imvppqmUJZ6Lc86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018965, "uuid": "4cde6d57-e57a-4a23-bee2-a10db8434690", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018965, "uuid": "2714c1de-aa97-4f88-8270-a1c407564db4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018965, "uuid": "20c2cda0-f268-4c79-a375-37d3889cf119", "value": "2dc84202b0cec681b7ff344c9ea9e598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be22cbc6-d973-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625037669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625037669, "uuid": "7af8da7f-5471-45d0-8409-4128c3422a0a", "comment": "Malware payload (RedLineStealer)", "value": "7ee551bbeb9fe968ac78112d08c7c7f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625037669, "uuid": "49a1cc17-f326-42ad-b409-d17f73746143", "comment": "Malware payload (RedLineStealer)", "value": "4015dced57df6b9c89bdc4948d224a4d5b9dcd9c55bde5415ca12c879dca2c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625037669, "uuid": "848000d3-d018-41dc-97e4-397606285b5e", "comment": "Malware payload (RedLineStealer)", "value": "cb9b3b5e38131d9ed4727b468fc0c8c8738c10c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625037669, "uuid": "76946faf-1217-4368-a3e6-d115282f494e", "comment": "Malware payload (RedLineStealer)", "value": "632dbdb0019696053b263d3f542416bab8a8e408235741d9c28fba3283f9678190946f6c656478701ae72ce141b0c0ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625037669, "uuid": "68d371f4-d8c4-4de2-860f-8967b1b40e74", "value": "8294E04236F0146BDBADD7B18492027003B069367E92D7C97CA9669F0DF7B993902E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625037669, "uuid": "4c41f867-6712-4545-96e0-4fc740040c79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625037669, "uuid": "fe667f1d-fd04-4add-a97c-afef18fe9174", "value": "6144:ZfIxnMurAcOvD60fc+DBJKrat77kEFwYRKZfH3Yk1yZYFAN0b651CPbgWy/p7yxk:lWmXNxDBZt/kEGYtk1MYd6rCPUh/Vyxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625037669, "uuid": "7652c2f3-394d-4fe1-b4a6-3b1578954435", "value": 408760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625037669, "uuid": "1344acd5-8af0-4449-8faa-338570e2c0ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625037669, "uuid": "7c90f986-eaf7-4486-bb5b-fd53ed56e64d", "value": "7ee551bbeb9fe968ac78112d08c7c7f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dab7be7-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625018905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018905, "uuid": "b9ba44f9-b8af-49e5-9cf1-d86dfbd3cfa0", "comment": "Malware payload (Gafgyt)", "value": "4d60dd08ccc62a66a39cb33df04d778b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018905, "uuid": "85c2e522-86aa-46e9-9448-00685aad0340", "comment": "Malware payload (Gafgyt)", "value": "4110dd04db3932f1f03bdce6fa74f5298ffb429b816c7a8fce40f1cbb043e968", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018905, "uuid": "06df47db-9aee-45c7-a185-1ea99fe2c143", "comment": "Malware payload (Gafgyt)", "value": "87923360db6efa2131fef4fc12993f29d2f41f81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018905, "uuid": "0a2c4b38-ccb1-42c2-9e4c-b6c72ce041c4", "comment": "Malware payload (Gafgyt)", "value": "2d463dbfeaa71893a8de9f4d12cc836f2bef89ad447b351e9c235e74d00c2bd8f49321cfb7e9d8f40a605c1f302e9f75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018905, "uuid": "78f03ad6-ced8-4352-a7f4-8e7827bf486c", "value": "1B93E784FD55971BC3D372FAE759028D763A1FA8A7EB30269934BE9023F5BD02536120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018905, "uuid": "b0f3b3a1-10a7-4877-a648-9e04359f2457", "value": "1536:dmjnaOU7w+N62KBfISGHFxBpqRP/1yoQt/NeOCOlCvV4Vb:7OR+N62w5GHFERPcFNerKVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018905, "uuid": "1dd31da6-93d2-45a1-ad57-bb62b5271b73", "value": 90612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018905, "uuid": "e402c85c-f65e-499a-9864-b292e37c1222", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018905, "uuid": "137c9d53-ee47-4d1e-943f-28992c2687fe", "value": "4d60dd08ccc62a66a39cb33df04d778b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57749d74-d957-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625025471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025471, "uuid": "23bcb30c-647e-47ba-9e4f-8a3e676e5ce9", "comment": "Malware payload", "value": "c373f42b842a723c9def72fe12bb8fc8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025471, "uuid": "6e6172bc-f082-4152-ac60-ad2ecc4bf85f", "comment": "Malware payload", "value": "41db78fad794ca70ba68d9225112a0a8f6d50799effca89a88736e3df0c925ae", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025471, "uuid": "a20750be-2d5e-4d37-b6f6-2525ee266783", "comment": "Malware payload", "value": "17a64e238b7dc11b06302620dd81c1f5e81f74ce", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025471, "uuid": "5bba0c2b-e121-421d-91e6-b94d61a33518", "comment": "Malware payload", "value": "11178ff889d6a8ea8d982dbb6df606aa2a23f5b581f82a12cfcdc0e6a19d071324cc7fb849b4dfe02db06589f16027d2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025471, "uuid": "8b1e5aac-c92d-4eb2-9666-cf131374f702", "value": "68956A05BE8E8161DC1146388966D371E7627C241F6D86EBF29ABB2E6F331D09D36313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025471, "uuid": "4725ff6f-c91b-4159-a2ec-dc5b4d60ab9d", "value": "49152:GLVGY5AblMDbCmnGnrijpsX8kU4UUU3UUUtvFOpLjhs6564m:NY5A4bznuijpKLU4UUU3UUUtvFOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625025471, "uuid": "7cd8fe32-bdbf-4631-bef9-ea8e601e7048", "value": 2009600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625025471, "uuid": "7d1a9ffd-b1a0-4d0d-9753-fed2ebe4afad", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025471, "uuid": "cdafd1d2-3b28-41d4-a029-edb843fa37c8", "value": "BOL_88ZP6MTAWC28GN1TXW0S0OXV3.pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc564d3-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018959, "uuid": "473767c5-05ed-41f3-b616-674bb757e750", "comment": "Malware payload (Mirai)", "value": "8da51824e0b9daff7c0372948020fb02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018959, "uuid": "514d57c5-acfd-4a6e-9fd6-4bba435f22c8", "comment": "Malware payload (Mirai)", "value": "431dc60c6708d6856faac26a3f4b91019405d01fb43273bc25e2271e7b5db8ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018959, "uuid": "8314f12c-a4fb-45dd-a644-d5f45a516e0f", "comment": "Malware payload (Mirai)", "value": "a64fd973bc10b406c7536be46d27b5501295f99c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018959, "uuid": "9fea0c5e-b196-4678-9c70-46a356a9c2f8", "comment": "Malware payload (Mirai)", "value": "3faedaa14923de23facf613afe6acde0518c7896245e053ba03d2755807de9445d9eda7ff4d62eb227c301bc6a086cfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018959, "uuid": "aed4114c-5b83-41f4-a66d-6166a859b6ae", "value": "E0D2E0626A11FEB2C1F10B38FA774EC765775EB9E191308A2B7954E8E482B055DF8402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018959, "uuid": "6672d4c7-5b31-4d26-a409-777cae68e00a", "value": "768:IusHfRavjycYC5HkU82CgLOQcVyaWn4RNSUEgih9q3UEL4e:6RwydCRh8mKQcVblTDiUL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018959, "uuid": "665e7adc-1f59-491c-864f-62fd13cf6b11", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018959, "uuid": "af601477-f420-49cc-be71-60d1393b1f14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018959, "uuid": "ab2a3b35-9804-4858-89db-dcb893238c8c", "value": "8da51824e0b9daff7c0372948020fb02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00de575-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625059201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059201, "uuid": "2e8c26f0-784d-4b0e-a6fd-675222b15412", "comment": "Malware payload (GuLoader)", "value": "000d4ff0fd3d1bd184fef8583dd714e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059201, "uuid": "3feaae83-3c9f-4dac-afd1-443a9515929f", "comment": "Malware payload (GuLoader)", "value": "4384ad76060dd9c39eeb3d61bcc1e09f98240f9534e78f7aba99bba4091c98c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059201, "uuid": "15b6614b-3de9-42f7-b87c-98569e71aa15", "comment": "Malware payload (GuLoader)", "value": "8aaeafdd73de23ec5037ab0b17395c6c44e47c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059201, "uuid": "6e5a77e3-2d6d-477b-935b-1e335bfd8271", "comment": "Malware payload (GuLoader)", "value": "06e88462205ae5ded2d4cda3b0f5d837d6c31208083e8f973dbd3397ca4cc9e7319f25f0de105e00da2ba4f52d932498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059201, "uuid": "d868f469-620a-4f1e-883b-8b694ed6be05", "value": "5FA3D40275F38F1BD1A78A716B608D5FB29478FC59439D2742C5252A3AF6B0786B032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059201, "uuid": "96a640f8-a957-4281-a79b-8e726c121c6d", "value": "e3e4c9cae99340ffbee12b193d7b6357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059201, "uuid": "2eeacea8-b8bd-4c17-b299-0905f07190a0", "value": "1536:t9ut5cAci+RrDNoK13F4hXvCWx1W/64JdTlKi9v/PdeEBoHUDiMJX:tR5i6NH3CFaWTWndUiqmeUDiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059201, "uuid": "1d3cc899-69d3-42e6-99f3-01b30f9cc0af", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059201, "uuid": "7778d8a6-587e-4f82-9686-30d7f997820d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059201, "uuid": "dd2d259f-3265-4a04-8bd3-be2a82d55c48", "value": "Drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dac46f-d96a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625033513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033513, "uuid": "8047f2c7-e34a-4428-af8a-716c65d9b9ae", "comment": "Malware payload (SnakeKeylogger)", "value": "21d41eda5fb0d8a00f9e58203801316a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033513, "uuid": "89fdde00-687a-481c-8957-87524c2fcbaf", "comment": "Malware payload (SnakeKeylogger)", "value": "43999a31cf39af3b63ad19da61ab8d5828a86ee4ea0cd77d49143427d1bd0cca", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033513, "uuid": "4cf0adf8-2af9-4a22-b494-aadd8556199c", "comment": "Malware payload (SnakeKeylogger)", "value": "14136caf19b41f1760eb4193c440315c8e394c28", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033513, "uuid": "74aa7377-fb2d-4abc-81ab-12684485507e", "comment": "Malware payload (SnakeKeylogger)", "value": "6c4c4c2d1f5b287c530c35ea60a8155b05d00b87035ce677b43834d62d386c9406f4eefa1c59e1cd9a16baf02e802026", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033513, "uuid": "f9e0c67b-3ffa-48ab-a409-22818c25e88b", "value": "D6C42365EF05B7959A0F24545C32E43A6E7CF6000BBF1CF867C6629ECC8A7C14926D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033513, "uuid": "e1e02a17-aa8d-41da-92b8-0aaf9ed00985", "value": "12288:4nsP27oUygfDz3ItFkDmgMKFOYBZvLKmJuOHlb2/XgX9LEGP:4nUcoHgPYtFkDm2Y5Iu6nXmGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033513, "uuid": "34525a93-8cd3-4a76-a4c5-d71fde13a20f", "value": 558348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033513, "uuid": "d06870ea-bbb8-4994-a1b7-2c78cdc7e635", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033513, "uuid": "a66502bc-7820-40fc-b502-605f4bb9eba9", "value": "MECHANICAL SPARE PARTS FOR PETRONAS CARIGALI IRAQ HOLDING B.V.TAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abcf7ce-d9dc-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkVNC)", "timestamp": 1625082466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625082466, "uuid": "6c3bb560-bde2-42cb-bacf-92218e64f0ba", "comment": "Malware payload (DarkVNC)", "value": "18c3793f2df5ae48b55a9a1825b1c1fb", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vnc", "colour": "#9EA865", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625082466, "uuid": "37e239bb-49d6-4867-b14a-1b89c543ca82", "comment": "Malware payload (DarkVNC)", "value": "43e35aa1486b2cd51237520eb1b0b02fb46f0f3b135622e66b7438684429441c", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vnc", "colour": "#9EA865", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625082466, "uuid": "5a66d1d1-de56-4b94-8a51-85d802b0c0d0", "comment": "Malware payload (DarkVNC)", "value": "8e90dc300bb91dd6ce57566116b156e3473cf646", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vnc", "colour": "#9EA865", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625082466, "uuid": "9d85d818-19a8-4ad0-901e-e18a6a84cf4f", "comment": "Malware payload (DarkVNC)", "value": "5801bebed35886f745ed1c011b83b0d55d63ea87b943d80c3a9327c55a691ce5ab4fd91f551acc575d33be9d541dc10c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vnc", "colour": "#9EA865", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625082466, "uuid": "2568091d-a083-48dc-ac97-9ea44c34af1d", "value": "CA75AD143759FD25C2E6A2364F65E4E11B0934682B7440DF38F87FAF2FAD4A35A68306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625082466, "uuid": "e4791377-d83b-4edd-a241-0af849c5e87f", "value": "be0a2d959e20c7f06e996a3dfae0d06d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625082466, "uuid": "27d61749-fa8c-46c2-bca0-f7ef37d102f7", "value": "24576:L3G8qqDn4HT28T14a5EhXn6LLdHr/CLn+/nfwoeCOUgFqmRCka/2qp5e+l8U3h:iiYTtwaLdHryn+ZRg5rqJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625082466, "uuid": "0d93f1db-47ca-46b2-9f06-0ddf3114a8d9", "value": 1701376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625082466, "uuid": "f02f6257-254e-489d-a872-2e066f776880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625082466, "uuid": "8bc57041-aa95-4c86-ac9a-6dfdc65049eb", "value": "idu567.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243dec36-d9c8-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625073918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625073918, "uuid": "75d2c2d3-73ec-42a9-8155-558fb4f5de9e", "comment": "Malware payload (OskiStealer)", "value": "182d417728e3b8da39249e7691bdef16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625073918, "uuid": "87702ac2-6920-4e94-b4cc-2f3c533733df", "comment": "Malware payload (OskiStealer)", "value": "44205e4cf223ec528c507423db81ea8dce460b243e4dfa14088c5686b78590b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625073918, "uuid": "8ce49bbc-e9e3-42b4-aea0-a44a04854374", "comment": "Malware payload (OskiStealer)", "value": "2fb8da0b4c7c779d8c63c48729e417d7a0f2e707", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625073918, "uuid": "1c99a6d6-38c8-484f-b008-bd087865d0f8", "comment": "Malware payload (OskiStealer)", "value": "4ac7a540e7a9158512a36478430813921858bf85927617cac4c2749706a818054e17fb9fd296ed49c2665bec58590b0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625073918, "uuid": "c0e3bb6f-dd8a-4afe-b86f-c71ce396cdf8", "value": "4B055CAC325435DEC467C6B9CAA8AC74EA613C6A431BC107909319DFAA0DB97DF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625073918, "uuid": "263add81-b5b7-4b1b-bc2f-64e39f9203c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625073918, "uuid": "9b12e5a3-e1d6-4ba8-85ab-ecab3506d0a9", "value": "12288:i4Ta41R+ontJxkMoLsO+Il2nchnvf0zhArjixoZVoTa+nuEiG5+25/d8oDWC:c4P+o7aT+Iwnchnvf0zhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625073918, "uuid": "10eaac57-5939-4fa4-861c-a7fd5d65adee", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625073918, "uuid": "84a386c4-d378-4dd0-80aa-64dbd17e2fb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625073918, "uuid": "496e3238-2436-41f7-8e0f-92d48123a11b", "value": "182d417728e3b8da39249e7691bdef16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50997c01-d957-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625025460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025460, "uuid": "a73cd94f-c897-496e-a2f6-b19aecbb84d4", "comment": "Malware payload", "value": "aef5024a83edc00e6540c720d061d4a9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025460, "uuid": "530b59d3-fb73-48d8-88cf-90d73d5b63e7", "comment": "Malware payload", "value": "451b4fb4bbd1132305a70846d178321c1cdf291d51c51974ff5beb98674e14ba", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025460, "uuid": "808057f5-f965-40ab-ab8e-fca9d5fef009", "comment": "Malware payload", "value": "17b71ce8a2df84b9c53f8a0e7f91d072b91e39b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625025460, "uuid": "cad9b81c-4ebc-473b-a903-74c3e54c7ff4", "comment": "Malware payload", "value": "0c0cc47b0127a6c22aeccc60eb56a21e5f86604b4e11ae2f2d6db284862a728fca301eb6bcb2152e801210ce6c5ee7f4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025460, "uuid": "df20d927-b569-45dc-84b9-6d343b563371", "value": "052533172B448BC547D759FF1762A15C84D30C387058B6367AAF4BB8A13B907B32A9BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025460, "uuid": "f99a746c-d235-4a02-b4b6-6972db48d381", "value": "24576:uEaJMhK4nvMnxPwMR6rlUmGFD0ANaE+eW7J:xaehdnUnFw3GLFla9eWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625025460, "uuid": "e721850d-1196-4b17-8753-f363b35516e5", "value": 1000313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625025460, "uuid": "c10bb641-2468-44f2-95ad-93104b0de587", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625025460, "uuid": "bc996886-008c-4530-99e3-a9df35ac2dc1", "value": "fatura_vivo_01072021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6d30c8-d976-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625038903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038903, "uuid": "d0350a24-064d-4b1b-8a81-a7356db6e1b2", "comment": "Malware payload (Mirai)", "value": "a8ad861db94efe3360dc35a53185bc56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038903, "uuid": "659213e0-512d-4de5-98d0-7913a6b6d1ff", "comment": "Malware payload (Mirai)", "value": "470373829c41244317d9aaf36f4cec9e431ac6a45e2953229bbb2edc1d7938a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038903, "uuid": "24aa0461-e9f5-418c-a21a-4ff6e0baf307", "comment": "Malware payload (Mirai)", "value": "6b32a22762df2116b5dcd6a2d0b5e932a313f295", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038903, "uuid": "e00fbe22-7bb3-4a20-a5a7-a92837700fc1", "comment": "Malware payload (Mirai)", "value": "fec567a9376c524052851d4ef28bb4ac1a7489f2c6da9a3a06318875f97f662e837e0cb764f5cd2aa0580eb2d312144a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038903, "uuid": "a30668d1-27f7-437f-8f28-b93829cbc191", "value": "B45302859605ACB4E2329E3BE66E562EBAE94F7171DE37E25F109368F0C119F2F01019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038903, "uuid": "58b530df-20d5-4b3c-9dc0-a25948a8b3e8", "value": "1536:xbkdML2gpfq1emDrtZQ8oHux7QlhASc3k6A:xPigvpN2Xk6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625038903, "uuid": "bd3843e6-0277-4427-b9db-9c9ff119e8ba", "value": 62992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625038903, "uuid": "0754b9cb-2e92-4b88-a2f1-89baa9e00930", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038903, "uuid": "cd48df03-a0c3-42ef-b734-d2720c294494", "value": "a8ad861db94efe3360dc35a53185bc56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafb8555-d93b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013720, "uuid": "53462464-a3d9-4d7c-b575-7878f78f5925", "comment": "Malware payload (Gafgyt)", "value": "3538ef550cf1ec74c48aa2710d7c1778", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013720, "uuid": "6733b24a-f17b-4e32-a7ba-e6a890a2fce5", "comment": "Malware payload (Gafgyt)", "value": "471b4d64420bdf2c8749c390a142ed449aff23b0d67609b268be044657501fa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013720, "uuid": "96a58972-47d7-4e3f-be27-faaad3f6e67f", "comment": "Malware payload (Gafgyt)", "value": "a7979766b51317aa13517ae3d455b656a7c9ef3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013720, "uuid": "801379d3-eedc-434a-bc6d-bd2f7d7e767a", "comment": "Malware payload (Gafgyt)", "value": "512ec0aeaec24012973d0f1a32298def233cfbe06fd182b949a5b39b5779315957fffa9f526e9f08d18c991a5fdf2b46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013720, "uuid": "48bf0db2-7eb8-4fee-b905-a0440272adb1", "value": "5AD32ACB661C0783C49755B12D6737F1B79CBBB021A262C1A91BEF900B73A743516FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013720, "uuid": "1a13188d-ada2-454c-9049-74e91834b0cc", "value": "3072:lXLo3QEUgAcZYU5JmDj5hqToW3tQnL0CDYxlQNU8:lX4QEUgAcZYU5kDj5hqTltQnL0CDYxl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013720, "uuid": "7bbb6b23-6243-4dcf-ab6e-04ec2223f35c", "value": 137838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013720, "uuid": "525ff0c0-a098-40ae-bbb5-fbad49e22a0b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013720, "uuid": "d6b4c38e-0f10-4d12-b630-59f93b4e42bb", "value": "3538ef550cf1ec74c48aa2710d7c1778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c995e8db-d99a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625054439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054439, "uuid": "db0f189a-f26e-48ed-b118-ecd45b3bf464", "comment": "Malware payload (Mirai)", "value": "ead6289a8b996071ce38eda65945e852", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054439, "uuid": "ca4dbc18-58e7-4374-9816-9e0ce1be5516", "comment": "Malware payload (Mirai)", "value": "4b547f5acbac096bd97268d84df0fefae55ac056bee0d5e0f66b4ee36a0b787a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054439, "uuid": "a5c90ef2-6b6c-4196-9d8b-66fc61e3555f", "comment": "Malware payload (Mirai)", "value": "3e135bc3364e3e85936c4d2139792f7b7cea7e39", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054439, "uuid": "3944e9d9-00a9-4b03-a66a-05c67edf3846", "comment": "Malware payload (Mirai)", "value": "50588a8c31a98e37659a7f5d44b30c3841b458a6c4f27740707910552d3c9e00fb95f4d026be378248e845ac4897418b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054439, "uuid": "2f4b2e24-8fdc-4c7f-b57d-6a74639c3d11", "value": "A664D08AEE01AF25E9C425BAFE5F034973634B6CD3EBB111E620972537CA54B4F36045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054439, "uuid": "0aef6d7c-6700-4b41-9e6e-7d6664442483", "value": "6144:p3lOYoaja8xzx/0wsxzSi/abE5wKSDP99zBa77oNsKqqfPqOJ:p1CG/jsxzX/abEDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625054439, "uuid": "8715a37a-244e-4612-862f-f0a42a1c5e78", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625054439, "uuid": "f7755d69-3e0a-4b52-9320-8a57c5ddfd32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054439, "uuid": "52b88883-db63-406d-9d5e-5bf8dda2430a", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddb9db7-d9cb-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625075330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075330, "uuid": "4451cb1d-96e0-490c-bd4a-107489d7673c", "comment": "Malware payload (RemcosRAT)", "value": "2e1a701b32b44e83f60bdcda914b332c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075330, "uuid": "2d167797-552d-4ba4-81b8-88851f2c259a", "comment": "Malware payload (RemcosRAT)", "value": "4be9060105bafe3c28b9cbca8208a69952c4c524cb45398e0443e29ce2323e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075330, "uuid": "e33302e0-9abb-4f64-92af-6cbf796071e1", "comment": "Malware payload (RemcosRAT)", "value": "5b8d5f4dccb90a6871afc919fb69d815eed882c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075330, "uuid": "134fd87e-95d7-4d24-a49e-08b7c8ef980f", "comment": "Malware payload (RemcosRAT)", "value": "436003a2d0c038f2293ca806ab69619eb9dd195b547d77644520cb0bd7e8021506d0a05caa5a6864ec9cf4f5875ea787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075330, "uuid": "1a662fa8-c247-4463-91e2-a0a532fa9a69", "value": "4DF48EE2B1D0C536E6A62E38BC2A9AA59835BF002E54780B23E43F5C4F765C57D3D187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075330, "uuid": "88d5a428-5a46-4635-ab98-980a5b234056", "value": "49872ca347743de3342dae48ab6a2426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075330, "uuid": "1cae2176-a909-4455-a5be-c01f86a4732c", "value": "12288:3/GRJUeqFZCVHtc67SJFBoy7PoAMkANkLkU41Xc:3eRJsFQHGKSacRsNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075330, "uuid": "e3a83fb6-fb97-411c-b9a5-c2004d7e44b7", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075330, "uuid": "03b499b0-edb4-485d-99be-fca645627b91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075330, "uuid": "28a2104d-c093-4d24-bc0a-fa5f0137075d", "value": "2e1a701b32b44e83f60bdcda914b332c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa9b3dc-d998-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625053287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625053287, "uuid": "0be3a90a-248d-46cc-814b-3d94e936de81", "comment": "Malware payload (Formbook)", "value": "c6b35f353ddce781f1ad2bfa077a872c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625053287, "uuid": "e288f88c-10d6-40d9-8cbb-2641ad1fe159", "comment": "Malware payload (Formbook)", "value": "4bffffde56eece4e7588a5ebe9c7f53c822e516442a16eb351437807f0da841f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625053287, "uuid": "e5249995-d39a-4bed-b832-05ee7b68611d", "comment": "Malware payload (Formbook)", "value": "371964402d1523c3783cc98479d1ca1e53b752b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625053287, "uuid": "945b832f-7ee3-40bf-8ce3-bbba8cdf4abe", "comment": "Malware payload (Formbook)", "value": "0b490bf9df9588b6634b91aca7184cf309fcacb3f6bed715d09bb686327b36529b817e8227d1ba694e171037fb56fd57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625053287, "uuid": "5c1aac76-198a-48b7-91ba-86f5b0557acf", "value": "1EE48D312BA85A39E0B69FBDD5A1208197EEF6136F03D85C78B501C54753E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625053287, "uuid": "52aa63b6-92b7-4f4b-bd09-264d35075869", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625053287, "uuid": "9ef14e8d-911c-4de0-a499-11bdde0b3d26", "value": "12288:DoKgrwGBbX5Ty9oN2ibz0STq/+gQRI+6d3g5tWHEqfE7w77xDVLmdj:DoKgrPjN2MiQ2+6d3g5tWHEJe7xDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625053287, "uuid": "6524df05-4c1b-45ce-b2cb-c426f4741ab1", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625053287, "uuid": "d4a204b3-190c-4f40-a5ae-2e43d9e0f4e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625053287, "uuid": "084b7531-6d44-4616-9b1c-daae1954e1ab", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c2ae4d-d9fe-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625097355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625097355, "uuid": "6af06593-46ef-4290-ae88-1e46e1adc496", "comment": "Malware payload (RedLineStealer)", "value": "7da96252d82e25ac097e81a57d4cbbec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625097355, "uuid": "1ebe4a1f-33f6-4cf0-a042-2faddf0fc683", "comment": "Malware payload (RedLineStealer)", "value": "4c0e776bf41b76778d9580cb7116453d9c9c4406eda5fdcc169bd0cecc1c134c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625097355, "uuid": "663ccffa-f783-46f2-a15b-f857a72b2d96", "comment": "Malware payload (RedLineStealer)", "value": "690ba5f642556297f7258983ff57b7d70be6c35f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625097355, "uuid": "79f69a62-80a3-4850-9267-2391f0d0b3cb", "comment": "Malware payload (RedLineStealer)", "value": "fe713c0568d775611eb77d4d65161f434199cd73d19cdb30b8683db01a0e8023a75433f9bfba3718265d783dc9cc811f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625097355, "uuid": "3daf1a57-8790-4d2f-971a-a75e1d0a28c0", "value": "18C4BF513BB8CA45DDADC4FA741040F635E9BD5B506EFA7E4D80B2F91B3C7428E40AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625097355, "uuid": "bcd6cbeb-fdbf-4adc-9ed1-f99f1e7e1630", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625097355, "uuid": "783e8a6f-ab2c-4454-8c79-db6eb83b6e0b", "value": "12288:pzDTo+c8NlvH0tGJjeM5u8v+VmlE2GLJ0uDSAA6FKrc9G:9xbP0tkaM5Rwm6200wSB6FKEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625097355, "uuid": "2e9b3f3f-80da-4dd7-8d84-24e6ccdeacd7", "value": 578192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625097355, "uuid": "584d88d0-60aa-4b36-8278-55ca17773850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625097355, "uuid": "c9056ca3-a85b-4094-bb46-cfe71e7782ce", "value": "7DA96252D82E25AC097E81A57D4CBBEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f56da7-d99e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625055908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625055908, "uuid": "fe11c271-643c-4711-a209-335b17accbf5", "comment": "Malware payload (Formbook)", "value": "cb1b8f388d0d021150f2744304a580fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625055908, "uuid": "4c39e625-c0e8-4e06-86d0-5a69ec94365e", "comment": "Malware payload (Formbook)", "value": "4d712492e99881e2d59608153262e30b2f6799a1bc37c22a4195994eea72f81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625055908, "uuid": "cd89d97b-0fe5-407f-b969-4ec53704b211", "comment": "Malware payload (Formbook)", "value": "3859795451b4c7772185f9d9f8c8201d9bd67057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625055908, "uuid": "c9c65484-95f7-4b3b-8eb5-e209910a7228", "comment": "Malware payload (Formbook)", "value": "75e6de69fdeab0502d6a41767699c427d2b23e60fc4c310142655310c002efe132aa960c47f686a4b702c2f6d8a5940f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625055908, "uuid": "1c231f09-ab6f-4e20-90d1-4753d2ab1ecb", "value": "8E558C10B9849528D87A8F3D5AB6C824577EBD677E32DC1C38F933AA0B73693847114B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625055908, "uuid": "9dde87e3-4281-4d7d-96fd-c686e8701b71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625055908, "uuid": "adcd8825-661b-4f9a-9a78-8f98b706ef70", "value": "12288:sqOQbuBbX5TyM4y2pt+4y2ptToNBto+eoXS5dca0nWKCt+l2pszmhUJ+vtRFuSp0:aQyayoyDNBtWjdcuKCUosKdOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625055908, "uuid": "5cb1ecc4-3174-44d4-b8f8-ea75ae72f6df", "value": 1384960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625055908, "uuid": "b4530d06-6779-4371-a4c0-81d00e75e3a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625055908, "uuid": "98fa8b34-3fbe-488b-80e4-a35ef155d19a", "value": "ATLAS AL SHARQ TRADING EST - PRODUCTS LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5849b73-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625059183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059183, "uuid": "0a014fad-3d25-4652-a874-d2c7241e51c2", "comment": "Malware payload (Mirai)", "value": "8c8839dc6bf9f7bbca6d6f3d107c9bec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059183, "uuid": "04b8cef5-3e00-48b8-8dfb-2b9332560f5a", "comment": "Malware payload (Mirai)", "value": "4df6f098aa96bda742f8df92725645fae3e6d98fcba212708f80105cb82cc024", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059183, "uuid": "1bf5bb1d-5ab3-40c5-91c2-599d0dcbca92", "comment": "Malware payload (Mirai)", "value": "0a1f820b78c48385c1b7b6bc377696cbe87f4a03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059183, "uuid": "b8661e38-c7b8-4105-9eda-09da83638b01", "comment": "Malware payload (Mirai)", "value": "0c46630afaf83ad36093b1795cefb284a44701cf007813604a7596d2cdb36380c9327cdb63d3e4564ce461ba20ddfd10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059183, "uuid": "6814d535-fad7-443b-ade3-0e89f4aecc36", "value": "A2E2D010EEDA6FA8DCD5F9B1CDC6DBC157CCEE1D1C65CDE2B059A74085D2B1682808C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059183, "uuid": "cd7c1efb-6b06-4721-8450-45aba8b732f3", "value": "768:IhECa/Zo6v2ZtovD94elhY9SDtNBlITxS84uVcqgw02NWXULD:KEzZo6vstomePaCWTxH4u+qgw06WX0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059183, "uuid": "28f27a18-7d4b-47a4-9d7a-0904c857b77b", "value": 31848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059183, "uuid": "91323203-566e-4978-83b3-b75dabb9ebf7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059183, "uuid": "3db5198a-81b8-43cb-8585-54bf3c32e20c", "value": "8c8839dc6bf9f7bbca6d6f3d107c9bec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec4bb6e-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083305, "uuid": "2046d897-0782-4fbd-9aa8-83c37dfc700d", "comment": "Malware payload", "value": "f4c7c42fddad7089a70cb59728aa66dc", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083305, "uuid": "3e69dfc7-2cae-4267-bfa0-3264973255fc", "comment": "Malware payload", "value": "4df8dd523d0e458a3704589d57098fb4a8cc54d95b608aae823cddb9c0dc57f6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083305, "uuid": "aefe03eb-eac7-4278-92bb-e13a3cbfa365", "comment": "Malware payload", "value": "6bc17912a0368a6aa5439c14d8f3bd07127e9744", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083305, "uuid": "a5c477ac-ea1e-47a6-89ac-3bc55fa0046f", "comment": "Malware payload", "value": "8f760a0bed5bf5720dd9dc9a04fcd2ef21a1b261f083eb3c48b99c8b348b1079b2730f42e683d4c159945323ce71cd11", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083305, "uuid": "244ae307-0b56-4f64-bc0a-d6cdcf53f0c8", "value": "11241205E127E861DF8F4077BAF92AF61369581315581533E732342CD8ABC6ED2287BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083305, "uuid": "b1413f1f-6559-4e8c-be08-bc3a477b816c", "value": "6144:fzQpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56BGHU:7Qu9l2pgxjt6XUyNW+Md56BSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083305, "uuid": "b2fd1d49-be2a-4482-9a92-f987e95d8b18", "value": 218078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083305, "uuid": "c1abb19c-434f-4050-bcbe-c770a6b8cf8f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083305, "uuid": "2a412b36-d873-4f46-95a9-89bb8a2a4952", "value": "PO 97179275.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42945d66-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625032738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032738, "uuid": "ece814ce-12c5-443a-8c95-1f7e729fc5e9", "comment": "Malware payload (Mirai)", "value": "f1ac1aa011697144c822e3cb3dbc25a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032738, "uuid": "92e8af29-4b0d-4cec-8e35-e3ed6200263c", "comment": "Malware payload (Mirai)", "value": "529b55c7cdef6cf7260f45656dbe8f05f866d5ee4b7607fb20f15540d23d6054", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032738, "uuid": "54db9045-97d9-4bc2-9a2d-44bc255c01a9", "comment": "Malware payload (Mirai)", "value": "ad57170c5267e5cdfcc4a0557b50d46134c68061", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032738, "uuid": "35d2cf7a-c9e0-4323-9e56-cab4852cb43f", "comment": "Malware payload (Mirai)", "value": "839938c9a4bdd65edc66cbef7500dae80e966c815e0f3afe66f403c2910cb6d33012aca18a8971db9b78b09487bb7dcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032738, "uuid": "d41be432-5a50-45bb-9ca9-3078cd8150b3", "value": "E3534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E374999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032738, "uuid": "8d28932b-0160-492e-b516-787516f19ca8", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Bv6GG4TlW2c5sjgi+DDiZ/v3BbsVf:2KbpuqJlzk5xGpJgbDOZ/v3uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032738, "uuid": "e7ab69ba-ab6c-43be-bbde-1d7327d69602", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032738, "uuid": "c660ab9c-dc99-4ef4-af3b-fec33ca7b611", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032738, "uuid": "6d00e394-70fa-4689-b62e-e829cb0cadba", "value": "f1ac1aa011697144c822e3cb3dbc25a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b075ba73-d9a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625059980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059980, "uuid": "15e35fd9-fc40-4b94-9c56-ae42a82c7942", "comment": "Malware payload (Formbook)", "value": "3a3124b570a3df6467bf9089a395a8fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059980, "uuid": "f02eb2cf-3798-4503-82a6-e55cdb5ae57f", "comment": "Malware payload (Formbook)", "value": "52f12a925f53adafd752c33413413ea3928a53f124e9530909107b57527d75fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059980, "uuid": "c7b83573-c189-48c4-979e-1334d6ac7770", "comment": "Malware payload (Formbook)", "value": "d30678e9c5b4ae4ef0d7ced6db47a60cb164feb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059980, "uuid": "26f68a0e-4497-4794-95f7-3ba8134e9ff2", "comment": "Malware payload (Formbook)", "value": "4c9e9d48a8932ddf9806d9682c3657ec6952c98a1209dac9190acd82580ec09a5a0e5b9cf8f11dbf084bbbb9b649ce4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059980, "uuid": "04e7e47d-7975-45e0-8c82-63209796ac7d", "value": "2D159E0DBCF43683F22B96BD36C960E24275BC1D9B18EEE35D82F3E6056160AA577503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059980, "uuid": "d74c873d-79c1-43c6-ab7c-5477abbb4718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059980, "uuid": "4072ac0d-7d89-4933-91b9-4aaa1a3878a3", "value": "12288:Ip2vupLVGL5fL8lV/ZbeLcA5qBnNVU0bN+CL:e2tJ4htA5knNV7+CL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059980, "uuid": "ab389eec-ef6a-47c9-a8ad-64f837a1f2d8", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059980, "uuid": "2348145c-a88b-4551-88e9-d35a15a77736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059980, "uuid": "fb73473b-5ebe-45b6-800e-ee65783d3ee5", "value": "pl254.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6939463-d990-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625050166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625050166, "uuid": "44ed643d-4799-4693-9cf4-5e5968c072b1", "comment": "Malware payload", "value": "3492b1c33fcaa892615aa673b9283014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORTH PROPERTY LTD", "colour": "#3C35B1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625050166, "uuid": "a2edc23a-f876-4a91-b7f0-7dc465a1760d", "comment": "Malware payload", "value": "531686f56257eafa0da5908fa50d5ef2ef51efee156c1185c212ed0958ee5b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORTH PROPERTY LTD", "colour": "#3C35B1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625050166, "uuid": "229783ae-973b-4efb-844e-f5b2ca314c72", "comment": "Malware payload", "value": "b13dde42895155a85837287c2b7eaf371af94752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORTH PROPERTY LTD", "colour": "#3C35B1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625050166, "uuid": "e49da5c7-3298-4b45-88e6-0a1046cfa6b5", "comment": "Malware payload", "value": "e8dfa9e62e0358546a07870938352b08f70a9e3e79618aa0e58a5ef8e90052578a8a6438a3b3f5ff8e2f2b5fe2ad8ed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FORTH PROPERTY LTD", "colour": "#3C35B1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625050166, "uuid": "6b947b0d-2f3d-4e19-861a-ff013aea87be", "value": "4D05F10076B90BC6E77893F61DD2552147FA3D2F7869E6182EC072CB29B2F404A51F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625050166, "uuid": "cbca627e-aa3c-44da-8499-14f732d96af0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625050166, "uuid": "0246dc07-0825-4af2-9cb5-91ccda972f25", "value": "12288:yDUuZX+iDsJRCb1cQ9Ylue3m7ULjUlNzYhxQdVjCk2GEXJ+Ult:yDP8O1jCH3zjkWhadHI5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625050166, "uuid": "4aeafd91-266d-4193-800b-5c872cfadba2", "value": 858512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625050166, "uuid": "a8537322-ba8f-4223-8313-5e7aba20d5cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625050166, "uuid": "85ca458d-0f7f-4a5a-a651-52da8b560755", "value": "531686f56257eafa0da5908fa50d5ef2ef51efee156c1185c212ed0958ee5b59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ba4812-d989-11eb-875b-42010a9c0053", "comment": "Malware payload (LockBit)", "timestamp": 1625047084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047084, "uuid": "c7b62fe3-04a5-4b15-aaf9-0e4c7e917eb5", "comment": "Malware payload (LockBit)", "value": "ee9e9d6b90c5df29a52464e977b566ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047084, "uuid": "902cde9a-f502-4e5c-b3d2-228f8a577459", "comment": "Malware payload (LockBit)", "value": "54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047084, "uuid": "732b944d-1633-40ea-98e8-0d0a1d314943", "comment": "Malware payload (LockBit)", "value": "d8f9b34d0e14f303373a86f52716ca0351977b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047084, "uuid": "cdbe8657-0929-408b-a569-265a7033be89", "comment": "Malware payload (LockBit)", "value": "74f9fa0d8224912431a9104366c430870bdf530d11da6dcdd71b4bc7b4e305696ffe199b8d7010fa97f328780d189b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047084, "uuid": "b2d838dd-198a-48a7-b91c-675a3e85b88e", "value": "4CE31725E156E276C4E70BB07668CFF658E8A434232090F7DBED0A5C18E4BE16E37256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047084, "uuid": "d720074e-f966-4cab-95e9-c6319328dc20", "value": "e9f710b579880d1b6ff748176eb620f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047084, "uuid": "0caf6dc7-40d0-4807-a33b-23a9b0e422ca", "value": "3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625047084, "uuid": "55094391-6aa5-4f54-8c86-a560d289af50", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625047084, "uuid": "45b62903-17a9-4a91-89e2-4e3f1a45fccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047084, "uuid": "f385e424-2a08-4e39-89aa-c48e00ea73d1", "value": "VERWALTUNG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5607956e-d9d9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625081303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081303, "uuid": "9db8c3b1-18e9-44bf-a437-9ed266396be0", "comment": "Malware payload", "value": "c29fd72969e4d542f8ed7f0a57141423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081303, "uuid": "45f0d15f-7733-4a75-beb0-e4470c1194a2", "comment": "Malware payload", "value": "54ae4be0297bac7594eba00d00c518c0211e83b93020187f561b36928cdc080f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081303, "uuid": "b6a16fdf-4c4a-4c80-be12-9c0c2c0101f1", "comment": "Malware payload", "value": "927fa3c865e2b888503993b9a5b3516746d1feaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625081303, "uuid": "5d3f3587-c51b-43e2-af73-d286e0c95acd", "comment": "Malware payload", "value": "f54d15682c28784fbda7259cd59749992cd13662c414d53393ad37162f320184cbc83482a489a7c3899413ca2cb6fe79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081303, "uuid": "af27a52c-9454-4157-87d6-cbbcb456394e", "value": "68756A10B260D033F6B12672893AD9F3D975FD128A2573CBE4D2363C1A3D9D35A25EA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081303, "uuid": "3b28c410-6c29-4905-bd1b-fffb6cb98e5a", "value": "9cff33d60abb2b9ada3b724500411bdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081303, "uuid": "93fcfcfc-59ff-42e3-9a58-bfcef8249c8d", "value": "24576:RimzrjHy2WUJueLZ1v4414vbqWrbp414TbqWrb:RbfjS2DfZm414+Wrbp414KWrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625081303, "uuid": "d354296f-16f4-49c3-96c9-3e25e25a2d73", "value": 1560576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625081303, "uuid": "056aa82a-5775-4767-8233-7cbb2f048b1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625081303, "uuid": "21b42a10-804f-4a8b-a001-e8b6065238d1", "value": "54ae4be0297bac7594eba00d00c518c0211e83b93020187f561b36928cdc080f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711e3a40-d969-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625033245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033245, "uuid": "104621be-99f1-439b-933a-7eece143d0d0", "comment": "Malware payload (Mirai)", "value": "d9006496807989dcd67aba8c4b63a751", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033245, "uuid": "73cf144a-5fa3-419c-9880-6ec45ac46900", "comment": "Malware payload (Mirai)", "value": "55b765d7db333e51f3a2e878c471af7a7b3f63e0626733dfdc099e54f1735334", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033245, "uuid": "f4d56514-3ff2-42fc-8eba-1ae2cafdb521", "comment": "Malware payload (Mirai)", "value": "6f032813ece5d966c76a83ad49ea48fd9d9894a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033245, "uuid": "28c8c13d-c09d-4c46-99bc-75926ff2b6ac", "comment": "Malware payload (Mirai)", "value": "e02a9a5ca5922881a7c44050026f36e16e78054d90765d80a9fa83c87d602de651d733ef39d341125474ba390b580255", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033245, "uuid": "d7517039-c554-4bc3-9a4f-c5e73e5a3e39", "value": "99831981B9809E15C6C5177BFA6F108D331247A9E2DEB353CD145F6477CA82B0E37A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033245, "uuid": "d6141024-2a77-4ee1-9721-7bb4607df82f", "value": "1536:29n7/xkRBFg3yFhk20WtEu+1F4YPjaduBcPYO9mrsplDKZUlQBKXAVan1X+F8Jyn:gJTyHknWt/+L4qjmugd9mrsplDKZUlQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033245, "uuid": "ef8905a5-27c3-49de-b1d5-cfeab491e42d", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033245, "uuid": "0d602517-8fcd-4bd2-9def-b0c88c404e8f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033245, "uuid": "424ea90f-0138-4ffc-95bb-c6077312b1a9", "value": "d9006496807989dcd67aba8c4b63a751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83bdc1e-d9ae-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625063107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063107, "uuid": "e3bcc73b-dff2-4eaf-bdac-4ec15546010d", "comment": "Malware payload (NanoCore)", "value": "7b1c14a25437e267dacc8588c3803aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063107, "uuid": "5a9551b8-4b51-4d02-8586-2595653173bd", "comment": "Malware payload (NanoCore)", "value": "55f536c640c8cf931a09788c5e05b5f170c944e4aab1f5c2b72c2d6311e97641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063107, "uuid": "42021d55-31f4-46e3-ba11-51d4ac9a2ce8", "comment": "Malware payload (NanoCore)", "value": "317e22588b107afa164ce50b7442760025d7667e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063107, "uuid": "764ef96a-c8e2-40a7-ab5a-5a2310dab762", "comment": "Malware payload (NanoCore)", "value": "e5ffafa79bdd026543740e70244a6bddb96df9b10ec78b5e2bf6b9cfe65ea2f70e30ea35bea473242f86079bf468c323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063107, "uuid": "5418c6f4-aeb3-4ef3-a84c-6aaec0083f77", "value": "3F159D9D3650B6DFC8A7CE36C9A81C60EAA0A477830BE747A4530ADDD94D697CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063107, "uuid": "cd3ff825-3fb7-4223-9563-1933717631ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063107, "uuid": "a6a22bb4-edb9-46c1-a6b6-7e130a796134", "value": "12288:03b9BFocRquLevKhbvhbQKnIRkmqr0Ti2u36g6GZ4PBGfybPx3ofBnz9+zxpKoRw:03BBFB1fFhkoOkJKg6WHyLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625063107, "uuid": "0af75976-746c-4903-98c3-0f97e938b44e", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625063107, "uuid": "306a14fd-c194-4612-8da3-ee5ee10c1b45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063107, "uuid": "dd88dfed-a16a-49c9-883a-feb1f427e967", "value": "New Proforma Invoice20210630.xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e21f6cd-d967-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625032435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032435, "uuid": "c64362a5-2834-4af9-a3f3-a18e8389a3e0", "comment": "Malware payload (NanoCore)", "value": "356de21f3911e2878ee196dcd3751036", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032435, "uuid": "98e33bd4-b762-4532-8a4c-53d423f9ae55", "comment": "Malware payload (NanoCore)", "value": "5610e552b9a56a2b9be262db3c518975066bce0a0f2190b4b9df898a762a3329", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032435, "uuid": "b679bf04-0bb8-4b7c-90c7-b4ee6d1c0f83", "comment": "Malware payload (NanoCore)", "value": "23095d8bf5ecfc5974e079c642d571ba118d9ece", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032435, "uuid": "e37e5502-ff2b-4e34-9cd5-1f280f2e29e4", "comment": "Malware payload (NanoCore)", "value": "c44a7a9b2194da05c5caebca11c8e0c94692d02a775ef4f437a67de12d1f466fddfab3552d272637df498b4a9df96ee3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032435, "uuid": "91ff661a-a990-4465-abcc-b238bd883b03", "value": "FD6433A4119F8272E6448E4D35C0B1895E74FE9230CACC2963AECA75DF65AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032435, "uuid": "0a95b0b9-3002-4b21-bd18-d39c1eed4702", "value": "3072:9tBrB2BrBthK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHRlrdzFDr5RDAw5wfA:ZVcVtprdzFD1RDAUw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032435, "uuid": "5aea6c3f-778b-4642-bff6-74e1edc1f657", "value": 336322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032435, "uuid": "3236f811-09a5-4c39-b64b-df167951999a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032435, "uuid": "e2ff00a9-bd91-4084-924d-9a6ce83aa3bb", "value": "P O (2).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edc024e-d9b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625065964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065964, "uuid": "b61882fd-a7a5-4ea9-b18c-7dcddffdd674", "comment": "Malware payload (Mirai)", "value": "ef8d7d02d1e79def9c5a930b472d7880", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065964, "uuid": "5dcb40d7-eaab-4de9-bc82-b27f0e286fe5", "comment": "Malware payload (Mirai)", "value": "56e15031f781eb3bf01ca03f04b968c845a72c18d001292545e1a4afa4c0dd92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065964, "uuid": "4fa72c63-a7df-4690-9d66-ab5a087ddf6d", "comment": "Malware payload (Mirai)", "value": "dc4d1abd26e235e2077ab1d6c4145d59f8fbdd53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065964, "uuid": "f5baf28c-46c3-483a-a083-bf05df71eadc", "comment": "Malware payload (Mirai)", "value": "844c1b7876f2967b91605642b13c4dec068a210da9a5a67d43bf10c39dd78bba3038ab0e1230b6b404e834a2ad0a399e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065964, "uuid": "84ef9404-64f2-4ed6-b3c9-e97146a94e63", "value": "5223F1124754F421D336A5FAD06404077F2E6D3EC3BE38A961AD829DAA10F5221F719F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065964, "uuid": "32d33934-4086-47e9-816a-2a153fc4b09f", "value": "768:SHq8Y4Ip76Ny2zK3gjMYab9q3UEL7yBZUXBxSf+L:SHq8QJKyp3gwYxL7zxM+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625065964, "uuid": "8e6b5603-fa23-4170-8e13-a0f27d347118", "value": 46840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625065964, "uuid": "e9572649-58d7-436d-86eb-2b39253049fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065964, "uuid": "f0824f90-9977-402e-a881-5145d2eca1cd", "value": "ef8d7d02d1e79def9c5a930b472d7880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119656a8-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018912, "uuid": "ed355f06-9f82-4836-8aa8-741fcbd5d5c8", "comment": "Malware payload (Mirai)", "value": "1fe185400609fcbf6d899cc4c572fcb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018912, "uuid": "fe4a8528-cd3b-4cd4-bf9d-9d1806764fb7", "comment": "Malware payload (Mirai)", "value": "576bce5c1d1143b0e532333a28d37c98d65b271d651dbce86360d3e80460733f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018912, "uuid": "9b172a53-fbb4-4eff-94c6-4076d677e8c5", "comment": "Malware payload (Mirai)", "value": "8a65b34dafeba219171cf0bee2592098a753493d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018912, "uuid": "eca90f4e-6170-435b-9d0e-962a0a52a09d", "comment": "Malware payload (Mirai)", "value": "16e5eab0e6ac26b9f538ff8df5d76cf1724d3acd55f1fe61e4c286f8ce5ee84d4d2cb296c2f9b25445b90d17b9733166", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018912, "uuid": "362693c5-aa98-408c-b9a5-c5aee7aa50ac", "value": "29C3223E7E22AF7EE278823107F66F70C35929D636A18344E16CF6485E7528C189F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018912, "uuid": "03fee610-d424-4edd-8faf-aa32ccaa3795", "value": "1536:dcjrzNw7l53+fw8rgf9Pq42rKHpOBY2cACMxKOiVg9DAaTDOpULGiVgemfWsb+O1:AAXtA2VgVAaTQULGiV+dSO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018912, "uuid": "c6296919-4482-4fee-ac5a-f209d5c01a69", "value": 129688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018912, "uuid": "c5872d5a-cb55-41e0-80a4-3a4bc300c51b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018912, "uuid": "e420ab06-1cd7-4753-b366-58c591d779bd", "value": "1fe185400609fcbf6d899cc4c572fcb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3be174-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625018899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018899, "uuid": "4bfa1b01-f9cc-4b1d-a60f-6ca718d9bc20", "comment": "Malware payload (Gafgyt)", "value": "f2651ac1e266ec4a5b19ff4ebec994a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018899, "uuid": "54d97c06-09a4-47e0-b918-688a0121f9be", "comment": "Malware payload (Gafgyt)", "value": "5a9f02031f0b3b1a2edaeae2d77b8c1f67de2b611449432c42c88f840d7a1d5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018899, "uuid": "6593f7c9-acb6-4bb8-9708-ba84485cbcdd", "comment": "Malware payload (Gafgyt)", "value": "3585188cd8d440a7f714f3a348c4d93edfe4bb6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018899, "uuid": "35d40314-85aa-4468-970c-706ccb997a2d", "comment": "Malware payload (Gafgyt)", "value": "deffdd6950c1d26e907dfb86a8283d1cbc4b30dc0ec98e12d7a290c58a1e1797e10e37f854a9c1bd2f6d6996d00f4f98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018899, "uuid": "10b8554e-fa98-49ac-82f5-cf6aec951da9", "value": "FE730B56E743C7B3C80306F202A7AA6F8931FE3A5835DA4AE3257D54E7338D06612B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018899, "uuid": "3c2a1b78-719e-4eaa-90c5-efd8898a2e2b", "value": "1536:txXVxzBt9UzYJmwaFuTWMKOXsqbL5SA5NFZu:tBzBt9Uz8mXZOXsqbL5S8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018899, "uuid": "f5961dc4-a98b-46ed-b137-675ceef18060", "value": 74104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018899, "uuid": "f7ec3d03-194f-4edd-ae9e-34825d239bf0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018899, "uuid": "d51530d0-90dc-424a-9cf8-f0057e49ea49", "value": "f2651ac1e266ec4a5b19ff4ebec994a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adae48b2-d9a4-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625058687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058687, "uuid": "c0050b61-fff7-47ab-837d-aebcd80e5a3e", "comment": "Malware payload (NanoCore)", "value": "2e494841a78631c0fac486e7b8a34750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058687, "uuid": "7a193e25-3a87-4b3e-8ea0-314c2ce2744e", "comment": "Malware payload (NanoCore)", "value": "5a9f046e4d99942288488d69dec64e9ea90b2105e92bc86742e6d322448cdf8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058687, "uuid": "d0283b12-97e7-4094-a564-44747e3efa27", "comment": "Malware payload (NanoCore)", "value": "4dea0f76ab2d4e50ff1012e453068cdd1896fe4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058687, "uuid": "68c98dbe-a58a-4431-b597-b60b1a0b0dd4", "comment": "Malware payload (NanoCore)", "value": "6971b6b662581265a9a10efcab1090777ce5f5a4d2711ab5069901afe71d28512c37953b7a121e54d56ae885155b1098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058687, "uuid": "4b9f0a00-3895-4459-b1c9-c3a8fa120715", "value": "8105023865BD8408D57E4BBD95E09080D77BB2563233E61E644D224A1F53B82CEB1BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058687, "uuid": "c064f955-5b8d-409e-b72c-27d71df574a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058687, "uuid": "4839b6fb-494e-4052-8f72-c004f727d038", "value": "12288:Xxuk81oZ/ukHdRueW8KXgFNPx2DZaUcNSN9Y8PnS6BW4vwjH5DjwD:BhW4/umbWdxDIUcNSNq6S/4vEHJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058687, "uuid": "9cbf6c48-b06f-46e5-a070-c397ee462835", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058687, "uuid": "8ace6f9f-000b-4b74-b8e2-40f021319904", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058687, "uuid": "24fb2b69-775a-4bf4-8fe1-92a16e984cab", "value": "2e494841a78631c0fac486e7b8a34750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac64da14-d967-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625032486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032486, "uuid": "31d019e2-1888-466c-bc09-de6001cd4d93", "comment": "Malware payload (Mirai)", "value": "f6bbaad6b5941ead933f537c5b9dd70e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032486, "uuid": "5125ca87-8200-47db-81f5-2d19b356432d", "comment": "Malware payload (Mirai)", "value": "5b47b90a718caededfacf53dbfd63ebeda0188213df4b970e173c566290ffe66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032486, "uuid": "cd6963b4-4b16-47c7-b57b-d9ca06041a65", "comment": "Malware payload (Mirai)", "value": "890aae6f56b97b45037639a52a5ff735a4578932", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032486, "uuid": "6839e84d-23e3-419d-89a3-0cc29200f6f9", "comment": "Malware payload (Mirai)", "value": "59ab78ec8ecb24c505f7e8ec5efb3be954cedb3e2ed943820fda5ddc34f68102d999a517aacd3c17b1123a696fe82df3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032486, "uuid": "53f9f4d5-d456-48f8-88d3-5d555740915d", "value": "786318817C80AA26C7D0177BFA9F108E3314ABD8E1DA73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032486, "uuid": "93b43b8d-3cc8-4796-9dbe-243a88151ddc", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8zM:GbtexU0r8QCKw2Fbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032486, "uuid": "acf9d609-a739-4180-b8af-0570c34cd999", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032486, "uuid": "49617f98-cdd2-4856-988f-5001db63c178", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032486, "uuid": "53aea099-b5a2-4e03-98ab-4666929051dd", "value": "f6bbaad6b5941ead933f537c5b9dd70e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a9a97e-d96b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625033999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033999, "uuid": "79d271c4-d490-458b-ad6b-8ea9b517ea37", "comment": "Malware payload (AgentTesla)", "value": "0795f4f62f0ec3c37e8252ce0415ccf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033999, "uuid": "5e317e78-bd31-4c4e-9748-a934d8b0aed9", "comment": "Malware payload (AgentTesla)", "value": "5b9fe0bbd0638b97634496cb4cd1a6b29da81ae64cc441b67d6fd825d992b9d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033999, "uuid": "48777882-e0a5-4fcb-b069-454e6be9de57", "comment": "Malware payload (AgentTesla)", "value": "38176b5ba658fea1ca5ac98cf1dc51cebd1f65c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033999, "uuid": "39808022-dd06-415a-a980-e8b66dc7df86", "comment": "Malware payload (AgentTesla)", "value": "b6d25ff1f3bf2b325c29c1404decb54159b1b75a5dc14c74fb94c5fad6ec1a4c418be9d204db238c6e4a633b5dc6bd47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033999, "uuid": "46f30502-6e9f-4f9f-8461-1876906f5ea6", "value": "B7F4BF342EE85626E1BA9FBD96E0605157EDF2236F17C86D3DF502C50713E42C9F122A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033999, "uuid": "421e89c2-f971-4f94-9549-dfcc3a3dab5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033999, "uuid": "63a4b75a-8b5d-4cbd-8dae-6bd506103afc", "value": "12288:aZnjGE6JAiFEmoEceBbX5TyqMJLXXZOJAFvf9IFCrO/gRiP7iRsg/JE4F5yuT:Xce9MEAF9moO/8d/JE4wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033999, "uuid": "9d563751-ba06-4770-b390-9c57b6c035b5", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033999, "uuid": "fec7bd84-ebf0-4a3e-9147-ac1b731ff4c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033999, "uuid": "fe4ee020-c746-49e5-8f32-340e67b31c63", "value": "0795f4f62f0ec3c37e8252ce0415ccf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66156a3d-d96b-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1625034086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034086, "uuid": "833fa5ef-a730-4955-8fb2-da453e5f4560", "comment": "Malware payload (QuasarRAT)", "value": "54c95d530834d4a28a4dcb583d61abc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034086, "uuid": "9337ea45-3ae7-4913-b15d-7bdbc2e9b896", "comment": "Malware payload (QuasarRAT)", "value": "5c627ab23daa708e73eae534919c3f6494331df0dca30ab67047e0ec65182495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034086, "uuid": "2a6f5b1e-443e-44c9-8788-2c8d1e867a89", "comment": "Malware payload (QuasarRAT)", "value": "837c64df4a5abee07f0f25732d5ce2d17017c990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034086, "uuid": "ec8238fa-06db-49ac-a0ce-88c06a40d981", "comment": "Malware payload (QuasarRAT)", "value": "184579ee992e139702051df3f0cc469e1d26056bff5baa5e01d50f38b96dff0de1d7bd968a47ec92598f89baea8083f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034086, "uuid": "7d58779d-d16a-4ada-bf34-c7f6cbbd9434", "value": "E7E469909EEFDDDEC26F323FA05A0D9215EEC306074792E58B464E74B3852278D661E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034086, "uuid": "7172e674-a1af-4671-9280-0c4fef5dd48d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034086, "uuid": "bbb43cc4-87b8-48ed-91d5-ad10f99c9896", "value": "12288:XEFVzMFtW9NM4qpF0pnnntQxug9UzFpp61u2oHB12U:ca14CFQnn86NS9Q2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625034086, "uuid": "637658d2-e2af-437d-84ea-97c663a9a864", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625034086, "uuid": "58dba4c7-36a7-415c-a350-7ed2c22046ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034086, "uuid": "cea83d5c-5ab2-43f8-9b2f-189b412e63bb", "value": "54c95d530834d4a28a4dcb583d61abc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9728a726-d9de-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1625083560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083560, "uuid": "c2638fa0-cb90-4d7c-9f60-34248a897f54", "comment": "Malware payload (FickerStealer)", "value": "23181be91b31a1376b3401fbd9a491a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083560, "uuid": "52369292-4357-4ae8-b54b-413f8d038f5a", "comment": "Malware payload (FickerStealer)", "value": "5ca5094a2b00a4f97ca49c409fbbdfc3b38bf272348ed8b7371bf26f61070eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083560, "uuid": "8b4c0a1b-3c4c-42ce-ab3b-b44ea3f858ea", "comment": "Malware payload (FickerStealer)", "value": "23486c0f6e5343233d4a1caa6ea1d540a2dc5c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083560, "uuid": "1a59fce0-e4de-4b8e-8231-2d292c62373e", "comment": "Malware payload (FickerStealer)", "value": "563aa014b3c75e9330aa01855e97ae03e6dbb75a63bc87e35864b87272c790a370d44788cb20d4438b14e5c286c32aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083560, "uuid": "9b4bf58f-9935-49f8-a43d-f35d0b839d68", "value": "1784AE00EAA1C035F5F312F48A7593B9953E7EA06B3090CB52D5EAEE5A346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083560, "uuid": "d088d282-2327-4254-8146-302915e83f6a", "value": "4a891687ee9846e9d6ffccd45a4930df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083560, "uuid": "97e6f641-87f2-4532-9780-00baa8fbee06", "value": "6144:YIiQ+WA0jc8OrG2DGBw1shAdzWD3+dzsCVFZ3zzMgdJIZG3IkE:4Q+WA0joZDGT93+d4kDzzQuIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083560, "uuid": "c1f6ae10-983b-4129-a906-1cf177a04a6f", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083560, "uuid": "4053c159-30fc-4d87-ba03-d9301fc2fc4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083560, "uuid": "eda2f27a-9e76-4011-a69a-27c3df251152", "value": "23181BE91B31A1376B3401FBD9A491A0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2505780-d99f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625056547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056547, "uuid": "0d14cfe0-3ec6-422e-9093-174220b93d2a", "comment": "Malware payload (AgentTesla)", "value": "77c8088e0554d21f1147c2087b1dc3dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056547, "uuid": "efa2dd52-d317-49c7-ab2d-a4f1dac0e324", "comment": "Malware payload (AgentTesla)", "value": "5e0e859d4b69fc234369a57eb29fe40bc73af4c71d2844862dd599787d4ba744", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056547, "uuid": "9e1589b1-22b5-4741-8e41-65fc6b2ac760", "comment": "Malware payload (AgentTesla)", "value": "cb0e3bf71d48e95ddccaaac2147119f3f1e9bda1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056547, "uuid": "e6f2c082-5ba9-488f-9969-b356fe9960b8", "comment": "Malware payload (AgentTesla)", "value": "ccee5464a44e58aa9e9c1715fa92fbd6daef01a0fa0d804dad3c7ab2eda49b361401a747a737c740c71006ebc5ec0ebe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056547, "uuid": "f6590fe2-2b1c-4f60-9352-00d9f3f1b62e", "value": "6CE48D312BA85A36E0B69FBDD5A1109197EDF623AF03D85C78B501C54713E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056547, "uuid": "d1c087dc-cdea-412e-8451-ccf92f74c5e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056547, "uuid": "f6996d48-0929-4887-9840-9df3a2ea1f32", "value": "12288:OQoXH3kw4BbX5TyhQVKVpy+R5YNGgOy5G3g8po0vbgjZ7HXly:OQg3kJKQQpD52GH+Gg8tTkdHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625056547, "uuid": "3d75d61d-ce0c-487e-9222-2078350a95c5", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625056547, "uuid": "d9adc88f-434b-4619-9510-de36972d748d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056547, "uuid": "e9a456af-0934-4540-b1a6-4ae120a36f1b", "value": "SecuriteInfo.com.Trojan.PackedNET.899.26593.4422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38a1b21-d9b2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625064737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064737, "uuid": "0b27487d-fb5c-4876-964b-6d7f8f40e788", "comment": "Malware payload", "value": "5fd9592605456a3a9336187df19d3d05", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064737, "uuid": "b7a77d54-2327-4560-98cc-f216a6599d5b", "comment": "Malware payload", "value": "5e5537e2c5ca877e3a7bb6cefb0258ded276d88a4b15d806e4a64cdeb0a44c9d", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064737, "uuid": "646b8fb4-09c3-44a4-8181-2983849cfc83", "comment": "Malware payload", "value": "b24e6b5d4b3831c6cf1f8e236656b2b9d08c7ed9", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064737, "uuid": "665849c1-f0b4-4295-806b-dd59a9503bc7", "comment": "Malware payload", "value": "d3edbe5f3948117b55736f2d591a597ded3de3222aa089200fbd59a1ca09bafb33a398b7116e3bbdd522d419f4b731c9", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064737, "uuid": "3c7cafcb-82b2-445f-b593-8bcd73bc4dbe", "value": "1EC423F5411D1CD4937CF71B2D934E1C2A3E198CA12389F11E177AB27EA3496C4AA2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064737, "uuid": "9d761a67-508a-447a-94b4-5585daf644b0", "value": "12288:4EXBMUGNORoYl3thTRXaP5oAms+nEVUTM:4EqBYd7R2h7+nvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625064737, "uuid": "360ca0f1-1aeb-4cd0-8223-40e620a90f88", "value": 570962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625064737, "uuid": "c7fe7da4-6650-470c-b6fc-00b2db734c85", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064737, "uuid": "3c8de5a0-677c-42dd-a081-7902290dd341", "value": "quotation (2).lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f92b2a8-d94c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020841, "uuid": "3655c752-f514-4c32-8fb5-ebb604593d57", "comment": "Malware payload (Mirai)", "value": "73f283680395e9e8b1e441486a38e750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020841, "uuid": "ec3b63f6-24ef-4ba8-bf55-27058386ef55", "comment": "Malware payload (Mirai)", "value": "5f0c0a6a6c8f48fc6abd527525a3ad38eb0b62bd54b5664e10d4e8167454a624", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020841, "uuid": "a5bfea79-3a30-4214-b554-b46e86ffa471", "comment": "Malware payload (Mirai)", "value": "f483ad8519ac05b2537ca5f4a3407f0398ed3a5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020841, "uuid": "7d94ebfc-3007-46a6-9f8a-0a625b1e33de", "comment": "Malware payload (Mirai)", "value": "8096bae67ae5b6c81cf253cda06108b8ef17d8c830dc0254b090d0ae352fcf171008ce04e5ce8ee243dd96620a7d9506", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020841, "uuid": "126f5f6c-10b6-4fe6-b494-86671ce92b02", "value": "D0734A0276288E4BEAD60AF1253F5BE483BEED8025E4B584680FD7424635F37458EF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020841, "uuid": "00af3c2e-ca71-4264-b25f-f35266b759df", "value": "768:x0zlipKQt/M9Kr902YECVNoIdgxI+B5vTemF6m3PpT5v99/sllk5MCs7/nLDJQ0b:6iYQtO6VCbWFdT1ik5kvm04/V5yDOhub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020841, "uuid": "ff3702a6-fa73-4468-9f87-d97c00e136dd", "value": 74660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020841, "uuid": "3d929a11-4343-4d72-be0a-bc99a6ff6e84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020841, "uuid": "7a2aac91-0c4c-49c3-81d8-9cbfd8827c45", "value": "73f283680395e9e8b1e441486a38e750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbccdaa6-d979-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625040350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625040350, "uuid": "68fc6b52-aaf3-407f-977b-7f17fcc7a325", "comment": "Malware payload (RedLineStealer)", "value": "dc2ad73d29c4f13a9da18f327625a6c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625040350, "uuid": "803d053f-55fa-4fee-ab78-509225f05f9a", "comment": "Malware payload (RedLineStealer)", "value": "5f48c241c815060c266f3ad4eaf267ecb0026af7369a91125b87c7e079ca3aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625040350, "uuid": "06ad0777-2cca-4459-9eac-854134b016aa", "comment": "Malware payload (RedLineStealer)", "value": "4987698425e4e43a34312cfed51de09dea333f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625040350, "uuid": "d821cbac-c386-433a-9df7-9004ea567f14", "comment": "Malware payload (RedLineStealer)", "value": "a2228bc4d45a83dac21fea1203f7d520fda36c711d7d2cfd583bde8e069bd0b5784fe309021546cb502d058a1dc5428f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625040350, "uuid": "aa466541-6621-4474-a649-26211e7e4500", "value": "2CE533903BB680FBF66910729B8C6F7360FCC74E16670CEBA750866D9D28C05931E56B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625040350, "uuid": "d2eb7d26-5184-4c54-a89e-9ea45bf2bc0d", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625040350, "uuid": "1079f4fe-94ed-44e9-afbe-be370a61b9a9", "value": "98304:xqEbOx/oLHp9CDEQf2fmTbuDM1zCvLUBsKlOCV:xDb0QFoEQf2fmTwM1ILUCKMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625040350, "uuid": "1edb882c-ddd2-4b05-9d57-0ef94ea416f5", "value": 3235403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625040350, "uuid": "5e8df0e3-3936-4fd2-b76c-280c2fcc7269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625040350, "uuid": "82798bdd-c432-4f0a-b491-74f9c8f803eb", "value": "DC2AD73D29C4F13A9DA18F327625A6C7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fe4e35-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload (YoungLotus)", "timestamp": 1625075686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075686, "uuid": "747a1bd3-fb26-4434-9f49-a50986c6e65c", "comment": "Malware payload (YoungLotus)", "value": "39ca800c2e9014e34be3bdd0645c2218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075686, "uuid": "f0a44c7c-ff37-4e87-8da6-1c9617d13e78", "comment": "Malware payload (YoungLotus)", "value": "5fc335f79202263e7e68942ffc5f14d705db9caf44c09255ba142f5489a28155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075686, "uuid": "6f256a8e-e064-43b8-9d8b-96df21f7208c", "comment": "Malware payload (YoungLotus)", "value": "0a8d58e0add43e3ecc88e58b1bedf91b49943132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075686, "uuid": "2c7c838d-b601-4731-8d32-987ec7022942", "comment": "Malware payload (YoungLotus)", "value": "7faf1b578a7b4f8870678c7c55c0631b1719b3dd36b282697b4c6dbd0311af05f32cdb7e73f4deeee9ab44b4b6f35b51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075686, "uuid": "a495b7bb-cdc2-4ba8-88a6-3b0e885f3d18", "value": "92836B6AD9071C58F49EC93000B29635F5609CA8BB8186FB9794FD4F583B4C0DFB662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075686, "uuid": "168e14f5-999e-4cb7-bba1-d5e57b96b7b7", "value": "009ee06e31757d0d574376049e1b8abb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075686, "uuid": "3b319b27-dcf1-4cfe-9684-1928f5ca5cc3", "value": "768:Owd3ayDEX4qcAqQ8fSM3S9wK5NSbIB4Sa6Eko2MCXWyRj6uj+r:OU3rDYeQUFkxP8ZSa6THmw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075686, "uuid": "8ad2e64f-c93b-402d-820e-7647276ba738", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075686, "uuid": "cba9501c-8c38-4ac7-b3c8-2675db3dafbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075686, "uuid": "5dfc7c1e-1c11-4f50-8630-4477250390b4", "value": "39ca800c2e9014e34be3bdd0645c2218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ce9c10-d96a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625033491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033491, "uuid": "5b1f5b16-d2c6-4dff-9823-f736ee35781d", "comment": "Malware payload (SnakeKeylogger)", "value": "4240db0af6ad10bcb1c5d9eea2008dda", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033491, "uuid": "86e91ee1-e9ec-4e1d-a878-03fc51207211", "comment": "Malware payload (SnakeKeylogger)", "value": "6014a249398a77294a8e0533975dad4bc14e3e85c99f706dd768dcd877c11410", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033491, "uuid": "a52efbd6-64d5-4dc2-ba24-10293f02a810", "comment": "Malware payload (SnakeKeylogger)", "value": "3363c2ee3c598b0584c15813aa4643c48846b155", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033491, "uuid": "25a1bc32-0184-4b9b-aa66-ad56e86d9aeb", "comment": "Malware payload (SnakeKeylogger)", "value": "7d0b6ee2099b0a62d905169d78912ef60b70e5912384519a630a772a76bf80b0dbb4ce801f44ba85284b86992dca8a50", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033491, "uuid": "375d469d-7cb8-4241-af91-c1ec3c19f27b", "value": "D3C42365EF05B7959A0F24545C32E43A6E7CF6000BBF1CF867C6629ECC86BC14926D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033491, "uuid": "6c041787-2a10-4616-9122-b7dd4607802f", "value": "12288:XnsP27oUygfDz3ItFkDmgMKFOYBZvLKmJuOHlb2/XgX9LEGe:XnUcoHgPYtFkDm2Y5Iu6nXmGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033491, "uuid": "3894424e-ba4c-418e-bf72-75161307d61f", "value": 558282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033491, "uuid": "0e0e52fb-1c0b-41b1-a5c1-06631d98c65d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033491, "uuid": "512cbf41-7ed1-4731-b838-bef26a5e144b", "value": "PETRONAS RFQPCIHBV2021MRP2711.TAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea95bb56-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083271, "uuid": "156aa007-e19f-4a56-b83a-7b4b6c425452", "comment": "Malware payload", "value": "4f817ca23420dd08a3f8bc8bea2e7dc9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083271, "uuid": "bff4e68c-21df-407d-9d73-1ba613a49fe5", "comment": "Malware payload", "value": "60d3a6a96815b235c93bb340cd338fbdf8a80a3dee023a37503550eb953f5e78", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083271, "uuid": "e41fd2f9-d562-4dce-96ba-2f7cff4defe6", "comment": "Malware payload", "value": "9cce2126c14ba39a57e21479b07ad98747219a1f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083271, "uuid": "8983ae64-3efd-4d68-99d3-9429a1cfe5d9", "comment": "Malware payload", "value": "a202f96681eb022b6f87596e9096ec1cc16bac6724fef500191910ca0d0317c485ab30b7c58a747a2f8e85790e24695d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083271, "uuid": "c9d11e85-55a6-40bc-a17a-51131e727d78", "value": "0A7152226BE4C6E1D25C3A7109834B1DD96DF634C71387223B90A92F2D6B3A4642E756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083271, "uuid": "83e94d00-622b-47a4-8c38-6d97a855633d", "value": "efe4e83a803acf4884cbe38e0de198b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083271, "uuid": "719478bf-91e7-46b1-a731-817c8538314f", "value": "48:ZvtkwMY0mAYzFlqw99v9tmilde9xE2vrBLz6:Z1pj0e+w99bQjXTZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083271, "uuid": "d398687a-86a6-4a39-9d3b-282f1292fe97", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083271, "uuid": "4a975c43-aeb2-4016-b49e-6c8e806c6b4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083271, "uuid": "3f3918a4-e153-4456-93c0-e3c59cd0f249", "value": "document.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52db570-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625032984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032984, "uuid": "db29d787-63ee-4eee-8f53-84f4af2ef468", "comment": "Malware payload (Mirai)", "value": "cd3fc075bb4b206619afcc99fa39795b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032984, "uuid": "e7630eee-fb19-4cab-a178-6920605510d5", "comment": "Malware payload (Mirai)", "value": "6107f6c15476a3e55ab0b83711d06e42ee14047586210e70a7b2c1e73a969b26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032984, "uuid": "ee72f8cb-06d2-413d-aba8-3ae9fbe0fe7d", "comment": "Malware payload (Mirai)", "value": "0e6bf17836b406f6c6c8191f1ad86368a51de850", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032984, "uuid": "9aa99a23-d01b-42a5-b372-2596198069cc", "comment": "Malware payload (Mirai)", "value": "1bc8d90b40d99cd7229fa6bcd6552656b31681ef92121e74aef732650e8627a9f7cdbd1962c54010fcfba8df85e97f5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032984, "uuid": "ee4fe26c-c0d4-46aa-9f8a-008510c29641", "value": "E6332B8968121E2CDAD358FD54729F4E9E512321A0A3070FA7ABFDC33D33269EF55948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032984, "uuid": "d729329c-a0b7-44da-9df7-b2450b782bd7", "value": "768:m8uzcCOmYr4cIGh6HHaihHHeIXXdauZj0CGeWxQyexbtM7edUo+f1prA4fUcN8Qj:m8qcCcrtIC6HHaiFu/ei7edJg1pc4MQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032984, "uuid": "c8155498-27e8-46b8-86f8-058043b9f1a7", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032984, "uuid": "7d02ba43-0132-4253-a69f-06940ddee7f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032984, "uuid": "ac05bc16-8c23-4a51-848f-182e7484b908", "value": "cd3fc075bb4b206619afcc99fa39795b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf714a1-d9ab-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625061748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061748, "uuid": "935cf007-dd4f-470b-974b-58208b965e28", "comment": "Malware payload (Mirai)", "value": "ab16f7f1bd44a1c2c80568a74fdf2288", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061748, "uuid": "f0d45e98-3c9c-4ffd-8ec1-cbbc3ffbb43d", "comment": "Malware payload (Mirai)", "value": "611bf7e9c64bccc298e4a0ffaf48129b4e98f34398b271408a460f435be8e429", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061748, "uuid": "262974fc-15bf-4cd0-83ba-c7916ad830e5", "comment": "Malware payload (Mirai)", "value": "fdf9433832bc1ae44898dd7296de62359659c9b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061748, "uuid": "718585bb-23a1-44fd-99ab-6e8eb24d517a", "comment": "Malware payload (Mirai)", "value": "e86468648acbec1d715fbd6d73d3f96fb02f643b78a523e868b23713da974d39ef837a9cfec635a8d05afa35acf0b9fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061748, "uuid": "fc474695-0afe-4f24-a91d-836ad789576d", "value": "C2B37EB5B4019D7CF897DE7A40230A09B431A2514FE21F2BA667FC93BCB21B99907D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061748, "uuid": "8b7049b3-1e4e-4689-a624-4e88c6cbc289", "value": "1536:RO39RSKa1QfNFRp1PBXCI5Q61wBtNjFHFQELsYMrW5IGYjND/nk8kGHPV6rqL6do:ROL1PBXLO6Wh1g5/91suhvE4yQG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061748, "uuid": "5761a211-cd16-4095-9e90-8698bf3cdd5f", "value": 110520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061748, "uuid": "ad44375f-c238-4a80-a713-514f87301630", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061748, "uuid": "e9ffe43c-5392-45bb-8fe6-60840bec9ff9", "value": "ab16f7f1bd44a1c2c80568a74fdf2288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cd87e9-d98a-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625047594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047594, "uuid": "2eb62710-4585-4df1-86f7-338bf849e0bf", "comment": "Malware payload (AsyncRAT)", "value": "f4bf1efb0919822cc2cc6ac757b6c047", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047594, "uuid": "22ce12d0-aee1-488a-9932-d4dcd606c9f4", "comment": "Malware payload (AsyncRAT)", "value": "61cf72b64353f9154f3ba984f08d65e1a29dafed131cc283d9b56cf9808b4536", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047594, "uuid": "5ccb7f25-e7f3-4819-801e-7a688911b6fc", "comment": "Malware payload (AsyncRAT)", "value": "1f3cd0297e424470ae03baa8d947610889091391", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047594, "uuid": "292d15aa-d740-4901-81a7-9d3273f4453b", "comment": "Malware payload (AsyncRAT)", "value": "fa52b884b67e34baaf97af58f58350df870e4c35fac5aea4528d73f51419cb719d72e19e7625fa45f2b104b577920f80", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047594, "uuid": "880892f0-c48d-4515-a578-d8ceae7b5296", "value": "19348D70F2A08962ED161BB188A6C87410F37D5DEDB4511DB08DB61D6AB3395005FBEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047594, "uuid": "9dd384b4-03ea-423e-ac16-671656a6d66b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047594, "uuid": "f7c95db0-64e6-4734-9e59-f91f813a9402", "value": "3072:tXXWmzFnO1x6CUTLBYiZUFQjNN83ksQoVuoFljEMf/Ub+tO4uL8rhxZSLcVXibB7:9WmpOf6CUTFKFrxc0wm/U+OZ0P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625047594, "uuid": "8b780126-df6c-433b-a2ec-dc9b2e8dfcea", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625047594, "uuid": "c5578333-69c9-439c-b970-eb2c54cff1ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047594, "uuid": "515ae42f-b371-4add-a090-97f22f892e82", "value": "F4BF1EFB0919822CC2CC6AC757B6C047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbacfc8-d96c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625034686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034686, "uuid": "6f90464c-2906-4fa9-bb1f-60944ef8a19c", "comment": "Malware payload", "value": "e801e028024da04aeb969c2e568ce064", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034686, "uuid": "839923da-3cad-4424-b7c0-192b5a1983e3", "comment": "Malware payload", "value": "6238c4966a2517433dcdb057121c01fc897ce0a042f96b13389175ff20c0334e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034686, "uuid": "d3960ad4-94dc-4963-b03c-2c3abefdde24", "comment": "Malware payload", "value": "4fed7e9f4405e67379a505501bffde1e71fcf913", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034686, "uuid": "30ed86a4-f676-48c7-93ac-d26826bae169", "comment": "Malware payload", "value": "95b42c5bb14246f9b11a5deec0bb56d98751924969a59ad16dd042ca4d3633d6bf2b6883dfe567adc91f1d15c8e6f64b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034686, "uuid": "53e3181e-c8d2-47b4-8d5e-cbe525f98794", "value": "A383B9D71158C17BBA9C0C5B2CB96E3DACAEDB70E1DD7813C6487BB9402C5718AD9B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034686, "uuid": "97ab6ecb-9a07-4c6a-b9d9-215edf7f4f14", "value": "1536:QTNi5JT1uATeE/va922TvpqzwqVF7yQtW:5JuA7/S92nw273tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625034686, "uuid": "31da03e9-4337-4540-a8e5-86634392e90c", "value": 81361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625034686, "uuid": "220313b9-1eb4-4baa-a341-37c8eb4453bd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034686, "uuid": "f2469432-a455-4d4c-aeb1-963056252a8b", "value": "usb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b45a8a-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018358, "uuid": "ba236e34-e0cf-46e6-adaa-88546d9a7fc8", "comment": "Malware payload (Mirai)", "value": "f6f99db0106d4c4dab93e095a5049547", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018358, "uuid": "1291c2ea-17ee-498d-9d7a-3123ad29e54c", "comment": "Malware payload (Mirai)", "value": "624b57eeefcdeb81ecc20517df792e93157e90d2c9e0baeba9442a3cfc156fb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018358, "uuid": "95ec2b0e-ab10-47f7-b7dd-25e76cf99abf", "comment": "Malware payload (Mirai)", "value": "15c303c38596d8ec57ed61e40aca36671fc50b09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018358, "uuid": "1c2804d2-763f-4f8f-8590-8e4b71bbc5f8", "comment": "Malware payload (Mirai)", "value": "749e19ef33a5cb88d558489216dd85cf3c80678ee1d0f95e4654a0f253f9d878a1b0061e008c71fdd46addf11d9a0d87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018358, "uuid": "9a6a5e5d-8b17-4de3-b571-0cb6e62faf62", "value": "85B2F1D5D6EB2BC3C291D336D07C8A8DE1721AD10747851A200AB28EA7D760E47FB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018358, "uuid": "1f81584b-ef79-4652-bec7-26572a5c05c0", "value": "768:i/QOC0Yhn6ROHWF/P+cwNlwFCnNBxckcel:i/nihneFzw1NBaD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018358, "uuid": "fbf1de34-6277-4955-98db-034cdf80c805", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018358, "uuid": "3e75a448-efca-4dad-a2e7-fe9674d59cbd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018358, "uuid": "fc2c06c8-36c8-4d41-b87d-da12bf4c185c", "value": "f6f99db0106d4c4dab93e095a5049547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a3e74b-d9a4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625058404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058404, "uuid": "dcb7d81d-2d39-42db-b048-b3c045ea3650", "comment": "Malware payload (AgentTesla)", "value": "838becdcc81acb916c1a3b3b3fc6a499", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058404, "uuid": "c61002fb-fc7a-422f-acd6-975fbe875a94", "comment": "Malware payload (AgentTesla)", "value": "629f9ca238663c553455fd75c008140bf026dfdaa9c033b4262368c2ccea4d29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058404, "uuid": "bf5f0be4-637a-42a6-b827-aeed9862749a", "comment": "Malware payload (AgentTesla)", "value": "c6680b2b45fdb7a2f999b5174e84bfca751df230", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058404, "uuid": "1e016653-434d-4540-9ccf-33083c8b0725", "comment": "Malware payload (AgentTesla)", "value": "dd1ec696aa7ded58800237fe198182fbbab336774f4401bde4907ab3a0f4b36c2362f47c54db950534c92cbdb4b430be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058404, "uuid": "eeb0717d-b4a4-4204-be90-62966ac31333", "value": "52156BAC326475DEC467C6BACAA8AC74A6617C66431BC107909309DFAE0DB97DF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058404, "uuid": "b3d9fdf1-bd1c-439d-a148-e775df082e07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058404, "uuid": "219b254a-0f4b-47ce-9e89-c55c1f4f95ee", "value": "24576:P6OCgUuh1MLu6lUWGmrVO5UqvosUrtOGIM+5kc:PXUaWL/OfzvPUp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058404, "uuid": "9d428bc5-32b3-4d22-8017-cc5db38fab9f", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058404, "uuid": "d8635720-a3b8-4f3d-a539-93fb169e19bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058404, "uuid": "a534bc68-8739-43b7-bfb8-7f7c5f43f2ae", "value": "SKM_C335019110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93888bf6-d94c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020848, "uuid": "cc3f610e-0e80-4f84-a414-621158b3b6ce", "comment": "Malware payload (Mirai)", "value": "f83e2aae4088037cf1bff9f0640a5901", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020848, "uuid": "35956884-621e-4aef-81ef-5af42a02b4bb", "comment": "Malware payload (Mirai)", "value": "6533ffd95fdff13ac1169bb044b6e28bdb2569686630ee4ab5b9f148fe019316", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020848, "uuid": "51223838-1151-4ce0-ad8e-09195e0932ff", "comment": "Malware payload (Mirai)", "value": "093c6d5da0782a6eef75c5644facd335192cec4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020848, "uuid": "cc29226e-3366-45f4-9926-00fc2e365139", "comment": "Malware payload (Mirai)", "value": "ddf68dc5dbbdae998128cba0fdbb7cc5c4384423fc225d3f1c87c390a4d5ba227fa00065fcc1c2ea1446136a51622f35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020848, "uuid": "df4008b4-2892-4d8f-9f0b-31e540600099", "value": "84533A9D18420E2CE9D75CFD54224F0BED562310A0D71B0BA69EFDC37EB33A9AE12545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020848, "uuid": "78c43a2a-d9de-4bf4-bd88-da183735e2a4", "value": "768:4PCi/e3m/tzaDuLmaEeB4vvKjxXB2WEaPP+WUgFySbNw7Iv6d+f1prKjTQeuQ:QCi/tFzYuLmaEIL+qs7IvSg1pejr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020848, "uuid": "4fe059cf-5f57-40cd-be1a-a152fb85564e", "value": 62100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020848, "uuid": "7184dad4-710a-407d-bd9e-91c3b52d19f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020848, "uuid": "a42bd141-82c7-47a4-8f86-2f07f8f25716", "value": "f83e2aae4088037cf1bff9f0640a5901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5fc84d-d9d6-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625080217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080217, "uuid": "c40d3ab4-37a8-4ff0-918e-5530c37e1927", "comment": "Malware payload (DCRat)", "value": "60449321c84b049efc646a811a2f0df9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080217, "uuid": "2608de55-e460-4785-b169-da83e7949f59", "comment": "Malware payload (DCRat)", "value": "656c30291730b6fba735fa6a987c12e68c06cdaf6bfbcf1bcf208132ee435309", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080217, "uuid": "ef0550ef-0d14-4a83-8f0b-065f246a9826", "comment": "Malware payload (DCRat)", "value": "5eac86904cd10d9a7380a40efa642bdd983de53d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080217, "uuid": "154fcb8b-6b54-434d-ab76-cfdf2945f84d", "comment": "Malware payload (DCRat)", "value": "b5713a938b0477a7a91e176ee81237884dce2208581d17fffabb089517be0ff5cb41057808f9a6ef530f84632bfe9389", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080217, "uuid": "a9c5f8cc-c8a3-462e-9935-7b103d4e81a3", "value": "376539027A46DF02C0392A37D9EF946407B8BD003B66DB5A7E9B336D65113A33D4E5CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080217, "uuid": "008d1a2d-16f0-4669-a833-5e87d2cbc53a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080217, "uuid": "734340fc-4392-4fd0-b06e-1639af2c3286", "value": "24576:U2G/nvxW3Ww0tahqYKG5KURICcMRjdwW7RTZwW7RQNXwW0RWN+wW4RPOpD/f/wWC:UbA303bqKURICcMRjdwW7RTZwW7RQNX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625080217, "uuid": "229aed3b-25a0-435f-b5ad-c817a0636e7d", "value": 1422510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625080217, "uuid": "3b846f54-b7a0-4dc3-87f8-279df9c8f3fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080217, "uuid": "1dda84f0-bcac-41a8-b5bf-568bc26f64be", "value": "5eac86904cd10d9a7380a40efa642bdd983de53d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9badcf71-d9fc-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1625096453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625096453, "uuid": "13437081-2b4a-4736-842f-668dc63934c4", "comment": "Malware payload (RaccoonStealer)", "value": "6f0d4cb85d8eda6dfd3a80d538923db5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625096453, "uuid": "0a4737e3-0096-47a3-8043-c1822c29c975", "comment": "Malware payload (RaccoonStealer)", "value": "662198412b44e61f7f0b495b939249c6bc05ebb154407de517b422e09145b19b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625096453, "uuid": "9294458d-99b7-4624-85bc-e59c4610389a", "comment": "Malware payload (RaccoonStealer)", "value": "af2225e7ee8e1d80266a791df6e9ae8e77850224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625096453, "uuid": "b3ba810f-b2f9-4ad8-9bf8-5394548caaa8", "comment": "Malware payload (RaccoonStealer)", "value": "d71b106f9b9c92f2ca474005c02a31cb209ca8fc11594b52b239b1a67df1a032710e97d2d2635bd0d6a91905648ded93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625096453, "uuid": "be3f1519-b6c3-4e2b-9b8d-d8ea32e8d291", "value": "40759F10FD94F806E1B6593ECAD5CC2F0AAFBD415E328A2524B7268F931371ADC505BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625096453, "uuid": "24529f73-c65c-452b-a099-9fd7203524d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625096453, "uuid": "a67153d4-1da2-49da-93ee-b80ae7610e20", "value": "24576:1qxVqDU70Z5ErEjC6xGx+L3NR33tsFwUMcjCYj0GZemeKYZ:wJ70j1C1x+L373lUzX0G0meKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625096453, "uuid": "c2a45655-0eb5-41a9-a28f-7dbbc6a83ef0", "value": 1660704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625096453, "uuid": "ce65c879-df72-4434-bbb6-9f97bc4927c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625096453, "uuid": "c57884e2-1d0c-4392-9e30-da17d711d595", "value": "6F0D4CB85D8EDA6DFD3A80D538923DB5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91202121-d98b-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1625047902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047902, "uuid": "2a427ae0-5067-4386-b446-c140ab81217f", "comment": "Malware payload (njrat)", "value": "b16a969889a73f13d88f215ad5ce6931", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047902, "uuid": "4ce2ee7c-b931-49c6-8c1a-774a633d5260", "comment": "Malware payload (njrat)", "value": "670bf2bad23645b731a67e3299f4f1692da3bdaa711c588b17024ed916e55438", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047902, "uuid": "8aa4e3d5-075a-4343-bce6-77b389d8bd52", "comment": "Malware payload (njrat)", "value": "aa799d11085b0c51802d852faead5e9ccc7fa05c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047902, "uuid": "89edbf17-458e-4c78-86ac-f63168f5e2a1", "comment": "Malware payload (njrat)", "value": "87f7ac006c087fdbb061ea19aa9054cec2cba0005ce3951e9013de8137b34f12298a419e6c7512034d87277e5a341cd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047902, "uuid": "ce6ca863-5580-408a-80c1-9fcf54ed038d", "value": "2745DE697391E3E6C98CD037F26D80754B3A5F8E2A36989E6DC822DAEFF3721055441C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047902, "uuid": "7c2e5967-fad1-4242-9194-d4c0c475d2ca", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047902, "uuid": "b824ec6a-14c8-43cf-86ea-d9d670a35bcb", "value": "24576:9LgLbWbzN9zjAHe+SLPFXob5BF1LwzZnFiYWr9DX0f1Bolzw:ZUCPN1E++EaFBwNF+9DEdBMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625047902, "uuid": "1a8b85e9-c517-4a65-9ffd-53e51ffd9414", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625047902, "uuid": "c3ce5f01-738e-41a2-8fcc-ba6f5d63752c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047902, "uuid": "325667e8-e38c-4349-ad4d-e1dbabf019a8", "value": "b16a969889a73f13d88f215ad5ce6931", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0491384-d9cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625077267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077267, "uuid": "6d8fd363-8c8c-46a9-b599-e84591621eaa", "comment": "Malware payload", "value": "8e4c99586b0e28b14f2ada5b6dcd1fa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077267, "uuid": "aac26f41-09a3-40a1-b9cf-21ed35acc372", "comment": "Malware payload", "value": "67fb3ac999134df0f82f0baf7184552b9f5a25b6745aba7e16a32e1e4b69d581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077267, "uuid": "a975aa56-7a51-4c1e-bce1-93b46ca3cdd7", "comment": "Malware payload", "value": "90d579b4845a6167364e12bf92d374b5c2a7e107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077267, "uuid": "dcdc1bf7-022d-4086-ab69-0dfc7dd3e77a", "comment": "Malware payload", "value": "eb2e1921c915beb4931a68b60eab56cc4e83fd5c5cb6f1feb266bd2120552b848981f8bde655571bf22d805bd1c13dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077267, "uuid": "2dce9d62-3f26-4f60-86f5-0106391dab68", "value": "DC65E10FAABCC106D67C27F459908294AFFAFD9939548B9F70A7B23DEE331101918917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077267, "uuid": "8ec2bd9a-510c-42f3-a7eb-3c5de5b0a3fe", "value": "96778352d99ca84b52328b0725ee1935", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077267, "uuid": "476d5e94-5533-4a20-bc2d-1231b046b50f", "value": "24576:0we6Ogt/zD6h+1SaPxBhaPkKqckbxPGV8gFGDfg7fCtSH54puVd5Jrs3HBwYe:S6t/zDN5ZKqFbxPy03tJSHrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625077267, "uuid": "2da32b2b-fd0c-49dc-b9f7-0e694910cde4", "value": 1538840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625077267, "uuid": "90fbf852-3468-4acd-99b3-bf7caff3b336", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077267, "uuid": "5a2164a8-93f4-46ca-aa5b-018cfcfc7107", "value": "8e4c99586b0e28b14f2ada5b6dcd1fa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd8f722-d9cb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625075492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075492, "uuid": "a180d090-67fd-4faf-afde-aac658b063ce", "comment": "Malware payload (AgentTesla)", "value": "214239925183ba9978cacbfd584c62e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075492, "uuid": "a7350b06-a795-43fe-9b1f-f61aa75429f3", "comment": "Malware payload (AgentTesla)", "value": "6858fcd2f6b042dc538d1c3fa198a4cc93dbb65a3e8d61da0700aa83dad8af93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075492, "uuid": "7e30d8aa-6239-467f-b2a6-01a248260082", "comment": "Malware payload (AgentTesla)", "value": "3ac32ace452556f4cfb8f4bbbe735bf2437b1087", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075492, "uuid": "245c1a0c-6654-457e-81b3-33e980988044", "comment": "Malware payload (AgentTesla)", "value": "6fc1d7b9bf31709a692dcede99f6cb21e40a48d7d3c80cec02baa2470169d9beb8816831173c91eaf9463f77c136837f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075492, "uuid": "eec959cd-199d-4006-87f8-0315d63d5656", "value": "4CE4023829FAC808E57E4BBD99E554C09B77B5267572F61D2048208A0F53B81CEA1F7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075492, "uuid": "05c2839c-5d11-4e1e-92b3-02b7b4cd700e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075492, "uuid": "861a9e79-0fb1-40c0-b4dd-031967aa5606", "value": "12288:NxLzV175KKMbUZfd1R7MQNNdekQzezYLgmkoHGtrL97LvrF+cmmM3A3rWf:T/H9fLfxYAQnznLgRH5kmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075492, "uuid": "c325aa6a-fcf6-4679-a459-3cbfc9f8fa47", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075492, "uuid": "aa061aee-50a7-4e89-908d-9460a8c834f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075492, "uuid": "c3e19f05-29b3-4d4e-883f-9efb3576b693", "value": "214239925183ba9978cacbfd584c62e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4747c254-d9cf-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625076984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625076984, "uuid": "e0daa167-f816-455b-9c7b-67b564c95039", "comment": "Malware payload (Mirai)", "value": "8d06dd7c227947a3a19fdb3a21d75074", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625076984, "uuid": "1ced2e5c-d53f-44cd-9c7c-74fb1374461a", "comment": "Malware payload (Mirai)", "value": "69825eeb4ea167584ddb983eeb32fd04eb58ef47924836dfdb05cfb7250e3948", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625076984, "uuid": "9f3fa6d1-4f2a-4806-885d-38379877ef41", "comment": "Malware payload (Mirai)", "value": "bd4d229f90cf1c64841c4ff1b51f7cf737e48bb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625076984, "uuid": "fb36f716-ccbc-45c4-8ca7-03e8a39322b4", "comment": "Malware payload (Mirai)", "value": "4d85d7a6d826a0e6a9fdcb1be47a6d16438c5016b359653ea491d470cadf12966eb92aa3b9b5374f6688b92fc20c157e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625076984, "uuid": "37a19982-486e-4022-a5eb-dfaafe12681b", "value": "B3C34B46EB408E03C4C61775BAAF524A3323A755E3DB73068E18AFB43F8279E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625076984, "uuid": "cbf11cfc-cd2a-4137-921d-254125a98af6", "value": "3072:Z5RHmfEkwZK8JELnm7Xeun6LCaMysM/9otYyL+G:jEfLwZK6ELnm7X9npaMJM/9NyqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625076984, "uuid": "23210156-aa43-4113-b783-ba5fb6c38117", "value": 129325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625076984, "uuid": "d0a6d01c-d537-4efe-8c02-6f2e411b58ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625076984, "uuid": "03c3e461-022a-4b21-bbb3-155e6d1163e4", "value": "8d06dd7c227947a3a19fdb3a21d75074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133ad0db-d9ad-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1625062294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062294, "uuid": "8d41ec0b-44eb-4944-9912-30fe40ec8072", "comment": "Malware payload (RaccoonStealer)", "value": "035e286f0b1c50844dcf7dccb7312036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062294, "uuid": "e5af8456-5856-4833-8004-af17a6d1461b", "comment": "Malware payload (RaccoonStealer)", "value": "69e75e57bc4a09c9a3d7726b28423d10df5b0224177ebfa43930668efd0af5da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062294, "uuid": "24383149-c1ce-46d0-b0bc-17ec870198e1", "comment": "Malware payload (RaccoonStealer)", "value": "c25108d623cd05bb4405b1330f40623c2ee5552d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062294, "uuid": "35025245-99ba-45e0-956d-792f5c87440f", "comment": "Malware payload (RaccoonStealer)", "value": "f7d0a0b7fd521cb9de835594ffc47e75b3c78e5bf53548cac2490733f68759ec437487045f516ced7e3538267f7d0bb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062294, "uuid": "33270f98-d1d8-4f19-9e9c-866e9fa8964b", "value": "F8459E683AFB9019F06A9E715BE479E7DA6EFA733506580F9341030B0453E82DDE163B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062294, "uuid": "9c6792de-43e6-45e7-a51b-5b6750af3321", "value": "d98bce45dab9a77041968f41ed47c4c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062294, "uuid": "192604cd-85c3-465f-bc8e-7241644dad93", "value": "12288:nSU2jso7o1Hn3+Wa+jzYBPznWCyF/NvjBC8IA2USN3GOZn26/4/by3Gt83GC4:ec1HuKjmPjE/djUrtt1xZn2D/bi28F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062294, "uuid": "eddb3f77-6d88-4c7e-920b-d955e7a0fc2b", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062294, "uuid": "a49e3fed-947b-4254-b233-3bbff20ffa75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062294, "uuid": "cb2af540-e5ba-4c1e-9355-25f20741dff3", "value": "035e286f0b1c50844dcf7dccb7312036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdaad22-d980-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625043063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043063, "uuid": "c7869c54-03e0-42ab-8018-4be714b6e52d", "comment": "Malware payload (OskiStealer)", "value": "8d1a835aec4a08b9f3bd3be40c3de3e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043063, "uuid": "7b175f4f-063e-4c63-ab36-efe076c924fc", "comment": "Malware payload (OskiStealer)", "value": "6ab28a843d5ad26feee60448dfbbb5ddba73da6d5dc5a6a6fb9c0129bc7e3bf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043063, "uuid": "d4d1bfed-92fe-4e29-8804-9f4f6de9dbac", "comment": "Malware payload (OskiStealer)", "value": "c225f31c999580ba3d0bdbf2f2510eb43d583bc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043063, "uuid": "c5b91ddf-cd0a-4bbd-be49-daeff159fba5", "comment": "Malware payload (OskiStealer)", "value": "c8b5ece74ef2e538ff19ebf69019ea8f9d56264e4bb966872087d14a408cd3f565e90ad1c29efee3ee69f1ad01bb9c11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043063, "uuid": "7fcf3635-5fc0-497f-9db9-2f36d8112135", "value": "37B4DF1231449D6BE2071CBA8C0ED2B215E6AD655066F61C71AE335F08F236263EFB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043063, "uuid": "1001c95d-cbd8-4309-a264-e11bf09e58c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043063, "uuid": "d6c9f6b9-e1be-4467-88de-2e554e857929", "value": "12288:rEFVzMF4sgqoYQxnqkkXu/Scm6pjL8DP:YaToYQxqkk6e6xcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625043063, "uuid": "f7c92717-a179-4558-a797-464be3adb6a7", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625043063, "uuid": "06c7154e-38d2-4adc-93aa-0b5bf94287ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043063, "uuid": "7809bb78-1215-4678-8320-3d904693e0ed", "value": "8d1a835aec4a08b9f3bd3be40c3de3e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb841678-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083299, "uuid": "0be53028-244c-4250-8c3f-b27b639f664d", "comment": "Malware payload", "value": "7c704faaa07a321c2f916293c0551732", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083299, "uuid": "68a25ce7-dae1-47a1-bb71-f7e23e8b716f", "comment": "Malware payload", "value": "6ae5f3f6dccabb9768c58b11d373cd626b48bae09da9d433f45c2b057fe358dc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083299, "uuid": "e351faff-c65a-40db-ad80-2183dcdf716b", "comment": "Malware payload", "value": "4626433cf9e1e6e4b371ede29f516005463c1198", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083299, "uuid": "4875b2a0-98c6-42a7-a1de-91b3518066c1", "comment": "Malware payload", "value": "2ef123e1352dd685032294de84495f980e7d499b6be69fbcac4b06cfd6107212fd49ea239864b6c75710777bd7bb4ae2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083299, "uuid": "58cc8658-685e-4392-8849-b46d155b996b", "value": "EC241205E16BE862EF9F5077BAF91AF11366486308490533E631345CD8A7C5ED228BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083299, "uuid": "5672e180-8b95-4d4e-bfa7-daf7e4760264", "value": "6144:fKspA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56XHn:Ru9l2pgxjt6XUyNW+Md56X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083299, "uuid": "1e532d7e-fb3e-4bd0-8967-53919764d7d6", "value": 217545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083299, "uuid": "a2f71f4f-b377-4c77-8506-2b3844aa8f3f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083299, "uuid": "e174d4fc-aeff-4f42-93d3-d63fb7ea5ae5", "value": "INS 2965424.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f36be4-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625058944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058944, "uuid": "be0b0e48-8367-40d0-814d-267e1487b8f8", "comment": "Malware payload (Mirai)", "value": "db35ac89e4694bae68a01ec3c89f86fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058944, "uuid": "97d9c6b0-6d22-417f-991b-1a8842336317", "comment": "Malware payload (Mirai)", "value": "6e7394586b120999495ea752563342194b2546cb674d34a9c38123d95e76691f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058944, "uuid": "71127543-a2be-4f5b-90c1-36664f65cd02", "comment": "Malware payload (Mirai)", "value": "f9e2772ebd5d2aa4023e024df77ac6d60f120468", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058944, "uuid": "cfd34f66-46c3-4124-b178-3bb11ae54cac", "comment": "Malware payload (Mirai)", "value": "c4cf6da3eab330bca8244810272fc02579f0a2ccba0ceb98b0b88dca8816e8dec09231ddeb0cdf5daba880b62f67c655", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058944, "uuid": "00cd0917-0484-4e80-9e69-249af5695a20", "value": "F4E2E057F189CAF5C0A73174B8DF7B188939631D8C4903A2BEDC258B8812B493E5A794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058944, "uuid": "03b77f2e-e1d5-43c8-a8e8-0f7914f3cb69", "value": "768:BwTv2xHfR7Bn7kURL51T+yPgt5G6Yim5X4nbcuyD7UryqPl:STv2xHtJ7kKUZ2LF4nouy8mqPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058944, "uuid": "27b7a373-376d-460a-a90b-fd7846185f2f", "value": 32004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058944, "uuid": "d76aee03-46cb-4881-b098-a6c97fc043f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058944, "uuid": "4c9660f5-b711-43f6-a04f-a3ee82f4aa0a", "value": "db35ac89e4694bae68a01ec3c89f86fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78081445-d982-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1625043994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043994, "uuid": "c820c03b-5c65-4725-9c7b-2f5af0518260", "comment": "Malware payload (NetWire)", "value": "36019894ec24a4a4a35af4d7abf26a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043994, "uuid": "99bb9d12-df85-4dad-ade9-a1d1b165ac5a", "comment": "Malware payload (NetWire)", "value": "6e75af8d5d325800f4cfcaab0ec5a96976011f10544863ec3f75ee2a21eaded3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043994, "uuid": "215acd51-267b-4b43-b0f0-09414d5313f4", "comment": "Malware payload (NetWire)", "value": "07ee272f677893765d60931d8698371286bd550b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043994, "uuid": "88ddd938-2846-4780-a149-5c27179f27a4", "comment": "Malware payload (NetWire)", "value": "408dcd691f1f96ddb1f2ed77cdd539683bf7aa350d8d88fb7878aa9239a1d965acd8dabb84b6f05dd08f112af9cb09b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043994, "uuid": "7aa4e942-9eed-4eb4-a5e9-de0ebced7ad9", "value": "80F48DF2F1C59532E1562A38BC6BAB945821BF002D6C3D02F2F2394D8FBD1D27635696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043994, "uuid": "c3920405-6e56-4974-87de-3e26db3a8925", "value": "49872ca347743de3342dae48ab6a2426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043994, "uuid": "83fb9f86-ae02-4d42-9e3b-f47c6e20d492", "value": "12288:3/GRJUeqFZCVHtc67SJFBoy7PoAMkANkLkU4uXc:3eRJsFQHGKSacRsNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625043994, "uuid": "464fef5b-940c-4bd2-9e2f-b296d456a61d", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625043994, "uuid": "78b940e6-de7f-4ab5-8523-9dbe7f75c604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043994, "uuid": "8564e51f-baf6-48b5-be62-6bd624f36989", "value": "Bill of Lading, Invoice, & Packing LIsts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6c0519-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625074387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074387, "uuid": "80a75f70-08dd-40b9-9ebc-55be1c1a028f", "comment": "Malware payload (Mirai)", "value": "8b14c7981158e3f129d8df7fda61fec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074387, "uuid": "057e8dd8-0d7a-4bd2-914c-dd58de4721cc", "comment": "Malware payload (Mirai)", "value": "6f3dee05016028036ee8c840900272d0cf28257a9980f186f78175199edb419d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074387, "uuid": "d2cfb9b9-3eb1-48ea-ad1e-f5a14382ece5", "comment": "Malware payload (Mirai)", "value": "6746f6941502eef2ff0a0dcdf0f474f6c3e0b07d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074387, "uuid": "27cf614d-7824-42a0-ad80-ef32adcf4ef8", "comment": "Malware payload (Mirai)", "value": "a6151289abcaadcc1f5421baa75e59abe4eb0b8d07136737976a6f08d89ad58d87f7e403031ffbfa989d3c3c2be8634d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074387, "uuid": "240dd6a4-b070-4889-b38e-3f4f04e2b262", "value": "5E03F135631A2470E9028C7047E507602D560FAFA007946F2A58BE63ED5B8BB7CF4BDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074387, "uuid": "1a86684a-51c7-4865-927f-0e1b61e4f37b", "value": "768:4PWl1tts6qPtwZ6InmyIqtBIMF93kMrHCQJwCJgGlzDpxYsj:ll1ttqehmyZQqnrHziGVrY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074387, "uuid": "2fdf6324-9eec-4607-906c-dca7d77c0eb8", "value": 38796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074387, "uuid": "bef71ee8-cf40-4b02-a2d2-f10decf2f211", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074387, "uuid": "fe287084-4686-4d62-8883-86c80a8451d4", "value": "8b14c7981158e3f129d8df7fda61fec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0874d7c2-d9ca-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625074731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074731, "uuid": "1c305f85-bd65-4163-be67-69c1954acc30", "comment": "Malware payload (AsyncRAT)", "value": "35723001a0f410011a6f7e7269b51d7c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074731, "uuid": "7b72b9ae-1a40-443d-95e0-6ceb3dd5bc9b", "comment": "Malware payload (AsyncRAT)", "value": "7016026303e84483d6c6fd21e250e3d4d9b5bf268414918054485d5ecf0e8d5c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074731, "uuid": "38e7f199-bff2-4505-b9ee-af5051cc78fe", "comment": "Malware payload (AsyncRAT)", "value": "b28354e234e463e9db0a5252379d63dd4fcb6a81", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074731, "uuid": "ae84aec7-4ebe-4318-8611-ebc26f980322", "comment": "Malware payload (AsyncRAT)", "value": "d0c6537f75085f215f091708824ea5c8d0d599ccaeee70efd4cb82accc48d608d1a6f70dd7b97c52649ca9e95487731b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074731, "uuid": "9c75cde7-b25b-4fe1-8ee7-188acc13d9a3", "value": "6FF4BE683664746EDA2FC777CD9C5C91EA33786E1327820E501B219D5F2EA82CE106F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074731, "uuid": "cc7ec7d2-6abe-43e0-8ba8-805327726139", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074731, "uuid": "c5404b6a-fde6-4f89-8d8f-0ade5d78d451", "value": "12288:REn6fSJVDyQiVXImCFghyRiP0Q0TOLtRtK/qa3OJrQTRUhTLyTD8i:REn6aHDyQmCyyRiBLt4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074731, "uuid": "977966c1-02db-4929-93fe-2a02d4273a04", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074731, "uuid": "819f2c3c-75fe-4a56-9407-829b7beb6df4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074731, "uuid": "92fecbbf-ceef-44e8-b48c-57d63483838a", "value": "YEN\u0130 SATI\u015e S\u00d6ZLE\u015eMELER\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ca582d-d9f6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625093765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093765, "uuid": "fec2d070-22d3-4348-afce-f64b56712767", "comment": "Malware payload (RedLineStealer)", "value": "be23958ce4cb7c999dddca276120d276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093765, "uuid": "a8c01fd0-5448-4abf-b608-1772ade0fdca", "comment": "Malware payload (RedLineStealer)", "value": "7084f1ae45733b1311a449d2a33202b5ca93363755fc6a746b37ed934b8fa9c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093765, "uuid": "f807260c-b734-4e37-bfd7-beba1f7036ad", "comment": "Malware payload (RedLineStealer)", "value": "138b5ff59f733eed7ed135b7e11a7597081facff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093765, "uuid": "d399cc9a-5f63-4efe-816f-978b5015a0c5", "comment": "Malware payload (RedLineStealer)", "value": "6b495c8ef2fdeada5ad62948ff93771ad0cab0f31267195ae702e12089bce6a184783e50105893e1da0062840962cf99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093765, "uuid": "14835949-ef15-431d-a325-6bc70dcb991d", "value": "0984E0627950C872C582443058A5FB7197AAFD615AB3D207F3A92E6F7F232C116F231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093765, "uuid": "45b06eb3-192a-41ae-8c5b-7328d4e4d100", "value": "56277425cc4e9198f16e54164d30a11e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093765, "uuid": "8d015f5e-e91c-4d80-9836-8f2c61adaa40", "value": "3072:QnZGBiNW5OCcUlRE1BnSyjKGTTMowq0yTD9rk55syRSAvxQVEDvzFbX:QgBi0calS7KGTT8hK9rSsBAbvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625093765, "uuid": "325658dd-278f-472d-887b-48b06e0a8f09", "value": 371200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625093765, "uuid": "dba196b2-5da6-475e-bb14-9ff43968573a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093765, "uuid": "da646c05-916a-4453-ac23-6d6eb8400c5f", "value": "7084f1ae45733b1311a449d2a33202b5ca93363755fc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acd464f-d9e9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625088264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088264, "uuid": "ce7597aa-a294-4177-a507-8a19d4e47728", "comment": "Malware payload", "value": "74708b96618bd93dfadf391c9a2cf610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088264, "uuid": "eb0f20a3-0158-4885-8d08-b3fbcc5186d4", "comment": "Malware payload", "value": "7104a4df53b683b1a99c9767c743a53d3ffe200f31279ee3d31f1514fb5fa95e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088264, "uuid": "2fa36349-401b-4450-aed3-8f077aa98bf6", "comment": "Malware payload", "value": "04c0161058cbd959037d513b4b4165228c8a9f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088264, "uuid": "f7e68bcd-07e0-4e8c-964f-f21db74c4ef9", "comment": "Malware payload", "value": "b3fd7dd11adff0e196733644d4b919672a92fb3e45a395a92d6c2a782fa6ae79568eb4448915ebe4f3f9e023eda3ebcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088264, "uuid": "c25911b8-f1a3-4ff4-8e99-6d5d6ff4173f", "value": "55E3022906B0C4A7C7B35BB0AF7736679FE9E2252A5D974B53904B6C34236C2612E1C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088264, "uuid": "b0800792-0b48-47f2-ad39-cf6ee99fdebf", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088264, "uuid": "c787203e-3d8c-417d-8923-0ebaeb88542a", "value": "3072:iBkfJpRXATwMdFCcGbNHF64DvfnXpWNUYZbtN+DnEPe/bPAKuh4J:iqjIKtTDvfnXoNU8JN+qCb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625088264, "uuid": "b3b1601f-4ac6-4395-a7f6-cc234721b768", "value": 145112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625088264, "uuid": "8f1147bd-2dfa-40c9-87cd-902a113bfbea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088264, "uuid": "abb89fbd-2ccc-4ab1-a228-f7d81fde5a18", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4991a1a-d94b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020527, "uuid": "e8513963-f183-43f5-aa07-26afe85796c0", "comment": "Malware payload (Mirai)", "value": "bd1e691146ccd141a73508070a32c21f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020527, "uuid": "931cecab-7c45-44e2-a0d0-917610669807", "comment": "Malware payload (Mirai)", "value": "713fc4bc00059e3eb79f7cfd442215b79f8ffe22732d89873955e44a25f63159", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020527, "uuid": "0b49142a-f232-4a7f-98c6-96b5330cfdb9", "comment": "Malware payload (Mirai)", "value": "f3c7e9d57cf38bb1b3c9d6663c7b6149de74bf24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020527, "uuid": "2333c289-d970-40b3-9bc3-8b7e6423acdf", "comment": "Malware payload (Mirai)", "value": "f6706ba13b3e25ac2c8e177e08787cc7a1f3a368f459586f01ebace43314c8daedd9bbc24eda91abd3ad84f752d0aff4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020527, "uuid": "e7ff5e3e-1966-4076-bc98-08bbde3ac7b1", "value": "88930885B8819E15C6D413BBFA2F008D335297A8E2DEB253CD145F6477CA81F0E7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020527, "uuid": "116295b5-58b0-4e16-9a23-2c2cf08ec735", "value": "1536:019n6ba+ZvOpqHk5QOgyb+YAYQ+yxNcjsuCvw9mrsplDKZUCQBKXAVanVX+F8Jyw:0KbaykeObbDAV+eNOsRo9mrsplDKZUCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020527, "uuid": "0efa8a4f-cd12-44b1-872f-c9c255bfe35d", "value": 91264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020527, "uuid": "11bbaa4a-1c2b-4620-a916-0a34b7b7985d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020527, "uuid": "672275d2-58f9-4672-a02b-21bb01d22d38", "value": "bd1e691146ccd141a73508070a32c21f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba74bc4-d98e-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625049047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625049047, "uuid": "06560c28-200e-4854-9643-779e279068a0", "comment": "Malware payload (AsyncRAT)", "value": "ffd77befd87088a37204e612ebb159fe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625049047, "uuid": "d932be33-b70a-4f84-89e8-7e9f8b2ae69a", "comment": "Malware payload (AsyncRAT)", "value": "71b437c875d90c7b16ba9d671c5932aacc2f30cd63005ccb0fe7ba5373a0a5bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625049047, "uuid": "bfd93298-3e43-4a30-8567-5d162a48f173", "comment": "Malware payload (AsyncRAT)", "value": "cdd3a7302451b54d7bd4e5a717a4bfd29895be35", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625049047, "uuid": "a6f4d07c-adfa-4e9b-aeef-37e8e6e1b1c1", "comment": "Malware payload (AsyncRAT)", "value": "46fb10d8ff90aad6aac1580de8e80ab69dd1270cb1ba8f167f7d1b557ff0e68727373de5aae25930045e6accb13c2f87", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625049047, "uuid": "0ac250f5-7572-4750-8cee-1bbf47c462a8", "value": "69B241F9434C31A9EB6275F509D621A0F5E39E314DA7366A283F3464093293BCC53BAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625049047, "uuid": "3baa7073-d032-4a2e-92a4-0e3992da6e9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625049047, "uuid": "d030952a-f7b4-43b3-b290-18b2eb0751dc", "value": "384:PvXqcdqMaiq9gRMlMaM4MwMcLMweM3MxM8UMpMLMRM0UMvM2M1MpMBhMMMMMyM0K:KB4MlMaM4MwMcLMweM3MxMLMpMLMRMNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625049047, "uuid": "b201858b-a1cb-489e-b4e0-b10a7b295b94", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625049047, "uuid": "b4cbf1d3-9b0a-4994-a6ed-7340999074bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625049047, "uuid": "1bd0136e-7b81-45f9-8ad9-09c969cb069b", "value": "ffd77befd87088a37204e612ebb159fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029d1c18-d9a6-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625059259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059259, "uuid": "415bb61a-ff5c-4aac-a484-f9f649d87c19", "comment": "Malware payload (SnakeKeylogger)", "value": "f2f2443dcb9d3d06d02d978c8be17b77", "object_relation": "md5", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059259, "uuid": "0d172ff4-2e6e-40c7-9f52-2c23b00d84ad", "comment": "Malware payload (SnakeKeylogger)", "value": "7206f76507cdca47c857d4d415f6f4306846e5b24434bab0423011f61c78c5ea", "object_relation": "sha256", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059259, "uuid": "58bc3a5c-18a7-446c-8523-a05577212312", "comment": "Malware payload (SnakeKeylogger)", "value": "8efc352e26970015a8058a938645b06416a2d58f", "object_relation": "sha1", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059259, "uuid": "bb54d423-6afa-48f4-b5da-cbe6fbf7601e", "comment": "Malware payload (SnakeKeylogger)", "value": "d53bca3d4e5d5c15ab5c88df35b53163c3ec7985d2611ac09dd5e3afa750a4c47861e495e635d25487ae8ee5f657fc57", "object_relation": "sha3-384", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059259, "uuid": "01965109-33d8-4e1e-95d1-255dd47f4abc", "value": "9AD4230C33BF2B65F3B85BB86BE0B4D893866E113E81493E09EB751353347C8B895884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059259, "uuid": "25bf870a-5c6e-4d23-b6e3-e1286c4a5fd2", "value": "12288:CUb/koC3CqMdYSuqqvXgPXVLkFkkOM1o50WLLPwgZRedOkNFT4UlX8so:CUzOChdYVqoXlkkWImReoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059259, "uuid": "6e4fb20a-8eab-477c-8eec-b277009d634b", "value": 643614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059259, "uuid": "45ae9f6c-8165-4ed4-8e0c-b386d0651e24", "value": "application/x-bzip2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059259, "uuid": "48390c22-8e06-488a-862e-6b242a76a100", "value": "revised PO201128.exe.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eda568c-d9a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625058501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058501, "uuid": "bafbf9b1-3654-4628-8571-6804fcf1ef5b", "comment": "Malware payload (Formbook)", "value": "5d795e196dd6a162a9316480acff2f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058501, "uuid": "f4786159-14fb-47a1-8b2a-fc32c275b7e9", "comment": "Malware payload (Formbook)", "value": "72c6697907363b49b380a98519bd1301562ed640b1d4d98f5a4bc08cddeb5ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058501, "uuid": "75bd9111-27cf-4980-a884-50b6422d99eb", "comment": "Malware payload (Formbook)", "value": "a965f3eb9f7dcf7fc3dd0920012ea92ba5d0b0bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058501, "uuid": "6df7437a-7cb0-4f45-9a28-058a1c0bcb39", "comment": "Malware payload (Formbook)", "value": "af7d61ffddd742dd3444b7a34f24454a608b49686494373d0ccd970b165c465e93d79d56ae77865c93a7f5af27682704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058501, "uuid": "1ca27ccc-5b23-4e40-9e0f-8f62b1174d63", "value": "5B056CAC325475DEC467C6BACAA8AC74AA613C76431B8107909709DFAE0DB97DF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058501, "uuid": "b8210557-6e32-4f96-a3b1-dd2e2cc72cb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058501, "uuid": "674eb2e7-a1ea-46b6-847e-eb3623eb20be", "value": "12288:ZQNFpw9v5gqopRY8cWovOI9j1Pu2bs0C0l1R53VKM2A5Eb+9NmCIB87FpGbLDYXl:2Axi/Y8cTTY05x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058501, "uuid": "e0aa3e60-0e8e-4040-b316-afcb5262cc14", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058501, "uuid": "6e0c112f-e85c-4c9c-a6f9-8f124de3d621", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058501, "uuid": "644a8c68-44bd-4d35-83c2-dfdde6353c52", "value": "Urgent! confirmation of Invoicepayment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb19c53f-d9a9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625060965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060965, "uuid": "29095fc3-affb-43d9-91ba-61dcbd0e1458", "comment": "Malware payload", "value": "fe604fd6c25d607612de45ac00962353", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060965, "uuid": "799d0f3f-9cb7-4e84-8af3-503ffa682365", "comment": "Malware payload", "value": "731f03b0468f6913732deb6c3682329576baf8ac0f044c3c42315fbb9c65082c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060965, "uuid": "e63584a8-7469-496e-afc4-32cdfd056cd0", "comment": "Malware payload", "value": "a0cb86a646d9748c71295831f9823b4455104ad0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060965, "uuid": "d4248e14-88ca-48dc-8179-0ccb5a080891", "comment": "Malware payload", "value": "7791de763638a5078f4b776449e6630a0576434707daa5232a7f9163f2d770b203530f801d2f5b07227a6b23c8689d57", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060965, "uuid": "15fea863-c01f-415c-affb-b0578686c5a6", "value": "2BC423E912EF3B1C32FCF5F01981E18CF8B3E5362759AE151D8D5049296F12C0B69AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060965, "uuid": "39edb243-f1cf-4717-b34c-28f13d342bd5", "value": "12288:ypCG+lTHLEpPkwWHHCYIgC3xYKK+OrD9gjKzzpkvgNxSFgf:VVl8pswWWgCBYPau/p3xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625060965, "uuid": "0c0e59c2-a07f-4e27-8b43-d54bc0fedf63", "value": 551154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625060965, "uuid": "8c51c927-0fed-49cc-95e7-bef6c5592b70", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060965, "uuid": "8aa827bc-daf8-4f95-89bb-4fb2e2278c3b", "value": "doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412a9ee2-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625058935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058935, "uuid": "50803dca-2f5b-44ad-80b7-daf59a82aa67", "comment": "Malware payload (Mirai)", "value": "4a8269387178ad3e6b4e84d2a5146188", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058935, "uuid": "d46f0db9-faa6-4dd3-9de5-b0f2b6c9a32d", "comment": "Malware payload (Mirai)", "value": "73ef333c94564e7eb8cd686a77d24f8ec189113bdc036824448c1961857d1382", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058935, "uuid": "339b7170-24f2-4393-aac4-23db7a82fcda", "comment": "Malware payload (Mirai)", "value": "8fddb099472a4dafd29ccd117348dc0fb58f052c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058935, "uuid": "f1af871b-4a41-4f1b-bfbc-bef2489de308", "comment": "Malware payload (Mirai)", "value": "8c7bfcaf737d839aaddd656fd5e55fe6e650ddf01bb49a51447dc21c7db69e48078a0b3bb7d00df6c84164ce074a9ca7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058935, "uuid": "4b65fae0-04a7-4a0b-8aaa-23079282c1a0", "value": "D9D2E17126C9F6D2D8D01F32A6605C4742369BD1C4D9906AF3140BD0DBE84962BFEC6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058935, "uuid": "09696e18-90bb-41aa-b9b2-7ae9fa3114a1", "value": "384:Tj1kAnDzc8MCz+4K9+ZiR1x4CU0s9PUBuDahYAkAQKNn9N8t56AUV+lIz/qwxKHn:TjND3R4dUHOub4Kt5k+lIz/VxQ/3Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058935, "uuid": "83f0dbaf-3c68-4b38-af46-e62ba1380e3a", "value": 30948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058935, "uuid": "f5a4937b-5bb9-4a44-bf81-5c0b737c6e5a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058935, "uuid": "dccbb2d0-007a-455c-95cb-cb2b912e35c3", "value": "4a8269387178ad3e6b4e84d2a5146188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673ce832-d9cb-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625075319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075319, "uuid": "3c7d0192-3379-41ef-ae16-15df598b3cd7", "comment": "Malware payload (AsyncRAT)", "value": "cef1b7bd026c509526f86b30aa1b630c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075319, "uuid": "afe17fd1-1bc8-4b55-a47a-cab1992a94f3", "comment": "Malware payload (AsyncRAT)", "value": "74793bc735c85a0aa392628532d0f27d6bf3d93c399d8b364e50f7353b0a1427", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075319, "uuid": "36d7b8fd-6f8f-480a-b0f5-1fb0be62d60b", "comment": "Malware payload (AsyncRAT)", "value": "074e84b1fbf1db2e9c8c95348b4093bcf5e28968", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075319, "uuid": "4307a703-0af7-47c4-a837-c829be91fca7", "comment": "Malware payload (AsyncRAT)", "value": "dd17ae9a5419e3ed94e04bdc2e965bec59f6968d41e579929fb0738a46e7ffa2377b2e58749d1a887afd9101c6821c87", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075319, "uuid": "b0d17785-eb43-4e17-b36c-e7139f79ebc4", "value": "0BF44AAC325435DEC467C6B9DAA8AD74AA613C6A531B8107909709DFAE0DF93CF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075319, "uuid": "cbf5bcdb-9062-403b-a960-54d28bd83bec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075319, "uuid": "deb1aff6-622b-4a80-9ed2-6175b5392bae", "value": "12288:DwnZ62Uu55UOOqCVSFTs13TwI8nIu9q/xD6+Ut9TnRvF3hFt+uzM/66I3cVUz8y6:ek2V5Gq/2w7z9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075319, "uuid": "9e2f5d23-bf17-47bd-a5af-1317849d1bf0", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075319, "uuid": "7e8c989a-35b4-4fc8-bda4-a989e3311dee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075319, "uuid": "1d5da504-4ed4-402e-8aa8-0d8d4648126c", "value": "cef1b7bd026c509526f86b30aa1b630c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565076c9-d981-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625043508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043508, "uuid": "2fb33046-e93e-42b4-9993-26638ec78465", "comment": "Malware payload (Formbook)", "value": "8354ceaa7ac81f8e475f3f2e8756d282", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043508, "uuid": "b8f52173-5992-4dac-a4b3-5b80234656d3", "comment": "Malware payload (Formbook)", "value": "74fde8074cd3435ffd7c24532d01feec52bb351eb07aa9849b864070c81de6ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043508, "uuid": "bcb7995c-8e28-4ba4-8f9f-22d00fabf6c5", "comment": "Malware payload (Formbook)", "value": "c9e6ff3fa7d185681a248753d7ea9788d0de80d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043508, "uuid": "8ebc5a9d-0417-4883-a0bc-7a5f13e99f8b", "comment": "Malware payload (Formbook)", "value": "c5921453ecb7156a1a9ee90aa968f8efc170f3045c90be5737024414290be336da6c13548706c421f57b8c13374378e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043508, "uuid": "81a8496b-05b4-439c-b0a0-c10465239dc7", "value": "B3D4EF123544AE7BE2031CB68C0EC2A215977C29A06AE51D75AE370F14F236653EFB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043508, "uuid": "9f92bcc0-9b8f-4fb1-ae58-90018f394367", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043508, "uuid": "e3c2a0e1-4f21-415f-917f-74bf46d2a636", "value": "12288:ytcEFVzMFqWwI5JDN/Sy0RJij/b1JMhf4XmHpxBz4/UjL8DP:ytJagYJD0yoe/BolpxBUecP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625043508, "uuid": "4e2bb0a0-659e-4d31-b9f0-820a3b3008b6", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625043508, "uuid": "56515d5c-0d22-4095-b10e-63121e9fcf9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043508, "uuid": "7632b8c7-d202-422a-a5bf-f7cca82c5cc8", "value": "8354ceaa7ac81f8e475f3f2e8756d282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493b51ed-d9cf-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625076987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625076987, "uuid": "f7fb66c1-51eb-407c-87d8-09b06c5d2233", "comment": "Malware payload (Mirai)", "value": "440a7a28242416bb973577e3f76a5b7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625076987, "uuid": "6f55e4ad-e2c9-4a76-b693-f86cc58ac47d", "comment": "Malware payload (Mirai)", "value": "76a6b868fc0471e2e52c43724db3647442cf87dfe33c6cfe7648a025657da587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625076987, "uuid": "430d4cd9-3586-45d9-bf51-3de8d6f7ac65", "comment": "Malware payload (Mirai)", "value": "ae284f5d727c4ee7b9006a601afb6c353b37cacc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625076987, "uuid": "0678f6f0-7861-4182-8639-907d7b8ae26b", "comment": "Malware payload (Mirai)", "value": "95c6a4c6f478f85345895aaf752e30b1c419e13b4c55e770916893ca75507cc2eb8e3c1ed448ba29411b9dc0c92bb686", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625076987, "uuid": "0d9699ab-0f0c-4b24-b78d-af8282f3d65a", "value": "F643F782FC81D902DBC41336BA6E61DE37213399E1DE73439E126F6076CA95F0DAB152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625076987, "uuid": "43211988-5b92-47d3-930e-3a60e6c46315", "value": "768:wQtGpcQVRCpBspx3my47Aa4/Y+s3bto0rXNnxEHgXFVpors9khqBNOmJ7kfKgF79:HGaQAjsXm/ka4wBBo0wHUFVLkmJha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625076987, "uuid": "519c18c4-c311-4efc-b44f-6cbca8d0447a", "value": 55240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625076987, "uuid": "7f4e0c47-f6b3-434d-b0b7-2e9596abdbf8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625076987, "uuid": "7047563f-4d3c-4bd8-9f38-86db77105efd", "value": "440a7a28242416bb973577e3f76a5b7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a663bd9-d9a4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625058467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058467, "uuid": "41f5b42a-cf50-4116-ad69-8daef6054e90", "comment": "Malware payload (AgentTesla)", "value": "ff1d596cedeb8e7905cf54ac3b205dd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058467, "uuid": "9337c039-de7f-479f-9204-ce6434fbd258", "comment": "Malware payload (AgentTesla)", "value": "77a856a589cf0491c1e2508b0725c265328bc2b40ac944ed2fe90afbb27a843f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058467, "uuid": "657c080c-90c5-4317-b67b-9162e5c57129", "comment": "Malware payload (AgentTesla)", "value": "f0951727d9556c5006206e19a5208b47ca4a0e54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058467, "uuid": "649691de-0064-4b36-b29a-f6537e2bc1af", "comment": "Malware payload (AgentTesla)", "value": "069315b1c0d3104e5f6cb6128d37e2f5842c010886bd8607d1d4f960c4577747921a52e59051c39214054c0fa90a7fb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058467, "uuid": "31dfe8a9-a789-4bd7-8faf-9d92a19c66e9", "value": "13559E107D94D429E0BA5F3D4AA9941452BEBE637F27DC5D3DBA33DA073328388A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058467, "uuid": "ea09b33f-5f95-42a0-8e06-b3b00f3ca358", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058467, "uuid": "6071b136-c264-47a4-9728-50f08733ad49", "value": "12288:k5UaB5kVBbX5TyW4y2pt+4y2pttsdFBF7Zdn2jJJI3XPJ2w2A6dKQrypVyfCasSG:1q5kVwyoyCsdFXZdMhwwdNrsVgLjOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058467, "uuid": "fd779534-57e6-479e-9d69-4bbd704755d9", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058467, "uuid": "942f5bf3-3923-4088-900a-41a928d9a1fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058467, "uuid": "602372dd-3a5c-46fa-a672-a3655a3c9c0d", "value": "swift transfer_copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af42080e-d9b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625066421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066421, "uuid": "cfdc2a44-5f83-46d2-a40f-d59ee5dfdd8c", "comment": "Malware payload (Mirai)", "value": "e96f0441986a8bb2ae78cbe1ba017621", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066421, "uuid": "58e60acf-3424-4437-8d59-6a72a955dddb", "comment": "Malware payload (Mirai)", "value": "78d901934666cc6bfd727e3e8ed0df6ffc11d92aa498bc686d34acc333ffd302", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066421, "uuid": "67eef9ca-30a3-4fb3-b89c-5ea5a435864c", "comment": "Malware payload (Mirai)", "value": "2a3f1bca02c065ee428fad81faed8bd8875bfbc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066421, "uuid": "b6b3e492-45b8-4dc4-b82e-31b2ffad37af", "comment": "Malware payload (Mirai)", "value": "c8318a03d748301500074b1aff00b2f5bc92023ac69645dc985d273e413aef64d4ef2b3acbc07b5328d12d1025da91f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066421, "uuid": "0001ede2-2163-45f8-b130-f5dd3b3dd0db", "value": "F0A2D0A0AE82AEAEFCF5D13A67E5ED069101EDD3374D834BD029A17130EB141F1516ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066421, "uuid": "5dc22cb5-719d-41f9-bdc5-c51470b95364", "value": "384:MOX206yHsN1DG/JKQtDhdKoahlAZB5TsR/VB5XPnk+TNyrc:f2/uBKmEcBBKpurc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625066421, "uuid": "fd125159-81f9-4db1-8d19-95af919e1301", "value": 21992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625066421, "uuid": "a7134667-c685-4640-b276-4a2ca1661139", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066421, "uuid": "8f41565e-446c-41cd-94ba-3c67dddc45df", "value": "e96f0441986a8bb2ae78cbe1ba017621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf6969c-d93b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013725, "uuid": "de60e410-be12-4f53-956a-e23c99a4fd62", "comment": "Malware payload (Gafgyt)", "value": "bcc2d964a7ce220a77bd6ab4efbbf3e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013725, "uuid": "2f792d53-3418-4334-8a55-49d84c5d1fb8", "comment": "Malware payload (Gafgyt)", "value": "78d9488d688f3b12181b54df0e9da3770e90a4a42a13db001fd211d16645a1bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013725, "uuid": "a085f52c-6ba7-4233-b241-cd5da5898600", "comment": "Malware payload (Gafgyt)", "value": "a87be0df20bbb33c9069b4bdda520edbc9921c90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013725, "uuid": "7a512615-4c78-4472-bd6c-6711eb0cbf51", "comment": "Malware payload (Gafgyt)", "value": "de48b2709103d3d5c1304ec1017262cbb1616e333984f27e0131ed2bd79cf27c0b0bf247332d0ee7647358a61c210d41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013725, "uuid": "110de22b-20fd-4e41-b121-75ca4576f62a", "value": "FEE3E82F7B271F23C0C5507102D32232BDA9C7D434B952E7AED16DAC6F1998834A6BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013725, "uuid": "726a609b-ef6a-4003-b160-45c180a8ce06", "value": "3072:yuEBdewPH0NPhOMnphakZ/m/nDEC/WabQfn8:yxdevlsMnphakZ/m/nDEC/WabQfn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013725, "uuid": "6c35fc77-e678-49e8-a3ac-8504f65bd685", "value": 154419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013725, "uuid": "fe30f6bc-eed9-4656-9129-bc92571fa590", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013725, "uuid": "0a00aa36-3435-4a4c-b897-b7d8101d2830", "value": "bcc2d964a7ce220a77bd6ab4efbbf3e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0a0563-d9b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625066796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066796, "uuid": "0de36844-0bdb-4369-937c-02d1c81f9a5c", "comment": "Malware payload (Mirai)", "value": "04c932cdb3bf3cfcde68a2a92ca4224c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066796, "uuid": "94c4eb42-127c-44d8-bd6c-5e24969eb3e5", "comment": "Malware payload (Mirai)", "value": "7936689e81109ed8a8ad5b3013b33dc31ffbb6fa39d5654c82daafd895c8237d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066796, "uuid": "91d87927-fd09-4515-a02e-933edcaa2073", "comment": "Malware payload (Mirai)", "value": "f2804ebf1ede4850b2cea735240822ebaea15b8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066796, "uuid": "db15cb1b-2915-4504-9192-79623b5449d0", "comment": "Malware payload (Mirai)", "value": "20a2cd767e3ac186b74124b4cde3c6feea4130b62bb572ab17d5b10e2ecb1f2c0f720542416e625eaa5d610676d5e683", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066796, "uuid": "61c18e11-aa24-48d6-a17b-3b72c2144b6b", "value": "3DB2D1AEE69CB6C9CE6CA4BA98AA1755DB8070D537D78F165310CCECE0C1A4FF5480D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066796, "uuid": "528de096-a377-4784-b213-3306e1f97db8", "value": "384:SwuV2Kf5T+KeG2EZQOwyjxKsev3s0twBUG3y8OCgvD/3RWGVCz0Nvw5:StV2K1zeOwyMs6jmh8hWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625066796, "uuid": "014d7491-3d53-4389-8f27-2c08acb8cd7f", "value": 24548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625066796, "uuid": "a79decc1-98df-433d-8675-0c34cd8b8ed7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066796, "uuid": "7c17ae63-e24c-41ae-90ef-573f5ab83283", "value": "04c932cdb3bf3cfcde68a2a92ca4224c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dd315a-d969-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625033196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033196, "uuid": "e497565b-44ba-4fb7-adf6-310b086bada6", "comment": "Malware payload", "value": "a951a2a98623826a7f0734652a52ec6d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033196, "uuid": "b8602d81-a353-493b-976d-6f92bc31c52b", "comment": "Malware payload", "value": "794a518c2857ed2106f0ee8d409c8dc9e0b358df749e6f693ee2a7ba5150b084", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033196, "uuid": "50eeb492-ed0e-4d4e-879a-d6de94743e32", "comment": "Malware payload", "value": "b43b26068b4fee1f0ca020f8fa61a19b8926fc34", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033196, "uuid": "4361dc78-33c7-4a5f-a081-699133cabd31", "comment": "Malware payload", "value": "b207edb60e1ea2cf4fceef02882415f35e166a25ddff5a8ea7068d96a22aba779dfd5fd30f811449662c9054611fe09a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033196, "uuid": "6da52c63-2144-4f9c-9e11-36008ff8b512", "value": "0BC4233C65E3A488AAE8294D86CEFE59C7CD134690B2A37C15343DBDD1178D6E8E53C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033196, "uuid": "d792d78c-47a8-4efd-b679-50e3d842abd2", "value": "12288:9nLo/i79HWx2cGw+KNfTxVAAv4Rt2UFjXptb4Z4dF8Ic8:1KiJ5cUKNxg2Orw4d3c8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033196, "uuid": "058d5b87-e384-41d7-87f2-f07afa32d6b3", "value": 557215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033196, "uuid": "c3d7c457-744e-4e40-9cff-607cda93d9a8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033196, "uuid": "9e77c01d-6fca-4300-8c08-79a7efdaa737", "value": "DOC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52126df6-d9fd-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625096759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625096759, "uuid": "2aa3af68-ae50-402f-a361-40def86263b7", "comment": "Malware payload (BitRAT)", "value": "6f4fe28e05573fa3973816a5d1f51eaa", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625096759, "uuid": "f90679d4-419b-4e9f-947c-201e6c1d37e7", "comment": "Malware payload (BitRAT)", "value": "79d5449c8c5d235309e76a7c9b9530087ecede589f26732bc8022b1073fcf043", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625096759, "uuid": "75c7e72e-07b3-4c59-abd1-71b2f7a7f7c0", "comment": "Malware payload (BitRAT)", "value": "3bd3bb1190e0289dc4dd96ce46683081539de928", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625096759, "uuid": "6eda83ac-abe3-4da2-9547-84551639e9f7", "comment": "Malware payload (BitRAT)", "value": "8fc5d7b97077ac790e6297fed2a3b1187c8a39679c14aa2578dc1eb6f1dc17ecd37e9e05d97c8fd40e182c64198744b9", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625096759, "uuid": "5fff0e0f-ba23-4bb4-a46f-a2bc47389125", "value": "0DA53354BFB8F2C5F8AB17F06CD6D3566BB1163F4589E6AD8C9908042EE23314711AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625096759, "uuid": "6eb007c7-d1c6-4326-92e1-9ffc1f13c0ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625096759, "uuid": "7c597e26-591c-4580-b1e0-50da0f414a9e", "value": "49152:6ETpJP95+iCYYW668ZBKqlIPSn7VdvDIn3iSZpQmoK44:d9JFUiCYbhbPSn7V5cnS8Qx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625096759, "uuid": "bb688f6e-aadb-481c-906d-eaf6506a14a4", "value": 2168320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625096759, "uuid": "55864dd8-6eb9-4e7e-9e6d-671937d12026", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625096759, "uuid": "1fcf56db-81ca-4be8-8e48-36732d85ddd5", "value": "6F4FE28E05573FA3973816A5D1F51EAA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1a39af-d977-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625039357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039357, "uuid": "fa6357d2-707f-4b09-a9ec-954f15894a4a", "comment": "Malware payload (Loki)", "value": "26a73fd70036450034632f02acb7d28b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039357, "uuid": "90af2301-c5b1-4350-8db0-548ff325e9f1", "comment": "Malware payload (Loki)", "value": "7b208abea68d05caa2ae3e5347d01ec731f585f404f3719738861cf98953b546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039357, "uuid": "668e5a13-51fb-4aff-afae-729be8f6ecc6", "comment": "Malware payload (Loki)", "value": "0d6c60921e90a44d1dd93e69e688cacc87704853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039357, "uuid": "1576e285-a11a-4cbb-a0eb-654d8b381141", "comment": "Malware payload (Loki)", "value": "4d39b5b01d1bb1b53157867184f8e85b750eafae33e5841d36abee74ea6e7960600b2664789227ae5df7dedd8fac8a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039357, "uuid": "c1767749-c3d9-4967-8660-efe34aff92cf", "value": "A0E4AE342EE99626E0BA9FBD92A0605197FDF2236F17D85D7CB502C50713E42C8F162E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039357, "uuid": "88ea165b-525b-458f-9bab-fc23b9b82e7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039357, "uuid": "7eb090ef-bdf1-4f5a-903e-3a2f81d50849", "value": "12288:G3ldAm/LtzA1zeJG8BbX5TyzARbkfxPlbCFkYWcwuWqI5xE7pp88H9HTbywhq+TP:kG8Ez92PqbqkE7U8HNbyZ+TtE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625039357, "uuid": "0788bb47-71e4-492d-888d-664a262d72f9", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625039357, "uuid": "b1fb4ecc-47f2-490f-8d7a-ed9717e6d256", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039357, "uuid": "1e69b2e7-b527-45e1-8ef9-a445adb3ae50", "value": "http___103.89.90.94_hthp_wininit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ecf3d6-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625074487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074487, "uuid": "faa3a17b-99f1-491e-a26e-796ecd749a67", "comment": "Malware payload (NanoCore)", "value": "d065ed24f5472f74250c52fa58558f5b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074487, "uuid": "6edfeaac-a911-4f10-ad48-1660ca6853c0", "comment": "Malware payload (NanoCore)", "value": "7d07c612f42b933792cc4e6122096bd8c695cd6ee20394de04cb8d2d531faf49", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074487, "uuid": "813674ef-61b8-48f7-907f-e6686ee16573", "comment": "Malware payload (NanoCore)", "value": "f15380f170bc4140c7c234adb393756fb4c8f682", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074487, "uuid": "6a28c694-bc8f-4370-b8d2-3f61e11f250b", "comment": "Malware payload (NanoCore)", "value": "416faa94c2d52f895cbc3656c7190bf58f560716cfc6f78156fbe8bc83d014d53e5be6524b5e521294541f562aeaa215", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074487, "uuid": "01e51477-34ea-462d-a46c-ce6d9c891e28", "value": "3973207DF1470A988F8697B8170B2F81154CF51CF3D994B236ACEB3866C5D7A862293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074487, "uuid": "28046e2b-b457-4e39-9af3-b141e422946b", "value": "1536:fOgVzn6eypqCucR2/dPgsdGL1rLnuo0b3X1vVv984:RVzn6eypqCucR2/dPgsdGL1rLnuo0b3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074487, "uuid": "2334dd05-cf47-4c0a-bdc0-c4cda7f437b4", "value": 76837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074487, "uuid": "7ee47d3d-f949-43c6-b000-4fc5281d73a1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074487, "uuid": "8833af64-31b0-4e31-898c-be5d9434e64d", "value": "P.O List.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d050a7ce-d9ab-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625061752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061752, "uuid": "5b5e92b0-e208-4691-aad1-1d201b876d4f", "comment": "Malware payload (Mirai)", "value": "e7791ffeff0081a953cc6afbc3c5b06d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061752, "uuid": "4150d82b-a3aa-44ed-9389-45c31aa68120", "comment": "Malware payload (Mirai)", "value": "7d3e972413a49a907b9c73298ae2b4a56de7f1a673110632348098cd405dd9fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061752, "uuid": "0c640371-7cfa-48e2-9a55-99736d1cca9f", "comment": "Malware payload (Mirai)", "value": "3fb3d3a80ad200512c763f5a489453d4238aab82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061752, "uuid": "2fe57a23-0fdf-4af3-8082-f3e56bf0847a", "comment": "Malware payload (Mirai)", "value": "76e7be3a5c9b1c2fc6457729a5b7368a2744028bcedc58d5ef187a9b3fe27b1db998104856c882b36e041d9898c8c750", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061752, "uuid": "da578ba6-a033-4ae1-ae24-638c32b6f54e", "value": "0203E16465478C23EEF30DB03E6352D062520421EAED32492A9DD217BF98A1973BA54B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061752, "uuid": "40c298f5-dd8d-41be-aae1-f76f4b65bd77", "value": "768:TpgZjfN/4YfPS9O1CTcE7ajWdr4rtNToMwljIP7wxNliPffsWBBn+pAks3UozDJ:TaOYfqwQTcidrmtNDwJIPMXcPnV+pABR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061752, "uuid": "0a1df492-0d32-47b3-b56d-cc2c17ea749e", "value": 40072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061752, "uuid": "f70e96db-7c28-408a-80e2-f4f617f9a31c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061752, "uuid": "78a0909c-5532-42dc-a7ba-2e8e5988dd7b", "value": "e7791ffeff0081a953cc6afbc3c5b06d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e3dbe0-d93b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013715, "uuid": "5d4eb94c-2834-4249-a1cf-4eb39cec8dbe", "comment": "Malware payload (Gafgyt)", "value": "93e5d39552d06dc6cfb908ce33d2ee27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013715, "uuid": "86e3e4b1-03be-4247-8f67-129998f42b63", "comment": "Malware payload (Gafgyt)", "value": "7f2aa6e5e1f1229fb18a15d1599a7a6014796cc7c08b26b9c4336a2048dc8928", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013715, "uuid": "d700e95d-06f8-4775-8fd3-ecec8ac547fc", "comment": "Malware payload (Gafgyt)", "value": "c5b582961920a8b7af84b8d8e5e8d007960d4e98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013715, "uuid": "5de21927-2c69-400c-b733-d10961b64c10", "comment": "Malware payload (Gafgyt)", "value": "6fe23d5ed26261b40bfffbbe531dbb2a352f5f9bef1bd7f4bb8365e35f6921c40b40b2757c7c06dec47fe0e56e5cf184", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013715, "uuid": "9db767fc-d060-4f0b-bb2a-1f4a7464dec5", "value": "B4143A05DA805B57C6E327BAEB8E438D732347A867C7330549389BF43BC2B991E76461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013715, "uuid": "3edc98ec-5d3f-43ae-aa60-b420c133e176", "value": "6144:1KazSanP7Hppnq61Ne5hLAZOiSM/9AWmBwKBIe8X7:1KazSanP7Hppqw05hLA17/jmB1BIe8X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013715, "uuid": "5aa76fb3-0870-4356-aaa5-9957f04a7a65", "value": 205249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013715, "uuid": "6eaf1734-5b70-4b94-9e64-b56d47c7c6ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013715, "uuid": "8c68751d-8057-47f8-a645-a8bf2aa0f643", "value": "93e5d39552d06dc6cfb908ce33d2ee27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75118b8-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625019243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019243, "uuid": "19b43d87-e52c-464a-9e76-379a4b16148a", "comment": "Malware payload (Mirai)", "value": "4ef462614de0b95b69fec950c541d9f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019243, "uuid": "5cdd0435-957a-4f44-8f26-abcd510c2c70", "comment": "Malware payload (Mirai)", "value": "7f5b57e1f80337332d94d724d38dfba817cc7c39d0e671c5a80ab13aa16dccfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019243, "uuid": "ce3db2af-8470-44d5-ae77-d47431c5c788", "comment": "Malware payload (Mirai)", "value": "9a2cd352be7217feaf9b8b830c8c1278dd4f12b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019243, "uuid": "774187cb-f6ec-4a7f-ae01-879ce6db2ff0", "comment": "Malware payload (Mirai)", "value": "336d135b7554a608e6b9c5fd242181cbd3c15e7a872b61ec59d47a7def91bb0865c49cb4e347a9d98eb1f3296948e821", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019243, "uuid": "a38867e0-1817-4eb2-8807-a66086539c82", "value": "91232A96F8829B2AC5D0227AF57E995C3764A7E4D3CF3227CC601B207A8650F1E63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019243, "uuid": "4fd7f059-9852-4ad2-9982-f9972af4df61", "value": "768:FGg7wgy62tyWWEUgpdYNlciq5HtfA/iEQwHpYPf+Qsk041JpXJxhoajXzZY10Uj5:326EUgdYNlGS/iE5Hpwj5RjDa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625019243, "uuid": "8c0debda-91a1-429d-bf08-67a9dd8e344b", "value": 47728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625019243, "uuid": "72bc45c3-a486-4d5d-9810-d5082b4d37bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019243, "uuid": "ede7c39d-ffac-4062-9f95-ee77fae8632a", "value": "4ef462614de0b95b69fec950c541d9f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c55a233-d9ac-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625062014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062014, "uuid": "cdaffb47-d98e-4d72-af1d-ed51e02e8f87", "comment": "Malware payload (Mirai)", "value": "9dbe4bf33e588c25f66774e0d2a47f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062014, "uuid": "8e436e6e-6ca1-4934-8928-fc6327341a43", "comment": "Malware payload (Mirai)", "value": "7f5ca6e4861d96efbf5cbaab479d5bb633011303f8949934a0aa9f282dcbc357", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062014, "uuid": "41060633-387c-4e0a-bbb3-01719d092df1", "comment": "Malware payload (Mirai)", "value": "59adc0a8be2a66e4c8e36b2be5cfcca1596f0748", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062014, "uuid": "93a15659-a582-49e8-a181-701098a25e40", "comment": "Malware payload (Mirai)", "value": "24ef516af2313f9c071f9e4d355e5c15c7524fe002b2f1942350ac9aaa51bc6ebb86859ac3dbd6f339eec2df7eb533b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062014, "uuid": "363d8b26-b068-4b76-b2c8-34c98a022608", "value": "D4630232DA2E0E71CD7457ACCFE18CAA950C5FB9DFD724BAA2F5468C16C21D61618C03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062014, "uuid": "282ab22b-32f1-4671-ba69-a5afa36261f2", "value": "768:MRFDgg8ibVKyOrF+dAvnAlVZlefVkbgyiXm0zWKfVFjb8CmhNoVI9q3UEL0WVpLY:Y8ibwyOr8i31ZHz/ni0TL0KnS4MzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062014, "uuid": "a076ce52-f6bc-4b79-a3ed-b4a8b4b77530", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062014, "uuid": "1cb651f2-6849-46e6-878b-f9c07cd76122", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062014, "uuid": "2cd2d896-e7f5-4757-8efe-d73633aa1755", "value": "9dbe4bf33e588c25f66774e0d2a47f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc079cff-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625059194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059194, "uuid": "5178f155-ba78-47dc-a977-7186da43f923", "comment": "Malware payload (Mirai)", "value": "57548676efd56e6da16a545baf15bea0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059194, "uuid": "c9a8aa3b-3957-41c8-abfd-5482363b1a00", "comment": "Malware payload (Mirai)", "value": "7f91cb9cc635eb2dadd189d52df9d8e482582f2d9db4223892bd5d8018b6ea02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059194, "uuid": "ab675ec4-3b5c-411e-9424-bdf81e842916", "comment": "Malware payload (Mirai)", "value": "81e71a874ae790363013978ae5b6ac7e75d53323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059194, "uuid": "7082cd1e-704f-49fe-b38b-4856175c4c58", "comment": "Malware payload (Mirai)", "value": "075b27012c0966f3c8be1723834b4ba914a07adbb0590afd6c601418103acab35d44255720ccbd2780f69f4992004846", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059194, "uuid": "231e3dc9-0f38-47b9-b997-566205c51d06", "value": "17F2F1EA5D4267B38C348CFFF6DD921616791EBCC21138A3132206A4C6FB5CA6B6C115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059194, "uuid": "83d24c90-cd37-4e0e-8c4e-02498d2cc3df", "value": "768:a5yr+eFAz120bnh7Wkb2oqYpWZfb73KoRBC0yZLq3U7Z:PfFAzkIYBRYkasdyZPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059194, "uuid": "3d7bc5d9-aa58-4310-8ed2-e3f40c2b33c2", "value": 37520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059194, "uuid": "b4742ea5-8b89-4094-8bab-aa46aaff3d20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059194, "uuid": "36ca34fe-46f9-498a-937b-53ff82281a88", "value": "57548676efd56e6da16a545baf15bea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001a4796-d985-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625045082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625045082, "uuid": "662b93c3-9340-4d42-8322-b927ed745840", "comment": "Malware payload (Formbook)", "value": "67445b6530b2a309b6941107c83214c0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625045082, "uuid": "17d90ae5-81a1-4ebf-9333-e11918108c6a", "comment": "Malware payload (Formbook)", "value": "7fa2b0707e132f23fb58b562386fb691d6ebe35294f93f68be1de43297af1c30", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625045082, "uuid": "632b17fb-f0c7-4a7b-b41e-8a49f4ec7166", "comment": "Malware payload (Formbook)", "value": "06a7f130bef4fd62dd291187b9414eb4b63c74cb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625045082, "uuid": "14045ed8-5604-42fe-9871-ddc49169ed57", "comment": "Malware payload (Formbook)", "value": "8a08357c7422b47cfb039177b42a29985f614c004c9fe9703c6f5bf23e00b5cc2335ebb1e77b2c601e66aec081b44286", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625045082, "uuid": "03d074b0-c257-4ef2-9351-2a6dd7a482b2", "value": "A585BADBB86295C2C38BCAF49D6AB5CC922EF4E50CC856450811C3F92C5A6DBC70FD5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625045082, "uuid": "6f47576d-6bc1-4ea6-907b-d07ff577e091", "value": "1536:UrjVejp3iiiiiiiii64iiQibFr3ndbLuYib2GrjdUGbFr3ndbLuYiiiXiyiiib2j:aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625045082, "uuid": "91d1456c-66b5-4e2b-b973-2f1d77bed9a7", "value": 1858683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625045082, "uuid": "8ee85501-bf95-45df-9bc9-989949463767", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625045082, "uuid": "7c905e6c-662a-4ed0-b4ce-67ae6513dd48", "value": "Appendix #1_RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211c48c9-d9bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625068330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625068330, "uuid": "c1f32ad3-e331-4b99-afa5-c7a4b7909349", "comment": "Malware payload", "value": "ae04a781914f2a54f738053d05af91e2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625068330, "uuid": "494ee836-516c-42d6-9c47-b18c0cfe5c9a", "comment": "Malware payload", "value": "7fe7b33752c60f65697a66e92db044259fcfea7b7aec37588faa55887bf75f8b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625068330, "uuid": "2bda908e-f7ed-4992-8066-ce33cff3d859", "comment": "Malware payload", "value": "2a47740bb98d717cec5dce94c386ecce26dcd82a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625068330, "uuid": "df5582b3-c3e1-497e-8add-89d0661c1154", "comment": "Malware payload", "value": "1c8fe25da9b23b52c204d41b58bd46e545ff4cb37b5860a5026ceadb4a04a12feb69160f923527a2433de739882260eb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625068330, "uuid": "60a8ae63-f623-4dd8-af20-651184199350", "value": "BC6161117BA4CE12C8379AF96D6F6310DA25B8DEA4F4D73FCA30C60C6485A748063B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625068330, "uuid": "d6be8309-7daf-43d5-8ab4-fed7672960ff", "value": "48:8We7LLtKxvzt6xZwEAIgEdbod/NL7uzvF7ELGw0ph:8LLRKJzsJA5EdMPLazNfph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625068330, "uuid": "01bb0baf-ed5e-4e23-87ca-c10cc76055bf", "value": 3222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625068330, "uuid": "da69543b-0b37-4258-a44c-b5cfe4a893c3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625068330, "uuid": "c77e744b-dabf-4ce0-a8f2-8f60acdc9750", "value": "7fe7b33752c60f65697a66e92db044259fcfea7b7aec37588faa55887bf75f8b.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cbdf57-d93c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013763, "uuid": "32ae33a2-f75e-463c-8e92-35c6ec0c5cb7", "comment": "Malware payload (Gafgyt)", "value": "602e5796d0653bfbb6212a32d30db298", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013763, "uuid": "4cabd2d0-8a0d-44a8-aeaf-a6bd9dd23de6", "comment": "Malware payload (Gafgyt)", "value": "805917658c7761debdaf18e83b54ec4e9ba645950c773ddd21d6cd8ba29b32d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013763, "uuid": "48d1b28d-a0e2-4efd-b96c-e32d1d2c82fd", "comment": "Malware payload (Gafgyt)", "value": "54587f5bd9e9d487b013fd63f2f79276c1a4bd44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013763, "uuid": "b753ef42-8d52-49a3-ad56-ad479bf95b58", "comment": "Malware payload (Gafgyt)", "value": "a9ea880de833c6940cf65e4f129561f65a5e2f8dbd0d3e5903e9a04b61c71f51cfb3832f731e737f1f306dd7a2d57bf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013763, "uuid": "147a9b6f-aba3-4f16-a738-382a156ba77c", "value": "FCF31805D8905767C6E327BAF79E428D73231BACA7C7332149385EB42BC17992A7D870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013763, "uuid": "4b904eb7-de3d-4f1a-ac08-afdfec6c06be", "value": "3072:8FfM8KdtpEeQOMi6dHGz6Qab5NCqYuODSx03hb45hLO7uOIizKAmyMQBYS2jV7:EmGQabaqY/hU5hLwuOIiKAmyMQBYS2jZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013763, "uuid": "9a28e814-e743-4c2a-88cd-ede414bf7cd4", "value": 163936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013763, "uuid": "03a4d42f-033c-40d7-9ff1-2beeb9ec79da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013763, "uuid": "765484ca-5bb6-4bab-98be-704c170bc1f1", "value": "602e5796d0653bfbb6212a32d30db298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a117f2e-d9aa-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625061016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061016, "uuid": "20a44340-1eee-4cbd-88e0-26368825bbd6", "comment": "Malware payload (SnakeKeylogger)", "value": "a16ded7d698144a68f3e2069ebbc3312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061016, "uuid": "9c26ca28-ac60-47b7-bc38-114bd75b1d3b", "comment": "Malware payload (SnakeKeylogger)", "value": "8079b3754a424eb542b8f4129f27af794161ed2c646c94c168c84a32e78e969f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061016, "uuid": "4da0f935-d58d-43d4-91ce-5f272669f0d8", "comment": "Malware payload (SnakeKeylogger)", "value": "400a343bac2f4c4d18ba6cfbcfece2186070f707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061016, "uuid": "0efbc8a9-a717-497e-94d3-70db1f8d707d", "comment": "Malware payload (SnakeKeylogger)", "value": "ec4762588b2cbfd9cfa65b194fda3f2ec53742bfa2dc51d28c8f8da4f674f766b0e297a080853366444dcbe74b51b68e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061016, "uuid": "c38dfb53-2a3e-4595-928d-048f181b0ac3", "value": "AF156CAC315475DEC567C6BACAA8AC74AA613C7A431B8107909309DFAE0DB93DF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061016, "uuid": "84ef4b47-ebb5-459f-9521-952c7ac6458b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061016, "uuid": "4416e61d-99cb-4b22-80d3-bf10965f48dd", "value": "12288:Uw+PILs+SvAFkwO8HoxW1gp2tPz+gTu6GIJOhuIlT7K4SRliQq34vJfsib7ncZiR:CPIq9JhW1HN+uShP7KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061016, "uuid": "8898d4a2-f5a6-4916-ae6d-d5b7c374c030", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061016, "uuid": "15a1f26e-c9ab-4194-ae54-a54727b87567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061016, "uuid": "513751f1-e082-469e-88c0-6cd2a177bfdf", "value": "revised PO201128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0777aaf2-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018895, "uuid": "87c4f43f-4d87-4498-a468-ca16e684c5d3", "comment": "Malware payload (Mirai)", "value": "6091800eb39b96a461ca81ea297f320e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018895, "uuid": "dedf7501-f225-438f-8651-435bba5cb076", "comment": "Malware payload (Mirai)", "value": "80c1b6ce43a753b0e50ec7c255adb9aa9b4426737c36d3ac14d66ce921841ec5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018895, "uuid": "5bfdf26e-4203-4c4f-8746-0b04830e0d55", "comment": "Malware payload (Mirai)", "value": "7e1f27e67fa7035f3e764b2facf0b2c11e3e0938", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018895, "uuid": "1e87f1a2-50b8-4443-9a1e-ee603e8ba046", "comment": "Malware payload (Mirai)", "value": "41aac02751a0d63632c192cb183fe6ee6213ff001be6d35a7a31482d8d09108ffe0a8a6970d59ab88d67a4679b2e639a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018895, "uuid": "117bbb70-20db-43b8-8f1b-f3b893020657", "value": "96C2E0CDF814BDC2C5E56CF874DC47F21695906633AAAF0E37425DC996F180FB899068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018895, "uuid": "e7a914fc-73d3-4125-a9c1-3e077c1ef908", "value": "768:w9CUFskb2JgIs/E2+On5dafxkmkfEvtY/vb+zyz5WL:GCrJgHiOnPUxRyOu3bpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018895, "uuid": "a0db89b8-29db-4067-a556-8752bdf1c754", "value": 27236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018895, "uuid": "c4f6234b-9ce2-4269-9a58-4c95b185e097", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018895, "uuid": "0e6a6ef8-434d-4f6f-bd5a-cbda0acb7671", "value": "6091800eb39b96a461ca81ea297f320e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3765a2da-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625074380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074380, "uuid": "e1a1604a-1d44-4ace-baed-ba6455d98bb7", "comment": "Malware payload (Mirai)", "value": "88f8b539b4baf77605e8a6728de10b32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074380, "uuid": "1da530ec-08df-4b8a-8fdc-02377e736899", "comment": "Malware payload (Mirai)", "value": "8107232355f1d4500f024f6b38f5dbbbeed4d81f472e8cb1f43da597ed4d3818", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074380, "uuid": "410639b0-9d60-4758-bc06-211eb8424428", "comment": "Malware payload (Mirai)", "value": "c92b0607ea6a9a8bfd506011304d098bb1624ec0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074380, "uuid": "c88cdc90-c3dc-48d7-b0e3-17ca3492e4aa", "comment": "Malware payload (Mirai)", "value": "2a1ba10b9ff5f3f9c9f83e36ccbf36451965bee73e5d32fe0aea46248d09f1a728816a98c66fe9ef483bb4511e260828", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074380, "uuid": "5b01e493-c7f1-4cec-af43-701e0bf0065b", "value": "69F2E098B8EA4EB0EBF4D6B4BD6C7BE5EFF18A0FBA46C55142C66704290201B7049DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074380, "uuid": "a1229663-8883-41b8-b44b-b10375ce5010", "value": "768:bb+S3FhHkQ1+7ZQuex48mEyWM6GD7mT/wfD8Gglvd4uVcqgw02NWXd:bb+UF17+qJyKBGDkwfQl4u+qgw06WXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074380, "uuid": "2253cd5d-fa33-4705-8613-be2b7b4a7ff0", "value": 36052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074380, "uuid": "206b9a2c-7402-446b-bbe1-6f1911e22740", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074380, "uuid": "43e3d146-dbf2-4d04-8bfb-219f09cea86d", "value": "88f8b539b4baf77605e8a6728de10b32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087bb2f2-d96a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625033499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033499, "uuid": "d94a3467-c11c-4360-b2f3-6f1fb8d6ae92", "comment": "Malware payload (SnakeKeylogger)", "value": "2b61dd8087ea1e745e34d9ad3d7c4a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033499, "uuid": "5cb4c66b-13ce-4bce-b79b-bd9ad0d6f6de", "comment": "Malware payload (SnakeKeylogger)", "value": "812f68851a0237986ff6d67142ef28113eba14a0a8410e339b81e4f38d2f6774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033499, "uuid": "361135f7-a75e-49bc-9640-84f4aeed3209", "comment": "Malware payload (SnakeKeylogger)", "value": "20c05e7eea7021ad8b42d0c491abbc2d4081003d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033499, "uuid": "f8ed1847-afd2-4c0a-bbd0-30ed257ad2ef", "comment": "Malware payload (SnakeKeylogger)", "value": "aa5fb6ced9dd3e541b7551bae552972dbc2388e4958b622a011b5ad4336a85f2f99c8f8ebfe15d51c8d548c45f9adc06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033499, "uuid": "2261226f-345d-4eb7-8985-209f01583450", "value": "6F457C107994E529E4BA5F3D4AA5941462BEBD637F23DD6C3CB933DE073328388A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033499, "uuid": "4dee6788-0611-4d0a-ab53-24c5980c5a4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033499, "uuid": "a9d706a2-38e2-4997-9a4b-35796dcf660f", "value": "12288:EIKdfBbX5TyP4y2pt+4y2ptJOgVMQLiwQkqzIgxM8klVt3fD1Pcn5BD+m4y2pt:CBPyoySBokA2TVtvD1Ev+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033499, "uuid": "771eb5ed-6a34-4b13-890f-ef7c4582c840", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033499, "uuid": "ef535913-bb8f-4fe2-b79c-0926f039a40f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033499, "uuid": "67e8ebf5-a415-49b4-9043-d093795a85b6", "value": "PETRONAS RFQPCIHBV2021MRP2711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b48d83-d9a3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625058370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058370, "uuid": "71981e2f-029f-41b0-a15e-43c2793f29cb", "comment": "Malware payload (AgentTesla)", "value": "e5122fbb9fa5f21facc6df2141305073", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058370, "uuid": "f628cc64-6d80-4c3f-a9fb-146be90c09bd", "comment": "Malware payload (AgentTesla)", "value": "82004576665b77d6a67e5286154013f6f7b95bb46d81ee6b061b13343dfc4acd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058370, "uuid": "390122ef-397e-4b60-8655-90152a229d76", "comment": "Malware payload (AgentTesla)", "value": "48ac23cd88339974ea2d0ad0a9f80b513fd2b0df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058370, "uuid": "386a4ab9-6b75-40ca-9e2a-9fbe94c8b7bc", "comment": "Malware payload (AgentTesla)", "value": "eae240bfebf78b085fb3ecdc6e5d2210ee2bea62c5890c4f47e96e10bfbff245e061630f66c9f459cd51a1a2e576bb9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058370, "uuid": "8d495094-ce13-468e-b93d-d8e2f616e490", "value": "70559D107E94D519E0BA5F3D8AA5941452BEBD637F23DC5C3DBA33DA0B3329388A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058370, "uuid": "75bfd129-abbb-42b9-9aca-198b538734e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058370, "uuid": "15acaa0b-3f5d-46f6-b4fb-95f4f2b7e06e", "value": "12288:s1fwrjBbX5Tyg4y2pt+4y2ptFlYN2+GCJaza2mVB3Lzhw/btaS4OY64fY9LUlTjU:qwfWyoyYQ2HCszyZLzS5aX5oASly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058370, "uuid": "fb7e6b8a-fe93-4edc-a7f1-98f8e88ee58f", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058370, "uuid": "b76a8d4c-aa44-4e70-976a-08448db8086f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058370, "uuid": "9c01ff0f-390a-4f72-a03e-1b0ab3650feb", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad9dcf7-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625074654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074654, "uuid": "aacd84ab-a9af-4da3-9561-1598e214e3a6", "comment": "Malware payload (Mirai)", "value": "b0abc22a4c0b7324b01354a8e8cf8013", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074654, "uuid": "e7497953-4d39-49ff-87b4-56a1e5410122", "comment": "Malware payload (Mirai)", "value": "83435b51e1b6aee618038cfcd723f4353977b369ffdd9685c8e0f07d497fd532", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074654, "uuid": "1b6ca772-ce99-4eea-8437-56ed1c8f4bb2", "comment": "Malware payload (Mirai)", "value": "39803942ef9f180120ab004f6faf4d93f45a923e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074654, "uuid": "41293f51-200d-473a-b59a-0ea8dd1c8efe", "comment": "Malware payload (Mirai)", "value": "8c7a5530bf7a2c0ddd57f69d9fa45b6a59b0179bb7e0da280400d52a7aa5e96cff74ac36e9d4a9088704dcfc419e984d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074654, "uuid": "1b6ef823-08de-4691-9c79-44b38f02cd6b", "value": "F403E18ED4D65D8EDCDECA3C93D463339ADCD4E161DAC7182201C9486B5590BD1EE8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074654, "uuid": "0dd9195d-a2c5-49d7-97a4-dc4b4d689d65", "value": "768:mCTCqdab2OtrXMA7cp5YysCrj5imStRWRPB:Lab2KrMX5YfOliXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074654, "uuid": "704199dd-860f-45b9-8904-4be8c4aa3363", "value": 39156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074654, "uuid": "f95f1b25-ba50-47de-8aad-d102a9bb6467", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074654, "uuid": "b2c58137-fbe6-4879-ba5d-0a7f2d007aa9", "value": "b0abc22a4c0b7324b01354a8e8cf8013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5066b5-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625032731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032731, "uuid": "aeb1155a-9573-490c-b35a-c67dca9b8dc2", "comment": "Malware payload (Mirai)", "value": "e815282611d575c3d6282dbb1fbd481f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032731, "uuid": "06db3c5a-10ee-4080-bd67-90ee98fed991", "comment": "Malware payload (Mirai)", "value": "838b41e41c2f89ec2f118f12d8600bdac8a110ed5f3269616f6f1de168dafa19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032731, "uuid": "9b228a60-d917-4dc0-b13f-0e4edf5cea3c", "comment": "Malware payload (Mirai)", "value": "4533d84be9b0be16dcd84cbd259001575dd4150d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032731, "uuid": "2faf5def-8490-4412-8efd-66bcdb278e5a", "comment": "Malware payload (Mirai)", "value": "c4dbf3de31380e7917b86e51450d90ebacf888694c387dab4f98ec136dcda74841bd511b9ab7ad9e861afc653820e349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032731, "uuid": "5f95aae7-00e7-4174-a9cd-91a228e453a3", "value": "1093800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032731, "uuid": "760ebde2-636e-48be-855c-87d03397c2f0", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqCi:qCYxrKDy46Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032731, "uuid": "05144d1c-0717-4002-93b7-abf49264f266", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032731, "uuid": "87f3da6a-db5d-4be3-be24-0c7e03e0c647", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032731, "uuid": "b562fe8c-ed2f-4f20-9589-b90b277cf12e", "value": "e815282611d575c3d6282dbb1fbd481f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0f2113-d9b1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625064350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064350, "uuid": "a111689e-5b3d-4e4b-8452-367214e98859", "comment": "Malware payload (SnakeKeylogger)", "value": "b7756c2b7c73a471abeb4711e2260edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064350, "uuid": "90ee4f25-2765-4d47-b47a-bcdb3a57a3f0", "comment": "Malware payload (SnakeKeylogger)", "value": "840cbec65162b36c73facb4c63c41b22caf9e9da32c6d0afbedc74cf652f1e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064350, "uuid": "58c78339-c538-4069-a5d8-ae4b0bc63059", "comment": "Malware payload (SnakeKeylogger)", "value": "46f54aa95a1c77ca92ce814e9f5dc7b12a1ed3da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064350, "uuid": "0bdeca4b-4f95-412d-86ee-8582a07f262a", "comment": "Malware payload (SnakeKeylogger)", "value": "ac6f700457abc9ec222e239d8292cecd61c6295c22ace6da52de50c86407222595f540af27ac62be795152c7508d792d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064350, "uuid": "5d174972-aa7e-44da-bae5-63c6640f3c48", "value": "8FE4F23869FE8808F6BE0B7D49E0A080DBBB76253532E75D2449115A0F53785CE62B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064350, "uuid": "174dd7b7-9483-4768-89be-68abb74d7145", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064350, "uuid": "0b2fef0b-6f13-4922-85c7-49461ff1de9d", "value": "12288:Fx+5XYKb0wxwiuSWpYIw/De/iQ935EbXiEEjrzSY76gTuITZwV:r+ZLV0oTQJybSrnSYNT5TZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625064350, "uuid": "ca992323-00a5-4af0-a263-518c311c0f92", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625064350, "uuid": "0475a5a4-c3a6-43d5-aee1-56bf790a5caa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064350, "uuid": "fe333f9a-c7de-4a26-9ee0-f5014b08cede", "value": "SecuriteInfo.com.Scr.Malcodegdn30.1467.17608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fba931-d94b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020533, "uuid": "e68582f1-f95c-445d-9e3a-2036aed7c329", "comment": "Malware payload (Mirai)", "value": "1e00f4dea13cd4691b72d57f2726a282", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020533, "uuid": "c8d24cd9-845b-4b72-8180-bf594702b65e", "comment": "Malware payload (Mirai)", "value": "84a467e2d7203c3345d9cc965a27df14bb1142a71c5dec3d652b50ae94dfbc67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020533, "uuid": "6b97c3a2-0be5-4714-aac6-4bc61ef8e27e", "comment": "Malware payload (Mirai)", "value": "27f7d23975db87dbe445767b01840ed222c77cfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020533, "uuid": "9c92c775-5f95-4eb4-8afd-70b0affb4f3a", "comment": "Malware payload (Mirai)", "value": "0b7cf7f87fae9709298d2d6c1b71bfb7a773fd4f4f0c3b4a06c24d6840535a11dcd9ad13948fc0100b31767a33a13e38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020533, "uuid": "5be320c2-6ef4-47ba-9711-4e7ef055cbb8", "value": "73A3840E2E619F7DFFAC823887B79B219249339A36E1C585D15CEA011E7034E741FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020533, "uuid": "68e42042-9277-4a61-9329-caefbcf57df7", "value": "3072:XDIkiGgcsQoeJP0r01ed6WP0qNuCd4auP9:iU2Rd6WP0qNuCu7P9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020533, "uuid": "ebe72335-fccb-49ee-997a-93f95097072c", "value": 100332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020533, "uuid": "09ff4feb-4196-4a55-8ec5-956244dbfdac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020533, "uuid": "07d2dfa3-3fbf-4c50-8d9b-fb8784caf6d1", "value": "1e00f4dea13cd4691b72d57f2726a282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3252e6f6-d98a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625047313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047313, "uuid": "a77e37a3-a599-41bb-b44a-218d00e96478", "comment": "Malware payload", "value": "0b3e2348f65b553476e53c815c2f5e2a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047313, "uuid": "451d45df-c76e-4232-9cb1-11062c0d228d", "comment": "Malware payload", "value": "855ebc9912eb6bca6ea6e7904f190edcc5c6dc690d939dcd577934ecef109d4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047313, "uuid": "ca4f5b43-a3ba-46f9-ac02-b8efe7e30992", "comment": "Malware payload", "value": "63e1a1c3064561042271c076e309da3ec5923777", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047313, "uuid": "8527a121-75c6-43f6-be10-603c0d2e8714", "comment": "Malware payload", "value": "80a4aa089f0844333a0c006e1398eadf2fcbf087955902461ada503344fa383cd05fa59dd5e2c0b07b4211a164b2b85a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047313, "uuid": "00ddd462-6b5f-4375-821c-e8e1214fa13a", "value": "A264129BD9767C8FEE0B0FF021971E4A5AF8D2DAD3C618907354448435FE382A2607C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047313, "uuid": "f11ac187-057f-4848-a1aa-53be3395d052", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6cot:7O/QJHZweEL/NOjCHm7FZZncu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625047313, "uuid": "345f3e05-fb81-4377-9309-73f878e645cd", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625047313, "uuid": "8aa8ec36-0808-47c8-b93a-56101b8d6224", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047313, "uuid": "69d7f8e9-6002-4fc6-bc5a-fd9ff7a9653b", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c906ce-d982-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625043969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043969, "uuid": "2cafe6ba-be09-4102-bb66-0e597a582135", "comment": "Malware payload (AveMariaRAT)", "value": "b455358185501ce270f622fa64e60560", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043969, "uuid": "9bda8b51-46ce-43eb-b884-5bff8be2dba4", "comment": "Malware payload (AveMariaRAT)", "value": "85c02d0cd6412118420143865d77fc24fdc9fcddae292155919aad1270d327ca", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043969, "uuid": "c65fed51-03ca-4c0c-8314-f454ce50ef75", "comment": "Malware payload (AveMariaRAT)", "value": "eb11fece160cc11255541d42ef89c42657cdef67", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043969, "uuid": "f3aefbc7-2683-4058-b5c9-84330b3b718b", "comment": "Malware payload (AveMariaRAT)", "value": "3b588f9a9aa67ffa0ba23e339f34dc75122438bdd387d3c175c249614583b2c8c533208eb3688c6fea98fd6902610365", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043969, "uuid": "e4619f1e-e892-4acf-9233-c2e0a610115d", "value": "63F2B501B2E95B67E6BDABF42471980043B3796B5A71F74D0DC520EF15B2B404BA2F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043969, "uuid": "7e28033f-f9e4-453e-bd6f-b417d01be6b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043969, "uuid": "06a99cbb-fd65-450d-a446-fc0c4ab6da82", "value": "768:b9y7UilJKLMlhijkd+vQZaxV2zsVufLcz0tO/gprqFs3GYA/ifGfAJmX4hjidkv4:txEfo/ifaQRUl165I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625043969, "uuid": "1966d760-033f-46a9-915e-4a7b0bddc507", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625043969, "uuid": "9995550f-5b68-4873-b2a8-82344e8793d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043969, "uuid": "d8038f4d-d091-49bc-b32d-0fff7890c1e7", "value": "\u0639\u0631\u0636 \u0627\u0644\u0645\u0646\u062a\u062c Stomanas_SKCGM_63746352021doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aab217f-d977-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625039167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039167, "uuid": "1544d84a-a440-4af8-b217-a6e7e6881019", "comment": "Malware payload", "value": "19bd74701b289de761899bcb352d07ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039167, "uuid": "975f1f73-d7ad-4889-bbf3-218eb4ef962f", "comment": "Malware payload", "value": "85d7aa235c4d50c29969f5a01712ab0d10cc0a18bb67d76495b7295713c5fec1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039167, "uuid": "27155893-54cc-483f-b90b-8e66cb026eb9", "comment": "Malware payload", "value": "cac829b4b9c4baa34511beecf4853e47725794a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039167, "uuid": "bab59315-592d-4f5a-882a-c2921f4c31a2", "comment": "Malware payload", "value": "4398b6c2c47e7eaf88b2daec8f564320ae094d469970cd458648d0c175663fe8bcefbc9951367b45045486d5ea35c33a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039167, "uuid": "f9bbb6d7-f7c5-4af8-8602-27498906f8cf", "value": "EC03F134430261B8D465B77EA9530BF0AB240F723B039E93B18561F99DA32297B63FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039167, "uuid": "20be625a-34a7-4de6-9dc8-7a3e8d52e0fb", "value": "768:ZkRdVMqfF6yk6e83nlcZXAiKFLZBphBf5+sqy2uaNSirJgGlzDpxYs2:276qfF6oe8OwjLzphBf5+sgSmVrYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625039167, "uuid": "cc244553-439e-4547-88cc-8a1058b8d474", "value": 39308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625039167, "uuid": "faae3e64-7907-4c1a-be8b-2bee9f4e292e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039167, "uuid": "2ae0d499-51be-45a9-bd2a-da9d31860604", "value": "19bd74701b289de761899bcb352d07ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e7bafb-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083291, "uuid": "e00bdb18-c108-4993-bc00-fad25a2a8dec", "comment": "Malware payload", "value": "3a49de10790aa214ecfc8198797afae9", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083291, "uuid": "c0373480-0b76-4a75-af25-5f11dec11338", "comment": "Malware payload", "value": "8812fc1bd832fce688472db7aee5792463bb2b3667441f21cdb5139c08bc293a", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083291, "uuid": "8dba8c97-05c3-4415-92cd-34402b75f610", "comment": "Malware payload", "value": "cc441935dc98507d0f560b1e7af228de5b7f04c9", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083291, "uuid": "d14ec29f-eb5c-4b43-92ce-d7d7d36267e7", "comment": "Malware payload", "value": "7654a42ff370360151de4f5c48b6f7a995f28d416e9fe74537151ebcb10953a57c62e527d2c60a2a532113f0ed0beff6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083291, "uuid": "031899b3-a09d-4543-a2fd-942d4bcd3a49", "value": "21241245E127E862DF8F5077BAFD2EF11769486309480233A732345CD9E7C5E92287BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083291, "uuid": "8c3f39d0-97a2-4e53-969a-ea218a0d7664", "value": "6144:fLdpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p569yWJ:Bu9l2pgxjt6XUyNW+Md56EWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083291, "uuid": "9bdf71eb-5da5-461c-8e68-c7b470fbe6db", "value": 217882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083291, "uuid": "3ea72d8e-765e-45af-9a9c-2103cce78a81", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083291, "uuid": "ab8b0395-012b-4874-887d-32580b4f39a5", "value": "PO 31449213.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722e5723-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625032818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032818, "uuid": "6f3f5273-cf06-4711-a939-642dd8606a8e", "comment": "Malware payload (RedLineStealer)", "value": "8b208a26d01897373c8a430f3d2eb3db", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032818, "uuid": "122643a5-682d-4f1d-a002-f447437d3e0f", "comment": "Malware payload (RedLineStealer)", "value": "8841f4c341be3122b4c3967a044b7871d22a67898ee36c1b94bd083aa58d31b1", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032818, "uuid": "4dfdc259-1e57-4437-8434-d2dc3bdf10e6", "comment": "Malware payload (RedLineStealer)", "value": "34f064e505a54360511c03767e7f73f410a5c9a5", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032818, "uuid": "89eb68ae-3004-47a3-a83c-b90ae2061176", "comment": "Malware payload (RedLineStealer)", "value": "41594f82d208d2dc7bb43af81ad2d00ecd9d05bd83b491080440b2ce6e34c54ad8488f3ddcda4f2dcbbccf1ebd5ae86e", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032818, "uuid": "468c24c0-59a2-4844-8b03-70cd8c04b359", "value": "5145331786703443E2E39ABC956DCDEEAC70C26A13D0A7F362255A450DD8FD22A3D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032818, "uuid": "a7099fa3-b7d9-417a-8843-73ac18ede0b9", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032818, "uuid": "6b2b3a8c-be76-42af-8601-abf62423d9b2", "value": "24576:hdWBmy8Wq/4VlqK/7TrWTgio5C6OW9E/C1JUkDQ+56N2SmRa:jWgy8Wq/4N/7Trs/yuW26XQ+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032818, "uuid": "84454201-6414-4303-b0c8-8b86d63473ad", "value": 1237800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032818, "uuid": "9aa395e4-b510-4321-a35e-0ccd849faf21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032818, "uuid": "f8db6c78-e804-4c2e-89b1-51b82d24eab1", "value": "8841f4c341be3122b4c3967a044b7871d22a67898ee36c1b94bd083aa58d31b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801958c6-d9a8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625060329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060329, "uuid": "c1e36f56-8fdf-4894-9174-df14ffe30f34", "comment": "Malware payload (AgentTesla)", "value": "9263202188f12befd978fb490c59836f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060329, "uuid": "29226b45-1459-4e61-a468-e643b4a915a0", "comment": "Malware payload (AgentTesla)", "value": "888d2a780cb168147cc5b76c9a3a1d567bfa1cc2db7275ccdccdcc50bc1c6f40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060329, "uuid": "bbc90ce1-b43a-470d-89a6-efcb7e5fe431", "comment": "Malware payload (AgentTesla)", "value": "25ae5831872c82415086a9ab03bae2c0aae060e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060329, "uuid": "8ec8f902-8284-489d-8bfc-609afd8a8404", "comment": "Malware payload (AgentTesla)", "value": "9e064da14e21050511ce44ff4fca0af1157dd8a5df8400dde69cfa37d32263de2405e621b8e7ddfc735acaede53c15cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060329, "uuid": "81aa6973-b251-41cf-bda8-19bde47dd285", "value": "20F48D301AA95635E0B69FBE95A1108197FDFE23AF03D85C78B531C50772E82C9F162E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060329, "uuid": "16ba1acb-5748-4601-ad49-e3b1f6d4d9e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060329, "uuid": "d6543c23-df6b-4d6f-9316-e87d9364e28c", "value": "12288:/qLnPZAwtBbX5TydacH/47VyU2dmt5xK5og0Xdyp7RbdLJSaCMwSP5MQe:/qLnPZAQEa0jUYT0Xd+8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625060329, "uuid": "aca7ca88-ec1e-4457-a6b3-2e7c15fee4d3", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625060329, "uuid": "6ab22e24-b4ce-44f2-b1a0-e05bd4726f27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060329, "uuid": "f956151c-195a-4e5e-994e-ae007ffe0668", "value": "swift pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be030f63-d9e9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625088350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088350, "uuid": "32388ad5-95e7-4e02-b10d-8de80f855869", "comment": "Malware payload", "value": "60cbc059aeaafb72a3b597c71ab8ebfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088350, "uuid": "66736549-6ef9-4999-ae97-fb2575396835", "comment": "Malware payload", "value": "88e4f5a171e5bd98e75d022d9d2380d9e51a9f9b7937a93ef01d85c3656bbe5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088350, "uuid": "8ddec5ca-93ee-4637-8ab0-237405c82274", "comment": "Malware payload", "value": "74c878eb05e3564881c425c1314d7ba46b343360", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088350, "uuid": "0afe7044-db38-4e9f-972b-b8c0d70aa870", "comment": "Malware payload", "value": "4b3f9893bd647a2672bb3f4e3524f394e91d751d099b10b5bc29d03004e76e16cedbb3fe954fe1d3a99b23cc32e2dee8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088350, "uuid": "f398e712-48c5-4f3e-a470-ac9d05385338", "value": "4F0551037D4CE311E5E45E3781EE2D3C23E559CA8633960BBF09BDA914B26469CB236D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088350, "uuid": "2b210938-b7bd-48b8-adbb-2a860b09e7fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088350, "uuid": "65a26bdf-23f6-43d4-a855-386483d4543a", "value": "12288:Iws3ahA+9ZP28e5OrDbxlIMM4qWyk6rCPUh/Tsn:m3eA+Ccr5GMM4qWPkCPUhbsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625088350, "uuid": "3e0b4692-9a01-427e-b5b7-66d25cc851bf", "value": 831656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625088350, "uuid": "65d89152-815b-4401-9bec-a2752a8c20a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088350, "uuid": "a713ec99-64f7-439d-a06c-6f942a7ef7d8", "value": "60cbc059aeaafb72a3b597c71ab8ebfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98346b9-d9b2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625064747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064747, "uuid": "8c9dfd83-4dba-4539-a1dd-67ebba66e57a", "comment": "Malware payload", "value": "6b7668dca78f7f5743e43d60029e51d8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064747, "uuid": "3dbc5a29-c806-44e9-9974-4520ba7df326", "comment": "Malware payload", "value": "88eacacbf0edfd6161df1ba99dc170e73e91d3691bf2d21e0e081fdae18eb413", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064747, "uuid": "8145b743-c86c-49df-908f-a446c08bb556", "comment": "Malware payload", "value": "7839e52971be05c76674dc056b2a7c7000353ac1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064747, "uuid": "b7ca0b99-e8f0-4457-a37b-d70adf6f7cd3", "comment": "Malware payload", "value": "933e36258b6e1c2800b1232c5150bb8ac2ea487bedf64bb6618987c91859e79ccd542744da97cd2702bf4a2f367a27f2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064747, "uuid": "5377176a-a263-4de5-a67e-cc591177f323", "value": "8DC423F5411D1CD4937CF71B2D934E1C2A3E198CA12389F11E177AB27EA3496C4AA2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064747, "uuid": "7f38766e-2525-446f-96e2-6b9ac1575e5c", "value": "12288:8EXBMUGNORoYl3thTRXaP5oAms+nEVUT3:8EqBYd7R2h7+nvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625064747, "uuid": "ba4acaeb-5b82-4843-b3ca-c032af323528", "value": 570796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625064747, "uuid": "68db89d9-71b4-4cdd-8054-9f963467590a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064747, "uuid": "93db5f0b-9537-4394-9533-45a8f97f93d5", "value": "quotation (2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe86184-d96e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625035256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035256, "uuid": "8f00b246-6710-4f96-9ade-4289a3810e30", "comment": "Malware payload (AgentTesla)", "value": "feaf04b9118607cb4032bad396ad4c44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035256, "uuid": "ba1c523b-5b1e-46bb-ac9f-9af479b7c55c", "comment": "Malware payload (AgentTesla)", "value": "8992e9e448943afa0f930a90dafd30a9b859972eae160f10fd94afccb28e1501", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035256, "uuid": "85d33856-a579-4bf5-8c53-765c3a64b7e0", "comment": "Malware payload (AgentTesla)", "value": "2656c09c4a0ff301f33540193ab1b858da2e4e3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035256, "uuid": "9ba74729-39ff-4e80-ad8d-30fdb33a4ad6", "comment": "Malware payload (AgentTesla)", "value": "d549cbc160319b74a9f1de4ffb40efc74acb65faaecb82ec24b64b670b5bb6109718b3d4147129b66a950f0f7e65b62d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035256, "uuid": "ba78aaa0-ec17-4554-8b41-b41c741a51aa", "value": "61A1E76413692983DE6380FADCB6BEA751F3F21989CB07C0B32EED600B137765D62540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035256, "uuid": "c662253a-32b1-426b-8876-1f042fd6c8fd", "value": "96:f7a5LHv/w4CIWimdqLILEgg3JlVwJCcyhY5Z+LdfasOzzG9/xh:fW7vY4CIVmcIwgg3rKxKLdfaYph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625035256, "uuid": "85b5ef18-4a4c-4345-9334-788281733356", "value": 4845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625035256, "uuid": "eff1a62f-da66-4b4e-a3ec-a704a97a5773", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035256, "uuid": "92cbd17c-4fa6-4931-bdc6-ed2c51417239", "value": "NEW ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c36bce8-d981-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625043491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043491, "uuid": "6f5fc33a-9324-4e83-8d89-180c6ab1058c", "comment": "Malware payload (OskiStealer)", "value": "1c1b93412ab9925460ee78ebf5c76a15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043491, "uuid": "801294dd-e430-4b4a-b5fa-88c4d92282b8", "comment": "Malware payload (OskiStealer)", "value": "89eb1caa50dfc398890c3490fef1d34527dd8505de3d770bb6ae7032ae22fd1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043491, "uuid": "415da36c-a935-455f-9f8b-f714aa9113aa", "comment": "Malware payload (OskiStealer)", "value": "0004689b4953642eddc67235f8ce294c2dfd7d1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043491, "uuid": "64d85e06-17f8-4693-bcad-b907f2852139", "comment": "Malware payload (OskiStealer)", "value": "bdcad94ca667655511809dd8a0d93e06d8616f278c2f7c567edc59de752a61b56b2252537bbd044e3b5b0645ec57e0f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043491, "uuid": "67483220-5f30-42cc-94ae-3d8176649255", "value": "DAB4E06231489AB7F2131CBA4C1ED2B115ABBD245019E95C75AA334F19F232253EFB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043491, "uuid": "f95453d5-a56c-40b2-a36e-f72ca767e348", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043491, "uuid": "2e13cbd5-55ea-418f-b489-83b597ef194c", "value": "12288:W/EFVzMFHxVPjpkvdMmokNyu0L64MXYijL8DP:WEaHeVKkIu0L64MXvcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625043491, "uuid": "ea2d266b-6425-448b-81ec-b92df4352096", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625043491, "uuid": "dbf98f80-d3a7-491e-9ef5-1e7723d85b33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043491, "uuid": "60fd9381-8023-4146-987c-d59b1bec9b22", "value": "1c1b93412ab9925460ee78ebf5c76a15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec23a2a7-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083273, "uuid": "dfe27072-2cf0-4971-af23-9e0105958e57", "comment": "Malware payload", "value": "89d0f4a39fc22906a66a870b49186fef", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083273, "uuid": "5c19f9a9-8370-4278-8721-a30d45b0e006", "comment": "Malware payload", "value": "89fef01e8bf5d15aa8601415aa0a58d40abcfdece7800442058a84a5fa173d5b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083273, "uuid": "e6753394-cd6e-4917-a285-3541f9e14662", "comment": "Malware payload", "value": "d73053f34f22415483962608bb5e0fb579661290", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083273, "uuid": "ec993f1b-7bb7-4dc9-9cf4-c39cd59df4e6", "comment": "Malware payload", "value": "3d3758341e0ae8f280520a4ad60cec8b50fe192801a44519e7d71afa96ba565998918630b26d081454b3ed4e1552b6cd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083273, "uuid": "1a15d88f-cbf7-49c4-b3de-e25de658adc8", "value": "45241245E12BE821EF8F50777AF92EF1136A5863095816339636341CC4EBC5ED2287BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083273, "uuid": "8258d923-3485-4d02-afb3-94308cfd1b33", "value": "6144:fQbwupA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56ByN:obZu9l2pgxjt6XUyNW+Md56IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083273, "uuid": "b6f7879b-697d-4d3a-9882-1453a45ff0ee", "value": 218156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083273, "uuid": "1f4f1c06-75dc-472f-953e-6b55b63ac926", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083273, "uuid": "7c28c2de-be77-4fb4-b8aa-afae4dee60b2", "value": "WO 469584.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b382ab-d9b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625066786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066786, "uuid": "320ab216-ef03-4056-8c7a-6eb01d1e37ad", "comment": "Malware payload (Mirai)", "value": "a4899f96af4576d839a5fac5df44aae5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066786, "uuid": "68beaa40-eb76-482f-a269-b149d2a569d8", "comment": "Malware payload (Mirai)", "value": "8a9b7bae226eef3c09417acac4d9c3d2a71c5cb6bfd3f09d11e9938e1b6e3638", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066786, "uuid": "3156d8b3-852e-4d6f-8ae6-47eefb783ba5", "comment": "Malware payload (Mirai)", "value": "64edf32ac92f86b16f854b0841d0ab4eabee9104", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066786, "uuid": "c32c6ab9-4908-4b2e-8b5b-8aeaf741c61c", "comment": "Malware payload (Mirai)", "value": "c2262ad67129acbe604419a1cfbd315553c2513e95f6640e4cf5e7b1bfe29b843ed293be39ae3ceb27deeec246c533c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066786, "uuid": "09ef48e7-5f2f-4bca-8308-853122821c1f", "value": "20333C87B801AE7CF85FE6BB8533490DB920A2558193073377BBFDD76C321A85A12D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066786, "uuid": "a9e7d4fd-659c-4c19-8cdf-988d209743cd", "value": "768:QAe+gVovaZnDfZ08VCKFOXWBuGT/ymoAOtMnXvOvhS4Y0deE+ZLvR683yYDhR:37gAKLFamoA4IXvZ4Y0dqZLv88CYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625066786, "uuid": "5b9574b2-0092-4a7e-bfb2-98ed344e8639", "value": 52276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625066786, "uuid": "cbff10c9-7c94-441f-9a67-8d261492cd4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066786, "uuid": "c96abca6-f250-4a47-9fc7-8a2bb12718c1", "value": "a4899f96af4576d839a5fac5df44aae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16a9b80-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083282, "uuid": "2b38f1e2-f9da-48f6-b2f4-e0c7934670ee", "comment": "Malware payload", "value": "d3be17699d29454e1bacf9b140a30349", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083282, "uuid": "58013f3b-3375-458c-8420-5f6b7c19f815", "comment": "Malware payload", "value": "8b07c94dd43ce4eed991289529199e2247b515ce9a02b0066f359f24a24da5ec", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083282, "uuid": "96a2141f-2145-40fe-96d4-3dc7d57fe87f", "comment": "Malware payload", "value": "1cd5bab4c998c8110e852ff9110637f074cf92d7", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083282, "uuid": "dac3060b-13b6-417b-ba1c-961cde6eb058", "comment": "Malware payload", "value": "f352778a614f74c5241e8f6d075c7cd379dbe030fb30f3378f87b19f131bb7bca65bc297004b644687149243b9394029", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083282, "uuid": "a611196f-4dd0-4496-9541-6ad39fa2c7d8", "value": "97241245E12BE852DF9F5077BAF92EF21366586304490533A632341CD4ABC6ED2287FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083282, "uuid": "edbcd2b6-88fb-4875-a54b-0c8549772726", "value": "6144:fBpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56Hz:Ju9l2pgxjt6XUyNW+Md56T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083282, "uuid": "517d3a67-4365-4c1c-b263-2bb4a41784d0", "value": 217868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083282, "uuid": "b41ba10f-b35e-413b-9398-8f03da4fb208", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083282, "uuid": "a18ddffd-f199-4fdc-8448-5443574c62b2", "value": "WO 378871.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63af68b-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625059131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059131, "uuid": "18e0e3c3-4260-4cfe-a697-391c287038b0", "comment": "Malware payload", "value": "32ab0e2770ae98a918bb013273d4b18d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059131, "uuid": "e07d1e0d-e2b3-4686-9430-c768357988ae", "comment": "Malware payload", "value": "8b29cba635acf43e3662f5b26c253da2cac4e3656b5b11e9d1548e1130fad9d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059131, "uuid": "73744728-6ee9-4028-a297-7eac39762cab", "comment": "Malware payload", "value": "d4266f94166b04f9f87fc15e32fa49ae82d3db4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059131, "uuid": "8424d0f3-d781-4e8f-bca1-4fb8120eb6c6", "comment": "Malware payload", "value": "53d3aa629747f9dee174dc22d13e9e75564dc6003110388fcdb20413245cf41e8b0575945d2ed590346975d62b482203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059131, "uuid": "d0132054-0936-4cca-95b9-ccb6c16c8220", "value": "D6559C11B9D99519E0BA5F3D8AA5841052BEBE637F23DC6C3DB533DA0733293C8A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059131, "uuid": "eea57b7a-57c3-4356-9a9d-2d72b2adb898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059131, "uuid": "8d4885ec-63cc-49c6-830c-3184695522d3", "value": "12288:meUxuenOBbX5Tyb4y2pt+4y2ptL/DcOkU2wQA2572V+Mg0fzNTsdSbvgGv+D4y2P:GxueODyoywcOkWQX72VBgszsSbvgGTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059131, "uuid": "073d3630-c289-4f6f-b006-5d83d43609aa", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059131, "uuid": "3cfc1381-bb1d-4c2a-8a4f-f8fed02a7d3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059131, "uuid": "fb547e57-39a2-4133-bd96-c642b78afe53", "value": "o2UtA5rSjE4y03T.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59f536e-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083289, "uuid": "75f06126-3739-4d4c-9367-5856d4f6b074", "comment": "Malware payload", "value": "f58eff64328ec2a2619ff8f81363f95b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083289, "uuid": "3fb299ab-0db9-4940-a1ac-a0825bba13ed", "comment": "Malware payload", "value": "8bc467b91632242290d71490826416691e4af77fd5e56e68946ec3ec44c8bbc3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083289, "uuid": "e0ec7517-f269-4850-918f-fb5eb7a6b24d", "comment": "Malware payload", "value": "cd403d0556692e60d76d722a19a5bc2d17850e6e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083289, "uuid": "c1ad4dad-2405-4342-8b45-3343362e2289", "comment": "Malware payload", "value": "5028f58921757f397e3f6c6c198c377d97797c6efa0b4142176ac6d80f6d3c06e11cfcb553f2c080f9bd41e6b395f133", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083289, "uuid": "d6b86ed9-3073-418b-ac3b-8850ef79ed20", "value": "21241245E227E851EF9F4077BBF92EF11769482345580133D735282CD8ABC5EE2287BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083289, "uuid": "5ec03be9-6ac3-4724-8742-dc8bc9f81989", "value": "6144:fIpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56WlC5:Qu9l2pgxjt6XUyNW+Md56gC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083289, "uuid": "3c677eda-d305-48cb-8c58-8170b6765f95", "value": 218010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083289, "uuid": "2beca571-e97b-4134-ae5b-6927c301ad37", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083289, "uuid": "5e65f2ab-6395-4003-8c85-0c1ff982b70f", "value": "Order 161488.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde9cf5d-d9ab-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625061775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061775, "uuid": "304cb903-b512-48b0-8b1f-84ff28cef3f6", "comment": "Malware payload (Mirai)", "value": "ba3ab88dd994ab72666f59574f182245", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061775, "uuid": "0c7823dc-1dd9-4740-89d1-00a569a7d459", "comment": "Malware payload (Mirai)", "value": "8c3605d43d133c7db2e5a036e8d9549821587619261381de5cda6bb534544ab2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061775, "uuid": "58b14139-bb15-480c-9c33-44d17d4974b2", "comment": "Malware payload (Mirai)", "value": "1e16724b3aaf659fc42dc916732de43faeb9bd1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061775, "uuid": "b36c97a9-7c83-43e4-9843-7b752cc71e3d", "comment": "Malware payload (Mirai)", "value": "c9b2c2ae44aec8aa6515ef2d65f5b58bf4c504b1421872dd45209e3be09b1e9657c147d24cc25f18f0aefaebdf2eb535", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061775, "uuid": "be33c147-4475-4851-a1f1-026f1f149182", "value": "6D23F1D0A5AF42B78B20A432C4BD98C63C725A7E86FDB4D400264A7DECC4D15EE79157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061775, "uuid": "2a75b9f2-7317-4754-b019-9b1e5ec8a627", "value": "768:f5K0bcJ5R+DBQqAZGuFH2O/uotQVr6obOvSytAMmnJ0Ph0+IxZaL6HAPN9q3UELO:vQ3eahZRH26tQrzOlAM66J8uugPgLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061775, "uuid": "bb435ad4-dbfe-47fd-b26e-86bcbe9aff44", "value": 45760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061775, "uuid": "23834ee5-ab1f-427d-a170-098d0141c097", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061775, "uuid": "a7bf8b60-1360-4bde-9ae6-78e02eb4fe84", "value": "ba3ab88dd994ab72666f59574f182245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fd32c6-d968-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625032978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032978, "uuid": "e392ff77-cf00-4487-8148-86de34453fe2", "comment": "Malware payload", "value": "d75ad6e2e58ffa37a6281a396c3a8f17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032978, "uuid": "3780f12f-f61f-48b3-b21a-725f3a866952", "comment": "Malware payload", "value": "8d27c889a984cbf83e2c013a0ae7c08d5f21b95e7940ce8c8e87fd480c1bab24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032978, "uuid": "462e40d3-e8f3-4fc9-a624-7ac63a2d097e", "comment": "Malware payload", "value": "bf24b61fc23993a8ca07da4edd282b5b7780b853", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032978, "uuid": "c724ba45-95f6-4a48-8f45-c5ee79136ee1", "comment": "Malware payload", "value": "262ff2818e4a15ffd1a3aee2d20a6486a12d321bb9876a143f05c116485b53884eb5831d2bb7fc10ac9226bfa90f5bef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032978, "uuid": "21eabb7e-38b3-46d0-b307-b6d23e89782e", "value": "BCD2F785B8919A26C5E423BAEA6F018D3321B3E8E2CF3627CC255F457B9553F0D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032978, "uuid": "a2cdd866-dbf6-4b93-a2fe-d954337b4633", "value": "768:+8x3sOzZYRbvxzVcJWZuQ1nLbhE9xd5KySMlz+BN:LcwZMRk2LLbW9xd51Su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032978, "uuid": "5bebd2bb-0030-4b2e-93f3-59166a94612c", "value": 31012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032978, "uuid": "727625ea-f5b9-4179-a3fc-ca269640c784", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032978, "uuid": "1ae24eea-e228-469f-88f2-df51f4436960", "value": "d75ad6e2e58ffa37a6281a396c3a8f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a93ffe-d94b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020529, "uuid": "74e93af7-0a8b-4647-bafb-b4e98e87a2df", "comment": "Malware payload (Mirai)", "value": "ce497bb864605754524d5044ff29744c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020529, "uuid": "ff0b34c8-e1ff-48f7-8faf-034cd2aa7169", "comment": "Malware payload (Mirai)", "value": "8ddfc2ff0beedb87da885756fc1b0e3cf88b80234388d000c7d0f96db7cc74c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020529, "uuid": "20d5a5b9-c14c-451c-a853-de949e751d9b", "comment": "Malware payload (Mirai)", "value": "1ec7e0c5d1f7e73c67a657e5ceceb707fe46ce9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020529, "uuid": "b1f53103-ba82-46df-a20b-748678f93d54", "comment": "Malware payload (Mirai)", "value": "55daafc7d4f3e7b56f70efb6c5156467f6bef3d811f1568c4a6ae01000f3fd5a3f8ac35ae5dfc5e089bdfb906f8b0fbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020529, "uuid": "b085004d-73c1-4100-99b7-bc5f9df863bf", "value": "377319827C81AA26C7D017BBFA6F108E33156BA8D1DA73438C155F5577CA80F0DA7B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020529, "uuid": "ec4464d0-1f31-446a-99b1-03cd0680475c", "value": "1536:ufzomOUDUrqVC+Oe97OBo/qMH/HMBLpJeZWaeJBM:ufzomOUUBLTwnsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020529, "uuid": "0f3d0197-8788-481b-8234-6fc09019e6e9", "value": 80280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020529, "uuid": "2b5dfa2b-3282-4ca6-a375-f54db8105796", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020529, "uuid": "9adecdc5-5048-4872-97e7-a347bc715f2c", "value": "ce497bb864605754524d5044ff29744c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59fdde9-d9e6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625087128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625087128, "uuid": "1886c8b8-6c12-4337-a2df-c244cab4a610", "comment": "Malware payload", "value": "fcc006d52996cd0eb65b33914045ef17", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625087128, "uuid": "879ad330-84b5-46a4-8419-f78fa2b7e96b", "comment": "Malware payload", "value": "8f0d2de4aa56863828317470967c04ef12741562214070520592edb10ade261c", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625087128, "uuid": "e15d4ed7-e7cb-47d0-8d74-de4acf33095a", "comment": "Malware payload", "value": "383e290057968289d0128fee10fd17dc986aec5c", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625087128, "uuid": "6489c8d1-0730-4586-96de-dbd79bbbdd2a", "comment": "Malware payload", "value": "1d0d09bce24beda24609df00ea56e468c74379c1fb00aa217e9de4fc46b52c42966c27bf616b062745565094b22ef9eb", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625087128, "uuid": "17d86f43-d1c4-49d5-a32c-f92c7871db09", "value": "FE3253E762E45E38C43C4BB9CA8E17D9933F9A950C031F1B6063049196DB98BF771D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625087128, "uuid": "258f80dd-9f5e-4f5a-a315-70806a70e515", "value": "67fdc237b514ec9fab9c4500917eb60f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625087128, "uuid": "5998f47e-b7d8-4c72-8747-ca25a03251a9", "value": "192:71moyFRbPyy5ynHythIJP4BL3NaVfBL3DglxbSyyyJ:71ryz7yy5ynHythIJPshaVJPglxbSyyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625087128, "uuid": "0b19391f-bba5-49a6-a216-d3110f7bcd7a", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625087128, "uuid": "e1497f08-57c4-4660-92b3-0a882ca59ac6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625087128, "uuid": "10d4ef9f-cf3e-411e-a072-9131c1696a8b", "value": "iduD8A5.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada22e26-d99f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625056540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056540, "uuid": "e6507348-9db4-48b1-a0ed-f148443a69e6", "comment": "Malware payload (Formbook)", "value": "799847b23e8c374821c93ebebbedac53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056540, "uuid": "7f8b29fa-5ddf-41d5-85e0-daf1028dec13", "comment": "Malware payload (Formbook)", "value": "900009eb072aa1eb5377fdd09e5a4d5dda9e2755a8934fc998cc1243ab7c8765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056540, "uuid": "475892ab-ddf1-4729-ad71-28a21af1beb8", "comment": "Malware payload (Formbook)", "value": "53aa53db18e1de573863835b456c96c8dedc54d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056540, "uuid": "ffc750ad-601f-4309-889d-bcd49d2659cb", "comment": "Malware payload (Formbook)", "value": "a479a6efea55ab0349bdc415367dd5fb245d91eaf410208157a76b6aa290eefdee4a62be230ee033a57f9601a54cb238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056540, "uuid": "fb6a0e33-77e1-46b7-a6d6-a6970d1eb3bc", "value": "B4E48D302BE85635E0B69FBDD5A1108197FDF623AF07D85D68B512C90712E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056540, "uuid": "de755742-cb8d-413c-b901-bd632e199477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056540, "uuid": "c0b40eeb-566c-4adb-8ed5-ba09afc4b6ab", "value": "12288:a+wAdWw9BbX5TyrQD+xdsJpqBu8ABBp8I2EOqUeXgL4Dr/1:a+wAdWkOQD8KTrVBBp8IdgRq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625056540, "uuid": "9b74fe3d-f6a8-44c7-a27b-b60787cb259a", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625056540, "uuid": "990316c5-9e0e-400e-874b-1264429d4510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056540, "uuid": "70bb48fb-4e39-45a1-ac83-0e3295ce7d8f", "value": "SecuriteInfo.com.Trojan.PackedNET.899.25889.4415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c399bed-d9b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625066791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066791, "uuid": "f5e0d9f4-ff54-4b43-b7e9-52467ad352be", "comment": "Malware payload (Mirai)", "value": "ee6b285a5f068654443c1ec2d3936daa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066791, "uuid": "c2acb360-571c-472b-a188-3897dd70143f", "comment": "Malware payload (Mirai)", "value": "90085dfb4856427dea516256019be8e484704ecdc5a5c105e4a80968b6c68f34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066791, "uuid": "302139f0-9f58-4798-a8c8-94948600326d", "comment": "Malware payload (Mirai)", "value": "a5c0f8535a9a0a8837ae9f23ad345f37419199c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066791, "uuid": "20797f4e-adda-4a57-87b1-6c05f9106522", "comment": "Malware payload (Mirai)", "value": "6884376611bdd6ed5f115c09b5b1241fade458f94b8eda8c13d04ad277117e7d13608ef8c7fe38f0e5f952b0fce9f084", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066791, "uuid": "e462002c-f674-49e6-9b06-f2744432d431", "value": "58334B25BA791D53C4E8647A63F7432AB2FA124E20B88F5D3D720F9DFF64580A9071B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066791, "uuid": "d5687e58-f6d8-4090-b797-48fad883115c", "value": "768:hoolq0kR/1Ns18bY1aXd5jqxrAqJiLO+rSopoouEgC:hob0kR/1Ne8kkXDjuJiPrSfot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625066791, "uuid": "cb57b0f2-ef84-4830-8ad9-a84fdad3108d", "value": 52776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625066791, "uuid": "50b355dc-a78b-4efb-82a5-24b47f1f7032", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066791, "uuid": "99355384-fc92-4c9d-8299-e48b83ede37b", "value": "ee6b285a5f068654443c1ec2d3936daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289e289b-d9a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625059323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059323, "uuid": "1bb9e624-4ca0-4849-8474-036d99d4a858", "comment": "Malware payload (Formbook)", "value": "27eebb17c78baf4ec67d92802a3b1544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059323, "uuid": "e5270725-8dcf-45f5-88c8-b48768bdfc27", "comment": "Malware payload (Formbook)", "value": "9015a3d36c6f378e870487b60ae7854376f55d0959444303691fb4f51d7b7420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059323, "uuid": "429b8e80-ed7f-46db-85cb-7a21b0baa313", "comment": "Malware payload (Formbook)", "value": "fb40744a83cce1e22e666cbc6853b47f6bdc50e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059323, "uuid": "4bc7244e-95c9-464f-aa75-e2a074b5d594", "comment": "Malware payload (Formbook)", "value": "b719d29158cb9213d6075a29dbc8ee3f067c3a0229eb68541879f6007bc42c2eee4dfb9f5792c14563066800ac54062e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059323, "uuid": "f4adf954-066a-4473-9f2f-d3787ca3c13f", "value": "EA157CAC319435DEC467C2B9CEA8BC74AA613C3A431B8507549319DE6E1DA87CF205FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059323, "uuid": "703f6596-405d-495e-844f-c4ef9e72fd6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059323, "uuid": "8809d764-5499-4e6e-9ebb-43c0d054801d", "value": "12288:UQ7zHTwYsrPaOo1NFAumOK+bBwqMCviAS0lpYZYzqvU0Z7UigqHieYiA79g9WWzT:vz81rPah1NdA+Q9UlZqv9Z7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059323, "uuid": "defd6dd0-0762-44ad-8bd5-d069ba3deec1", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059323, "uuid": "ccc871a6-f8a8-4faf-8bf8-ab2c877fcd0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059323, "uuid": "76b45adb-2e30-4933-8b9a-030ce583c179", "value": "Sridhar Insurance Broker P LTD Profoma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c5f909-d976-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625038890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038890, "uuid": "ad0d3488-1a1e-45dc-b4c6-869c3397285d", "comment": "Malware payload (AgentTesla)", "value": "961c7c87514eedb683ab4b64d1c3ae6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038890, "uuid": "dc298f0f-94fc-4d87-b4d9-46bf2eeb0e37", "comment": "Malware payload (AgentTesla)", "value": "908de549ea511294854ac04f06d1130042360077718904c00586a46386c31dec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038890, "uuid": "7f647576-345c-4cda-a3e1-c9e6928aa1d4", "comment": "Malware payload (AgentTesla)", "value": "634a3fd50c5cef6f6b7fd4a3e119e919e199dc5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038890, "uuid": "d995ecba-7b8d-4fbc-be4e-a6274a29c671", "comment": "Malware payload (AgentTesla)", "value": "176e47c710c1a4c691f39ca92c9e062baf3a48b7a393f5233dfdf2cf838179e906c9767d2182c863ff751a1a8a72e1f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038890, "uuid": "6d93e3fc-0bf4-4258-b69b-eb4791f87b38", "value": "7905BF342EA89625E0BA9FBD55A0605152FEFE276F17C81D3CF532C61333A42C5F162A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038890, "uuid": "3d608400-9245-4d87-935b-0483ad985554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038890, "uuid": "447396e4-2087-4160-9030-be5fd1737b1f", "value": "12288:7drvygZJcGpYC3BJBbX5TyOmijoPDJ3ZYSchgc7OsVcFiISYSZE7Tlw785aSmzDB:LJpmic7zYSch1aOcFTPSZMw785HSDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625038890, "uuid": "95388f7f-9f65-4aac-b722-b0a46e9fc0ca", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625038890, "uuid": "5b570e9e-922a-4960-9417-cef541fcfe9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038890, "uuid": "2da08bcf-4f87-4a34-8ec6-1059ba140153", "value": "961c7c87514eedb683ab4b64d1c3ae6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4fb9f2-d95d-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625028080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625028080, "uuid": "89fd7993-4c38-4549-a642-e9e34ff2020b", "comment": "Malware payload (AsyncRAT)", "value": "cb2b849ce8c762788b9dd3d1c76b4335", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625028080, "uuid": "7d717cde-48c5-43f0-b5af-8979ae5c1e87", "comment": "Malware payload (AsyncRAT)", "value": "9129df53f7560474c635daeb18350aaf46478897003aef437c819a71e03b18b0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625028080, "uuid": "6b1c2ac8-c06e-4628-80e2-ab68cbd356a4", "comment": "Malware payload (AsyncRAT)", "value": "0f9455e7a69e58978933d2adef6dce0b90232e87", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625028080, "uuid": "cd57d29a-9aec-4f08-8258-8f0837931b48", "comment": "Malware payload (AsyncRAT)", "value": "a036740ac7fb4916b6387cc24eb3efee56d82a0c45d2c6f8440b6352c6f7c8c954b58aa8ff5d725128e6e7d0432ef17e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625028080, "uuid": "9e6f5192-698d-4273-95a5-4248dac82ed9", "value": "7274BF8837F95F66F1BA47F956B0B010C3F96927253AE1095CC730CA05A9F104EA5F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625028080, "uuid": "dad50b22-c400-42ce-986d-60f8e59836b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625028080, "uuid": "317b138f-6551-4eed-8a1c-108b49b30066", "value": "6144:Kb8HgW/IJAcNzPDK9Ui2vsrw23ZonsNxbsqFShqqo6NKy79Krz4E5wD1:oH+9Ui2vsU2JosEqFShqqo6NKdPwD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625028080, "uuid": "008f12e1-2f11-4609-a75c-b19a8409fd2a", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625028080, "uuid": "4fa2c5d6-8634-49fe-bd92-e4f8603bc94a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625028080, "uuid": "50f138ca-07d8-4896-9424-4e20c9446330", "value": "CB2B849CE8C762788B9DD3D1C76B4335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5646ce-d9c8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625074143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074143, "uuid": "5ed6281f-4173-4352-ab2a-993faedbbce1", "comment": "Malware payload (Mirai)", "value": "d6428d83d36b7642e7d56d0784573f54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074143, "uuid": "77a23e19-6d7d-401d-ad3c-b9c2bd04853a", "comment": "Malware payload (Mirai)", "value": "91f85a20344f9dcfa57fc210c50508087fc06421826a04d510089ad047410f8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074143, "uuid": "302d8696-9b4d-4c62-b874-b20c90f94edb", "comment": "Malware payload (Mirai)", "value": "a668cccf171ccd8a624cf6b5fa769e04e4945645", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074143, "uuid": "bcf68d68-9785-4994-bdb9-4b79b133df97", "comment": "Malware payload (Mirai)", "value": "76822086aac848d01e61a0dd2dbf892ba905a3759d084a7a464d189858775396cb804f50559df2836d602a1f9effd3d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074143, "uuid": "fb05cde4-24b2-4521-bf21-152ad7c6facf", "value": "BE530110C1437163A6B80EFB993178A0E4C9363CEBF826695BC963463AD761B85E95C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074143, "uuid": "1f173ed8-496b-426e-8ec2-a73afd84ee57", "value": "1536:EFIr7efNFfkLqCx7iQkiuFo378Jx7/cZFWzqI:R7efNFfuxTuFXJx7/aOqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074143, "uuid": "749ee6fe-f6bf-4325-a2b4-a2e16547aadb", "value": 62536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074143, "uuid": "286c2d34-7704-4acc-a356-35f05d113f30", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074143, "uuid": "59315ae1-9ea3-4424-b9e5-77cd1b126285", "value": "d6428d83d36b7642e7d56d0784573f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f06a244-d993-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625051334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625051334, "uuid": "ce227c52-c446-4180-a7bb-93551560abed", "comment": "Malware payload (Formbook)", "value": "281d0fb65aaf7ac9588f359d53928d0a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625051334, "uuid": "f088ee9f-04e8-4c44-859c-cf49e8c42d15", "comment": "Malware payload (Formbook)", "value": "923cee65b6864e983a89554726ee733823b721f6e98d59c27491e3c76ea4efff", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625051334, "uuid": "18509391-d690-4803-8d23-77d1545c1c2d", "comment": "Malware payload (Formbook)", "value": "1a77ea0ef1e55dbdba87c9d6db49efd18f79741e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625051334, "uuid": "4c3c15f9-cad5-4076-b870-7af7884025d3", "comment": "Malware payload (Formbook)", "value": "f8355c115cb85f813a7260bdd816f7d8b8ab4ee42581e2ef9a5d40a725e5b59595f836d160c20158f63eb22343038277", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625051334, "uuid": "9879c493-d3c8-4bf2-a23b-83850b80a218", "value": "82B423B1B81BDF43CFBFCB2063E577A850195FAC9B51709429D72114AA523AFBA04CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625051334, "uuid": "733a1fbc-85ee-4927-863c-7fc7934501a8", "value": "12288:aj8uFbVSy9WH1126v3JURYGtgLqzZnzTlDZjjqC47:cHbVSy9YK6v36RYGtV9zHjjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625051334, "uuid": "f3c59b8a-09c6-4017-ae33-56434cef40fa", "value": 541542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625051334, "uuid": "5a12742c-45d8-4ecf-abb6-65d00cbf5c92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625051334, "uuid": "39cb1a93-d847-4510-8327-3e62eb2f6f4d", "value": "jsc_PI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8141ad-d94b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020514, "uuid": "9caa4e32-ac9e-4dad-953a-0205dcc7c062", "comment": "Malware payload (Mirai)", "value": "c7f184c63881b6abc85e0fbad7272bf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020514, "uuid": "afb217d4-c60a-4d27-a088-abfd1e625489", "comment": "Malware payload (Mirai)", "value": "92d389d498a67f504dd7d427db08da72e8e985a0e1271d7a7076bdd3e609ee9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020514, "uuid": "16276fcd-02fe-4927-98b3-01a7a3fdb7e1", "comment": "Malware payload (Mirai)", "value": "e1bef4f53aa61d016676b7d55e11115093f12398", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020514, "uuid": "53b41557-af42-4561-8458-50824385fc12", "comment": "Malware payload (Mirai)", "value": "b33e522723b55d3536a3c1a9b00f53a3e19c92ab053327724c18dacb1240593dfe2f46106e4357cd154595f649d982bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020514, "uuid": "6feaf81b-6276-4c64-90ae-e22b5590448a", "value": "D5733BC8A493E8F4DC1406792176BB735E73F13AB139ED9BD3E99567A801B02D00A36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020514, "uuid": "ade4e0bd-01cd-4b2a-88d7-c980835b6b29", "value": "1536:jwOgQ8JS4OZm3/W97kJ2f4ol+QLk+ltLugvSWy/ReAwJt8A73elQ:s39HJ2f4ol+QLk+ltLugvSWy/oAm8iuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020514, "uuid": "2883e2ed-14f4-4284-a1ee-d10bca0e912b", "value": 74328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020514, "uuid": "58d40673-ea4a-47e7-946a-05facfa20b67", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020514, "uuid": "44297273-213c-4518-9671-1e31ac939646", "value": "c7f184c63881b6abc85e0fbad7272bf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555cbfab-d9ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625074860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074860, "uuid": "fb93927f-ccab-4326-aef3-de2113359b39", "comment": "Malware payload (Formbook)", "value": "ed5bf7e3eb4795c42b77c4f4b212fc82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074860, "uuid": "3ebd1470-7146-457f-add2-3c7658aeef7d", "comment": "Malware payload (Formbook)", "value": "92fee75dbfa7cb48d837b580cc3544832cf116d9991ac9cd0135cef22e535510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074860, "uuid": "759b5987-8744-4a3b-8bdb-266a7b1134e1", "comment": "Malware payload (Formbook)", "value": "cb4a2aab72067114dd72bc0782df38a60b6eb37d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074860, "uuid": "22b8f1c0-20e9-48f8-8bd2-0321aa345a02", "comment": "Malware payload (Formbook)", "value": "96c1588033f8cfebe0ca2551444caf9b777a0c3e2e1c98cb648179dabe3d038b30f19f65baaebf107193f21ca0f5be7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074860, "uuid": "2740b1aa-61ff-4636-9846-3f04b40df845", "value": "05F4AEF2B7E18636D1521A38BC7FD774A826BF046F1478876AE63E4C4D725C0392A583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074860, "uuid": "c1d8fce9-0735-4c3c-bb0d-10c51caed825", "value": "49872ca347743de3342dae48ab6a2426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074860, "uuid": "d587d68c-d5cd-48a0-b499-286e8294ae02", "value": "12288:3/GRJUeqFZCVHtc67SJFBoy7PoAMkANkLkU4wXc:3eRJsFQHGKSacRsN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074860, "uuid": "f18f1d7c-121e-436f-a975-76fec8f73eec", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074860, "uuid": "d24f21fa-7429-4aa7-8102-b656b06a217c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074860, "uuid": "07e7dd00-4f97-4102-afbe-b585d49194fe", "value": "banka bildirimi SWIFT PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96dd26a-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083296, "uuid": "ef6d5121-a429-4bfe-86f3-8e492efd478b", "comment": "Malware payload", "value": "4b959e8812e34d65607dd237fbac9a08", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083296, "uuid": "9bc6ce75-c407-4809-bd62-c87a74b5db9c", "comment": "Malware payload", "value": "937225cbd0737c3212a68da73265a2d988a6c941e9a27229beb32c0507e559b6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083296, "uuid": "b8bc04d7-9291-40d3-8663-7ab3f94c1f0b", "comment": "Malware payload", "value": "06ab345313c2cab98e83bae0a912798d621b8a3e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083296, "uuid": "0327f64c-1ed5-4531-b78a-17c5f4aef523", "comment": "Malware payload", "value": "099c2e4de43613302885636ad4557662db64b688cd8313f69ff0035ae800bd66444806fe48b3b87a328cfc587624c7a4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083296, "uuid": "434214c8-6ba7-4701-9e49-fb9de8115e8e", "value": "3F241245E23BE812DF8F50B77AFD2AF517654423485815339732242CD8ABC6F92287BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083296, "uuid": "8d25e9da-c6c5-4bac-925e-0f6e02ad9fcd", "value": "6144:fpopA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p565F:Cu9l2pgxjt6XUyNW+Md563", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083296, "uuid": "9c407e9b-3709-4b1e-a847-f04e79f70887", "value": 217878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083296, "uuid": "53523d1a-5665-4443-a2c7-2aeb0e422582", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083296, "uuid": "9d829f2b-5792-4eec-b064-7e54cb339629", "value": "Order 5122948.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc255c48-d9d5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625079784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625079784, "uuid": "a55bd9ee-f873-4794-a869-644684a03ea9", "comment": "Malware payload (Formbook)", "value": "3844b2ba67af80e3d7d7253122644810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625079784, "uuid": "14ebadcb-98ff-4d8d-8572-30485d628593", "comment": "Malware payload (Formbook)", "value": "93eb2094dae2d9f36e52bc880594818e203973d1e62e2b2db76cd39804ff0323", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625079784, "uuid": "d0a0fa0c-a5fd-489c-97e3-792f15b51b8f", "comment": "Malware payload (Formbook)", "value": "eb3dcd75f27fafb88817268f0d45c17aaeadf5e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625079784, "uuid": "d625a73c-7d6b-4900-8cf0-70efdd950aee", "comment": "Malware payload (Formbook)", "value": "3e52214c497615e86aa451e9ca056e90e6f22f84dd28cddcf77eddd3dbc9c98e0b8cbda242ffac9a9c660becc77f1168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625079784, "uuid": "76594eee-b539-40f6-a91d-3fc9de7ab73d", "value": "5D558D11B9C4D429E0BA5F3D8AA5941466BEBD637F23DC5C3DB933DA073329388A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625079784, "uuid": "0a8e9fb0-629e-4b47-bed0-d26a45a72cd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625079784, "uuid": "e7bb7a88-afce-46e1-b79a-fa86a01ae194", "value": "12288:H5cmKPtLIBbX5Tye4y2pt+4y2ptHFbAd3oZW3abuPIUyWw9hdXfL8ikcc6VTp+0M:12kcyoymFbv03abuadXfAifT8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625079784, "uuid": "3b3aeb70-c9e5-4b53-9270-72e49c45de07", "value": 1304576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625079784, "uuid": "26f223e8-4d70-4f7c-921c-f3689f250632", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625079784, "uuid": "cc3b2b19-0008-45cc-964a-4f83f2cad93d", "value": "PO#EIMG_501367089.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2bdd0b-d9cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625077287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077287, "uuid": "1015b85e-8be6-4663-8b90-17b936ee1441", "comment": "Malware payload", "value": "b0f286bacf3cb151c80a99a312f7441e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077287, "uuid": "ad2788a1-fe5b-443c-b623-6140f80ff0e5", "comment": "Malware payload", "value": "93f7014e25773e18ee268b6ff82d1fadbde5bfce23abe814f4332800304e38e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077287, "uuid": "f3291bbf-b1a5-4e2a-9f8a-6fb471349cf0", "comment": "Malware payload", "value": "be615012039df8644aeaebdc8078fe6091229d91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077287, "uuid": "79e85a2c-749c-4ccc-8db9-63e7f2ddbfc7", "comment": "Malware payload", "value": "d872fe91dfaca7ad827b4b2836826032c4428f9ad447292b163769e9effc33e8825ffb0cf1530c4b970b264908810168", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077287, "uuid": "529c61b8-e082-4b1f-a21a-217b9857e0f1", "value": "AFD3E607F4415A92D8D1D37AFA0E168932A7B354D3DA7003CCC84F25378E96A2EDE6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077287, "uuid": "1797e98e-5f7f-4a90-8806-8becc29ff51d", "value": "3072:Ce5SK5WJ5is5Qy5Ja5bc7IE8BcVobbDGh7Z55DVJx7FaQEax9ujvbKnqh13wWqH:P5GvXKG7F8Bmo3DGh7Zfl7F9Eax9ujvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625077287, "uuid": "94faad6c-b503-4b98-9f21-2bd023acfc73", "value": 138992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625077287, "uuid": "e92f818d-9bca-4b38-926d-fca2c920b321", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077287, "uuid": "b3e2e460-596f-4eb1-9dff-a6f7b2a01c4b", "value": "b0f286bacf3cb151c80a99a312f7441e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a61d8ae-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625032831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032831, "uuid": "f4f8733d-150a-4947-9f77-2fb66da7fe82", "comment": "Malware payload (RedLineStealer)", "value": "a757f9556ae6586d840cfe43f3e56ba0", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032831, "uuid": "f2494b4c-16f4-4c1d-a466-f48da5dbac29", "comment": "Malware payload (RedLineStealer)", "value": "9405876cce12a7a194783c721b154f270b9b4e53be9ad3c6cb3982ffbd8a6c73", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032831, "uuid": "6ae7d9b5-0936-4d11-8316-0ff907a5f87f", "comment": "Malware payload (RedLineStealer)", "value": "fc68bc9cb3be14d0142f8ca8f2f0dcf6fd97a3e2", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032831, "uuid": "d827c414-030f-4265-bfb4-b3771dd465c2", "comment": "Malware payload (RedLineStealer)", "value": "1a854bab7a5144cace8152fd450281003f4dfbba7c978877b032a89636fa4fe22d3b10154563134f4b508b54410416b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032831, "uuid": "f74c3467-72b9-45eb-8a41-94fc6a9d6ec9", "value": "8084372864BFC05985E3EEA12EDCA8FBD89A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032831, "uuid": "ac417ea9-953a-4b4c-8c52-2e6e293e665e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032831, "uuid": "4b9edc52-dddf-4524-a915-87a4ffa4c2d5", "value": "12288:F5Y3fbJT4zK1LhHFRwpWBBBBBBBVBBBBBBBBBBBiBBBBBBBBBBBBULlQ6Tx/3hr5:msE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032831, "uuid": "3bf43dba-6d50-4934-b3fc-25570498db60", "value": 393608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032831, "uuid": "03cd6a96-0810-4194-ba7c-6310237264d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032831, "uuid": "16a8a4eb-c033-448a-91ca-db3f7418a0cf", "value": "9405876cce12a7a194783c721b154f270b9b4e53be9ad3c6cb3982ffbd8a6c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbdcfab-d972-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625037182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625037182, "uuid": "74cd85d1-4a8f-4602-a65d-65b81d58e433", "comment": "Malware payload", "value": "037ca561cbedcb3a649e829e366668b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625037182, "uuid": "1b32001c-b48f-4e8f-904b-c509ba12e174", "comment": "Malware payload", "value": "94406a0d8a55c26c79f89ab564dd23fb86713f48b8c1d6d5e83557c86f96daa7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625037182, "uuid": "806caa1e-30aa-486a-bc9e-2a71a90d670a", "comment": "Malware payload", "value": "14e58956ce87c0d0f178e195ad5251272d20b8c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625037182, "uuid": "5360b4ca-0832-4aa2-be32-2723b2d81d80", "comment": "Malware payload", "value": "9d8712ce3859f367e831c209fa8a536009dd0c959351a660350a9e04f857c0be2603b7081a72a0c7abf5b96508980a66", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625037182, "uuid": "d5da488c-b5af-4860-8b50-3f94df4dee93", "value": "007314EB2AF80D256047A3E50E3E104939F47493524F4C6E3D8F129D5F1065A3EDAABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625037182, "uuid": "5a485893-f625-4c2b-b72c-a9bb42d2f99d", "value": "384:Nzlm+7udnLObguHNojslMHBPncXNGn6MjqqsxIZLeVNuMRpPolA5r0+hoo5/Cv5Z:hOnL++tulPQAw6F3g9pmS1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625037182, "uuid": "9378c59b-9f4d-473e-bf10-bb3b2fbb0422", "value": 75877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625037182, "uuid": "a0df43cf-a248-4180-b36a-eb7790b32644", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625037182, "uuid": "9c3e7218-ba3a-47e6-9387-7cad159eec5a", "value": "plugins.refresh.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8299137-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083267, "uuid": "6c291b07-d9f8-4185-a296-5aadabe7e73e", "comment": "Malware payload", "value": "0517c01259f2a3c36fc251856072ea3f", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083267, "uuid": "0b000fad-9947-4953-a25e-15809e3019c5", "comment": "Malware payload", "value": "94771c0234c0a2c3fdd9d127afca07e47430d2082fc89c39d22fbb8a222f0844", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083267, "uuid": "2b336a50-e0e6-4362-b7bb-15dad30ce3f6", "comment": "Malware payload", "value": "d8ba4ac98dab5f0276e83b9320fe56cc106f0888", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083267, "uuid": "79021d3a-3fe7-4a47-870d-7de1e2a544de", "comment": "Malware payload", "value": "44824cb8336bc1b41dedc49a2d3c9cf3e8f8ad01e642bd46b8aa0c2fc2e6de0e29b767dc6c724a77b08bbef27b7492fe", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083267, "uuid": "fd31d96c-2616-47e9-aec8-a121e6ce8de7", "value": "AE241245D127E852DF9F54B7BEF82FF00765042305594133A636386CD8ABC6E9228BBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083267, "uuid": "ef2fec55-5df1-4769-9e78-f6a105a59049", "value": "6144:fwGWGGkpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56Oo:ZNu9l2pgxjt6XUyNW+Md56D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083267, "uuid": "391c91a7-7318-403b-b011-bd0878bcf91d", "value": 218179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083267, "uuid": "51a3d5dd-abb8-480a-ac4f-3efa408f5b5e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083267, "uuid": "babcbfcd-778b-4158-8c8e-fa8b055d41de", "value": "PO 0314935.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda56ccc-d980-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625043252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043252, "uuid": "102b5739-72d8-443b-a4ff-dc8d5fa099d7", "comment": "Malware payload (Formbook)", "value": "93ba3f6589d1765284d285257ef2b3b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043252, "uuid": "19daec2a-4237-4552-994e-874304028dc3", "comment": "Malware payload (Formbook)", "value": "94ad76a6e3bf3b13f3703814b4eb47bdf0c64a8aac9cf74d585d1b1bc84962e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043252, "uuid": "8ec29687-51b1-4c27-a6bf-91a096e3b68c", "comment": "Malware payload (Formbook)", "value": "a7413fd5a67f8ca6bc6c2167dd0b4d331ce21177", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625043252, "uuid": "79354f8e-70cb-4efc-abf2-6a66b76029c0", "comment": "Malware payload (Formbook)", "value": "b202c58087ec96984de017d281746815b12ce655ed8546a3e0288d8b1779e5b497b140fb0a2d6e81d661dd0da7035a1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043252, "uuid": "da8e2cb0-0f35-4025-9d0f-19cc5cf8759f", "value": "10C4DF5275449D7BE2531CBA4C1EC2B218A36D24105AF91DB5AA374F18F232213EFB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043252, "uuid": "afc261c6-c6bd-47a3-af7d-74bd3764ced4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043252, "uuid": "82a1f9b5-9826-4901-9c87-11463175a892", "value": "12288:FXEFVzMFbXNgvlqrKeyCFB007VrqpMHjL8DP:FcabXIk1BJ7V+pgcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625043252, "uuid": "6afa779e-cec8-4db8-81c2-6520178619b1", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625043252, "uuid": "d8592b44-3519-497a-a8e5-bc5bcb6431ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625043252, "uuid": "3aee9dd0-70b5-4361-b22f-5f8252c0d223", "value": "93ba3f6589d1765284d285257ef2b3b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f7e269-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625074616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074616, "uuid": "958133be-df02-47f7-b3b3-a1c808b085b1", "comment": "Malware payload (Formbook)", "value": "bf02f19177ac17274df1469892c2476d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074616, "uuid": "21ed683d-f5c6-46d9-a34c-79d13ded7aa4", "comment": "Malware payload (Formbook)", "value": "94e7f4d723f824c6b356c192fc585617a03357ee368f6cc5496ed3f9ac2f5876", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074616, "uuid": "1e2e49f2-d0b3-422e-a579-b3ea3c5af68e", "comment": "Malware payload (Formbook)", "value": "b49d54e6c9bd6a0cf83e6777197b0e830ed9ef33", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074616, "uuid": "5d3ef5c7-c8c6-4147-9e91-5265dace0316", "comment": "Malware payload (Formbook)", "value": "8d457fbd49e142317ee38bc65167acb0bcfe9355416afaab43edb761653ee982fa610c37f04ee53c017c72bb533aa7ac", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074616, "uuid": "94967a88-4784-44fa-bdc1-fcc07feb8923", "value": "4BF2E9ADD15742948F40ABBC6B1B2E85124C7B6EF7889932327CA73813D5D3FA41283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074616, "uuid": "04f4e1dd-8f6c-4d80-b327-91412768b7f2", "value": "192:LJur454WzS7wy0mBm18Yu3VYerhtRO9j4lcNLfrCBKLVjnY9FF22IayjvI:LvzSJBaa3VtcN3CALVbSFUayjvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074616, "uuid": "94156f31-937e-40ab-ac62-974bceca6e5f", "value": 35365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074616, "uuid": "3d54761e-110c-465e-b17d-a693892dad12", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074616, "uuid": "2a4faf63-50af-47a4-8bda-670c1f998910", "value": "Introductory Letter.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40bea5ff-d967-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625032305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032305, "uuid": "abc9de09-9ab6-4a03-8a10-0cd606f4d989", "comment": "Malware payload (AsyncRAT)", "value": "093d6dcc320a7bdb5d7d870cfb31432e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032305, "uuid": "fe9afc44-47b0-4e35-a70a-b171356dd168", "comment": "Malware payload (AsyncRAT)", "value": "952de49cb32683f135ddc940b0409b9a1464c941c13554f2cc843500b92049bc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032305, "uuid": "7ef5fdc8-c150-4726-a0c3-ec80ad1a3a3c", "comment": "Malware payload (AsyncRAT)", "value": "3e10b70fff5075eb741f857dd132b11a93129e07", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032305, "uuid": "943c8dc2-ce57-4afb-aa26-8ca7610591a6", "comment": "Malware payload (AsyncRAT)", "value": "fadc4693631223337228431b1ea3a776641987696506f5e9aa56264ac3fc15474f2d641f725074bd12a705b5751ed337", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032305, "uuid": "86fa68b0-1999-4a78-a767-496fcbcdcff9", "value": "C0E49D352EE85635E0BAAFBD96A0605297FDF2236F17C85D7CF502C50713A81C9F122A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032305, "uuid": "a535a08d-49a8-4364-912f-21e0438d8ebe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032305, "uuid": "ba184401-0047-422e-abc8-573e905fe3ed", "value": "12288:5rrWqY5TxaEAC/b5pBbX5TyFJ6c/DAB3AbDojWpVEnitmXkh3EMD8NB5Z1+p+a7p:q/WJzbdDoyEi6khUMD8NB5T+p+uomeBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032305, "uuid": "a5a92bc1-5816-46f0-ac52-99b8bdeb0100", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032305, "uuid": "46a8bc7d-cfbc-4c54-9dc1-f66fafaa51a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032305, "uuid": "a1d00756-855c-4aa5-9bbc-70c2de1e0efa", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005ada8d-d9de-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083307, "uuid": "7b33fbe8-bd52-4665-9511-8044ca0a8a11", "comment": "Malware payload", "value": "b3144e44e58755333a3ca39b805a1e08", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083307, "uuid": "d4a4041a-d3c4-4800-843d-5ff6073e9109", "comment": "Malware payload", "value": "95f32399edd3c82ba41c16c6eb8f745ebd7f7f7677527272c2215d1160c92a83", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083307, "uuid": "4e639e39-aa33-4c34-b741-0494715e351e", "comment": "Malware payload", "value": "15e891fbc55be0efa9698fa02964794de4254ca6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083307, "uuid": "ccae0085-e774-4003-9c2c-1f54d9eaa1a4", "comment": "Malware payload", "value": "aae34eaca997aae2430f91da4d9ddc621a4a67a2b918bfd88e5b879112e34e244a22d6d591db4cb787532a0b93f7e650", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083307, "uuid": "1f9ff0c8-17d2-4750-9007-6c03697f2fa2", "value": "00241249E12BE821EF9F4077BBF92EF517664823055806339635381CD4A7C6ED2287BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083307, "uuid": "35be98d4-08ae-4ac8-8d85-29e468b0fa29", "value": "6144:fJVpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56Ie:vu9l2pgxjt6XUyNW+Md56F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083307, "uuid": "b68984b7-32e9-4333-a6ed-447976e381a0", "value": 217832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083307, "uuid": "ce14354d-36b6-4db6-8356-46c4c1ee878b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083307, "uuid": "09511db3-0ca9-449d-9214-b1e263200741", "value": "INS 0966828.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02d23aa-d9ae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625063067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063067, "uuid": "5ed77b67-a131-4d9f-bc3e-a3776fb48728", "comment": "Malware payload", "value": "bf778b5aa367352b64544506c785037c", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063067, "uuid": "a464d93b-b9b0-4ab4-909f-143b1dec0da1", "comment": "Malware payload", "value": "964627926c709efa2260eb2d141b2afd7bdd2e73acdc0adf38d99e44865e7f17", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063067, "uuid": "4762330b-4c6e-4fa0-b93a-bee985413257", "comment": "Malware payload", "value": "5e1eca5d071e1c138ec905fe0fee7f66873323ba", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063067, "uuid": "6c7d155d-adb3-41ab-ad5c-bdba867ea3ba", "comment": "Malware payload", "value": "6dd74abc93ca6bc309332488bfd3d9ca72845c9527169a841bc608c43bb8a8721278a237989d123f814ec077e18399c0", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063067, "uuid": "dbb1bd9a-89b2-4220-bec3-9e23d1221c01", "value": "C8D423BB006185ABF544D9EF86628AD2175FDCC292577EDAC7313CCC3D935A12A120BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063067, "uuid": "3bc8d45d-aff7-4a4c-8b4a-98002b21ce41", "value": "12288:0DyUdcDP1Vx6Fijgo+gqQf9PSkD0yRhiC1IUH5pORXGWGbFuwEuhlOfVd:edcDPB6A9B0V4dqUH50W5cfVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625063067, "uuid": "4bbf9b14-6e2a-4708-82f1-5215caa55261", "value": 638977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625063067, "uuid": "c932eb6a-886c-4241-a0c8-ffe154f982a5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063067, "uuid": "a0c02b6f-71f2-4b7b-838c-870de5c0298a", "value": "nwhgu8941.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd7a6ad-d9ab-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1625061717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061717, "uuid": "92ddbfbd-dd1c-4809-ab96-c5de340369e0", "comment": "Malware payload (ArkeiStealer)", "value": "995bf66e1305d116167f598cffb872a9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061717, "uuid": "ae10cb5f-3dc3-491b-9afd-4f33d9e85098", "comment": "Malware payload (ArkeiStealer)", "value": "9674cfd1a6f04f7dc3b21ca60fb7896888d676ac51029586684915f14f12f19c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061717, "uuid": "e0e22565-fa1d-40be-a4e9-2a7b7e25018f", "comment": "Malware payload (ArkeiStealer)", "value": "99f94e02d30fe0f3d8a67802fcea9883d6f6de9e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061717, "uuid": "eff396d6-a3aa-4890-8256-1473113dbd55", "comment": "Malware payload (ArkeiStealer)", "value": "e46c3c867caa33c4383de0d5c1bf2cad1c65ccdaf56787f7d8d00e1707b602d7772d21403aad44b4d1ac735963c79c01", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061717, "uuid": "fb66f302-5e16-43de-948d-6ba89d5db193", "value": "F6157DAC325035DEC467C6BACAA8AD74E6613C6A431B8107909709DFAE0DB97DF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061717, "uuid": "b9bc3719-d108-49cb-8a59-92a830e94d14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061717, "uuid": "b244b8c1-8d25-4d50-aeb5-48c9328f9aa1", "value": "24576:gjXok/S/2cA7Ke5IipyeO98qx/oMGJ5iNc:gjlU2cE5OO4DGPiNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061717, "uuid": "658e59d2-16c6-4af5-9bb1-0d2a50c4d8c7", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061717, "uuid": "77b709aa-da4e-4161-be22-24c18c420877", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061717, "uuid": "20705656-16fe-432e-8df6-f9704793cf17", "value": "9674cfd1a6f04f7dc3b21ca60fb7896888d676ac51029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090fc83f-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625075591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075591, "uuid": "aaf5d71d-c9fb-4921-9ba2-0ec9cc43913f", "comment": "Malware payload (Formbook)", "value": "af289a1e1aee0cb39f25065584dd7876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075591, "uuid": "2602c864-f4fe-4fe9-9220-f53960ed36f4", "comment": "Malware payload (Formbook)", "value": "968e33752d87dc19ca806c2debcf125a50f6223b5732eb3191b9d9c9db9cf4dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075591, "uuid": "fb6849fe-ef26-4424-aa2a-0086eb3dee4d", "comment": "Malware payload (Formbook)", "value": "7bed8ba64f2883849976591f661da56ff573f352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075591, "uuid": "74fe8685-7702-4bb5-85ae-e63d9ab234dc", "comment": "Malware payload (Formbook)", "value": "53e3348767cf39654abfbb76b9292f57932af70407609503973df3fa48d30f89161c22542cdca08f5f1edd0b537760aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075591, "uuid": "89eeddc7-91e8-43ce-bbc1-f95bae1fa382", "value": "35141209A900C4ABC7530F7059774562AFE1E92414E85F076FD48FDEBB66BC1ED2E092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075591, "uuid": "4444b5a7-3db7-4f7d-9f69-49b8b15537f8", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075591, "uuid": "4b821a56-4b0f-4caf-a992-23d5681b52a0", "value": "3072:iBkfJpRXATwMdFCcGbkC+C4guFQoTwunYQCeZyEwCVEkiFyxg8jAQge+DTTnr5C:iqjIK3JkWQFZnWyxg6AQgemnrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075591, "uuid": "082eb797-205c-4aea-a4b9-9784be99d113", "value": 196680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075591, "uuid": "c4a83b76-2692-450b-bd8b-768a3fa49a64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075591, "uuid": "cfe77b7e-9b6a-446a-8c73-691a6187dee3", "value": "af289a1e1aee0cb39f25065584dd7876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d5307d-d9cf-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625077283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077283, "uuid": "022afdcc-5a9a-44cf-92af-11ac438d5a2d", "comment": "Malware payload (NanoCore)", "value": "5398c6db0ce70c200ecad76511baccf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077283, "uuid": "7be87224-291e-4dcb-a7cf-1e58e3e1008b", "comment": "Malware payload (NanoCore)", "value": "9821a5def0375e6e5c1a5cdf9385077108ea08d92ba8ec23aca91e15fb2fe074", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077283, "uuid": "ba7ef2bd-ada5-418c-a4ad-c4ada8e633db", "comment": "Malware payload (NanoCore)", "value": "7b9af482e3dd214fa7884c2ba05b3c18e10318a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077283, "uuid": "e94da2ca-b791-48a3-be09-011408eb9b75", "comment": "Malware payload (NanoCore)", "value": "9164de7fa1a87911ae350fb8e34a241c872f25860c282c9f7826127742486cfa3bc85fccf2dcd455082eb030df3b1cbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077283, "uuid": "4c54d45b-48a5-4c3f-acdc-b5a232edc5f9", "value": "4FF48D216AE84A29F0BA9F7D85B0544197FDF623AF13C96C3DB511C90723E82D5B133A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077283, "uuid": "338d6dd4-9450-444c-944b-f8497d9089da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077283, "uuid": "7106e8f3-c3df-41a6-b67a-fdf9b190f600", "value": "12288:jfEOFBbX5Tycw0VY6Wkpe2kOqVmyUg7eZkMT8tltgk2WFlt9aM82NVa:jfVFlyukLRCZ1DkjviM82/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625077283, "uuid": "888429f3-e7f6-457d-86dd-896a0f44f7cd", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625077283, "uuid": "592c8538-6272-4071-b3c1-0ed618749c84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077283, "uuid": "8b8fb57c-d129-4adb-93d4-f6d24725def1", "value": "5398c6db0ce70c200ecad76511baccf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4b1d53-d98a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625047436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047436, "uuid": "b904c70d-fb73-42fc-9ae2-be0acce95dec", "comment": "Malware payload", "value": "1a05d4e6fdb8a542381e6443a9b4c082", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047436, "uuid": "2b0d00dc-2382-41db-bc2d-8f755fa90d81", "comment": "Malware payload", "value": "983cc5015d0395ca041ddc3de35716e710795232f05d9cba8cadf25d5c1900d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047436, "uuid": "77e7cf14-4a29-47f9-9f8e-2ef403fffe80", "comment": "Malware payload", "value": "3934232fb6e451814e603e4f7c1c47a78aa4de2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047436, "uuid": "e6c877ae-b481-4337-8c6e-2eb4cb841355", "comment": "Malware payload", "value": "891ec95b9bdad1025ca99f3f07942b36739ed402711ef0a83629ba7bafa6530397e2fe22f739214c67eebcb6c0ab8a46", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047436, "uuid": "5e6c1074-5ec2-4305-8ed2-32a8a7a0d9a8", "value": "25C3124AFF359C1B8F102DB22ADB5E8E9C6D7A9B41DBF4A879C1D18F47900CE3952214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047436, "uuid": "d7efaa88-6e47-4dd1-b9d5-d6b74347d37e", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ1x:p3lOYoaja8xzx/0wsxzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625047436, "uuid": "1c13c061-93e1-481b-8db4-8075c2f43def", "value": 121632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625047436, "uuid": "2471ac00-3986-46f7-8e5b-6991198dccd2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047436, "uuid": "ba2cf8da-8406-457b-8a8f-f0a21dfb4399", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18910ee4-d98e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625048988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048988, "uuid": "4ba787a5-0beb-4d88-a027-0bd7ee6a6f3a", "comment": "Malware payload (AgentTesla)", "value": "bfcc4ebf88b9e713dc595d0c63168e57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048988, "uuid": "28797f23-3127-4398-91d6-7de2e0bac0d6", "comment": "Malware payload (AgentTesla)", "value": "98721b5b58d44b36cd9602321ccaff407c849b7fbff4b4cedbb7ba71128ac7ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048988, "uuid": "b432256f-7cbf-4b76-9720-9dbc1923e0af", "comment": "Malware payload (AgentTesla)", "value": "36be88f027baed74a44ac4f27cce8c0ef2bf8f99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048988, "uuid": "995b3247-9e9e-4517-958f-c2c14c1f9175", "comment": "Malware payload (AgentTesla)", "value": "5251f16f59e3a24802e2feeeddcf4d56a71badfaeb706f5640bec02f3890797ed45e5edf9e42da030340917b9952add7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048988, "uuid": "2699fc01-dc03-4804-bd17-6bc326eb8af2", "value": "58157CAC3254759EC567C6BACAA8AC74E6617C7A431BC107909309DFAA0DB97CF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048988, "uuid": "c2df24ba-f5aa-48ed-a3e7-63cdd583d417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048988, "uuid": "a00d33e4-2059-4703-8bd8-8128cbb0f93c", "value": "12288:dDdq6BivQLublnQwHus+OWSLPmtj5GubB+lNzEAqEBUw6kGOHBSEno2auQczzhQ4:2e6blQw6OfCG7pqEBl6xOHBbwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625048988, "uuid": "8b9a40da-8b0a-4702-93a8-4bfa820b0d1e", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625048988, "uuid": "452d4023-7867-481e-8003-576f5670a82e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048988, "uuid": "4f40557b-8cb0-40e7-87e0-eb7e768e9efe", "value": "J5b7ujijJvHtsvL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4329a6-d9b2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625064513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064513, "uuid": "89dae8c4-5e4b-4f3d-acd1-e8f1c75d40e8", "comment": "Malware payload (Formbook)", "value": "13f393154afcfb1185a3dd114068718c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064513, "uuid": "0e839327-ecf9-4699-a557-ed0436c975c9", "comment": "Malware payload (Formbook)", "value": "988d95abeabbcd76c7a1d68a27a27c37092c78cf3567ac418275f769d2f862f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064513, "uuid": "297ac243-4780-450f-b5fc-b78f315919ce", "comment": "Malware payload (Formbook)", "value": "3a3625b0f000a49836958f8f69942ae612702869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064513, "uuid": "cd23a1a9-3cf4-4094-b160-84529201e7a8", "comment": "Malware payload (Formbook)", "value": "2a40240b957883ce7c6bf34c6a8428e3cb875f01897827e2b1e6eb25411b304975a9dc568428f4dd30b0721de0e50fb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064513, "uuid": "b0e3a485-16e2-41b5-8c90-767198514b7f", "value": "44A2E90BB3422BADC505C4F8919D773390F2F833796A176CB7E081633C795A86A7A674", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064513, "uuid": "f8fe1f72-be87-46b1-9819-8421f3eb33db", "value": "57430fc469a821c3ff1e7a5a4de05ad7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064513, "uuid": "a41a56a5-6b10-4552-8399-33e5d85f40c1", "value": "384:KPbOG3haABfm6Jid8mw/GOrwwJYgoo1kFVxLtW0fwLCocvYcl:MqIzkbditwwoRW0fwgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625064513, "uuid": "accbe6c9-10fe-451b-b44e-27d111767627", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625064513, "uuid": "7b2c726e-d1ed-4708-9324-fa378386ff20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064513, "uuid": "d89243d3-384c-41cf-8fe6-2e4f37f780e4", "value": "data.doc_Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24663247-d9ae-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625062752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062752, "uuid": "d6f2b877-e00e-4712-8e66-d2bc65dc11e1", "comment": "Malware payload (AgentTesla)", "value": "7b28895fe4c010db8d8e0b36db3bda77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062752, "uuid": "055040cf-48ad-4f1e-b11c-52a3d93b7aa5", "comment": "Malware payload (AgentTesla)", "value": "99b99539800b783d66b35c5e977816a6541c03dd1b683f14a998cf840ba39171", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062752, "uuid": "7d8e41a7-3acd-412a-86ab-af460783d192", "comment": "Malware payload (AgentTesla)", "value": "0d657230f1131634ce0513c5c6524caa961a9a8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062752, "uuid": "08633982-9505-4b6d-82c3-0b63e45be814", "comment": "Malware payload (AgentTesla)", "value": "20305b78504ca1912f38ae35ee1fcf72a85443500f32d2494e1257fa42d16f35ac341f495c31edf7b1768610dda41764", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062752, "uuid": "36a9b2d4-0623-437a-a0f8-30f7f95ed88e", "value": "1FA42306098CF223BCCE6139A6D8FCC5BAA91BB6F7F80F400529E470895ADC745D596F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062752, "uuid": "93c7ff9e-7934-40c3-a4f8-18158331c15a", "value": "12288:4sDIJSCW/fJzRDs93r62f7VMtbU4XYf8dFMjk:RDeSz3Y42f7VyzYkdFwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062752, "uuid": "af23bc8b-d379-4667-968f-929c443677a2", "value": 474864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062752, "uuid": "cdf13517-9ea2-4e2d-aefc-7334d8588a69", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062752, "uuid": "fa7fd726-9dd6-4565-910c-73fa7a1e063b", "value": "payment copy.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a19e44-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625075639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075639, "uuid": "7dcae28b-281b-4b58-9980-7e090bd1acde", "comment": "Malware payload (NanoCore)", "value": "6a5f0b032470f8e70556d40e7cfa2a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075639, "uuid": "983b6427-8bc9-4037-9928-fa6e982de587", "comment": "Malware payload (NanoCore)", "value": "99d0493be000e012593aca3339e9f6dd2bd053c38275afcf8165a1a7d24198a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075639, "uuid": "8c76b11e-6993-43b3-9cfa-92737bbe6400", "comment": "Malware payload (NanoCore)", "value": "8f4c475b016d41fe0625d60d49210ff97d7e4e89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075639, "uuid": "a0f9fb3d-f03b-4c1a-be77-59ce80a86c0f", "comment": "Malware payload (NanoCore)", "value": "fe0197546878d6e9da14d529503077ddce07d85f8540c589eec0df6aece2b02f8d66504c18d6895cf96f10658310548c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075639, "uuid": "49a74e1d-be3d-44a5-bc63-26c1963b0423", "value": "EF257CAC325435DEC467C6B9CAA8AD74A6613C7A431BC10B909719DFAA0DB93DF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075639, "uuid": "8a7e7862-0b2b-4ed1-8a91-e57325acac47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075639, "uuid": "7885d686-050f-472b-8617-12617f4cdefa", "value": "12288:GDw1VUCcSix8WCrKuJa6MUi/L1UkJkWtn9DuTNvcqfSbvCq72+cN2moFVb86UD3Q:l/ISiKWCZJa33/znhgNvdkVa+c2RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075639, "uuid": "877ea1a4-e271-4535-bb75-b81d0fc0a54e", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075639, "uuid": "f6eb2792-37ff-45d0-9a24-ede031ba3571", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075639, "uuid": "901e42db-025c-4c1c-b81e-e792d05d6e19", "value": "6a5f0b032470f8e70556d40e7cfa2a8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6718043e-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625032799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032799, "uuid": "b7de28f6-d254-428d-b60a-5867e210bd96", "comment": "Malware payload (RedLineStealer)", "value": "2f9decafe6c38c314ef5db167444a14c", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032799, "uuid": "8a291e6b-afd6-44c6-9a7c-9b51529073ea", "comment": "Malware payload (RedLineStealer)", "value": "9b05a121301b3f18f571432586f28345f0e762873084e0b959eac2b682a6c6c9", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032799, "uuid": "7d2cf91c-9d81-4140-a69e-50e3a6e30b39", "comment": "Malware payload (RedLineStealer)", "value": "fc5f3baaa4203f082aeb18cb95e42bf77eedf5ad", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032799, "uuid": "3695c82f-9563-4e3c-9a04-4690b59f023e", "comment": "Malware payload (RedLineStealer)", "value": "17d023f720196226d7294889a7796487b98cd1791038fa8c855c81bc243fa46ccc15fff0afe4438ac1d3fefe8f8de7b1", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032799, "uuid": "01b0f2e5-0194-4e86-aa0b-1aeaa2473aa0", "value": "7AA32B15E3AC8616D7BE4935F5B0122547F1E6CBB042EBCB8DC0A89F2E627C126255F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032799, "uuid": "2c53f2db-df44-4f45-8ed0-4610a6321234", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032799, "uuid": "707cc375-dc96-4762-8ddb-dd715566bd00", "value": "1536:NcdIy9hTXj5K5Z/a1iL769XEtN4q5Gb4pQ3zHbWyFXdEX8qKx/SEpG6a/FlRQ:NcWshZuAsv69X414xzHCyRdlF8lR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032799, "uuid": "0c131793-b3ac-4542-bc47-e38665890462", "value": 105864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032799, "uuid": "1cdf30e5-cfe2-4c1f-bf26-d54ca9f11134", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032799, "uuid": "ae49c4f1-d8b7-4f76-85f0-5af2c1f6ea27", "value": "9b05a121301b3f18f571432586f28345f0e762873084e0b959eac2b682a6c6c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12415e11-d9ae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625062721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062721, "uuid": "8f662faf-efbe-452b-b832-ed16e5cb7265", "comment": "Malware payload", "value": "43a2f0f6fb1b858e9d7997ba8317df03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062721, "uuid": "c1768c50-b42b-4aa4-a85c-c388711c65d5", "comment": "Malware payload", "value": "9c04073ac3ba59508da365fbd8e3eec1a0b9b0427afbb6e740173f292960b205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062721, "uuid": "c8d865f3-986b-4a04-86b3-1e44b0d6cfe9", "comment": "Malware payload", "value": "7f9133fa32da3bd44b4aab7f4b4b8801b373337d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062721, "uuid": "33d7e017-3635-494a-8eae-eb9624bf8ef5", "comment": "Malware payload", "value": "3122e41f6d159868e09c43862a7655de691afab10b3380d7cd0a3cfb4cc44595f078fd67993f3e5a795ce5eb0eab4d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062721, "uuid": "60aaf1a3-e717-424b-8a76-9891465a366a", "value": "A894013254F58AB3D99E8572189321C910165F919C70E29B3B9F7E4F3B35B948AC7B30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062721, "uuid": "13f5b01d-1b46-488c-93aa-391a4063a03d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062721, "uuid": "9862d00c-8a75-4fbe-bf60-edf4909f3794", "value": "6144:dG1T9RnO4Cf5om/FZC/YlmgVK/HUFlcLGjzGemMvVOlmng+EmjS/r8Vc:aBxO4Cf5jCFgg/HUFhaZoYgnCJ2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062721, "uuid": "6711d6e5-099b-45b9-9e80-2ad845458281", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062721, "uuid": "352ab9b0-d1ed-4a74-bd64-13b091f658f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062721, "uuid": "b6452bdb-b11d-47c3-9a54-8787ae939392", "value": "TSO-10571013585200ppt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349eb86b-d977-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625039157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039157, "uuid": "12b140f6-35a7-45b0-b008-8668f0c890b3", "comment": "Malware payload (AgentTesla)", "value": "d9a00e83e1274fafbb08ffac114e7b10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039157, "uuid": "9ede4400-9ca9-4141-a055-84fda3578de8", "comment": "Malware payload (AgentTesla)", "value": "9cd3992bda7564c9d7b1cedaf412d5e4132282f9e78790d57952ec8235112ab8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039157, "uuid": "6489e24a-bf1c-4e67-8acd-379b9f9861c1", "comment": "Malware payload (AgentTesla)", "value": "8c7a4586825f5effa252ad2f7bd284a05195402f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039157, "uuid": "68ba9d89-a74e-4fb8-b038-1ff90f9f6034", "comment": "Malware payload (AgentTesla)", "value": "cb1b1d92ba5e31feebc4bb3ba0a88dd9040a6cc5a7a322ecacdd7a10240b5dd773e3bcf6a017ccd6a9176173fd26a3e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039157, "uuid": "9e8dee7e-4678-4bfd-9dba-e5ef28600dab", "value": "96F4BF382EA89625F0BA9F7D96E0605297FDF6236F17C8583CF502C54717A81C9F122E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039157, "uuid": "3b90315b-0418-47cc-8d99-63b1a9adebfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039157, "uuid": "2cb7c520-efc6-43ba-8ca0-28fcdcb816f9", "value": "12288:TL3+GEtaB+Yo6fm5BbX5TyXLrpV7p3qQAfUesjEUYMnLOfnBypLbjrXguzepU6/o:85wnB7AfWYznIpbgseu6/b5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625039157, "uuid": "a9a69c28-f14b-4598-9ecb-b2e654c77ad3", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625039157, "uuid": "63df5a8b-5850-414a-8bba-c920e2194ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039157, "uuid": "458bc005-d33a-438c-8e19-c4f5e16af08b", "value": "d9a00e83e1274fafbb08ffac114e7b10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cb3b46-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625074408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074408, "uuid": "50ce3233-e9fa-4e84-a0c5-463790695112", "comment": "Malware payload (Mirai)", "value": "9f9fffa8ef092fc5dd7a922d15de8280", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074408, "uuid": "77747ea8-ccca-4877-93eb-87a80893e4aa", "comment": "Malware payload (Mirai)", "value": "9d4c8714e7dfb20196bc1be7ae4abca78c58ed8c0d1cdd9be62993eae378a4c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074408, "uuid": "3c0764ef-f402-4d5b-b767-c0302c831bb5", "comment": "Malware payload (Mirai)", "value": "e5bacdde822c5251c86e13ac30e9dec9e1ba488b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074408, "uuid": "eac3fda5-ec7d-4441-91ca-6999860ab5bb", "comment": "Malware payload (Mirai)", "value": "152daa672379f8f67369843e8da17405136bfdcac7076df36f836fe79728543660a7005b706f94ec67bc02caab18c219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074408, "uuid": "e410e1b3-cf6f-4eac-8d22-6505c5fdf29f", "value": "AFF2F1708563AD43F7B61DB2B52E09CA2B161CB860DF3B785264473CFDF140392A8A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074408, "uuid": "36631e18-6163-45be-a09d-56345178f110", "value": "384:CqxYGG+IFWEs3dK2/0dWTw0HdKzqAVIp8bS3d5b7lufpZBlad9BUhmgR7yNnC3jj:COemQK0dWjHTL6lad9BxC3jy3o3U8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074408, "uuid": "b5d254cd-796f-42c1-9ce4-3ac7725fd3d7", "value": 34936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074408, "uuid": "05fa1cc4-24a7-41c1-9079-53ef19f034d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074408, "uuid": "370c914a-d30c-4645-a08d-6dc8325d0e44", "value": "9f9fffa8ef092fc5dd7a922d15de8280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f343437-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1625075709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075709, "uuid": "eb940f68-7845-42e2-a48c-67aac9fe1d20", "comment": "Malware payload (ArkeiStealer)", "value": "b99eea7fe65a14d8d15094cf8e7f5a38", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075709, "uuid": "a6c0c112-0793-416f-93da-9c8dcdb98ad8", "comment": "Malware payload (ArkeiStealer)", "value": "9f2d892a4f124d1b693d8ceafc6ebe8741484109f68d82ec49ac2c9d781483a7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075709, "uuid": "fa3d0c8e-97ac-402e-aba0-a9e2eedfef96", "comment": "Malware payload (ArkeiStealer)", "value": "3af3ee064bc3e3469bf06815dec0086c4ae7a558", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075709, "uuid": "359d31ac-7c32-4c82-a5b8-66e8e5cd4b6f", "comment": "Malware payload (ArkeiStealer)", "value": "fdb553939be5cbb60ac1dfa2ac5bac01d0fc33c506054ed3ee69124a9d10b26c21ba2f6a4a459a3e4d9d9fd082f88ba1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075709, "uuid": "dca0b684-5f88-44e2-b8ee-501da4b37060", "value": "8AE4D010B691C03AF5F316F85ABA93B8643DBEE19B5451CB62D52BEE47356E0AC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075709, "uuid": "0fd6edf8-7fa2-4929-8a97-a6e6d25d48bb", "value": "082e9d7628311472d52904fc98c0610d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075709, "uuid": "369f6db3-bb01-4631-ad40-80149bd8c719", "value": "12288:VjiiqeLRH+Rk1rRcB8BlwiBcdKP+q33Ls8gbWVN0ehQ/oWQCIUcCU319r:Y1eN8UrRcB8Lw6cQPbrUyVNxygWjIJdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075709, "uuid": "9ce2188a-7e5a-482d-9cde-d8f5df7a2ff7", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075709, "uuid": "250cde3e-e351-472c-9f7c-68b77122e768", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075709, "uuid": "92e3a706-9813-450b-bdde-30b50d8a7634", "value": "b99eea7fe65a14d8d15094cf8e7f5a38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18686dc3-d98d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625048558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048558, "uuid": "17509941-0207-426a-a112-c1cb53aa50d1", "comment": "Malware payload (Formbook)", "value": "a76c57dd87585973d84389a156fd753b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048558, "uuid": "ed8314a6-af21-459e-b751-5551af431f1c", "comment": "Malware payload (Formbook)", "value": "9f4b16af331b68940f006b23d176b9dc4b7078fc69f8623d97abd6fa651484a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048558, "uuid": "e21576cf-41a1-46be-a725-e7b62f29732c", "comment": "Malware payload (Formbook)", "value": "2bea2a8b1de0afcf3ea7a4baaac0cf9ce7768bab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048558, "uuid": "2b7b5555-433f-49ee-9422-68540087cf35", "comment": "Malware payload (Formbook)", "value": "78cbfebb1c2d935bf409b0b9b82bb997d63711b9cea07c3fe79242d3f0f063e4baf5a527f114899d7cd4314915e35db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048558, "uuid": "babf1a4c-8b03-4c7e-8e4a-d0ba9c6fe842", "value": "5BA4AE82A74CBEF6E545157909907CB20CA8E4753F2F8897EF865ECF8528AC05734F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048558, "uuid": "192b2030-ca50-4eb3-a179-85757b742d1d", "value": "c5077da20bcbeb8d9487891fb235ff1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048558, "uuid": "11aca65a-00df-4393-9b07-40a6563685a1", "value": "12288:5a/T1HmmA+1tv2Yp2MfmkqLm32ycX6SH2EePWTedP7R/B:8T1HjA+/vbp2zkqNqm23UyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625048558, "uuid": "af723b7e-29c0-4504-b4aa-8c9931acda81", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625048558, "uuid": "883f596a-4fb7-43b7-ad02-2331f42f18c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048558, "uuid": "487cd76c-1aeb-4852-835a-1e62aec051b5", "value": "FASMW.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ceeb04-d9d0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625077543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077543, "uuid": "b2d6f099-a1f6-4098-a23b-f7a43de454da", "comment": "Malware payload (RedLineStealer)", "value": "a77488a860f2d621cac9998edf4cda6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077543, "uuid": "bd0af2f7-66ed-4180-b5cb-b1a8f7573d6e", "comment": "Malware payload (RedLineStealer)", "value": "a02e416cdce33723c9ea749a4f7809dc9f5596b03eb312fe2449d0413b5e96b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077543, "uuid": "3a961436-2398-4916-bc0c-9e6356dacffb", "comment": "Malware payload (RedLineStealer)", "value": "68b39d1a599f72c253b48ec5edcc276fa8e5929e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077543, "uuid": "bc1f9190-4a0a-4833-8fdd-d6b9eb02b808", "comment": "Malware payload (RedLineStealer)", "value": "32b7da0a21927018f6a510cc8efefabce7d3cdea88ed34ab06a2f34c33de3a2af6baf75056b87dd6a8440d7ec4d3c94d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077543, "uuid": "3d762548-3f6b-41e0-9d19-b07c17bcdd74", "value": "5464D003BA78695FEAFD4EF294A215B007B17937B882D3893CA4364F0DFB7550512A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077543, "uuid": "3b9396ed-6505-4aa3-a16f-f18195b81338", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077543, "uuid": "c2831923-a86f-437a-b2a1-567e3a23f67e", "value": "6144:JXp5ooWsi0fn2hzCH8/oNr+7FXyGvwY5651CPbgWy/pBS1:Jp5pi0f20HrANyGvd56rCPUh/nS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625077543, "uuid": "9aee508e-c2ae-49bc-a8d5-95b4a565e2d4", "value": 318080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625077543, "uuid": "633feb55-8518-4a61-8fc6-92e189fe983e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077543, "uuid": "4b560472-51ba-4625-a1a4-8cdde605fb7a", "value": "a77488a860f2d621cac9998edf4cda6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6b5fa5-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083275, "uuid": "956b831f-9136-4844-ad64-909069443065", "comment": "Malware payload", "value": "56d9a0db8defe0857dd4bb7c9af97ee2", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083275, "uuid": "d1c9ac43-7ab5-46c6-8f8b-7a871dc911d1", "comment": "Malware payload", "value": "a0747e6e54af1fde0586add639282d26b5e22a0bb4e4cca5d362c6eb6f6f3ed4", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083275, "uuid": "5f203b0b-7012-4bca-9da0-a05278e00d44", "comment": "Malware payload", "value": "abf0d796220d5e8ba7a5cc3f5ed2421411a5fb56", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083275, "uuid": "5d8c58ad-e6b9-441d-a70b-4585be778452", "comment": "Malware payload", "value": "baa80848de6e0e71413f42bd58bc71f8164402716bb3aed680e56307938aae59677374aba238ea413c59766f9c537fbf", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083275, "uuid": "a03401c7-404b-4b7f-8fa4-3f6abf9ad312", "value": "0B241245E127E861EF9F40777AFA2EF21765042305491133D736385CD8ABC6F9128BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083275, "uuid": "77666f27-b9ee-4d31-a304-22db9537217e", "value": "6144:fmpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56/6:Ou9l2pgxjt6XUyNW+Md56y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083275, "uuid": "6f8b9809-ef2e-4f37-8363-30e8028660b8", "value": 217962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083275, "uuid": "1601bf96-cecd-4b58-ba23-ce3158a3a4a5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083275, "uuid": "75b7bb60-fe33-4c7a-9cdb-a698ca365683", "value": "WO 2825876.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f429ca48-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083287, "uuid": "e1c4d4b3-cd02-43e1-a137-b8378e1f35b1", "comment": "Malware payload", "value": "c37f1a5dbbc7d287c2bd728c8d18876d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083287, "uuid": "0c6444de-ce71-4913-b524-13c4d0ce2dd5", "comment": "Malware payload", "value": "a08189d1aa01364cc489c2b30bd60ef12a2a5c2e5e524f22755e503fbec74b86", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083287, "uuid": "1a6e53dc-d7a9-4590-be6a-68df4bb5432c", "comment": "Malware payload", "value": "5ba53460c848d92844b6ac475ea8304d46ca8aae", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083287, "uuid": "b80e755e-38c6-497d-85c2-bb826d5f4d8d", "comment": "Malware payload", "value": "ecdcbf09bb15cba63e414532881f93851fcd41f78c47c2af2b88e4342a45cd1a86a652daf5d55409f4f6ea4262885d23", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083287, "uuid": "e2054695-a849-43fa-8ffb-555f2e4fd0bc", "value": "83241205E12BE822EF8F50777AF92AF11366482305485133A636385CD9B7C1FD218BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083287, "uuid": "d2188afa-32fd-4b77-9ad3-3457502115ac", "value": "6144:fC/ewpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56Uj:K//u9l2pgxjt6XUyNW+Md562", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083287, "uuid": "a4e2f09c-bf95-4793-b50f-191417a01c2d", "value": 217884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083287, "uuid": "9764cefe-81ba-42bb-a88e-3299e71fa548", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083287, "uuid": "a00a4367-ecc3-4ce6-8f60-4ea7eca49879", "value": "Order 824126.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de86d84c-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018396, "uuid": "57621001-c15e-4943-a508-22f3d02cd1bb", "comment": "Malware payload (Mirai)", "value": "50663cb43608019c91f46cc107b3f522", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018396, "uuid": "b82e06d3-293c-4310-90c9-ea4e0f6c7a8b", "comment": "Malware payload (Mirai)", "value": "a0ee0d16dbf0772f1e5257ddad6b54011e6dc73dfdf2417549db9d8dbc3e7fd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018396, "uuid": "d52f0370-3257-4394-b617-ebe86fb2a5ca", "comment": "Malware payload (Mirai)", "value": "ac889ec1b5f8dd0569f069544ce5a747039629bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018396, "uuid": "289fcf9d-3ebd-4e79-b452-98001bcbc81c", "comment": "Malware payload (Mirai)", "value": "fae7f98b7a591de2dd0b32729f9693016055afc2d46d08b0449a7a1275dae9c04bc54515203883a6609dc414cbeb760d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018396, "uuid": "69acb6a0-ff71-43a5-ba04-ba645d214906", "value": "4D73A61E7E258FFDF799823447B78E216A5823C637E1D2C5D29CD6012E6024E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018396, "uuid": "ba7f9218-0ae9-4ade-8d50-add3834c1896", "value": "1536:qztcPRFA6olzsswoBO4ko9lOU8uzNZWMbobAgwbFa10q:qC8nwoBO4QmzNZW8gU85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018396, "uuid": "1dce1cc3-af36-48e0-967d-5c9f07998645", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018396, "uuid": "277eec10-666a-4ac4-b48a-04269d60b8ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018396, "uuid": "9a3bddd1-f530-4080-9935-467318f76d60", "value": "50663cb43608019c91f46cc107b3f522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a195ef30-d969-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625033327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033327, "uuid": "0b211e3a-c955-4b6c-ba44-0af3ae800815", "comment": "Malware payload (AgentTesla)", "value": "ce6c353230e01809d304eba4da1db05e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033327, "uuid": "1c192608-8710-4161-ad79-342aa65e41c8", "comment": "Malware payload (AgentTesla)", "value": "a20eda554815945a7f49a4ce60984943fd439bafc415068296c19d236dee0c69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033327, "uuid": "89492911-5f47-4572-b6ff-d6720f318225", "comment": "Malware payload (AgentTesla)", "value": "a7bfc4e1748f520741473f3e831fa54e25ddfa86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033327, "uuid": "485d4c8b-0530-4d44-a40d-2e04f7517f2b", "comment": "Malware payload (AgentTesla)", "value": "cf62754f473b9d08dfaa9ac13cf1f78600a8503f4b35d0c2a2797313531d9f20c08a5698e15e0181944277ffd7d0ef93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033327, "uuid": "6e86882f-ba7e-4465-b40d-0df3fcbe6002", "value": "CF1523CE38D7514BC8512869C8B7ABEEE835F7E5AB4379BAC1703085249CDEE8791314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033327, "uuid": "68dc9831-04c4-4af5-93eb-26c6a9382289", "value": "24576:9jmxUYR6lkVU7kqqlOeC3E+cpWrwe6+cYRLy6BQkhMwar:9yxUYR6leU7kqqlmtF6UZyQJhMwar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033327, "uuid": "495a7941-7aa8-4f86-b296-da145f1a160e", "value": 892682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033327, "uuid": "189cd511-b58b-465f-9d9f-4b92f176c984", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033327, "uuid": "e6b73777-85e6-447b-be05-659ac754c7bc", "value": "DOCUMENT ADVICE.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c36f24-d964-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625031055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625031055, "uuid": "84217b11-99f7-48e1-a7d2-a750d4d7474c", "comment": "Malware payload (SnakeKeylogger)", "value": "b778dd49c432f8e7904f9cc9b59f8668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625031055, "uuid": "a95ab2c4-a219-4ff4-a22c-633bd12d75a5", "comment": "Malware payload (SnakeKeylogger)", "value": "a3d13d3ae0ea1df687a6bd7a84db21340a3c23df83c1c55da4aae1d61d65f6b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625031055, "uuid": "bb1d9b2a-cd1f-47ae-8015-e7497cfe445e", "comment": "Malware payload (SnakeKeylogger)", "value": "05dfce33d15ca287385f8bc5cd829c08899b3097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625031055, "uuid": "cf1232d6-e567-40bd-9b13-b1a0cc45cf30", "comment": "Malware payload (SnakeKeylogger)", "value": "4c9d0c9257607b5a3dd8fff0a9f889a279b0cce8a540fa25b9680fbf92b9f1e9a814a14a4587c8096add40a369c979a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625031055, "uuid": "c194e87c-2a2e-47a7-bf4a-c855723dac02", "value": "8B55181069949419DC7B7F3E79ADD81452B9BD1F7F32D81C3B753F9A1B3328288A024A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625031055, "uuid": "3901e064-4120-4b5e-9849-c7442488ed5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625031055, "uuid": "e4c76466-2b25-4cf4-9eb5-7ef50e145424", "value": "12288:+sdWBbX5TyS4y2pt+4y2pt6HmlldCnUSF+3YRt/OPJaexSrjDy9M3MfnY+3wpt:/WMyoyLHkmnUi+o+PEeArjeG8vB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625031055, "uuid": "c5d509ac-71a9-4f50-9c94-bb43cd77e317", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625031055, "uuid": "4d48fed6-539f-48fe-a131-84c3b27c989a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625031055, "uuid": "a3a5f2bd-5c39-4c03-b16a-441b57df86d3", "value": "commercial J-80-PM-MRQ-4025-6901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b379d3-d936-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625011300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011300, "uuid": "ef0b875b-d3e0-4c04-9f58-b3ed607fbd68", "comment": "Malware payload", "value": "608f1484f89e433754d5960206148b62", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011300, "uuid": "9202e9f8-c0ab-41a0-b10b-434f7e14f9d4", "comment": "Malware payload", "value": "a4ef99cf43e2c63260847516cee19ce0b1fb034face7336f8d7ace23386a5f8b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011300, "uuid": "d66e8176-c50c-4271-892d-a82fd6953434", "comment": "Malware payload", "value": "295f37e6a886b01d79f881bc233b2c21ebf4aca7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625011300, "uuid": "e57680d7-5046-49d2-b301-a076ec2b6fa2", "comment": "Malware payload", "value": "5f42bd2f074ca1ca1f43f178f1a3fe7fe75858fa2ccea38d64f122b8c416a5a730cc12ae1baeed58ad64ef7d31e12a52", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011300, "uuid": "b6cef4b2-e083-49ed-abfa-577998353038", "value": "A7D31322D3130C4FC02578FA7A2BE62939873E6A24CE449C45F5D66A2FB7084ED71753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011300, "uuid": "c51cbbaa-0690-408c-945f-c2878dc2c11d", "value": "3072:giMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:2YFJvwe1gKCYVl2szN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625011300, "uuid": "b5fd0f02-ceb9-46de-a6c3-58e91d539625", "value": 137480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625011300, "uuid": "92ff7fac-9ec5-4431-82c7-06a351bff88a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625011300, "uuid": "1db72f02-2805-4a84-9f88-7a8182428752", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2df2a9-d99e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625055893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625055893, "uuid": "758e69b5-d955-473c-ab02-35a71a7786ad", "comment": "Malware payload (Formbook)", "value": "78a80774c30ca4d0808fa1d32ab3633e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625055893, "uuid": "680b4a8d-8d3b-419a-b4c8-55930acf4c01", "comment": "Malware payload (Formbook)", "value": "a65e94056f4196ac076a6cbd588bd094edb4f7dc9d9f5e1691817a4abc70be4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625055893, "uuid": "f58dde65-f26f-43e7-be2f-6c7faef36ce9", "comment": "Malware payload (Formbook)", "value": "175a9e22d556eac65eb42cae14328d5ed9fd4943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625055893, "uuid": "94764e6a-b248-4fda-99f4-4e39d681c262", "comment": "Malware payload (Formbook)", "value": "f855318b1330588362c8f68e650dc318ff7ed7afc8ce70bf3b498ced8db5db4b5537b7dfc552b7ea00c83a07872fe99d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625055893, "uuid": "496de5e4-b209-492b-a91d-46c67f6344b0", "value": "DA24F192DB9085D7DA651770857B2E3B16ABAE3491B2620F5B8CB7363B370D3602F103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625055893, "uuid": "88b8cf60-8fb2-4dc9-af1e-ac2b06a8f83b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625055893, "uuid": "34f3fc6c-b3db-4180-bbe4-0cc16ad8aeb1", "value": "3072:rBkfJpRXATwMdFCcG2Gonbaghb+IatL3XCSEA5rNyZmDsPOhSAqpu+9cJxVCbKL/:rqjIs29aI+IadH1E4yZIhSLxcyc/zBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625055893, "uuid": "c0c68404-5989-4088-83e4-f42bdaa386d9", "value": 211135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625055893, "uuid": "61aa6848-83a9-4008-b4d7-11d1d06f6085", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625055893, "uuid": "13073b05-2efe-4751-ad0c-e3417bf85ee6", "value": "owen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93b4166-d94b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020508, "uuid": "b985d5db-5a76-4304-9560-33701ddd3010", "comment": "Malware payload (Mirai)", "value": "f26f42db6a4ff49795318a8fa890f956", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020508, "uuid": "37dc5271-cb8a-49f5-a0eb-ffe2cf613fd8", "comment": "Malware payload (Mirai)", "value": "a68610f4a175b6dc085a3b764ed53f1cae7dae671578f958a35284d638473cdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020508, "uuid": "a4a22cbb-e6dc-4249-873c-400bca5b723b", "comment": "Malware payload (Mirai)", "value": "1bc904f573080f1d390befb8f191390c63947ac0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020508, "uuid": "f75e83e7-56c5-47a3-b1fe-a5c66a7aaefe", "comment": "Malware payload (Mirai)", "value": "aee09d39c5e7100ab491a855f687617a8ae5d5c82c4ac425493606f6b05a2460b7e018328a027ada6ca358966d4f0879", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020508, "uuid": "3ca4d0e2-c43f-4bf2-bd39-cc9fae6675d9", "value": "73E33B86EA408A13C1D5277BFAAF014A3322DB55E3DB73068D185FB43FC6A5E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020508, "uuid": "a56e5cfa-a0f9-4249-b141-5e452ea7ad62", "value": "3072:t1a5fdUEjnBGrYkRaaWgV9mrsplDKZUmQBKXAVanlX+F8JyvG4hLnAVIl+3jJNxU:tc5f2EjnBGrYkRaaLV9mrsplDKZUmQBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020508, "uuid": "d72e3453-020d-49b4-9cb6-91d4165e78f3", "value": 152486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020508, "uuid": "5549959f-edcf-45e6-8ef1-77c6a4fb778d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020508, "uuid": "3b1d51f3-43c9-4cfa-a9c3-03bd9918559e", "value": "f26f42db6a4ff49795318a8fa890f956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549c320d-d98e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625049089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625049089, "uuid": "c992e9e3-885d-4c71-a662-13c078eff880", "comment": "Malware payload (Loki)", "value": "fd271c778444d913fd95d6b25b64843c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625049089, "uuid": "645f8eed-2fa8-4ab5-b879-ec7ff212718e", "comment": "Malware payload (Loki)", "value": "a77c2b72a82237d5019b2ba51d96d4a0efee3d6a45fea184b6a5451804f916eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625049089, "uuid": "d4b924d8-6ddc-48b7-a187-8ce4a012f675", "comment": "Malware payload (Loki)", "value": "d98453daa6f2e5e65180e0dbfe0dc068de2a4dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625049089, "uuid": "d5d9f280-2d47-4bb8-8b50-165478602657", "comment": "Malware payload (Loki)", "value": "8e62b46a95082ca15a28225270bcb3c3b5101c4efeb6bff54cd4bb3c35ee8206d2e9bc908dde4c9eb057defa9f3d4575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625049089, "uuid": "4f64ebd9-8a3c-4d71-9617-f9deff2428c7", "value": "B0D46D311BE95636E0B69FBDD5A1108197FDFA236F03D85C68B911C50722E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625049089, "uuid": "ec1269f6-94ce-427b-8c06-3fde2d0e0ed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625049089, "uuid": "239bc991-b0a9-4ce4-a4c3-8453c00235ec", "value": "12288:8U/iuAwRBbX5TyxJYcDGkhhMwkU3DjAS1fWzypmv+Z40TVJuY:8U/iuAQa3h+wPxqvGDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625049089, "uuid": "16071637-34b7-4e3d-9828-3428a5b26deb", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625049089, "uuid": "79cb9eac-db1f-4624-9b6a-a1383d568af1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625049089, "uuid": "86419b49-c760-4e94-9a5b-0c372bf17cb9", "value": "Order List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2d6552-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083302, "uuid": "da9a9d67-a717-4fdc-bce0-4256b690252e", "comment": "Malware payload", "value": "89a78fbe45355cd4c6d1c40a7e06961a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083302, "uuid": "abf96964-693c-429a-b20a-f7c46092deb6", "comment": "Malware payload", "value": "a7bf09f0e448c42699df1c4b3dce050a4a55f242e9168d0ecebadde2a9765d2d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083302, "uuid": "6cfe6be4-4e50-442d-9576-487e5a7e9c11", "comment": "Malware payload", "value": "f395d69c35912e62967c75bbc6c0057e53382ce9", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083302, "uuid": "7687f776-8dbc-445a-a220-703ec1e7ff44", "comment": "Malware payload", "value": "a046e14cbd6853d8ef892f2fc6c9261dd8261ffd9fed9147cc9f9012772b695a105baaf25fee4cea2b507a0cc25ed231", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083302, "uuid": "3c647c51-4e6d-41ab-b2a7-5e7dafe9a5a8", "value": "DB241245E12BE851EF8F50B7BAF92EF113654423059C1533A631385CE8A7C6F92287FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083302, "uuid": "05a5cfe5-831d-43d2-8c58-3a421c18539a", "value": "6144:fhupA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56JO:Iu9l2pgxjt6XUyNW+Md56I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083302, "uuid": "aa39aec9-74a5-45dd-86ff-ca35bf34bbff", "value": 217861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083302, "uuid": "13eb7115-4a6a-415c-8a38-d801932d668a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083302, "uuid": "57d4d4fe-dad9-4ba9-9d3c-f4ce2942b474", "value": "Order 46975986.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22217c6-d93a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625013141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013141, "uuid": "3457c67f-9bb2-4ce6-a5d9-9b45a2aee150", "comment": "Malware payload (Loki)", "value": "2fee016b070916bbd637fd8870dfb207", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013141, "uuid": "7109cad3-a199-4ed0-bdc9-02f68d2ae5d1", "comment": "Malware payload (Loki)", "value": "a7e57b8f2f9ec702cf8f65d2a6f285d88c168afd9420627160e6d15c9f999815", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013141, "uuid": "0183862d-0d46-4bcd-9942-45e75a109424", "comment": "Malware payload (Loki)", "value": "d08b94c95f24d3e865b2df8503f8a085b27c1a91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013141, "uuid": "4f54421c-adcb-4f15-a270-49176c583f8b", "comment": "Malware payload (Loki)", "value": "048d39f99fad6ca85831eeeea8312ffc64dcf22a9debe270baecf7828cece02f256ce2439a9f837dab5b9629eed6a89d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013141, "uuid": "275f5753-305b-4590-a4fc-c54f876871af", "value": "4D748D00AB91C035FAF616F8497A93ADA53DBAB15B2450CB63D52EEE57342E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013141, "uuid": "651d6d9b-17c7-47b2-bd5f-3642fdff6b30", "value": "125e3e7cc1558104c6c521746bd08b89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013141, "uuid": "4d4d050c-d449-4d1d-876f-689c512e6285", "value": "6144:uwg3MOWxXGO1JFUCBN77gHS//RCG7V7SognnBvo+19srVFeX:uHsWOjFUCHge/RCsZAnBzvwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013141, "uuid": "5aadc622-83d0-4d9f-9ec9-55e797398bda", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013141, "uuid": "561e94c8-4e16-4470-a4ec-b9822b39110b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013141, "uuid": "bef0cd31-6855-4f7a-832c-e58d7015b7c8", "value": "2fee016b070916bbd637fd8870dfb207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e50dfa6-d9c0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625070687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625070687, "uuid": "f27391d9-87af-4077-83ed-3bb062ce2205", "comment": "Malware payload (Loki)", "value": "677e43a1196be7e0a774a6745fb411e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625070687, "uuid": "62c8e0d1-5e26-4a3e-bd84-5fbd996c44bc", "comment": "Malware payload (Loki)", "value": "aa08b9395415b671ca5c4d36a90bb6b6c241f18ba211f93408c10231c3b04ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625070687, "uuid": "0d83148a-99ac-4980-88f8-99016a17273d", "comment": "Malware payload (Loki)", "value": "5bfede03d66f8a0df570ebb27be6eaba586801f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625070687, "uuid": "f8ac47fd-46b0-4f79-af00-2e738945b066", "comment": "Malware payload (Loki)", "value": "670e1e89d93b31156e3c71b91564d96319ef6dbde5c5a237903f92487044818a386eca6df69d67aa18da2817baf54ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625070687, "uuid": "b314a26e-eb72-4cea-a1b3-1851f9c5af13", "value": "74F4F1BC97085F7BC67D517980550640A2F39203B9A1EF9EBC9010FBB1C7B89CB627A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625070687, "uuid": "97b2b721-f000-4a4a-a91f-410f0650a894", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625070687, "uuid": "816df5aa-665e-4099-8392-85fe44542005", "value": "12288:l3sEBMzTN2HTaG5YVnbbVsuGT7LzXkJRou9VRJ+y8rgFfdzQlhj14C6K5:ateaG5Yg5rufRJ+y8rOR0X4C7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625070687, "uuid": "790f398a-ded7-4bcf-8db7-72cd5d5dceba", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625070687, "uuid": "eb3645bc-953c-408f-af0b-2dd38cf87134", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625070687, "uuid": "faa50fcf-0e32-4c84-b511-e6431b3be993", "value": "facturas y datos bancarios.PDF____________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92b7b40-d954-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1625024454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625024454, "uuid": "2150ad7e-6b84-4652-a739-569c61c681a2", "comment": "Malware payload (QuasarRAT)", "value": "537dafd9730284b0377e1311150146a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625024454, "uuid": "753ef9d3-6f23-4286-9948-9b3098bf8a16", "comment": "Malware payload (QuasarRAT)", "value": "ac3541b6d4bf8c6378303f254ba10e0b7c628130345ee8c13e4801cee1770dc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625024454, "uuid": "2625ccb6-ba9f-4d8d-b77a-cbe5a5d4bfcf", "comment": "Malware payload (QuasarRAT)", "value": "2364eafd5bcda1ed9ceafd9a068fbacd5200b95d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625024454, "uuid": "a2b014c7-ca03-4ad7-96a1-f71da9a2a9c1", "comment": "Malware payload (QuasarRAT)", "value": "215ab2825330693527d977210f620404ecbf88318ec3a97eecf2284d9454d958849b59f3320802e77f7155987012913f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625024454, "uuid": "c3a2deac-1533-4b7e-a792-08f4b218d97c", "value": "2DB47C4063F8862BE17F5779E9710420A7F4F42BB267EB9F5540A2F92E667028E40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625024454, "uuid": "0dcfc781-c571-43e3-979d-ba0ca619961d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625024454, "uuid": "e60ef363-9062-404d-bc3c-77d839db81a8", "value": "6144:lTEgdc0YNX7IxUpGREW9R7I7CfWOkXis/1jcEoAb8F9J+KcTR3m:lTEgdfYWxUE8C1HKlYjjlcdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625024454, "uuid": "4d3d5b6c-6709-430f-9a8e-9ec1a57b2060", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625024454, "uuid": "49510042-cf74-4d3d-b1a4-c3e8e841ea55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625024454, "uuid": "f018fe85-6e6e-4e0d-8e45-b40d0bfdd39d", "value": "537dafd9730284b0377e1311150146a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cc7e2d-d971-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625036803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625036803, "uuid": "f0c1a497-b0ad-479c-8767-39d50ffa9154", "comment": "Malware payload (NanoCore)", "value": "27760cf0a3f50d3cd3d7d9f5d8d2368e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625036803, "uuid": "dc36b24d-59f1-4f03-83f7-69cd50bc0b28", "comment": "Malware payload (NanoCore)", "value": "ac7b7520306b78fbf374f615b281f7a1aea04506c47d44a5f318c85ad6957a88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625036803, "uuid": "f8beb1bf-4d1f-42de-afbe-f24eab13ddb8", "comment": "Malware payload (NanoCore)", "value": "113db05e30e39a82975d1108e946a3b54b75ea53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625036803, "uuid": "ea9b2dea-965e-4d5e-9b42-54433bdf5d06", "comment": "Malware payload (NanoCore)", "value": "84a168b2428c002486b345e1c1f5e8549405777fd3c4703aaba1e8ce131bacd0498b850e540271adec8f8b7684b24432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625036803, "uuid": "c4e1a85a-8f14-40b8-b7c1-936b4addbe02", "value": "8CB412A0AAEC2DD6F5E112F388F3A4213172C559E163DC6D6CEA649462273C33576E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625036803, "uuid": "5bc16a62-aba8-477b-b410-47317c2deea8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625036803, "uuid": "5fbcc6a8-e234-43fb-bebc-a221b57ac4df", "value": "12288:qFSEFVzMF14dTUqbTMUV2Sc49l5r+HGZrYOT/cRc2NdxwKO2mCMFx7:kaE/geBOQc4/uxPO2mCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625036803, "uuid": "d5154569-fe8f-4a15-afa6-60b70ec16317", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625036803, "uuid": "e124e01b-149c-4449-8f6f-5c55814b05eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625036803, "uuid": "7cf937c5-f37e-4864-b6d9-621f5ed167db", "value": "Img 06 30 2021 4677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920bdeb3-d9d0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625077539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077539, "uuid": "0da577fb-3448-4b58-b04f-de39fc9a8179", "comment": "Malware payload (RedLineStealer)", "value": "5c08df86e5cf82016ac4decd4d4f75e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077539, "uuid": "e0c5e658-8dcb-450c-ab1d-3adba61a6e09", "comment": "Malware payload (RedLineStealer)", "value": "ad221269b2193f8f53cc81076093f2f633fcb4744262df1b955b3a24653d483a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077539, "uuid": "ef98c749-6cae-4c6b-9131-17cb3a1c4139", "comment": "Malware payload (RedLineStealer)", "value": "f0f47bdd96ceb4dc6c0170ac47e043169942c3c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625077539, "uuid": "0d6bc003-a641-4a9d-a372-e2252322841d", "comment": "Malware payload (RedLineStealer)", "value": "6bbb0cf1e6399e6a4e9b985d129aaa5aa504e94f5f4c3edad6f92ef318aa531d6246caf49217fc1728520960cf3fe9e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077539, "uuid": "91ae5fad-ffdf-48c3-91a8-02360d1a1fda", "value": "2D85540172A5E165E5AA2A709FB5F6FC0621FD71DCB5821BBCC03F4F7A32650E820766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077539, "uuid": "d79dde48-9453-4201-9f4b-4e562942ccdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077539, "uuid": "ef0bf54d-af92-4311-9b77-8d3b96e0003d", "value": "6144:I7AW1jeYzrgQiaVtsyrJahNS910COyh6PyhtMEshkH0/rV0WV0TtjRWswtv1iOv9:4rgQrtQwaIaewswt9iO3TZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625077539, "uuid": "9a27c716-3f78-4ba7-947d-64031ebd169d", "value": 1823936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625077539, "uuid": "8be2caaf-2ec4-4b90-bd1d-0cc4a524a507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625077539, "uuid": "657a2f7a-93a6-4e66-8a2e-1a69c523f3b6", "value": "5c08df86e5cf82016ac4decd4d4f75e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf096ee-d9f5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625093395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093395, "uuid": "1c822914-09d2-48b6-a808-6504041809c9", "comment": "Malware payload", "value": "7f88817c4db6b9b29eb80c8f35fe29c5", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Royal Road", "colour": "#B5A97F", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093395, "uuid": "0948dba8-ce4a-4731-8c09-b5fc121f2a4d", "comment": "Malware payload", "value": "ade5415fffa0bdc8141453a9e343ebc7c022fdf99d85ae1f9c4c89ccbda00d46", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Royal Road", "colour": "#B5A97F", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093395, "uuid": "5da1b280-6577-44d4-a126-f0781c6bbc46", "comment": "Malware payload", "value": "f57c4744dd93d21ef255a3cd8582d7bdb39012e0", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Royal Road", "colour": "#B5A97F", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093395, "uuid": "c6ea9bd8-0b44-4959-98ec-16208af3d0f0", "comment": "Malware payload", "value": "05683cff5834bc3c5e8aab3a2da746b99a40f66fbe6f273d7f7006bf7e14dc422605f8a0656df55da1a2a6564cdb22aa", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Royal Road", "colour": "#B5A97F", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093395, "uuid": "e0598efa-9a39-4a9d-a53f-f3a89f0a080d", "value": "9945AEC9D53E44C6DC053FC999163AC74B2846768AF4001836AFBD8B4F7B5FA805BDA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093395, "uuid": "ac0d667f-b015-4f5d-a429-616f410ba32e", "value": "24576:BNjgunnVylOlgsgwqark8Kw/TyYhzAO9Vbk:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625093395, "uuid": "2e0b1470-b1b0-4138-8a82-40fde5aa4ea8", "value": 1187797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625093395, "uuid": "3267581f-89dc-40c7-97e5-4f99eddc1734", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093395, "uuid": "b46093f2-bb9a-4668-b7ff-71f1e64cb1db", "value": "ade5415fffa0bdc8141453a9e343ebc7c022fdf99d85ae1f9c4c89ccbda00d46.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbedda4-d93a-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013130, "uuid": "9123f26e-6361-4fc9-b3fe-23b7cdf36a16", "comment": "Malware payload (Gafgyt)", "value": "ff95ff57514452ca72c026c5c29ae139", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013130, "uuid": "da3c4f8b-fc53-4fb4-a95d-e86b0310a214", "comment": "Malware payload (Gafgyt)", "value": "ae880c7dd79ebb1d626aea57152fdaa779d07d5b326d7f7fad1d42b637e5da84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013130, "uuid": "3d80109a-0976-48c5-8531-6e67bfa8c70a", "comment": "Malware payload (Gafgyt)", "value": "bc7f89e97b313c058c65b83f63c6e5baba9ab66b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013130, "uuid": "cd3934fa-1d20-4531-8d00-1d69496da4b0", "comment": "Malware payload (Gafgyt)", "value": "40b79c41a40661ae99e1b1eae00b577a8321b735643085764ed26fc3a0245d27b278272eba16eb4716414293bb3b5bb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013130, "uuid": "b5d4a3e0-1f45-489d-85ad-b7dc13c8e080", "value": "34C34BD9E343C2F3C44306B3025FE66B4A22B67B4A2E9E56F7583DB49B128D57124F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013130, "uuid": "95d05743-abb8-473a-b2e1-dbd089728bee", "value": "3072:UDDUhgdRTFbKyxHYc5tzUFUCiY5hbWBQS/Yt1XnI0/zJfNQQ2u:UDHFbK+i+CiY5hbWBQDXnI0/zJfNQQ2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013130, "uuid": "fa45c6b3-4887-4615-8554-30bdd5ef2def", "value": 124531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013130, "uuid": "f3228d49-f94d-4e86-9a38-b11a77f84036", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013130, "uuid": "937bf8a5-b9df-4b42-a99d-819de483fc85", "value": "ff95ff57514452ca72c026c5c29ae139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46244587-d9df-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625083854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083854, "uuid": "82e80948-1466-4a50-9d89-e9e9439d5e90", "comment": "Malware payload (RedLineStealer)", "value": "1e8a8ee8289275f97487bb8e542fc82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083854, "uuid": "9bd1f9ad-4852-4d69-98f4-194064aa9455", "comment": "Malware payload (RedLineStealer)", "value": "aec52cfc257db5fc8401733d52f0b4eb0b8c1d814395b433859f64d08ec67d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083854, "uuid": "df7f1b23-24b8-4f88-bfbe-0a43a3ef59ba", "comment": "Malware payload (RedLineStealer)", "value": "a0bef3b42d878a39ffc9c97aa379bef23aa77d47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083854, "uuid": "294b6243-5d51-4261-bb52-dcdacd0790b5", "comment": "Malware payload (RedLineStealer)", "value": "8f98b12028a8471819746b24cf363122aab17f019b9aa7d02d717938e2c60ed6d4bbc8c85e8196dfc70ea6d7e7b3c76d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083854, "uuid": "cf61c365-d7d4-4374-affe-fd09e524c743", "value": "A0363385BEC1C4B3D9110630D51DBBF6A1FDCAA807314E937B50C51A8B68A6E932F8F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083854, "uuid": "06a8f750-c387-4579-a37f-32397d74850f", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083854, "uuid": "2d875736-adef-4a23-aa8e-b0e28f463df3", "value": "98304:xU18Q6nltLkuLgwZ10A9AYS2PLbiL9OVD+3FeuJCvLUBsKLNFpaAP:xE8Q8B0wZ10AQ2PviL9OBuepLUCKJXa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083854, "uuid": "cad95c3c-d29e-46c7-ad23-ba976b01e2c1", "value": 5165093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083854, "uuid": "e78da677-d14b-4976-a4a0-c70c3c4c7fae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083854, "uuid": "dc13a98e-9743-4149-8d44-0d95b1b7cfba", "value": "1E8A8EE8289275F97487BB8E542FC82B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d472f10e-d96c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625034700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034700, "uuid": "b9a38acb-94d4-4b67-9ad4-17329b6ad6cc", "comment": "Malware payload (RedLineStealer)", "value": "a7b68168e4b031470b23d2a208d150cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034700, "uuid": "a86c36e5-8e45-4da1-9d3c-b32f8ad7c74b", "comment": "Malware payload (RedLineStealer)", "value": "afc4c164f8d477697b19123327debb9648c612bf98f5c62cc89518f598c13da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034700, "uuid": "74f19c93-b453-4ee6-8dfd-becbf24de98a", "comment": "Malware payload (RedLineStealer)", "value": "7aa224d55b305d7f41c34cf0a9111284add730b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034700, "uuid": "8acc553d-d33e-43f3-924d-fdf4155d83e0", "comment": "Malware payload (RedLineStealer)", "value": "6cf31a6e55a3273bb598749490247aea74a9737ce9b47f88bbbd4fae89ab51338476cb9b29f9345a87f62ebc2b2f579d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034700, "uuid": "87a55bc0-e0f4-45b6-ac25-83f3f674eb70", "value": "C9641ABBF16513B3CC786D3743952E1425296EBFEB0278A7714639E1139F64A24832CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034700, "uuid": "c46130e8-3516-4622-bd67-aba882d422ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034700, "uuid": "cc166d65-1b15-47cd-a9da-bd5df56a8530", "value": "6144:6AArsfoynfY6Hbjv9VHZXTBnWBbYc6x9VgIsvSR4NEMPEfkp/t3lOb9:FArsfoynfY6Hbjv9VHZXTBnWBbYcsHgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625034700, "uuid": "6b3ff2a9-f3c9-4ef4-9bd0-ba49a2d1f211", "value": 328928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625034700, "uuid": "ebcf3090-ac16-4922-be22-213de169c8cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034700, "uuid": "86d8906e-37a2-472a-9e7c-38722cae2f0a", "value": "a7b68168e4b031470b23d2a208d150cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df689778-d9a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625060059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060059, "uuid": "c95e3aa4-9a76-401e-a270-9afa727cecf7", "comment": "Malware payload (Formbook)", "value": "2675e48f27d812a02d660ef4e0b6d1bc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060059, "uuid": "0183aeb9-37f1-4a93-82ff-813c1093d1d8", "comment": "Malware payload (Formbook)", "value": "afe2f14aefa056096d2c66789e0d7f304d64f7d4599cacc2f1c6170b3cbd70ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060059, "uuid": "e8002f11-f3f1-4b2d-aeb0-2e8662bd4ec9", "comment": "Malware payload (Formbook)", "value": "5d07cc4892b93fd7757ee4fe18a41f73d38cdbdb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625060059, "uuid": "2ceba5e9-e38f-47ba-baac-07013ec7c775", "comment": "Malware payload (Formbook)", "value": "aa4d6a53efdcf50dd9f93a70400468616209575d452072e742e8e211c3f68afd98c3f9b108fb5edf9cb97e81daca6221", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060059, "uuid": "71306e65-a7fe-478e-a964-7640f21380e1", "value": "04F10F37D62191689B4C39E1783675C914F4DBBAFD386220F27E4CC3212C9C865DD7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060059, "uuid": "8d8356a8-7e67-4f53-af3d-4e22a02dca2b", "value": "192:NijLjQrAeyvwL3FmqPnIVvSI3Br1yl9q2Jh9tp3F5lo8I9:knqGYL3AqvItHBrMo2Jh9tpV5lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625060059, "uuid": "701574de-66de-499a-baa3-d20fd67c6b43", "value": 7923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625060059, "uuid": "e024fe86-a6ef-4d86-8b4a-70eb6f49d28e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625060059, "uuid": "b93f46fe-7093-4c8a-85af-6108aa76fe2d", "value": "newbad.rtf_Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae23b77-d9ec-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625089553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625089553, "uuid": "499859bc-67e6-4850-86d0-5c3d3041006a", "comment": "Malware payload (NanoCore)", "value": "1efbcd27b8ad5e4b0f1220af11c9b24a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625089553, "uuid": "251686d9-d0f9-492c-816c-ead74ef89130", "comment": "Malware payload (NanoCore)", "value": "afe7d487324952929f8f037bdfbd7249049086fc8c4a90a2acdaaffd6d342823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625089553, "uuid": "22e524ab-dd68-42f6-bf69-73b2141f75a4", "comment": "Malware payload (NanoCore)", "value": "0e17e9e685e421b29f3cdd28876a3e9b8ae41d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625089553, "uuid": "f338710e-51cf-4d87-a54c-1bc78dd93e23", "comment": "Malware payload (NanoCore)", "value": "9109cadc2efdbed7b5aca6ed5baffe2d65cc26a90c95898504f778bdc2afc04e8d2633e51c56a422d5a797525977209b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625089553, "uuid": "7a9dfe2b-5361-4a49-84f2-871c73f100b2", "value": "0F4501EAA7CA8823E867663455B70B537F22FC929B74410B2721F89C1D72391FD34726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625089553, "uuid": "457575cf-0fdb-469c-b302-e230ce6bcf97", "value": "3e5b9923ab1e9eb27fe6580af9265696", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625089553, "uuid": "554c0f1c-bb98-4de1-a9bd-b8c638c29715", "value": "24576:xDdOxLFDApSPKk48zvvpUIQ0Gl9wzB2b21A9ZLh6+8:xDiLFssPH48pfqSN2bEMLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625089553, "uuid": "5f1087d6-f50c-4d9e-82b7-51677040d152", "value": 1211392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625089553, "uuid": "e99ab7ec-8f8e-4512-9457-0d9373773b5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625089553, "uuid": "44858341-70a0-419c-8f18-cacc5c94f1f2", "value": "AFE7D487324952929F8F037BDFBD7249049086FC8C4A9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff01537-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083280, "uuid": "cb459dd3-d92e-48a9-b684-45ca6520a832", "comment": "Malware payload", "value": "d951878c00cb4be4c74ff26e7db914cb", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083280, "uuid": "6da837e7-38af-4a3b-9a1a-2afb270785be", "comment": "Malware payload", "value": "b01cfa9099873cb5bf6ac235143431659b97c20111ca8fa0055bdaba9f52575d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083280, "uuid": "51a1d714-1a2a-4aab-b294-f53c4bcceffe", "comment": "Malware payload", "value": "b5bdd354ff31843c65375e008a1930429f57dee2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083280, "uuid": "9bacd3c8-cc66-43df-91f0-472401ab96a8", "comment": "Malware payload", "value": "ad085bb66e3415a5477e9084d60e50d61b9e3d376de9a829d96012f417cd986b94b9298719825375f77f0edc9a1b9090", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083280, "uuid": "ea7e680a-63d2-429d-a0f3-ee700008380a", "value": "8D241245E127E861EF9F5077BEFD2EF513654423091815339732242CD8ABC6EE2287AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083280, "uuid": "c4c6d369-74c9-417b-b7da-1a9600d05c35", "value": "6144:ffkpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56n/:0u9l2pgxjt6XUyNW+Md56/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083280, "uuid": "eb20c446-f75b-47d5-ac42-0f4055407fcd", "value": 218064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083280, "uuid": "982c0c3d-f2b1-4665-87e3-d9e07eb265af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083280, "uuid": "4f30b689-da47-453c-a93a-1365356cf336", "value": "Order 1744163.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3c3403-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625018389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018389, "uuid": "44d593d9-6847-4e4c-a426-1997ca7020d7", "comment": "Malware payload (Gafgyt)", "value": "fab8c7b0df5b2782bd02611d7c9b8f33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018389, "uuid": "1aef056d-2371-44a3-953c-cee850ba64e7", "comment": "Malware payload (Gafgyt)", "value": "b0d36c18bf900988d01828202ce1ab77949b9a8a29b264ea1639f170a6c9825b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018389, "uuid": "30e14e44-1574-4e33-a1e9-87f4bdac40b3", "comment": "Malware payload (Gafgyt)", "value": "fc442835de59f9ba2d43cc15b8bd7c9692cce311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018389, "uuid": "cc8b1b32-1a81-4f52-aaba-73ca36fe5fc5", "comment": "Malware payload (Gafgyt)", "value": "c2a3b0477b8d0a715a2d8c021517fdf83b2fe51b576230cc3814d4fbd1709aa588979110a6e989152e76682d396a9020", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018389, "uuid": "a55a7b82-0796-4ab5-bb07-a398c026121a", "value": "0983F784FD559B1FC3E372FAE759028D763A1FA8A7EB30259934BE9023F5BD02525120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018389, "uuid": "fe573c05-e98e-4378-a2a7-549ac018231a", "value": "1536:sC2ruOIXs+NGmd4fIVDJZPJmoSRBv8+B52u5OOF4nb:5Ot+NGm8oDJOocvh2lnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018389, "uuid": "34ed2259-1f5e-49b3-bac5-b7c92776cab2", "value": 86616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018389, "uuid": "c9591d66-f52c-4224-a48f-2c0b6d2f6bad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018389, "uuid": "01231068-168f-44ac-815d-824f9a532bd5", "value": "fab8c7b0df5b2782bd02611d7c9b8f33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452c8c83-d960-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625029306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625029306, "uuid": "7d90d3f5-1914-48fb-9c50-b5f600461b3a", "comment": "Malware payload (Loki)", "value": "1b283172b29683ae11f0d6924a5c1351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625029306, "uuid": "4fc5148a-c9ae-4d43-8ed0-5682d31cb26b", "comment": "Malware payload (Loki)", "value": "b0ea4256ed6da35b96a40d763e8281f46ff79c78a0c92aca14c69eaf13a3d244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625029306, "uuid": "ab26bc09-6f9f-497d-9c66-3e5175c919d0", "comment": "Malware payload (Loki)", "value": "cb589689ede41e8142e1e2b856f4076063095a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625029306, "uuid": "45126677-2c69-48c2-a346-684ba261d426", "comment": "Malware payload (Loki)", "value": "1a3d3ef349448213a1fe15baef635ad2cf88ff58c87776f0713bdaa45ed9828fa82524fb89b61a7a97c9157575c81e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625029306, "uuid": "dbef2126-0b95-4835-a705-ec2285d63132", "value": "B8458C10B994D529E0BA5F3D4AA5941452BEBD637F23DC6C3DB933EA0733293C8A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625029306, "uuid": "a9356517-f43c-4168-8bc7-5258c6e764fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625029306, "uuid": "1beb4ff6-0400-41f6-8433-e33de9e3593b", "value": "12288:mrAdzdBbX5TyVu4y2pt+4y2ptTYflu1peK64qWeDhsONu+M4y2pt:9zdYyoyFw18KzPkly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625029306, "uuid": "ebc3aecc-34e4-4c3a-ac1b-ac3f87d06ca1", "value": 1247232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625029306, "uuid": "867b7f1f-e461-4bca-b44e-c1462b1421f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625029306, "uuid": "29e89f17-2307-4b7a-a445-9788248115ed", "value": "PLQ8rKTmMupwqmw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bba76b8-d98e-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1625048967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048967, "uuid": "46cd5735-5859-487c-ac0e-1127eb4738da", "comment": "Malware payload (njrat)", "value": "d07f6d4d26c2fce6d6fcaedb2c9de1c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048967, "uuid": "cd9ee230-c5d4-45ef-a18e-1af955893f90", "comment": "Malware payload (njrat)", "value": "b23fac3382a51f1910438bce97a602ced4b5509fe28f323cde76a60914d83c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048967, "uuid": "ee77ccda-cbc6-46a6-90c1-f5a991fd53a7", "comment": "Malware payload (njrat)", "value": "1bb5bb489d633cef59cb4d34d627aea811dad7fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048967, "uuid": "794cba5b-f730-4529-a445-4fde909cee0a", "comment": "Malware payload (njrat)", "value": "279ae6a5464c3e9684794c313d6d163dde9908e7eaa7d5970c943959cad876ede25636d42a3692bcbfca2a7749238cd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048967, "uuid": "f8195789-f18a-4f71-96d9-b19db2385739", "value": "B7E4380AF7B0AF9AD32B0F3AF4070984ABF5C5176336FA6B69D409D55524F4BCA0E016", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048967, "uuid": "aa80421a-ed78-452f-85ca-23aaaddfcdbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048967, "uuid": "bc1d85b5-40c7-4eb0-8039-7aa22caf692c", "value": "12288:V0+mb0ctdCoYg5ojcdrApJNAv0dSz2AwYyGg3ssnX0NAHFad9Zp:KHwgXLi25AhkNVZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625048967, "uuid": "e9a7baa0-f08c-44bd-9ac6-ce43ccc88708", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625048967, "uuid": "9f7da885-33bc-4eb4-a17e-83fe2028b5f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048967, "uuid": "d5d451e9-02e9-476d-8054-54ad8f4e6beb", "value": "Doc_CompanyPROFILE_Quote30062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc5e6a5-d99a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625054498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054498, "uuid": "5cdfb2ae-de2c-46b1-be58-28ad6c44b44b", "comment": "Malware payload", "value": "690c791d5f9a65bf7e147865285aceff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054498, "uuid": "229f52d1-ae1f-412a-9754-88e3a740ce65", "comment": "Malware payload", "value": "b30ac3d2da447cff1436cd356b5ec3c88db960b281746c4dae132e81a8306c12", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054498, "uuid": "58789cb9-ac21-49e4-ae22-bef577d223ac", "comment": "Malware payload", "value": "ef7507f97bc5f122d981ceefa6a678e1ae7e8bbc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625054498, "uuid": "734c207a-409f-43b5-842b-4f14c163fd5e", "comment": "Malware payload", "value": "f9dc1247db193a27781fd1999274e1498179ff349c4f214ceea98d8f3a1b0599e61ede6318b3370b84ee0debee05434f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054498, "uuid": "a654eaec-d923-4cd0-b597-5d31b9aa9341", "value": "526402A7D7317D9BD44385B0716E138D627893CAC34A918173488D6E39BA34717AA3CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054498, "uuid": "e23b12ab-d194-42dd-a6f3-09b5bec63a35", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPto3:2IIKXhZtL7jOTyIG87Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625054498, "uuid": "f0537d70-1296-4999-8fc3-ec6391b8592d", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625054498, "uuid": "7d04cbed-6b55-444c-a978-3461b570d6fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625054498, "uuid": "0b30dc03-6883-4a31-b56b-e7db36bc257a", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf787d8-d96e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625035252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035252, "uuid": "49f0ad2c-f8fa-468e-876b-d22cc1a0430a", "comment": "Malware payload (AgentTesla)", "value": "834f146cf5ddf4972bf12437bf1a2c0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035252, "uuid": "6f913aa1-bbf0-4f62-941d-e8797d19391e", "comment": "Malware payload (AgentTesla)", "value": "b41f7133924702f8e2562f7b180bd6df806bad3498339220631cd1effb6884d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035252, "uuid": "b406d19c-aa84-4705-a7cc-5f55ea4890d6", "comment": "Malware payload (AgentTesla)", "value": "7d953cb68bb28cdf13cd60557f191449745a6cea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035252, "uuid": "be061fd5-2162-4507-b0a4-3f65aa133875", "comment": "Malware payload (AgentTesla)", "value": "28d708ac9d632d4575f0faecdcc84883d57d8a695fc913ce09d3e81bc9faf880b4d85301236202cb37164ab16f8f119d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035252, "uuid": "5267ff41-138b-46db-b0cc-edfdfa5460fd", "value": "3091186A5B340DA7CE63C9F0D4B1FE6101C5F20826DB2694F36CF87A136B332D929545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035252, "uuid": "af5cb17f-5c46-4ca2-9f52-d2ce3948d8d0", "value": "96:J42qXxaD4SLQs+njkyqrBxpAjHRsqaFawRXg0tBp+bDPGkCGvH:348LL+nQPjyjHyPlRXg0tZkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625035252, "uuid": "a0b88a53-707f-45c6-a5b8-24d23c6f8f47", "value": 4255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625035252, "uuid": "77c26da3-d00c-4491-a774-d85069b1507f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035252, "uuid": "fa043895-9529-4d79-b2a1-dc0c9ddb4326", "value": "Document200621.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ac896e-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625032845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032845, "uuid": "2deb5607-237d-42f8-ac04-dee4c26bba39", "comment": "Malware payload (RedLineStealer)", "value": "de986a64e54328b2b206bcc6f809d133", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032845, "uuid": "02b2479a-eaf2-4907-8063-3cb21248977e", "comment": "Malware payload (RedLineStealer)", "value": "b457a2d367d9f3fbc8861c5b0bee5b90c37f821eb86ffc9742d54fa93419b6d7", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032845, "uuid": "bcc74d68-5f83-47eb-aa07-86f88484658d", "comment": "Malware payload (RedLineStealer)", "value": "bc38b0bf2ac4e29d9dc72b534d7c77286137f794", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032845, "uuid": "9c9c9803-ac85-4ac4-988f-b10e4d228cc2", "comment": "Malware payload (RedLineStealer)", "value": "a613bd5ebcc07a364f7baac5dc0f622a46495cc190ffaf34c4a5915963ac2d7ee70d8682aa851dddbaea88ce48fa26ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032845, "uuid": "42925d07-6836-4e0f-ab1a-3288d72fdb1d", "value": "FF84272864BFC01985E3EEA12DDCA8FBD99A55E3640C743701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032845, "uuid": "4c0738a2-2d96-4e8a-815b-7cbe6970f15d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032845, "uuid": "38ff8d8e-280a-4126-9a57-e0e73c642aa8", "value": "6144:zASw+KkkgKOoky5YqofbiGEK2AW84EAMS0LNJ6Tv/3XVoiw4+8Ri:zBy5Y3fbiGPjW84EAMjLNJ6Tv/3XVrwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032845, "uuid": "ccbc33da-7840-4aad-82e3-096adb4b05f2", "value": 392592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032845, "uuid": "2b689727-a1b1-4835-b197-e99c81026a70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032845, "uuid": "94dafaee-288b-4c79-8bc5-41790be31365", "value": "b457a2d367d9f3fbc8861c5b0bee5b90c37f821eb86ffc9742d54fa93419b6d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266f2349-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018947, "uuid": "25bc3195-3c54-4858-b7ff-69290abf6453", "comment": "Malware payload (Mirai)", "value": "ad535b4eefde27968636fd3b5dd08b78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018947, "uuid": "ac726cdb-6eb1-48cc-9383-375a47945a44", "comment": "Malware payload (Mirai)", "value": "b4f9f1099103672665e2ca4b7431ac004a6e86297872b21cff398a58f8754bfb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018947, "uuid": "9919e156-973f-464a-918f-460c5d8eab26", "comment": "Malware payload (Mirai)", "value": "487e0e4ca76f1fc0309e47ce3b2013da7138851c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018947, "uuid": "d9c02e20-0dea-4e59-a591-6865ad66a201", "comment": "Malware payload (Mirai)", "value": "66801fa6b3ffc61216186b37c42664dd86bda006cf38d07fcb3d33f4a6f210b3f39ffd1a8d0b5c9484d89a43164edd0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018947, "uuid": "2cda233a-868f-4ac9-a195-128008dd4d61", "value": "19A2D0B038D2DE6DD7F644B1CE25E187191E13F6E0FD3238253812B8A5C281F6776286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018947, "uuid": "480f4167-bc26-473e-bddd-ff325fa297e0", "value": "384:z93UQyFDNgB36T3d7n3peSzvV3wlnxcrE4SI3gpphymdGUop5hXg:z9AWMLd73dOlV4XQns3UozJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018947, "uuid": "349e53fa-d8c2-4b21-bba8-ba297a267bcb", "value": 22124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018947, "uuid": "8cc50a10-9bc7-4224-b450-b59f98c403af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018947, "uuid": "660468ec-b334-4e81-9160-d3513500120a", "value": "ad535b4eefde27968636fd3b5dd08b78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67938d4e-d9ac-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625062006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062006, "uuid": "17a39666-dfe0-442a-a7b9-5318539343e4", "comment": "Malware payload (Mirai)", "value": "9ba49bac2f55fada55ddac2b26007c1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062006, "uuid": "b51ca25d-a067-4d4c-b591-0a72b009ecb7", "comment": "Malware payload (Mirai)", "value": "b79dcb545357eef6056318c6d75b75092cdf81acef2a9d9f17c7d375f54f789c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062006, "uuid": "ded7f83a-1b7d-4a37-835f-82d80428c83e", "comment": "Malware payload (Mirai)", "value": "dd689ce0c93b959bd9c7629873ca7921e7052c0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062006, "uuid": "02c3b9ff-0f63-4c68-9a81-57683193294b", "comment": "Malware payload (Mirai)", "value": "4620dc16ddee55b5ee1ed124111d8efda98b02e8584f656509766bf77a61c09d12b94ed2cc3cfa8b18fd13a51e857f61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062006, "uuid": "81c4f4d1-e797-46d0-84e8-f5958e9ab9ce", "value": "BC03E1B245A6850EA95CD23045A97AD36C70C11D68A89498FFCCB43BE7CDFA2387C7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062006, "uuid": "3b5646eb-63a9-4cbb-ad2f-096c0707a4d0", "value": "768:3CnMoP2Iz7JZaYudIxWVN54AhDNGzTQpzqkLO++ynbcuyD7UHQRji:ylPlPaYAichp6QkGoynouy8HyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062006, "uuid": "beda36ff-42c8-4c8e-95fc-ab7bdc022e76", "value": 40196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062006, "uuid": "edb682a5-e250-46f4-9091-a1a65bf0d31c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062006, "uuid": "417f54a1-46d8-4535-9af0-a95d8b40e413", "value": "9ba49bac2f55fada55ddac2b26007c1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd056676-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625019226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019226, "uuid": "8716fceb-227b-4f47-9f1a-614e4dfc338c", "comment": "Malware payload (Mirai)", "value": "87e9164452fdb356f4e0c9a869afd76f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019226, "uuid": "f2307439-6058-424d-b2b0-a57e221f023a", "comment": "Malware payload (Mirai)", "value": "b7c5895189c7f4e30984e2f0db703c2120909dccaa339e59795d3e732bca9340", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019226, "uuid": "c148fda9-dd34-4ff8-b30a-1ac9441efeea", "comment": "Malware payload (Mirai)", "value": "9f8e72806ba226671c863cc95bd59e659a46092e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019226, "uuid": "bde3e2df-ed08-4ada-bd7e-fba22e4f3372", "comment": "Malware payload (Mirai)", "value": "8834b1dfafa446e36d44a1ca9e0c6dce2e115bc351afa5b081c9045cdec74a18b1b04c268133cc4854269f31e067bcd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019226, "uuid": "6396c969-743d-42ed-96f8-62867a7d9a8f", "value": "D393F54BAB190B43C4975AF03D373BF0871DBEB112EA41C4601AFEC543B69B56116FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019226, "uuid": "392b550d-4898-43ff-bf2b-88ad3c715de1", "value": "1536:r+ItpSYxenV2jCDXIoUmK5U7sZ1whTu6YTDUG:yuJxMso7sZ1wgWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625019226, "uuid": "33dd818d-d102-43aa-b967-8ab20146bd5f", "value": 90720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625019226, "uuid": "d173070a-f6d9-480a-959f-3b64c66bed2a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019226, "uuid": "8ad2b5f9-6726-4c37-86fe-9129175ded40", "value": "87e9164452fdb356f4e0c9a869afd76f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb590176-d9bb-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1625068589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625068589, "uuid": "4f0a71ce-26bb-457d-8477-1e685d3245e0", "comment": "Malware payload (Vjw0rm)", "value": "cf5a481932b2210c0a9c812dc80c9888", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625068589, "uuid": "a84e5fcf-8cfd-46f0-a03a-ba76ef2e1925", "comment": "Malware payload (Vjw0rm)", "value": "b89a1d31f289da4606040ff39c969ec3fee3e65ae0dd512857da7826e56b3065", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625068589, "uuid": "eac4e8a6-00f9-4140-91b7-16947203818c", "comment": "Malware payload (Vjw0rm)", "value": "87aa4069842d290f8fd839757e69102a4888a91b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625068589, "uuid": "8078b280-595f-45df-87da-c4ff0bddfcad", "comment": "Malware payload (Vjw0rm)", "value": "485b54fc9c4408cba9f85777b4b33fc82fedb6f634e981093e907c6fa3754e9908a3ac8ebd280db09910f092fb863f51", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625068589, "uuid": "9b388c0f-511b-438c-b044-ca4588b6f904", "value": "7012B006000EED2858C5E9DECFABCE635E5BCFA919127ECC9013D55E2C87F159533416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625068589, "uuid": "d25c0429-ee70-45fe-a9fe-da669417621b", "value": "192:QmLubsqL5ZljsbTX6otXdOEPBssAWV+FOK9KVsWtQhT2eBQgk/Cy9nL11/hzbxt/:QmLQsqLT+bTX6otXdOEP+4VkORVWT2/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625068589, "uuid": "08a1389f-83f8-426e-8d8b-d10e611f5a11", "value": 9513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625068589, "uuid": "6036e199-dcb8-4337-a8ab-b320db1c92ca", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625068589, "uuid": "b855c48c-c4c7-47f7-81fd-d54c08c6086d", "value": "1Z87F7UOPMAS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a719038-d9af-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625063165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063165, "uuid": "b38bccb5-6e72-4af3-8085-f36d3bdac2c0", "comment": "Malware payload (NanoCore)", "value": "c38329468dfb2f7c6bb9a0fa80bbe6c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063165, "uuid": "c89a381a-40bd-4906-853c-77d2e3b13508", "comment": "Malware payload (NanoCore)", "value": "b9802d93c258aff8a3c384fc4c3181ee5f070102de92553a6173a7e501c49a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063165, "uuid": "4cfe5e57-2e6a-49aa-b1fb-1ca4addf4768", "comment": "Malware payload (NanoCore)", "value": "d389f5a391a11dbb792182a7a3b23d88c704a8f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063165, "uuid": "ea5b6303-3865-43ad-836a-c81bd96c8593", "comment": "Malware payload (NanoCore)", "value": "23e4b85950e7fb1f38d11f3e42199435d697d795651a39cc271c7b53b97a35554324db77b8e0c05023808cc9ac7425ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063165, "uuid": "15f5af6d-62d4-49e2-929b-9a8f74f644e5", "value": "44657C113E6CDA14E0B69E7DA961B1409A7DBD233F6AEC28F87533DB437BB825850047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063165, "uuid": "dce0c27c-1231-403e-8d61-520fcdfa62fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063165, "uuid": "e3bd4be9-9527-42a4-bab9-a82995dba89d", "value": "12288:WP4ilnwBbX5Tyd4y2pt+4y2ptgtu83Mt/G5KeYXf3M8dsuGFHCNxxp74Bv6ZwWas:rByoyDxWXf3/dxA0ZwWUd5SWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625063165, "uuid": "3e61c2f0-866c-40cd-8043-71f1a1950efa", "value": 1486848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625063165, "uuid": "eeb51be5-37c5-4337-b816-f2f1651fe431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063165, "uuid": "277c9c1c-c786-4be7-b8ab-e75a3242ab61", "value": "AWQ~0007655678TH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff6d5f7-d963-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625030666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030666, "uuid": "612e4cb2-9786-45ff-b0d6-735ed92dda10", "comment": "Malware payload (RedLineStealer)", "value": "30753cb879ce945f58d82a1bf96eec9c", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030666, "uuid": "62ccc908-629e-4ab2-b811-16667a723df6", "comment": "Malware payload (RedLineStealer)", "value": "b9c8f1cf4978dce7dd0c123bcae9a6c090d1fa76755faa79c8ecbaa28dbe9d68", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030666, "uuid": "f02bfaf7-984e-4d8b-a529-60f7aa0f0f5b", "comment": "Malware payload (RedLineStealer)", "value": "db2f8bddd91e72b3c2ab45aa5dfc6c4606619377", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030666, "uuid": "8f7e6803-2fde-4af5-a2e7-064c1ea6d866", "comment": "Malware payload (RedLineStealer)", "value": "e6e9eb53ccef398d03cdab5ac741ab4f80af20ff2e0d5fd2c9f9a1012edb92bd0c53efde3176bc06c391dda218aa82df", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030666, "uuid": "e3c33337-d8ea-4a42-bd38-2050140804c7", "value": "5184162864BFC01985E3EEA12EDCA8FBD99A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030666, "uuid": "a73eff29-b328-4511-9af5-bed854df0b34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030666, "uuid": "725b2588-e838-42d6-aafc-47aa36e7ca7d", "value": "6144:N5YqofbJw5ZDQcr9yL8DL7M6Tv/3woLz+Ek/Rk:N5Y3fbJw5tQcr9yLWL7M6Tv/3lP+ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625030666, "uuid": "da5847f7-d397-4a57-8957-6ac96311e377", "value": 392584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625030666, "uuid": "05d2828a-2441-4dc2-8210-9d8bfd5f56e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030666, "uuid": "c156a9ea-abe7-4eba-8732-6d61346e3e6c", "value": "30753cb879ce945f58d82a1bf96eec9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af22fb7-d962-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625030255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030255, "uuid": "0d815f58-fc56-4186-ab17-762dcb5fc07d", "comment": "Malware payload (AgentTesla)", "value": "1d846591dd58eaa810b036b8103df8b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030255, "uuid": "aafebcdb-0f03-4b29-8b23-003c5fd3be5e", "comment": "Malware payload (AgentTesla)", "value": "ba52fe87bd26000b7b5815c2035b73b68def670b5d0c314181c092049aa62fba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030255, "uuid": "647c2938-6dfd-43c6-a66d-9bc5edeec143", "comment": "Malware payload (AgentTesla)", "value": "91f029e7de876f4e24c4cecad452a212d933495d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030255, "uuid": "c28f710a-dfa0-4ade-82ac-3094468a9396", "comment": "Malware payload (AgentTesla)", "value": "430c25e3aecf0f31a7f0610304ac16bd9736d45d15dbaed84c0c1feafbd46eb21b924936413c7dee9c6b5625bd4d0087", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030255, "uuid": "28535847-2a12-432f-9d99-d32c943de057", "value": "82910AB1159C4EE1DE474BE3D6A4FC614ADAF12349CF099D777DE528032F3620593A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030255, "uuid": "e249c9a4-8f93-4e20-8bd6-f2a1eed98477", "value": "96:MGKRnGWpqE5lf72miVNplvHj84BybSBfOvysE:McgqEnDKNplvhYa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625030255, "uuid": "25fed46b-785a-4f1d-8f9a-c15ee862595d", "value": 4554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625030255, "uuid": "061d98a3-86bc-408e-b8bd-29ba3be2253b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030255, "uuid": "63646faa-71a3-4a27-870e-8a14b66c34ff", "value": "RFQ - Valves Appurtenances.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a20c446-d9ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625074814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074814, "uuid": "bb534aa3-d6f6-4b94-a741-e6976013fd6d", "comment": "Malware payload (Loki)", "value": "38a303790a8133746a7c6662615ca5bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074814, "uuid": "8820e386-af5c-46cd-ac6f-e996be955bf1", "comment": "Malware payload (Loki)", "value": "bb5df503b48b02b896b19231964a2aa53e48f2f1bf4e0abadf69dc1cfe1f6427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074814, "uuid": "c1fa017b-e56b-4e61-8d59-dabb19c9d066", "comment": "Malware payload (Loki)", "value": "9c543483dd6636678cf53c127182d74723d17db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074814, "uuid": "dd3ee9b9-7913-423c-87c8-30fb2e68b640", "comment": "Malware payload (Loki)", "value": "64dfb9e38377adebaf63e539a9f7b8f0cfda0c328a00cbb257fe904d1b04b3a19a28b5e292623c5490e4f493b312f86c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074814, "uuid": "e2cd96d3-2709-437f-8ac3-e647ea922cad", "value": "84D4F23C66FF8819E67F4B7995E46080AB3B66663632E31E1408114E0F43B56CD6277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074814, "uuid": "78bd0979-7740-432a-bc52-9bcea7a5c4fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074814, "uuid": "57d45571-555c-4956-a7b0-a7b4f2a610d9", "value": "12288:dxL11saIwoWOJuXChaChPJS/WVga4X60GgK6XWXgDYvSmf0:DLnsaIEQa6Q/di0HKXXgDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074814, "uuid": "ad001482-ba85-4fc5-9dd1-a5f2af763bb3", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074814, "uuid": "c07cb381-e6cb-4813-ab20-bc3a943a2fb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074814, "uuid": "980f6cc2-4bf2-4189-8321-6d5c18f6bd6b", "value": "cotizaci\u00f3n.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d316fef1-d9b1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625064333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064333, "uuid": "99e5f54f-b947-4d37-95eb-5c24f99ec1bc", "comment": "Malware payload", "value": "2e7b51ed2cb533a2958abf2f53ee718c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064333, "uuid": "9bc5fecc-a9f7-4448-b01d-f7754eee1b10", "comment": "Malware payload", "value": "bbbc8f3a435d61cd27be53a14435e7705449efb1b9c55c2d2c5f757f1a99676f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064333, "uuid": "1e28cc66-acb1-4407-82d3-b2d53783cbda", "comment": "Malware payload", "value": "41a04dd720238a948082fed8404b25c9b87362d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064333, "uuid": "e6e46027-a525-4226-87ea-9acc6cf51987", "comment": "Malware payload", "value": "2292038d0bd35280d386417328090c1964eadb43df39a5914a2ea7cf0e9391847b46e72f59f516f4c035b0edcfd42f53", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064333, "uuid": "c47cf349-837d-4639-965a-cd94e509d05d", "value": "A7E3177FB7D20F42C6490677D0E7A02003B1EB871273D7697A4E02D95C43B96DE9AB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064333, "uuid": "44cd7203-317b-48e9-94cc-c311fe02918f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064333, "uuid": "db05f536-fe8f-4829-aae9-4f751918dcbd", "value": "1536:Fehr9jycf+fMOEM/L0Wm3RDrSRgweTGRcCRHTlTTXM4JyUxnXPwzEcR0mVEyiyhx:Yx9T+UbMJmhDugwfbRHTls22zkmVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625064333, "uuid": "2ccd56bd-78d2-465c-ac4b-03e2c22d5e9c", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625064333, "uuid": "eb19bd70-4398-4d99-b25f-d1d74ce6df99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064333, "uuid": "7a4b0229-edf9-4407-8a5b-ca209da26778", "value": "Bjnwkisqxohvpomyd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ea3815-d96b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625034007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034007, "uuid": "b6909987-0a24-43ab-9afe-93ccc628c007", "comment": "Malware payload (Mirai)", "value": "32809665cf8c1732932b3dc6e04e5544", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034007, "uuid": "c27ca16c-61d9-41a3-b333-e8632a179e2c", "comment": "Malware payload (Mirai)", "value": "bc9d4b62351d1073686345619ede1a00db7b57f6b0ad4e409c1e3c0f0c02d67a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034007, "uuid": "6d46e3fb-0816-4ff0-982e-a66cfc03173e", "comment": "Malware payload (Mirai)", "value": "dcaf34b82b38a30430a69e2cc201bcad26f57ca5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625034007, "uuid": "e364dac4-ae44-434e-be0b-72348ed8b523", "comment": "Malware payload (Mirai)", "value": "97914b88f8167a8d01b2dc107c76cd66068c3371171c9c17b22735b7cd23df087d94f3167b35ad5110a9979d1a05218c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034007, "uuid": "4da73ca0-1d4c-4171-bece-ebb727f7c5a9", "value": "94735C34A97E2F26C0C4A17E52F78750B2E5220F2AB4965D7CB20F4FFF24544A8562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034007, "uuid": "007fd315-bc64-47fa-97a7-c5b3d83050c2", "value": "1536:vsnCSemCLLWeKNJ+1kbOSYcpC636v/bcYSZxFFi:rS1+SYccv/gpTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625034007, "uuid": "fd780f6d-3682-4208-916b-647f7e6444d5", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625034007, "uuid": "53c33e08-1578-4333-9ce0-d396d1372038", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625034007, "uuid": "de0f6ab5-3ba4-476c-832b-8410c8a820f3", "value": "32809665cf8c1732932b3dc6e04e5544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b138da0-d93c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013747, "uuid": "5540364b-bf62-4ac1-bd1b-4ebd5789fbb1", "comment": "Malware payload (Gafgyt)", "value": "7e93ace6e3e4d09e81d30a4300a1bb24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013747, "uuid": "dd1cae7d-3aed-4812-9793-693d3664d8bf", "comment": "Malware payload (Gafgyt)", "value": "c17bf892498ed1dce5db1b0f3d588774b8e82f2636f397b2456d15e7442781e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013747, "uuid": "9abad6d3-3f01-4c61-af4a-87781ac28f05", "comment": "Malware payload (Gafgyt)", "value": "39ae5de1002290ad531377e01d8ed3faec29693a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013747, "uuid": "b55ea74a-73cf-48d2-9558-922d662431d0", "comment": "Malware payload (Gafgyt)", "value": "21a1f40d818399324998f09c455afaad07e97759cfcb5b58ed05854cb35346108cc498b5512e55b90364ce5f8d47c4aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013747, "uuid": "44bd5783-7a04-4c90-a54e-f39fca5fb88a", "value": "EEC34AA5A780D1B2D15300B2258BDF164033F6FB4A9BEA6AE7582CF0CF595C6B160F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013747, "uuid": "3b358c4a-19f8-47f2-961c-770729d45d06", "value": "3072:BDEMS0U8UgU2Tk/LZmJWvhZh9Ankki5hJj+3PPinI0/zJfNQQ2u:k0RzRTKLZmujNki5h1+HinI0/zJfNQQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013747, "uuid": "bbb9f6c4-ab22-4343-8d83-505ccc47bd99", "value": 120435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013747, "uuid": "0429ead3-379b-4e25-8eb7-59e3037dc9df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013747, "uuid": "b9bcafd6-e839-42e7-a7f5-5a5525827943", "value": "7e93ace6e3e4d09e81d30a4300a1bb24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086ce9ac-d93c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013742, "uuid": "e59272d4-006c-47f9-a0e7-c9f2dcb2a034", "comment": "Malware payload (Gafgyt)", "value": "43c892094bd6d9cf44de152ac30bf8d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013742, "uuid": "dda1f890-5f43-4bb7-92c8-5caf6c3f68dd", "comment": "Malware payload (Gafgyt)", "value": "c27e328d2fe6fd75066938f58c3359c5dbb9deea166c6a4d3b0397d295a3e8d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013742, "uuid": "3ba8a04a-a7cb-4821-99ca-8223c7e796ee", "comment": "Malware payload (Gafgyt)", "value": "be18cedb5e5c2ebbe1a783ac6c06aef3f5536846", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013742, "uuid": "3e97231d-ce9f-44ea-903b-0fda27bd40b1", "comment": "Malware payload (Gafgyt)", "value": "0f69533d79408bb3cf4dd1e4f92a91d2dd91b47b8cc51886b2055118b5ddc789dbd19a01a8eb3b191ff5068677822945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013742, "uuid": "d2b16c25-4479-4b8d-a3f5-4623aea5a9fe", "value": "2AE3F704E8485767C3E367BAF79E438D772216EC67D333115A3C6DB42BC2B982A39560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013742, "uuid": "9c218858-3a77-4337-be23-bc509cd90a52", "value": "3072:FEDfcOlkmQCnoV1BqMlsEKlTBjCw9QtR5hLbfvEiOJLojdQQkhM4ZAvR8:ls5T3QtR5hLbfvuojdQQkhM4ZAvR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013742, "uuid": "b7366917-ba09-4fb3-b0d3-0d56e9c3a3a6", "value": 150782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013742, "uuid": "8295a339-2fc1-41b8-a409-5629d303eec2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013742, "uuid": "1a9ebbbf-ebb2-433a-ac15-6a408d4de103", "value": "43c892094bd6d9cf44de152ac30bf8d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b80489-d999-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625053889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625053889, "uuid": "4f792c66-d1b5-40bd-96e6-737adfc643a2", "comment": "Malware payload (AgentTesla)", "value": "7ac5272b8bc2eec707c1e9ed0445d8e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625053889, "uuid": "79f915bf-5c8a-47ec-99b9-535c594b7f4a", "comment": "Malware payload (AgentTesla)", "value": "c4148e04db6adf5e00ac075bdca6c861761e857f2e3662254883f297a07eb212", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625053889, "uuid": "17517b46-2c14-49c9-aa44-c2515b9f3cb3", "comment": "Malware payload (AgentTesla)", "value": "39dec0a1f14b5b2c225f06c558c5f75a2ad3cd9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625053889, "uuid": "f278d290-071d-4808-82eb-b0ef04ef09fd", "comment": "Malware payload (AgentTesla)", "value": "f84cc31d6b0c20c9cbf16cb841cf37ce19b8dd73ee24b9dbc636f3cc919428e235ef55f286b12fd0360e87dbc0f17d48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625053889, "uuid": "31cb1703-cb90-4c26-a573-91e5f0f84177", "value": "08157CAC325035DEC467C6BACAA8AD74EA653C67531B8107509709DFAA0DB97CF201F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625053889, "uuid": "fd53cc14-594d-4258-8bc8-0e2833002bac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625053889, "uuid": "64b98d15-3d59-4efc-bec5-a4602dca485c", "value": "12288:GQcJAekKM0lHqwHlqnHLBJim+bnVkYWg3U9/SJE2OcbzK3HGLpd3mEtIu3zqHmTW:+q4pllHlqnHLHim+bnVk7gpr9zK3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625053889, "uuid": "f716ad3a-c81a-4f61-a49a-93235d04e16b", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625053889, "uuid": "2851292e-2caf-4e37-8e16-b8ee0fb88748", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625053889, "uuid": "1fed57af-a939-49b6-95aa-ed37e9f7f987", "value": "New PO#33134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866a4fbd-d9d6-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625080096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080096, "uuid": "0dea3c47-ad0b-408a-b9c5-2d23959b4c62", "comment": "Malware payload (AveMariaRAT)", "value": "cdcdbe253da2dfdf3792f26681bbd14e", "object_relation": "md5", "Tag": [ { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080096, "uuid": "e9fbdb0e-4538-419d-9923-da7a4e2ea91a", "comment": "Malware payload (AveMariaRAT)", "value": "c512bba369f7480f1682546ba31ac48e290887f1209a8dbbfdd1ed3de2544095", "object_relation": "sha256", "Tag": [ { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080096, "uuid": "14c65ca8-7738-418d-a376-77de166dcea4", "comment": "Malware payload (AveMariaRAT)", "value": "bd1a0365d57366f2e1e50834c03e885784a23dd9", "object_relation": "sha1", "Tag": [ { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080096, "uuid": "47c4740a-44e0-40b9-86de-7dbcd71aaa65", "comment": "Malware payload (AveMariaRAT)", "value": "ecf52a2f2c03cd63dd322814363dc4a05d66b8ddacdac8edc19460c9d7106bdb1aeb925513135b46766783014bd8ca0c", "object_relation": "sha3-384", "Tag": [ { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080096, "uuid": "ef551924-5dd1-4bb6-8f7b-0d971f3d0054", "value": "B0E3021769D0C4E3CBA30EB06E7B6A53EBCDE6001462460F2BD00E593E76AC2555F9E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080096, "uuid": "9a0f819d-2e99-443e-809b-6103ca1d0a78", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080096, "uuid": "7522179d-3b24-441c-824c-597523ca08c2", "value": "3072:iBkfJpRXATwMdFCcGb6Es1TCVD+hjJPxtY7IbiqS71LaiMDSq4OXPJ0WcPM959:iqjIK1yiqhjJPx+IbIRLaioQgJJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625080096, "uuid": "ef4c5eb8-468b-45bf-92c6-cb01f2a6c7e8", "value": 144952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625080096, "uuid": "816a890b-d568-4992-8486-2bcb723ece5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080096, "uuid": "71ef8473-94e2-4e78-9841-a7e1ea721750", "value": "PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16aa065-d9e9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625088356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088356, "uuid": "f382ff2f-1cd6-407c-9728-206bd8f8e6e3", "comment": "Malware payload", "value": "0de1abeeb02cd1bb64cfd15d6520fe14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088356, "uuid": "3a8774ba-8780-41a2-87da-3e0bf82dcff2", "comment": "Malware payload", "value": "c60b1888a36d8fe74d12b5f88bb230af8f73b0a6a3c7f435d2f951ed32db098f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088356, "uuid": "6abd373c-04f1-435c-a724-052081b9e292", "comment": "Malware payload", "value": "5706325f22200579fcddcf7492266ff4055c98fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088356, "uuid": "15dbd913-b276-4e16-9468-3445b45837b6", "comment": "Malware payload", "value": "a7ea3e7d297d9cd7e6744af8fbf7677bcc80b1194c2e00de5874d820abf85cca4214687fa2c6c7ebdffcbd6384aa080f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088356, "uuid": "f9302080-119e-4ea2-b6df-9290a499952e", "value": "DD84272864BFC01985E3EEA12EDCA8FBD99A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088356, "uuid": "689384a0-0a6b-4f79-9360-ecb915ec4d79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088356, "uuid": "fb0ce05e-dbe2-4bec-8135-e5129c55e382", "value": "6144:/5Yqofb/N8MO89q87KgL956Tv/3bBthv2To9R:/5Y3fb/N8z89q87PL956Tv/3bBthv2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625088356, "uuid": "a8c285b2-3b04-4db5-94be-8d52c18fadbd", "value": 392584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625088356, "uuid": "63fe2880-181a-4244-8cbb-52396784f04a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088356, "uuid": "cd1e6b14-2fdf-46f6-bcd8-1f47b86cd20e", "value": "0de1abeeb02cd1bb64cfd15d6520fe14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df441d0-d94c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020811, "uuid": "f968f981-efba-45d7-a164-8288b69d6a95", "comment": "Malware payload (Mirai)", "value": "14c229c39b85f01dd1a288aeb8df642b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020811, "uuid": "43f3a28e-84cf-48dc-8572-1449cca19475", "comment": "Malware payload (Mirai)", "value": "c75afc651951c889a0d971133365b5553114f1efe683ce4fd729069eb5c5ffd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020811, "uuid": "e28638cd-2e0b-43b9-80a9-0e79267d8ddf", "comment": "Malware payload (Mirai)", "value": "57f7222aca4052a8edabc891dfbc9246cdd22c60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020811, "uuid": "4be52c81-4f4e-4f7f-8543-292755b44cab", "comment": "Malware payload (Mirai)", "value": "b1025ac68e205d35f450f334220042dba8a95908e6ad35fcfcd0a323f4abe87280017f964525a63d8918131755d4f832", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020811, "uuid": "892cec06-8e7b-4757-82bf-774115600db8", "value": "1F432925AD792E26C0D8B57E11F7C724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020811, "uuid": "d76c4e13-ecb4-455b-98de-a787d6102acc", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDF:eL0AxvSHfymp0xgunvCkV6vTMDaue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020811, "uuid": "1dde7552-364e-4d1e-8b25-a58d23026636", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020811, "uuid": "3501c264-7a77-48d0-ac7e-e6254efcb39b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020811, "uuid": "c094a2c2-2865-445b-bc46-3634354213f3", "value": "14c229c39b85f01dd1a288aeb8df642b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f96570-d9fa-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1625095584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625095584, "uuid": "08e32d18-7335-4218-a63b-c77462881329", "comment": "Malware payload (njrat)", "value": "6eedc0ea22ef8aeb88c40985a6cea3c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625095584, "uuid": "d1c65a67-f560-44d9-a280-ceb89a5a9d4e", "comment": "Malware payload (njrat)", "value": "c7ab8be4ae48937c0b4433d20253e1b4a1074a48dc7c18ca73ac8848182a3b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625095584, "uuid": "37666670-6ac4-4bbd-92c1-48323184dcb3", "comment": "Malware payload (njrat)", "value": "6574884b52ee42bb3faef4013a660e55ef82a960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625095584, "uuid": "c3b27347-1052-4d79-b210-d6c8d2e30942", "comment": "Malware payload (njrat)", "value": "7eceb12524b274683eff41c8f6d88f00ca953d699ba20ce0c7bccad64efd5aa6ab297af5726525ec85ee9387aba90c5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625095584, "uuid": "34a34a00-32d0-4629-80e9-7b1aab914c7f", "value": "DE94E012B9D18471C472193856E99BB1663CBD301F258ECFA3983E2D6E301D17B36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625095584, "uuid": "31902373-a3bb-4d94-a562-fb8c44911221", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625095584, "uuid": "c347e264-83ee-4ccd-8ee6-ca7182591484", "value": "6144:yQ+KaiKX2omqZEIvjzmW6rT+tGHYd1eH6UpwCp8aIJmWfaFPM5UoWPyJQzRA:eKry2/qZXzmLT+tGHBvp8hlaFUFWP1RA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625095584, "uuid": "b68f415f-2a2f-48e5-9f41-2261c3b39661", "value": 447380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625095584, "uuid": "9c58e22d-48cb-4bd7-be9a-a38cdc6cdc11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625095584, "uuid": "ad32962d-4fed-4024-b865-ee4f1de4ce26", "value": "6EEDC0EA22EF8AEB88C40985A6CEA3C7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e25371-d969-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625033250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033250, "uuid": "40d26777-301f-490b-b154-63e13ce2a380", "comment": "Malware payload (Mirai)", "value": "cbea2e69ca2ae6e9c2ac150a0567f111", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033250, "uuid": "0b0581fd-bb52-4f0c-97be-d4d321b3c906", "comment": "Malware payload (Mirai)", "value": "c894a30cbec6d671016f0bf0c12b75eedfd3cf854c155167e917ab8a208ea89e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033250, "uuid": "4f7e63c6-3efc-4aa1-bc2b-4ac973cffa4d", "comment": "Malware payload (Mirai)", "value": "02ef71f39bd33959d33d2f4770e544e2c6484eb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033250, "uuid": "da73d8f5-51a2-4ecc-879a-3731560da2ef", "comment": "Malware payload (Mirai)", "value": "8730eac194d63f8e645fe4ec2710c394fae459ac2332eee6a72d2dd485cae10d9601de15016e1737e0c21be45e48bbd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033250, "uuid": "48b5ad79-c4a3-4c70-8a37-3d901ac9c47c", "value": "92530A817C916A39C7D0577BEAAF108E3354ABD9D0DB7347CC044B917ACA90B0D6BB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033250, "uuid": "8fc560fe-7321-4612-bcc7-269ee4ebbf6b", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yvck6YceZWGzDTMH:dOxkyRWiPkjX0QckVcwLEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033250, "uuid": "081e181a-0443-4715-92c2-406ef9f2284e", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033250, "uuid": "16877f06-7ac7-4118-a7b2-905113a1dd51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033250, "uuid": "2f688c41-a01f-4a09-b95c-ea24217b0abd", "value": "cbea2e69ca2ae6e9c2ac150a0567f111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed17bf8-d96b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625033993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033993, "uuid": "4994e501-dfcb-45d3-ab85-bdb9e6c2e843", "comment": "Malware payload (AgentTesla)", "value": "f995cd680b323895f8e4ebd3b2b6d3e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033993, "uuid": "4e333fab-b02d-4086-b28c-df436f75ab2e", "comment": "Malware payload (AgentTesla)", "value": "c9a978ca46266e864878d68274995ef1bbacb71a146f9409d0f9b7247caf25bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033993, "uuid": "02a75337-1d5b-42ee-b05d-948fff874a6a", "comment": "Malware payload (AgentTesla)", "value": "24b1d03448bc59acfed2c6c8bf4a736541f6a191", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033993, "uuid": "019a0cf7-c4ab-4395-bfbc-eb7fe089516c", "comment": "Malware payload (AgentTesla)", "value": "3e7fe3912966e3ffe4d175328626c0ec95b3aca84612647ff4b1b766f83f7f11819477594c580fc4d0a97c70c9e724e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033993, "uuid": "8c58014a-dad0-4b48-9914-c498a365ec2e", "value": "59F4AE342EE95625F0BA9FBD96E0245197FDF223AF17D8697CB102C50317E42C9F122A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033993, "uuid": "35c8273d-a8ef-4404-a01d-1524ebd101a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033993, "uuid": "cb3df041-4174-4f4c-8d21-339791001e1f", "value": "12288:Rh3rWclVIS9EGbSLBbX5TyjpV8dbuBCFBgQyAOkoMs8oTLROLB/0rI0Q0FI1p5dt:+Lw4dQYBgQy9VqB/0rI0e1pLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033993, "uuid": "2fcafa90-2561-4129-9fe1-5c5bcfc3490a", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033993, "uuid": "e344caa0-f0a5-4cde-ab52-40ae110101c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033993, "uuid": "d1bef2d6-6513-40be-8c9f-5e7e677f933a", "value": "f995cd680b323895f8e4ebd3b2b6d3e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe11bcf-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625075629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075629, "uuid": "a92f4802-a861-4508-85f6-8e91733fb67b", "comment": "Malware payload", "value": "637e2585ca10929977949f8235d739fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075629, "uuid": "a171cddf-b9ad-4074-b4c9-9ef406fab3f5", "comment": "Malware payload", "value": "cb9797415542f1f8decb64021d470b5debb10f17c5e37b3b5a3ed6b1bb2d4024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075629, "uuid": "d78dfa49-af6a-4e98-b766-1cb9a5422d68", "comment": "Malware payload", "value": "716f7187e97f434bfc64c41085df9f3b5d88a7fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075629, "uuid": "1f0d7578-e5ea-43fd-8539-b8e30b197507", "comment": "Malware payload", "value": "9d536ad70e8b9e2cf8c455df825551458373f5a0031082c4f0ba54922a1b6680469744e8f6a505227a20f3035cf1bf09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075629, "uuid": "ad5e1780-3e9f-4df8-8c2f-c94390c1d6d7", "value": "6D156CAC3160359EC567C6B9CAA8AC74EA653C6B431BC107909709DEAE0DB93DF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075629, "uuid": "3ff2d152-a1b1-4d76-93d5-f3bde5d2c10b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075629, "uuid": "4f62f97e-256d-4f02-ac99-ce492944e9f1", "value": "12288:+4rmivgBZq64QTr3SQj++ad9NopWmAEvpsOYMXwmXvha64CLKnZmgI++B8HhVR/R:9mivccYr3Zu9NBmAEh3lkeUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075629, "uuid": "f79beddf-4253-4348-b33a-3339efa36131", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075629, "uuid": "92c04bcf-a661-4a15-b570-38b5a5109155", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075629, "uuid": "6669b771-4e83-4c96-bf22-e6d1c43dfce2", "value": "637e2585ca10929977949f8235d739fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ae9028-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083269, "uuid": "211ac91d-5c34-4091-a702-102ab2056ff4", "comment": "Malware payload", "value": "c047ef35f2f87572d66d001be1343548", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083269, "uuid": "6bf8c21d-3868-43f2-a011-3885b17bd71a", "comment": "Malware payload", "value": "cd5209c2bf2fb57926f9352d61b2ea69ea4e5732b1113224e98a8f5514d894d0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083269, "uuid": "2c4d29e2-dcf5-4615-9593-6074a8056658", "comment": "Malware payload", "value": "9973626f45750bfba0323235f165c2e11079dcef", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083269, "uuid": "949fd807-ffa4-455c-8a3e-75827f14c721", "comment": "Malware payload", "value": "9ac7302181841c15cedb5711020d3cdb45078c46867645d733d352066a434f8b24e443c1daf62cd67af03dfe011674f7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083269, "uuid": "278334b1-0117-421d-bc5a-5264d76e9fc5", "value": "4224120AE137E862EF9F0077BEF92EF11365446305585533A632285CD8A7C5E92287FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083269, "uuid": "4923f698-749a-4243-97d7-ba204e04ad9f", "value": "6144:f57pA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p562mm:R7u9l2pgxjt6XUyNW+Md56Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083269, "uuid": "6b863566-875f-4b24-bb9a-5fca8751555c", "value": 217929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083269, "uuid": "b9117af7-9392-4671-abac-21918ddd4c0e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083269, "uuid": "60883e1c-57d0-4785-91f1-0fa8f67c5693", "value": "INS 53614716.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3476c9-d9b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625065614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065614, "uuid": "c22495f1-4bc9-4266-b352-d9b48088f879", "comment": "Malware payload (Loki)", "value": "a364f844280f8546ac43c447f70525f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065614, "uuid": "1ebbe380-e620-429d-acf7-34c8b27c573f", "comment": "Malware payload (Loki)", "value": "cd5ad0f8d90f16e43d73cb104e150c7a8d8723bfc193f18a0ab4f9cfc0195e76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065614, "uuid": "07ba9072-5aed-4785-8212-8cf0666e2743", "comment": "Malware payload (Loki)", "value": "4d734018b2fe4d9257c10866f4e5c82448c3e66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065614, "uuid": "51e9e9e4-9e59-4f28-8e3c-97d7c8abfedc", "comment": "Malware payload (Loki)", "value": "4fd4710401e62cc65bdc7e977a55740f4403c96bb477556df053be5ef3aa399c280693a85d89f9fc3b0e027cf4988d6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065614, "uuid": "80fe3d6a-1bcc-41af-9844-8dc45cc16477", "value": "F91518AD725072DFC8A7CD368A681C64EBA0B477430BD203A06715EDEA4D997DF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065614, "uuid": "e3aedf9c-6844-4e5c-a095-e0c90e26c4d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065614, "uuid": "d96175fe-1dd9-4622-bdfd-86b60ee011d4", "value": "12288:6gmMjgiSLdmqx0MNft5TzwLTrfacrMhPxbK26T9YADihb/QQD6zH4XxxnHIosX53:5a9cScEPlK2G3QbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625065614, "uuid": "34355b12-424d-495a-b8c2-692df988601f", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625065614, "uuid": "2e702004-4c2f-4098-b373-1e827adb6c76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065614, "uuid": "77bbcc34-cca2-41e6-a31c-aef574a67f55", "value": "tYtvqMRsKerDuku.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b61734-d9a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625058536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058536, "uuid": "f4dcb21d-20ba-4a34-8388-bdd9859cb9f4", "comment": "Malware payload (Formbook)", "value": "4ef285a74900ac357fa6f0e3f0c0ec00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058536, "uuid": "2d521d56-c2a8-44d4-8b83-c2240b537c7e", "comment": "Malware payload (Formbook)", "value": "cee0d49fe5eb498e798bbbfaf93436426ee5f23b8e59dfe6afc21133c2c47486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058536, "uuid": "217eea90-6fc8-464b-9b76-097ff37bc561", "comment": "Malware payload (Formbook)", "value": "524c6f9fd9e3972384f70d63d5853e7648a6b663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058536, "uuid": "dcdc0a65-1e3a-4b64-b845-0f0562313550", "comment": "Malware payload (Formbook)", "value": "b4040ada973ee1c27e83469622666cf352cb4a2e7282020b826089d2f09b8e2f3fcc4586723757272faab280611cc8d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058536, "uuid": "a8a64f39-3fb8-443a-9e6c-858a7739ec10", "value": "64356B98B150359EC827D7B58A78DC3496223C7A563A810E50DB3D9B7F7EB93CE101A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058536, "uuid": "d7a0dc65-32f9-4b83-952f-c40752cce7ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058536, "uuid": "43f0623c-c529-4fe2-85d8-3a78f5c555c7", "value": "12288:HQBArAJjkj/3tl48xVtT5DVCjyADRFLF6HYhmcXj+P2LnSklZZ15IdkD0C35OcrG:2AcAb3tyUkyCRSPujFLS0L10kDl1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058536, "uuid": "d64a8624-d3dc-4bce-a73a-d464aa8c3ece", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058536, "uuid": "25007c0e-a56e-4dfe-a3b6-f9bb7d383f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058536, "uuid": "9d040f70-244d-4eb6-8935-3fa75a29da90", "value": "Invoice..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b56474c-d9b5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625065716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065716, "uuid": "0bfc28f9-c85c-44bb-bb16-0cf232190d2e", "comment": "Malware payload", "value": "be16629c4a08ee23fcc1c4a8198be065", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065716, "uuid": "6d8fd709-49f5-429f-961c-f2e5c0ab167d", "comment": "Malware payload", "value": "ceed0ebc3f52b44accb06cfe1828133c66665a27146a08dfca26fd77ad6e0474", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065716, "uuid": "fe87bd1f-655b-4cc4-95e3-67d137e83dcc", "comment": "Malware payload", "value": "0ddd9a81ab722db5a6913ddc013d396875f6a1d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065716, "uuid": "8c888570-57c3-466a-93d6-68b32fefe520", "comment": "Malware payload", "value": "40e2ce92a6b7c51f616968242b39d35319bc42a80bbef77d858979f374e00bff7ff90c6aad8ed3a1f7e4ebb7b10db6b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065716, "uuid": "1108de26-afd4-4627-a7e5-435bded559f0", "value": "2FF48DE2F1C28933E1361974FC6B976E1836FF142D0874856EF93A5C9B35682663E183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065716, "uuid": "a673b055-dcc6-4b38-b5f7-bf30089c2c6e", "value": "49872ca347743de3342dae48ab6a2426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065716, "uuid": "8943d920-7077-4ba9-bd5d-517e3684ee01", "value": "12288:3/GRJUeqFZCVHtc67SJFBoy7PoAMkANkLkU4wXc:3eRJsFQHGKSacRsNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625065716, "uuid": "efb75801-fa61-4aaa-97b4-033c0a7ce418", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625065716, "uuid": "50faf5d4-a324-4c3a-aed2-5f9fc6703d67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065716, "uuid": "351f1129-7baf-48b2-8815-113900498c99", "value": "be16629c4a08ee23fcc1c4a8198be065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91afc923-d96d-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625035018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035018, "uuid": "37b7952d-d645-438b-8791-dec9cdf9e46c", "comment": "Malware payload (AsyncRAT)", "value": "43e22202c870a9c4f807571dcebb53c6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035018, "uuid": "50129752-0700-4261-b908-7ee0c645960e", "comment": "Malware payload (AsyncRAT)", "value": "cf2519d7f487f8a64920eedf7446c626e41d6c0b8e7e8954f09214e12bbc7385", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035018, "uuid": "34fd814f-b0e6-4df7-99f9-f316f1a8d1d6", "comment": "Malware payload (AsyncRAT)", "value": "b94c3aba8e17795a22484ab42c8a7b02d79918f2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035018, "uuid": "a83fcf94-280f-44af-93b8-ae742d4fe55e", "comment": "Malware payload (AsyncRAT)", "value": "88b6e4edd4d24b84e2805a118a0f3340a626fd6c495867f583217ccde9de8cc7417ef544583d6a8f25f8a048b8de5fe4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035018, "uuid": "f9e66d72-d18a-4dc3-aa1b-6742b5cb1055", "value": "93063399EA489130D06D5F7982ED21201B74BFC715C2670B2FC8BDA5BA3B3C9198F365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035018, "uuid": "c8a868cf-9556-43da-ac33-dd523a9fa928", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035018, "uuid": "f707861b-3ffd-462d-a179-9600838b3140", "value": "98304:utFlIzgvl2JXF6jlFQTz7uKMX/32L1WS8Vggi:CFlugvKT31MuLr8Vggi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625035018, "uuid": "441dbd9e-331a-40ff-997e-e106e7f779ab", "value": 3896320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625035018, "uuid": "38c26da7-ec3e-4764-be01-395219dd33cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035018, "uuid": "fe1e6f77-ac16-4517-acfa-7e05c4c15cf2", "value": "CF2519D7F487F8A64920EEDF7446C626E41D6C0B8E7E8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254fa89d-d9d4-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1625079074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625079074, "uuid": "5520584e-5187-4f7d-861d-f671e0674edf", "comment": "Malware payload (NetWire)", "value": "467e17b8d44626b7456716680e3d043d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625079074, "uuid": "258e4496-357c-4f36-9a50-21bd7ba2c2b4", "comment": "Malware payload (NetWire)", "value": "cf2aec2969353dc99a7f715ac818212b42b8cff7a58c9109442f2c65ff62de42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625079074, "uuid": "bc4fdaee-f699-4e26-8e75-4d8b8d20bd5b", "comment": "Malware payload (NetWire)", "value": "6636511ae14abb0f2554199b4ed8977def1d9b8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625079074, "uuid": "947aabc7-b0cf-4509-837e-5f1dcb37fed5", "comment": "Malware payload (NetWire)", "value": "c7f65837f45e4e92d292f87629f262be204d5244e3f60b0347f04abd0c232b56eed3bc1e8587357d96ade5ca3ac402a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625079074, "uuid": "d4947247-f047-4080-9a36-876e70575251", "value": "CA74DF2474D1C073D4B6003509F8DBB89A3EBD250B259AEB77C447BE4F242D1AB356BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625079074, "uuid": "e6cbdc8f-e4e1-46a1-bee2-a45048369739", "value": "9be290f2eaaedf4c0e2cb2f062e8f8a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625079074, "uuid": "9f7631c7-76bb-4b2c-b381-080d6569eca8", "value": "6144:lWnWCHqxhNmocNLztFvQy5dAOwQxM3QLylFzk8x2dQ32SY/XDzZXa:lOqxhNmoAb/NxM3+yHY84dQmrzz1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625079074, "uuid": "9caa043a-d55c-4d4c-bd40-ed76dd807a8e", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625079074, "uuid": "b09d7195-d63a-4818-8484-e6469d6cb129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625079074, "uuid": "1b46e41b-887d-4473-a19e-3f85c1c2e2dd", "value": "467e17b8d44626b7456716680e3d043d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40cbb86-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018379, "uuid": "b79ab784-3b2c-45fa-8c1d-863111ca4120", "comment": "Malware payload (Mirai)", "value": "1f0b0e3b0431de53dbe3a3f76485d48c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018379, "uuid": "17cf9f4a-fecc-43e3-b6e5-ded3f2dbb36c", "comment": "Malware payload (Mirai)", "value": "cf738d2547506531ffcbf53e45ef3fe0b6b3a99d78f19877b105da9a32658fad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018379, "uuid": "fab69cff-50cc-41ed-9ac0-f197c78d78cf", "comment": "Malware payload (Mirai)", "value": "4d9c3811512661e581f599bd49eb32d88e599ae6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018379, "uuid": "124d77cb-6ea3-4cb0-8fff-3715f16ceb4c", "comment": "Malware payload (Mirai)", "value": "840fc309a24ef75a7b5b6b7e41f004a1bc5ca810ffddd891b128283cec242f8d42b7341618351d25a1c720c10e5d6fbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018379, "uuid": "b388e684-4fab-4ae3-a175-203238701f57", "value": "F043289BB8019D3DF40BA6BA94264D0DFD3163C142830B2B67B7FDE3AD720695D12D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018379, "uuid": "f143619e-152a-4ff4-83e1-2214e19ec2c8", "value": "768:ujepLLJ3QjJu11JfeCIg3S5s5ylgaZz2XA8SloW3U8N6AW4AZ2oHlKkbJoQLDB7:et8a4ksUlgWz+A8SqWJN6AEZ2Id3LJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018379, "uuid": "69f27eb8-a7f7-4731-9ce1-aeda4bdc191b", "value": 56500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018379, "uuid": "a6903a39-2547-4ef7-9cb0-80a785c57fc0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018379, "uuid": "4076ad0a-1fcc-426b-8522-5388dde2737b", "value": "1f0b0e3b0431de53dbe3a3f76485d48c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5660fc-d9b5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625065958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065958, "uuid": "80774707-f422-4ff4-a3ee-f1fc33d6a2b0", "comment": "Malware payload", "value": "5e223f7fefeef3d4ccb2352318980208", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065958, "uuid": "dc96cd74-5d67-4d21-8a25-17a4481881e5", "comment": "Malware payload", "value": "d0131ec682297bec00d22959c3059edb94469b1515a5febbce4a30e8877d6c2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065958, "uuid": "9819cd14-8a6f-44d2-b0a6-a8ee0dd3258a", "comment": "Malware payload", "value": "631728d583485219bc90b1cbe1aeaed17fd2d723", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065958, "uuid": "f0844164-0c84-42ad-bfab-f0b520cb2228", "comment": "Malware payload", "value": "3dc30b6593a7401b0f5cf16a679722afc81bcd0a00cac90a6542a43df356e2e0b227c28ab17234a47985f03d95d669fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065958, "uuid": "00d33f22-fb8a-46e2-9eaf-77eab4377153", "value": "B7F44AAC3254359EC567C6BACAA8AC74EA613C76431B8107909719DFAE0DB97CF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065958, "uuid": "3e3e9faf-715a-4c4b-afe2-ff2be4fdd450", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065958, "uuid": "7e5b9f7f-7930-4fba-b7a5-2f9ca496295a", "value": "12288:DIEOwZRiCSpN7LSol4F1K4WiagHyxFiyMUGnHKylXLqOfbFfnUFQy9dU:H/aNLt4LGgHyxFuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625065958, "uuid": "7b1b079d-e2f6-41e2-aff2-f12c031fcde7", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625065958, "uuid": "2df6a84d-4f4f-47be-b46e-031d13d7e14f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065958, "uuid": "b9dbb1bc-f994-4698-bf3a-f82e89ea0119", "value": "5e223f7fefeef3d4ccb2352318980208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6170df0-d9ae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625063077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063077, "uuid": "3ae5779c-9eaf-454b-ba8a-8fd3b781d4c1", "comment": "Malware payload", "value": "2a8a8eacac2bcf4b563660b825772b48", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063077, "uuid": "20971bb2-a932-43fd-a080-709b03926193", "comment": "Malware payload", "value": "d0818a0bdaf515b7e78d5d4a197c6164f89fda9615f5b56a7fe61c9ddf62e57f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063077, "uuid": "939ec393-dc10-4867-b800-6b24bf4f03b5", "comment": "Malware payload", "value": "67734fe8b406da0b34884d240349d1264a1f1b4d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063077, "uuid": "cf0e397a-5ae7-4b4e-9bfb-3278be937c41", "comment": "Malware payload", "value": "be24bb4f1860e4977284a4be04ebf42ed7b8d0366983b6e7eacbbc5f936e5f9ac2a473d6c51efd49bfb93c2cc0c63cd1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063077, "uuid": "12b85ee9-23d1-4531-8c89-8857a85d7e90", "value": "35D423BB006185ABF544D9EF86628AD2175FDCC292577EDAC7313CCC3D935A12A120BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063077, "uuid": "7bf932ce-bc4f-42d6-8ed2-782f1a511ba2", "value": "12288:LDyUdcDP1Vx6Fijgo+gqQf9PSkD0yRhiC1IUH5pORXGWGbFuwEuhlOfVp:pdcDPB6A9B0V4dqUH50W5cfVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625063077, "uuid": "211ecb33-4245-4dbc-9c79-1b333ec29c16", "value": 638819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625063077, "uuid": "c670546b-46ca-4236-9e0a-34680dd6be5a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063077, "uuid": "bd13218e-7546-4ca7-978f-9f0bfa76dac2", "value": "nwhgu8941.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dd254d-d9b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625066189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066189, "uuid": "65a2c42c-673c-48db-babc-6fbd71d7158c", "comment": "Malware payload (Mirai)", "value": "cf026e5259a4929d7e95f31dd10c38a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066189, "uuid": "49344596-b233-47ab-be26-206784d44f32", "comment": "Malware payload (Mirai)", "value": "d136f7129f6230c2eaad28ca05af5af4dff1684fb29e69482e722d64f6ebeb12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066189, "uuid": "2eb5cb04-f9af-4214-b28d-b24022247007", "comment": "Malware payload (Mirai)", "value": "747461a17d2627ef97761fdc97ecc0324caeee9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066189, "uuid": "85c8c4ef-23af-4a1a-8d95-dff442a949ae", "comment": "Malware payload (Mirai)", "value": "0f7fc465fb4b77d64ba71cfc04979e229f70b02804b9205e1804ba4018dc6e3032508d09527d1b91e6886d1b005ea24d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066189, "uuid": "2facab0e-86af-4110-b07c-9bf6e0f9ce84", "value": "97A2C038B248DA24C6B0DD7CEAB5A1CE34711AF4FCB73AA6610C0B2527D5547F2F9492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066189, "uuid": "80a27ef2-833b-4bdb-a269-3c6332cab90c", "value": "384:vXdEbHhQQabhnDjHQB836q7TCiCvtFLiS7XPXHYnCuTlqWiXDIAUFbgohymdGUoz:P2aQabRbQB83h7TCiatFLiS7XPobizI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625066189, "uuid": "e3dcc504-285a-44be-a5d5-9820cdf81d4b", "value": 22468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625066189, "uuid": "aad9ec83-6278-4e9e-af23-05fd2457a9b0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066189, "uuid": "a1dd6d2b-3f7b-4023-b6d8-f248c2b2cb5b", "value": "cf026e5259a4929d7e95f31dd10c38a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e325722a-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625074668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074668, "uuid": "fc2d2018-2a7c-4635-9afa-22c40a7f847d", "comment": "Malware payload (AgentTesla)", "value": "350dafc29549d4f24d58dba3ca22804a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074668, "uuid": "9a446cba-a82f-4609-9d8e-826a8bef3f0c", "comment": "Malware payload (AgentTesla)", "value": "d2ea4428145eefaaaf7a5c7345e2d15904b4463ac780e5c1cf1ea0c8bd0999eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074668, "uuid": "9be07c1d-f088-4240-9813-b222ebf56deb", "comment": "Malware payload (AgentTesla)", "value": "a83632543ba57cda70e5b230430ffb49985395b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074668, "uuid": "3b61c1d1-2ea9-4d6a-9f3f-4ed95e950a80", "comment": "Malware payload (AgentTesla)", "value": "3462d62b2eda86ed0227d29bc1545bbdcb314af83941aed85441a5cd8a6784bb85801867f5f687d557ca6b95eaa9683c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074668, "uuid": "1563bd98-13fd-4428-8597-3b52fa95c2f5", "value": "2D4512EBB12E9B9AEF1F17303A8CC019CDBC59809666E533B901737632E567C5B96009", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074668, "uuid": "52e65ca9-8e1a-42b6-a2aa-fccbdaef851b", "value": "24576:BTgt3ZjyvLNQGGfPoHXQi8BzN25oieXC5OSl84ao2qATCyIoLtbe:BTccvLNQGWPkAi8zN2yJYlaLTCRMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074668, "uuid": "fb3017d0-bfd1-45f1-9402-f0664bbc0989", "value": 1177576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074668, "uuid": "d177baeb-6cac-466f-b106-d100c914a64f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074668, "uuid": "99c8831b-dcab-4fec-80e3-c66d41b90501", "value": "PO DOCS 30-06.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2eea71c-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625059179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059179, "uuid": "a515c098-a084-4635-96c7-559900a5ba01", "comment": "Malware payload (AgentTesla)", "value": "c610224d423c237d6f74b4c8096a1b2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059179, "uuid": "e5826134-47a5-4281-901a-6ca93543f47e", "comment": "Malware payload (AgentTesla)", "value": "d3e30c5ace93870f29e8dd850907fc0f831f486e3a84ee9a02e6885f13d8622b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059179, "uuid": "9b1ec071-abf9-4485-aed5-51ecbe973f8e", "comment": "Malware payload (AgentTesla)", "value": "87639bac92dfeb3a43439d6d58bff0e4efe1e93f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059179, "uuid": "e0594a1d-aad0-4291-ba40-6bf37a5d19fc", "comment": "Malware payload (AgentTesla)", "value": "5d156d14b7c5544f491ac533fc24949ffff8f492078ae409949981ef94ed43f3f5b8099c8e1399871a0dd52b166e3e7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059179, "uuid": "1ecf544d-0eb6-4aab-a8af-39063a7d1592", "value": "89558C5079D99529E0BA4F3D4AA6941462BEBD637F23DC5C3DB533DA0B33283C8A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059179, "uuid": "31663d2d-e243-4402-95ba-f0dcaf614332", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059179, "uuid": "de413ef6-eee0-479d-b620-0ddfc40a05bf", "value": "12288:0T3+YtBbX5Ty04y2pt+4y2pt5YwSSIhb1psW8GHi9Y+8rGXlSGMyEbr+u4y2pt:YuyoyQSFb1pYGsY+3XlfMIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059179, "uuid": "71e3061c-83d5-4165-a3d6-0dc591d7d871", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059179, "uuid": "964c3e90-cbe5-4d67-a9dc-930eac6d0d69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059179, "uuid": "d304e271-4b8f-48f3-97ab-c90021ca28b0", "value": "Swift copy 65876665409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1ce951-d98a-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1625047596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047596, "uuid": "ee31f445-58fa-4cb4-bafc-81a7f55798dd", "comment": "Malware payload (FickerStealer)", "value": "f8ae8178794fd7038f5504ba23a22616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047596, "uuid": "dd947ca8-525e-4f75-9724-23c7d0482738", "comment": "Malware payload (FickerStealer)", "value": "d4842f9caa07b1dab09b1f2475f280eeacacdd6c4a3d625e4398b3cf67171f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047596, "uuid": "4a830d66-c396-452d-a782-66465e259412", "comment": "Malware payload (FickerStealer)", "value": "c07b82f22cc9cf2a86d83db52741a879b3da91e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625047596, "uuid": "066bcd25-b96d-4d27-904a-f40764991aeb", "comment": "Malware payload (FickerStealer)", "value": "7bda11531216709a20a86e92cc46283f2ebf10ceeed8f2388cf21045b08db907c58f00bb7450eaced1c2337c5b264038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047596, "uuid": "835aaea0-be4a-4aa0-a12e-0a2b67e1e14f", "value": "1094AE10A7A0C035F1F716F89A7993BC592D7EA16B2050CB62E5EADE16347E1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047596, "uuid": "48ed8e75-b10b-42fc-90cc-f193ecd8069a", "value": "9ab72a4ac068515907cc3cf9ecc00260", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047596, "uuid": "2f7c95ed-1f5a-435e-a312-33798ef27082", "value": "12288:Bp/l/skcnBShHQr6A1k+3Nl2ZKHWCs2DCabe6:l/skc0yrl1j3NlNrsvqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625047596, "uuid": "2d7e4366-bcd7-4db4-98be-edb1fea235d1", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625047596, "uuid": "2e95895e-0005-48c4-9c27-3d50d50b7436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625047596, "uuid": "d5f434eb-f449-42aa-86b2-fb1485c9c3d3", "value": "F8AE8178794FD7038F5504BA23A22616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85dfa9e8-d94c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020825, "uuid": "c5727af8-3bba-4343-99de-44f9e7b04d13", "comment": "Malware payload (Mirai)", "value": "229200f1b0689d1daf6a36484b50c153", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020825, "uuid": "5b8f0b81-4df2-4c23-8c66-18cd8c6cffdd", "comment": "Malware payload (Mirai)", "value": "d4cc128cc6f1cd2c42a985e340d8d366d92f497ddfbcab89d1491751a74b2115", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020825, "uuid": "b0c58c82-2337-4a3c-a7b7-94ddfa2c2450", "comment": "Malware payload (Mirai)", "value": "30d517ee61647581aa484b152a8350188d468aca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020825, "uuid": "7a58b43d-8a6e-4106-9ef7-b9b32b836ac3", "comment": "Malware payload (Mirai)", "value": "27034c4c6515af54c6fbf0c0758c26c1dcd194e46fc2c501d8a8d8019329427bec9a230317aa9d993c62bb1f2a26746e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020825, "uuid": "c356d63f-eb29-4c44-a3ac-5832c829058b", "value": "7763F9827C81AA2AC7D017BBFAAF109E3350ABE8D1DA7253CC154B5176C650F0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020825, "uuid": "25a20fb8-c4bd-4143-a7fd-7812d96b7991", "value": "1536:rvpMPHug5RlFyZS/l+UAuYkpzg0FS0ykFShYceZWYCNqx5M:rBMPHugc0lFSKcwcUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020825, "uuid": "a26435ee-e1c8-4aee-9855-6b809afb1ad0", "value": 70872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020825, "uuid": "520768d8-8eb3-43b0-85ce-5d0acdccb233", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020825, "uuid": "38a0dcc9-d684-40a5-83d3-b8ea35dd97d1", "value": "229200f1b0689d1daf6a36484b50c153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b790c47-d96e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625035276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035276, "uuid": "27902759-ab2c-4bce-8bb4-64fc76c92b4c", "comment": "Malware payload", "value": "87d51f73e7de9c7984b763edf43f0048", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035276, "uuid": "a52620be-b19a-4bb9-b417-41ee1153b0e7", "comment": "Malware payload", "value": "d6d6d06f132571ed737c1977849faf2e199cf1478d22346cd0edd1fca95aeac9", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035276, "uuid": "59816ffd-c93b-4d3b-bc9f-fa163e9dd4ad", "comment": "Malware payload", "value": "7067fa9712c4c9c8c7c63d94db2a08f6fbfc7b30", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035276, "uuid": "03e2055f-f0b3-4e4e-b5de-712868eb9543", "comment": "Malware payload", "value": "7a17904104dc2d054c2cbeafde85c337bfc1efcfb0a454bbb9ad47572103cb747a2338d666a22e1862a22acca6002265", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035276, "uuid": "7404dfe2-d5ec-4924-a69f-2976ac406f19", "value": "6F4512E07FEA9386C8020EFE6FD5D21171A81DF0ACCE4724D9C471597979520EEEAB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035276, "uuid": "ed55e95c-5cf2-4df6-b772-a505d6131e73", "value": "24576:gFqM6zZny5+X8C2H9pjiCJZORogAzMPrtWIsnCBq1fDC5:gFQnC+X8HHnvZORog8MPranCBq1fDC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625035276, "uuid": "9a59dc14-30a3-4fc2-b63a-281adf38db11", "value": 1267736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625035276, "uuid": "d1608662-99d8-4936-981d-bf239a4f67e4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035276, "uuid": "d0885503-3107-4f9d-bd54-06c43ac90424", "value": "PROFORMANew PO N. FM 29062021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b03931-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083284, "uuid": "7bd723a0-52b3-4814-a3bd-8b1900e79658", "comment": "Malware payload", "value": "1eda9b3ec25b73ced9676155d01b1b96", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083284, "uuid": "49783514-8253-4e1c-bd69-27c3c23b3fbf", "comment": "Malware payload", "value": "d6e688a0eb818ca27024de87af45c09bc983cf47c3c0f6e04fec154603358dc7", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083284, "uuid": "d9171d1e-217d-4972-b9a7-ea84f2523733", "comment": "Malware payload", "value": "12cdcb23ad5061ce2693dacec18ce2a329064888", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083284, "uuid": "f7517ea6-640f-45d8-9801-f1c90cc09a6a", "comment": "Malware payload", "value": "24f196e373e8742508469e7968217d42f22730c54fc04340961ab261b1c7017aa82336532dd4ebb25dbf0216a8a8d5b6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083284, "uuid": "1f40e1ac-493a-4541-b620-18d093e85735", "value": "98241244E237E812EFDF5077BAF82EF213664853055915339731385CD4A7C5E92287BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083284, "uuid": "e5deb563-7df4-4eb6-9b4a-fa2b8246f4dd", "value": "6144:fZpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56dd:Ru9l2pgxjt6XUyNW+Md563", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083284, "uuid": "8d56818d-3418-4df9-a983-e7348f6361af", "value": 218090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083284, "uuid": "3dc7daf4-2a4b-4876-aaf3-540c76c79549", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083284, "uuid": "9af82d9d-e30d-448d-938c-63eb3a50d358", "value": "Order 9572478.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aef92a1-d9ac-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625062038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062038, "uuid": "3b162fb4-9dc5-40f7-9711-adb028bf0e5f", "comment": "Malware payload (AgentTesla)", "value": "d26db601cb14c51f59e57d62e3140e39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062038, "uuid": "77f33921-4517-4b7e-ba39-e0437627d91e", "comment": "Malware payload (AgentTesla)", "value": "d6ea69cb27b5297b2df6d4bb332c698e66b387aa5e40032e3d2456b3dda930a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062038, "uuid": "240de9f1-08fe-4bc7-a843-6caf5eb310e4", "comment": "Malware payload (AgentTesla)", "value": "7ecd1b9bfbd891bc852c3aecd8bf9007f49393b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062038, "uuid": "b0704239-fba9-4104-bd88-800d6ddbf261", "comment": "Malware payload (AgentTesla)", "value": "380eaf9e8a14a5862dc1f2304aded7b4ee2bc136699e5c64895ce6a0d7de2cca4d69694c6577f36602abe98bc6630673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062038, "uuid": "576e7270-e978-4f25-9e7f-8a026bbeebd3", "value": "B4E4D0BCD6089EA7C13E20F68025012085F592876572EFC93ED470D9F5E1B8297E97FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062038, "uuid": "390f6527-aa40-4cd6-a1ac-8e7b5db54fb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062038, "uuid": "8da4b449-f11f-480b-bea0-b49e95824542", "value": "12288:vnAOPQwlLsvWR3l/fw8sXVuJ5QM9wLCO5pwJRMC:J0WR3l/f4XVuLr9w228RX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062038, "uuid": "b7fba091-606e-4751-85ac-82bfef5cb454", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062038, "uuid": "588b1ee1-71ac-467f-bf77-7effb8b60d50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062038, "uuid": "3b6941a9-43f3-41a9-874f-07cc10dfcbed", "value": "F\u0130YAT TEKL\u0130F VE TEKL\u0130F TALEP_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de707ef-d964-11eb-875b-42010a9c0053", "comment": "Malware payload (XpertRAT)", "timestamp": 1625031092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625031092, "uuid": "19703d05-6353-4389-8583-6fbaa5348d25", "comment": "Malware payload (XpertRAT)", "value": "a15915a25a5ec67af6e2e422acedaa68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625031092, "uuid": "e2a09b43-5497-49ef-86ea-dd2b7950cbda", "comment": "Malware payload (XpertRAT)", "value": "d72da2af39e90713d465aff2de9c4991a2fe6125e06b67cd85cd67915a2c966e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625031092, "uuid": "f89d4b90-c611-4696-9e62-e7f0c3c82e51", "comment": "Malware payload (XpertRAT)", "value": "c48ccd1326ab3a1d15dec32b1617c2e65ee9d194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625031092, "uuid": "2b4ce9bb-94fd-44c2-9433-fb8291d5235a", "comment": "Malware payload (XpertRAT)", "value": "b90fd008dbb6d18fb3f724d0a00a6e3161465bcb897edb986579ebfafbf1181b41200f130c709dd31b903f95179477f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625031092, "uuid": "8849c6ae-27f2-449e-b1fa-06f7c3c93371", "value": "53559D10BDD4D519E0BA1F3D4AA5941462BEBE677F23DC5C3CB933DA0B3329298A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625031092, "uuid": "fe1a9452-2669-4cba-9595-9ac383542396", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625031092, "uuid": "7e40d041-ecce-4586-9059-7d780aa25a29", "value": "24576:RsKhdK/edyoyjMEF9hXH5sCjYVQBG0qy:wedyoyjMEzteYCFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625031092, "uuid": "1e63c05f-c207-4c34-b527-3b90b0dc87e0", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625031092, "uuid": "3fd23ecc-b086-4b04-91b3-59c5c383a766", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625031092, "uuid": "3243799d-e0f1-4bef-bd81-0d46e5a9d78b", "value": "INQUIRY No. 063021 Materials for Al Wakra Pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc1179b-d99f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625056538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056538, "uuid": "1d0d32d1-879d-41ee-9e95-331282ec98bc", "comment": "Malware payload (Formbook)", "value": "fb7152e24744c5dcde84318931ca8946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056538, "uuid": "7504737d-469b-4d31-9647-24c236c8fdbf", "comment": "Malware payload (Formbook)", "value": "d933001638f194baed0596efe53af5dc534ad6f5177aa8aacf2c25188fbdd2f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056538, "uuid": "32524081-241a-49f7-ac85-32a91d114431", "comment": "Malware payload (Formbook)", "value": "3cb3c9a63cd5ecdd6d165566fa9b51a20ef331f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625056538, "uuid": "73a94a01-6a08-49d4-94de-882e751eb105", "comment": "Malware payload (Formbook)", "value": "3fd8aa70fde6fb8ff3b200f20d45aa8a531d00cabaf42dd51ef04c33c8b543f1158cd66901568d78cc93d4c00e2eddab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056538, "uuid": "8fe3d68c-27ad-4def-afd1-a3f58354b145", "value": "A8C4EF52719489B7E2131C7A4C6E92A211D66E605426E41E32AF730F1BF136253FFB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056538, "uuid": "dc72b554-6311-4c0c-8926-8114a52ef96b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056538, "uuid": "c688f381-023d-4083-b689-ca23e5aa24ac", "value": "12288:RR2xZjufhmyKcyx9wOtzh0pTptT3BlNDomsjL8DPD:D2xd2hmjj8OcTnJkpcPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625056538, "uuid": "e444273b-f276-4889-b74e-bb0f1b23e030", "value": 587496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625056538, "uuid": "a5d5f9e7-9fb0-43e9-9b54-3ae9c7781cf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625056538, "uuid": "4206fd0b-319f-46ce-af55-d73cd063a522", "value": "SecuriteInfo.com.Trojan.Siggen14.17233.12511.8065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3deb574b-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625058929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058929, "uuid": "67c725c5-f3bf-4e86-b26b-43957ae795b8", "comment": "Malware payload (Mirai)", "value": "b259f261a61a7663dc874520e67067e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058929, "uuid": "2715f99e-a300-4ff3-be90-0fea15c33745", "comment": "Malware payload (Mirai)", "value": "da414efa235fa1bf69c0149cd8a8a711ecec4fb1658c1c09dee52bd21e55e449", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058929, "uuid": "99ed7140-bf02-4da3-8240-36623f1e9904", "comment": "Malware payload (Mirai)", "value": "6cd1c8758b06f47dad24b299de0869e9e35327f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058929, "uuid": "8f09dcdc-276d-47b9-a7ef-bf55636b5608", "comment": "Malware payload (Mirai)", "value": "7035acf067f1ceefef835cea7bf2b3665c13b037d2e48dbf93b134e18ddfe1ecb0911ab2fe5eebf971b79d9c10123f0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058929, "uuid": "73098a18-5e9a-492c-8360-e96455fb6a43", "value": "DFF2E11D621300E4CE6280B551B72FD0997A8FC7F452EC5EB5EE8AC29D53025BCB79E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058929, "uuid": "8d4d3eaa-9f30-4477-8d2f-beb7a8e2860d", "value": "768:3L+NKBfPopmG+deGGTf61vSICQybeSq+Y8GJgGlzDpxYsOZ7:3CNKvG+E7uvWQsxCVrYT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058929, "uuid": "7cc81992-9910-4630-8b18-93ba476dc52b", "value": 35644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058929, "uuid": "29540a26-b78e-4576-929d-e932f9575841", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058929, "uuid": "bb6f1f37-fb47-40f1-9d06-a07f41ffe590", "value": "b259f261a61a7663dc874520e67067e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abab7297-d977-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625039356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039356, "uuid": "6b29a030-62f0-4415-822e-4b3004de20f1", "comment": "Malware payload (OskiStealer)", "value": "804ef5a2ee7b5689ec3d20fcbbbe7946", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039356, "uuid": "46d7d8e4-a3dc-4df8-8c1b-d89ec6855178", "comment": "Malware payload (OskiStealer)", "value": "dad6bcf047cc4dee788fb313d70ca790b3e52b7ffbadcc10655d11b1a87bd912", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039356, "uuid": "3f4342db-caf0-48c1-81af-e03e7c5a467f", "comment": "Malware payload (OskiStealer)", "value": "04e674b1a1ea215f4fd975e647fc8efcf4d7e5e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039356, "uuid": "e69d7739-1c5d-4da4-9e63-24222e7dd79a", "comment": "Malware payload (OskiStealer)", "value": "ff8af83c7f61d16affb07a439c76028ec9e0fd357faff340c51d998be0ec983e3a44c6ff729a071c7f0ef12f08e5aca3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039356, "uuid": "3c061b6d-f5a8-42dc-9b39-65f36c257678", "value": "847172226BD0C2E0E55C3A7209834A1DD969F634C71383223B90A91F2D6B2A4642EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039356, "uuid": "bfe19b7e-1de1-437c-a7c3-6d09712e17d7", "value": "efe4e83a803acf4884cbe38e0de198b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039356, "uuid": "ecfd73db-2f4f-4c22-b75d-0a87f58197b5", "value": "48:ZvtkN2MY0mAYzFlqw99v9tvlte9xyP6vrBLzi:Z1kQj0e+w99bSjFTZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625039356, "uuid": "82a69d0d-71e0-4336-821e-c188af0827b3", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625039356, "uuid": "14648e0a-d952-496b-97aa-08ef114cd600", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039356, "uuid": "781c8888-c4cf-4ceb-922e-93a1fc47e7eb", "value": "372955591DX.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45c953e-d9a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625058672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058672, "uuid": "8762c737-27fa-4342-ba77-e14ec932e66e", "comment": "Malware payload (Mirai)", "value": "3c8741fd718d19b38fa4f2a8271309a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058672, "uuid": "bef0a88f-1461-4c49-a2bf-d361e2767eca", "comment": "Malware payload (Mirai)", "value": "db23bf90a7f0c69c3501876243ca2fe29e9208864dfa6f2b5d0dac51061a3d86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058672, "uuid": "db30e3a4-e865-4de8-bc2a-8d89e90fe73b", "comment": "Malware payload (Mirai)", "value": "bbe1912512ea02a7edbf51dae4e68c0ff0744e38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058672, "uuid": "12316daa-faf2-4eae-b2e7-8b3072f6b2bd", "comment": "Malware payload (Mirai)", "value": "264d0974659ce7aebf9e51570385964632d9338c8249cd45976f3352aa591046521e5bee8321ce904666e754df93257c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058672, "uuid": "0cc4a180-4a16-4c5f-8895-5e36c9ed42b8", "value": "3883C62B7B130E63C0D610B152E30632F9B9EF5938FC5697A8A07DAD5F3698431127E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058672, "uuid": "019813af-f89a-4079-b0f0-42de0bf6d6cd", "value": "768:wJcfHVOCWCm1C10WizytotghVYGebhl2lnRaTc/mYO+N95Vdzyf6m9l01tPHCjqU:RvsluVZ1RaEHN95DeMtqjqt+sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058672, "uuid": "8073406d-c86d-46b7-bdf6-c25427b1eed4", "value": 86360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058672, "uuid": "c2374aa9-44e6-4a22-8be6-bd01b6762bf9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058672, "uuid": "9d87c327-459a-4adb-86c9-8e0e6f747e8a", "value": "3c8741fd718d19b38fa4f2a8271309a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8db58b8-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625074624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074624, "uuid": "bfb54967-7a36-45c9-8f0b-6b3673dc23bd", "comment": "Malware payload (NanoCore)", "value": "ee4f0ee74e0170c7ae1733210d7f1a79", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074624, "uuid": "f914a535-d5ff-4d57-b76d-5cee9a38ef8a", "comment": "Malware payload (NanoCore)", "value": "dbb9a8d74695467d8275771763de5a45deb0f32d32b107af9c7fd50a0113316e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074624, "uuid": "c6e89cb2-73e0-40a5-8909-e2ceb0064739", "comment": "Malware payload (NanoCore)", "value": "6b8294095b415bb32543dd8077e68c51ad1bd183", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074624, "uuid": "de401f10-253b-4640-814d-e9928862c172", "comment": "Malware payload (NanoCore)", "value": "516ca691e17bf6812023b58553dee7dfe0e97d7b590afed6a7d2bb9e6b696a725816d65cf48eb6ab61458ed83a2c508a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074624, "uuid": "7181429d-a672-4155-872e-3d8ae31d7250", "value": "B1724C7DF1970E88CE87D6A8121A7B82154CF40D73D994E237BCDB38764196B9623D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074624, "uuid": "cf1068cd-3fdc-42c8-8dff-1ecd7c56e2e3", "value": "192:IIpellX+Y+AmESve6q+SoGLfdSjvy9UIlmZvyhCwgndgmF:PUmESve5j7fd8yUm82VYfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074624, "uuid": "605ab408-325b-410c-9c36-204734e334e6", "value": 16060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074624, "uuid": "8e0a8c32-d0a6-465d-918e-d3de0db19913", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074624, "uuid": "1454c5d3-dc07-48e1-bb00-3ad9985d59e9", "value": "PROFORMA INVOICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389f7d5b-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625032721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032721, "uuid": "46a492ed-4d19-4ca1-beb4-b6fae90c7d7c", "comment": "Malware payload (Mirai)", "value": "7f8474e9f849bd7266dc9536b7675eb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032721, "uuid": "e2a38806-83fa-461a-95f4-e26efd2f9baf", "comment": "Malware payload (Mirai)", "value": "dc63597fd347dc676d6f5004d927911ab434a33d986b1174085ce222408c9191", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032721, "uuid": "93f25723-9571-4bbc-94a6-7e4fce0d80ab", "comment": "Malware payload (Mirai)", "value": "268a230dea491c22d09e939388169118dd55590f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032721, "uuid": "14d843c1-1f4e-41d8-9c91-1d3eb19a0646", "comment": "Malware payload (Mirai)", "value": "b5fe811fcab17426dd866ed3544716b0ec5324ca116f9fa3edd8a8b8ed6b8b8409386c0eaf9ed0d92895da163d9f15c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032721, "uuid": "2469545a-8614-4788-900e-28cf422fdc1a", "value": "67E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032721, "uuid": "fca4f558-c49d-4e35-b2bc-de7a401bb319", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1QM:walgM69pe0QmlTvI8t9mrsplDKZUQQBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032721, "uuid": "5abf2da7-f3d6-4d52-b9c3-12887863ec66", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032721, "uuid": "82ffa93a-a342-43e0-a4e9-28c14d314ccf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032721, "uuid": "1a1ede56-18af-4651-8f4e-1f66e036f315", "value": "7f8474e9f849bd7266dc9536b7675eb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da35f215-d9ab-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625061768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061768, "uuid": "fd899c57-f887-4f7e-b681-ad05bd455880", "comment": "Malware payload (Mirai)", "value": "c3381e7b478eefee656ffb5227186fd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061768, "uuid": "c0fc9135-b6b2-42e5-9adc-422ee9908deb", "comment": "Malware payload (Mirai)", "value": "dcf5c809a22f863a78ab13532af8ffd051c23aaf6577d400c178e695489d5954", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061768, "uuid": "7fc86f04-ea85-4cce-88a3-3747efc1c2d8", "comment": "Malware payload (Mirai)", "value": "952288d0ce9cd87523d99e8350750ddd59b0f770", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061768, "uuid": "b04da685-7083-426f-8131-5722f3cde788", "comment": "Malware payload (Mirai)", "value": "478f80e2d9ffa45a342cb08ec4a136f2a86e139138a33149f107935d7462c79224ccf516e847844c9a1723706c692746", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061768, "uuid": "9faec7b3-5a31-4022-a639-d644ddcce682", "value": "0213F286220557D9C52E89F54EF927859A2F1F173183FEDAF41E41D2A92D8E618C23D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061768, "uuid": "5bf42b8b-c2f7-44a4-9e3a-27ac9ea17bfe", "value": "768:bRCPWQq/1KIFx9oVLRUDkdroIsLDz1ZTM/vZCZhu2ctsmwCJgGlzDpbuR1JC:ItbIFkVOgroIsXfAuhKt/VJu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061768, "uuid": "3d28dbd9-b4e5-4ddf-814c-f4bb8e1d116f", "value": 42028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061768, "uuid": "80f2668a-c472-44dd-b8e6-428a09687709", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061768, "uuid": "68bf376d-da2e-49c8-b610-bfa85596b49b", "value": "c3381e7b478eefee656ffb5227186fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87804d3-d9a1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625057470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625057470, "uuid": "1e2d9de1-75dd-486b-8201-90082d520a4f", "comment": "Malware payload (Loki)", "value": "d595e845402ef7e4843daeab383ed5f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625057470, "uuid": "5d01a148-12bb-4382-8372-22932a8b1873", "comment": "Malware payload (Loki)", "value": "dd126fd9b7a9593510273aa60ab932b376b71b4b2fe4d5f0b171d7a0aa539ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625057470, "uuid": "8cf40151-5223-4b22-829e-5b4bfeea1158", "comment": "Malware payload (Loki)", "value": "0bfad24e1f17e61ad2dffc31f84003852134ec0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625057470, "uuid": "c4b73038-9b6b-4247-b9e9-ae6657cadaa9", "comment": "Malware payload (Loki)", "value": "c260e8f7400e2f16f1274f0b8e2d3d633d17a71bb3a16f66318099737fac8122767a1d6a73672a9ed616dbad2d3609bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625057470, "uuid": "a6cdcfd7-06cf-435a-9d37-56962e9fa584", "value": "7CE47C206AF84629F0BA9F7E95B4111547FDF713AF27C95C3CB511CA0723A42CAB172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625057470, "uuid": "9b9d6807-7e69-4103-9b4c-474037a88df3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625057470, "uuid": "4e0420fa-f2af-4e15-b2df-3187079abf41", "value": "12288:ajk3BbX5Tybcvn4B862XTBXbm/aaU48oXqdMbCKMlCEjxuM:sk3jcd2Zy/aa5FyKMLNuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625057470, "uuid": "b1edb683-040c-4c22-b684-531520c6d3c7", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625057470, "uuid": "ea584c7e-2969-47f7-9ec5-55b2bb624cc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625057470, "uuid": "e5b043b3-c7db-43d0-bffd-1c75908e2758", "value": "Ph89Z4hNbQPpro8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1c8a37-d943-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625016997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625016997, "uuid": "2bfea575-2f10-4f44-8ad4-78fce3c7dfa1", "comment": "Malware payload (GuLoader)", "value": "454ac76c3ba2ab9ac3f636c58b504eef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625016997, "uuid": "3205626b-2b23-4c44-bb8c-be9e1050d656", "comment": "Malware payload (GuLoader)", "value": "de64cd231b9786ae51ca4ff584ec2a3b126adfb99290035d1fecce12026e576a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625016997, "uuid": "cbd71bff-52f8-4f87-8413-ddd59d8e0b24", "comment": "Malware payload (GuLoader)", "value": "11762310805671cfb2c81b4e6afac49dfe7b831d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625016997, "uuid": "b0cce806-fd6f-4a2b-94eb-72f22f00b0fa", "comment": "Malware payload (GuLoader)", "value": "1c226ae7005620fe7a759e17b8e676cd2a0c289cf4de0bd60e9606e1821c5493c4550cc3d632956611d947e4adb40046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625016997, "uuid": "c31e3df1-217a-4e36-84be-4656680d8a7e", "value": "8F8471D2ED404455ED561AB2C83E997C10663FEDA4A4A50F34F7BE273AB33831066E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625016997, "uuid": "f5ce65c6-89ba-4575-94d1-2a2ecbc95eb2", "value": "ee63ec0cac1b301047c3f671ece2bc2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625016997, "uuid": "d22e36f7-3adf-4875-a8c8-a795b693366a", "value": "3072:4YUVSyvZ/xWfwCBXUdh2HRsAjnPsM9Qn522h/Dvelo:4YwSopcfZBXEqCADi52oveK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625016997, "uuid": "0037b3d9-a800-484d-835f-abcc70323ed8", "value": 382064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625016997, "uuid": "d69c54bb-79e7-463e-a6c8-51ff6812fd96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625016997, "uuid": "33181b68-3813-4a6f-8376-217601b935d0", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d470fc17-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625074644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074644, "uuid": "8753b986-3a90-4a73-bb6a-f98d1c6654f9", "comment": "Malware payload (Mirai)", "value": "b6feea9b482f074d94ba7d0b4df6998b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074644, "uuid": "2fd9b970-6f13-4eff-a36e-1c5e7a6a4126", "comment": "Malware payload (Mirai)", "value": "df13c541419d99c04006064ebccbe07d153999e48765257dbbc8107b65a48e39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074644, "uuid": "64d819d0-241b-4e09-af73-5def116458f4", "comment": "Malware payload (Mirai)", "value": "fab803a60fe237c4f91512fdfd52e629bc0cd6d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074644, "uuid": "e665bdff-6083-405e-bced-b320153386b9", "comment": "Malware payload (Mirai)", "value": "47a0a5b93bf699dddcd0bfaf5c8830f8bbcfff5cb780751242ee08c39f86a9c19e983747b154f0bddbcc14799070592e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074644, "uuid": "38cf0676-2c55-4c06-b2d7-ccfab5e80fe8", "value": "D7F2F121AE4194E1DA906D31C96F26C217B2632CFD7DB1D1582CD49D2BEB82B28F4817", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074644, "uuid": "2efe5aac-91b9-48a6-81ca-e58eac7439fc", "value": "768:2k1Ad+hrTxdXhyT1vSjnA4/ztsR3h6nb3AR0aKJBVlosWI9WV3Ut:2k1AdGrTxdXh4vSjnF/ztsR3YbaKHVlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074644, "uuid": "a1d7ddae-2fed-4473-96f0-57c1f1974d08", "value": 36452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074644, "uuid": "982bb8c3-8cd0-443b-9342-7620622df37a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074644, "uuid": "614a21b3-286c-4ce6-8580-7b5c7f8a486e", "value": "b6feea9b482f074d94ba7d0b4df6998b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01911523-d93c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013731, "uuid": "dc8aa7b5-0e69-4918-8854-34a830107690", "comment": "Malware payload (Gafgyt)", "value": "c7ea17f504372cb56c4249fb01c5964a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013731, "uuid": "3da2cebd-ba60-42ff-9eb3-0b3166be2f7d", "comment": "Malware payload (Gafgyt)", "value": "df292a289d93136fbdd6ac0850b2c8845f967d9a9a3bd29a9386b39843b82eda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013731, "uuid": "5e8ea968-d7af-4c58-b908-4db62334d451", "comment": "Malware payload (Gafgyt)", "value": "67d4704f43948c15c736549766fde6f2f8b132af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013731, "uuid": "cdcc4f2c-6e24-4cca-98e3-e2629e352d82", "comment": "Malware payload (Gafgyt)", "value": "4745781bce393f3d2341a48845237b3065a82df9987c1c55b40c220e543fa5eaaffb8fb51cf3206ddb846afc1f2f1737", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013731, "uuid": "efb81ba8-fd1d-4b69-829f-4fa5470bdfe7", "value": "C604646F7A22AB7EE6A4963107F65FB0C35521E22391E352D12CD64C5EF228D1C4FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013731, "uuid": "f6e33ee3-4c15-429b-a978-3a6bc445fdb7", "value": "3072:tE0WuCbkr61njiii5hox1cOpAYgBTexRxu6qb1cWgdh8:uuQbi5hox1cPYgB6xRxu6qb1cWgdh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013731, "uuid": "32400e5d-c70d-49ee-9eae-1f7a22d27afc", "value": 187385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013731, "uuid": "0f744ca4-1e4c-470c-9b34-0c3a97c07873", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013731, "uuid": "73524bc4-cbb1-4e7f-ba4b-b4128eda23a6", "value": "c7ea17f504372cb56c4249fb01c5964a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff47d23a-d96e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625035631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035631, "uuid": "99ff32d0-7681-434f-a8d8-7c4138754fc6", "comment": "Malware payload (NanoCore)", "value": "529db6ca62edcb9b1c96a440b66babac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035631, "uuid": "9a811ea8-e6c4-4b08-b305-35b601ec15ea", "comment": "Malware payload (NanoCore)", "value": "e0616714772d15d3118f1ee3b1c71ba8fd66b3e80e844e66e3550a7e7b6fe01a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035631, "uuid": "8ccafe8f-febc-4610-88e4-e57027f3267f", "comment": "Malware payload (NanoCore)", "value": "6c50ffe26e680fedc9863bda9a91a87121a819a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625035631, "uuid": "b6c2da12-c26b-4747-b278-653bc9bebebc", "comment": "Malware payload (NanoCore)", "value": "3a5453a87db9b2c0f90a8c9b8b02811e38a2211b63d82278dfe0bea0c73b6b058335ee7f962319935390a49ba39bcf5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035631, "uuid": "aef9085b-3550-4140-943e-636c77ff712b", "value": "2FB468FA303B952EF0D4A6FDA995650C04A6994C5C1DA1AC0996A671E1FEF4C0F0FF32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035631, "uuid": "df335907-e91b-4438-8163-5c80eede4741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035631, "uuid": "c590edb0-a8c5-4491-acfc-07b462639293", "value": "12288:FLEFVzMFj3JaRJ7bZFgK0zqqZhYCKUo4sxwKJGJ/e/ek:F4ajZcVF6qqZqUhsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625035631, "uuid": "e36d9b90-24e7-42b2-9038-a25345318b70", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625035631, "uuid": "a7078549-4ce9-468b-8115-2bf97e6b158b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625035631, "uuid": "04fede28-5418-4825-87c0-8c7f2c01430b", "value": "529db6ca62edcb9b1c96a440b66babac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052ddea8-d93c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625013737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013737, "uuid": "4ea0c89d-82ad-4246-9353-3c127ed42a1e", "comment": "Malware payload (Gafgyt)", "value": "8fdf13458f3438c8f7bccd46d728f1cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013737, "uuid": "ddc8b51d-cc91-4c34-8225-e48c375755cf", "comment": "Malware payload (Gafgyt)", "value": "e07a008aaf0a0a2666a705a9756da5bc54be18e2a53a50eb7539f1143548a57f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013737, "uuid": "8c5b9660-70a3-4986-8467-a9e56565644e", "comment": "Malware payload (Gafgyt)", "value": "0cc23bc8d2c3a3da8ca3e69cb332235a7cf81358", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625013737, "uuid": "5c117158-dd2f-4cee-93fd-9b19f70202ae", "comment": "Malware payload (Gafgyt)", "value": "c9f8ede7c7e032f07f582c8fb55e055aa5463e868df70d94701c48bcd61d4f23ca7cbe17666e116480224603489382e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013737, "uuid": "721a7dbe-86f3-49d4-94d7-c3cb5e3375fd", "value": "DBD35C0754A1AF73C086A97619AE79300725EA960B3F1E9B257857F4174F8CE700FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013737, "uuid": "639d1dec-8f5d-49dd-a517-6a29ccd0f1b7", "value": "3072:C15KwUPQb/N3ns7QP225hL+Lx7D08iLk60C/TVQN/g:C1EwUAV3T225hL+Lh5iLk60C/TVQN/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625013737, "uuid": "cca75ff2-0c40-40b4-be0a-d20a84a7c4ad", "value": 137388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625013737, "uuid": "d2727e73-5ad7-4b67-be0e-1162125b2a2f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625013737, "uuid": "7ecdd9cb-26e2-4bbb-9cd9-50522a1e7b74", "value": "8fdf13458f3438c8f7bccd46d728f1cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20795a07-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018937, "uuid": "f1a3a72a-48f2-4405-93cd-bf374f39604a", "comment": "Malware payload (Mirai)", "value": "667cb7f1b69f8d61d9c27d3a62af5980", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018937, "uuid": "c6b9c19b-f660-4b37-8185-581ae78b298f", "comment": "Malware payload (Mirai)", "value": "e1093d59bef8f260b0ca1ebe82c0635cc225e060b8d7296efe330ca7837e6d44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018937, "uuid": "74e9fedd-9880-41f7-83c8-671503d051eb", "comment": "Malware payload (Mirai)", "value": "fedd17734b8e4623883002aa78b36a3fbee5cfd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018937, "uuid": "508b395e-c7d5-487d-94be-a1be3f55f19d", "comment": "Malware payload (Mirai)", "value": "42f6d3ad19938a6f4c338d58a79ef32d344353c9e618b307dd0ee93573321a0afb760f32084441c5794a2bdf324444c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018937, "uuid": "f23af572-4a3d-4dd7-9a76-a82f2d1a7f27", "value": "7CC35426AB619FB7D81ECE3305A94901108CAD5A12D92F6FF1B0E61CE36BD4F48D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018937, "uuid": "8f518ba7-bd9b-4ac2-8836-0ef072f81f63", "value": "1536:UVeTCZ/ekn8gVT/7i/8ZGGX+yGCVKZlCb2ZyAzR2sA4hsqw:UN2XGX+JwKCrGRpTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018937, "uuid": "0744f4d3-b503-4315-83eb-8df81cf0b632", "value": 129688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018937, "uuid": "aae97ef4-24b6-487c-a20b-06164cb3d71b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018937, "uuid": "9bc13143-21f8-404b-b4ca-ef9ddc45039e", "value": "667cb7f1b69f8d61d9c27d3a62af5980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045224fd-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018889, "uuid": "1fae8f8b-f9b0-49b0-86f5-3372fb447cd6", "comment": "Malware payload (Mirai)", "value": "c8bfc540e603174428a1c7124a5fef1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018889, "uuid": "732a4b62-c318-4373-a343-9f7fcd98e4cb", "comment": "Malware payload (Mirai)", "value": "e29d1c2cbd64d0f1433602f2b63cf40e33b4376ac613e911a2160b268496164d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018889, "uuid": "e7d4eb29-90af-4f67-a3a2-074678a8ad0d", "comment": "Malware payload (Mirai)", "value": "6e4b4d7e0c091fb2de842dd6d04dbe7ade761f65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018889, "uuid": "95325139-2e01-42ca-b198-ef251b1c7496", "comment": "Malware payload (Mirai)", "value": "bf7eccebb6dd0c965570c7c58428d2295b189c8fb04b423fda44c33bc562bb2e5097a00f3dbd2582ebe1d87510054ce1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018889, "uuid": "775e367e-be62-4ebb-9dee-d7478dba241d", "value": "9383198A99A5AFB7C046F0B064B95D340B25BD511F1F1A986439BBD4027F9C9B00FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018889, "uuid": "a55f4086-aefb-4313-adf2-1d453bd81dce", "value": "1536:49+qLsCLyIuZg7TAJyAJXgdKrhR5mFrtAVvU8C14:49HF2FZg7cJyGXgErMFr/8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018889, "uuid": "e508d3b6-7de7-4257-8a49-902b25643f7e", "value": 82572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018889, "uuid": "43114fe9-5ea6-4d4a-9ea7-2ac5c316ff99", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018889, "uuid": "08c1091e-cabe-4839-9ff9-2668a68aaf99", "value": "c8bfc540e603174428a1c7124a5fef1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8634b8cc-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625032851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032851, "uuid": "df85557c-e1aa-4caa-b59a-d780bf5d4e16", "comment": "Malware payload (RedLineStealer)", "value": "3ec9a559d4ba30557916e9dbcba6daa9", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032851, "uuid": "250feda9-7768-4cea-886a-4bf9a6549c27", "comment": "Malware payload (RedLineStealer)", "value": "e358fd349ec54deaa1a4926892dd9e1e261777976f78f87627e54e3cbff06019", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032851, "uuid": "67064174-6b0d-4094-a63a-b624183128a6", "comment": "Malware payload (RedLineStealer)", "value": "305b69665703112106abc7d5e2750542278d97ea", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032851, "uuid": "69695804-0bb3-41a3-836b-b792f4593578", "comment": "Malware payload (RedLineStealer)", "value": "c1b88ed1c06eb0707c4decf0567af9e8f66e48679bb0c710cde57bd15256c3d27addf518efda189d1ecf3b8bff6c5d6d", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032851, "uuid": "ab530e7c-67dc-4cda-9f17-b924d3651dc1", "value": "7B842528647FC01985E3EEA12EDCA8FBD99A55E3640C743701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032851, "uuid": "d86001d1-f57f-41d9-8772-c8ed9e43d914", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032851, "uuid": "8cf8b53d-b351-462e-a5f6-f9252f152fe7", "value": "6144:55YqofbJodjLpyQQlD+kLKvo6Tv/32pw+lmL7R:55Y3fbJodXpyQQlDnLKvo6Tv/3+w+lm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032851, "uuid": "feed554a-2664-43f3-a290-c42e7d466fa9", "value": 392584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032851, "uuid": "a154324b-e081-4de6-a9ee-0374916cd825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032851, "uuid": "35abbf4f-2d36-4a66-a3d0-fc1b04db0c0b", "value": "e358fd349ec54deaa1a4926892dd9e1e261777976f78f87627e54e3cbff06019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82be0edf-d9ea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625088680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088680, "uuid": "7b031aa4-7ffd-4960-a5d9-b48937be2ebf", "comment": "Malware payload (AgentTesla)", "value": "3daa9fce976222981c22c970701fcfe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088680, "uuid": "9173ab0c-d59e-4eff-8bdb-6d6cc9efe124", "comment": "Malware payload (AgentTesla)", "value": "e3d3ca8a2fe65a80a3a730f49c63cc2f989550f4a5d14ec8d6e815924d93b532", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088680, "uuid": "d7e16f6d-c90f-48ae-9f5d-1d4e93247c73", "comment": "Malware payload (AgentTesla)", "value": "9752544f0d004fe9fa3864467750e0089b3a1088", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625088680, "uuid": "1be4fe92-b950-4b3b-8632-75e0a91a4685", "comment": "Malware payload (AgentTesla)", "value": "50442b83fada119eedae5b88489795fd8e887e155c4b48cd9699b051b09b9fbe6014c21ce306d0fc3dbe126238defe36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088680, "uuid": "ba0cd041-f97a-4371-b265-048acabe369b", "value": "63F4023429FAC508E17F4F7DCAE46081E77BB6652532E60D2408215E0F53F918A62BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088680, "uuid": "3d4d46d4-7443-463a-95d9-8377ecb99eb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088680, "uuid": "ba5afab9-5383-4151-a93e-f4920f57fe9c", "value": "12288:+xKM1MPxsDNh/4L8XVh33+iLSAkuKKEjK+yu0FbKmIrtGC1PPRjtlOQTwL:OKGso4L8f3OiLY/UFb9Ir5JJjtYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625088680, "uuid": "64bd7262-19fa-4e2f-b14f-fd28bc2aa8c1", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625088680, "uuid": "3ec81cbc-0f80-406a-8737-2a945bef5405", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625088680, "uuid": "af120b9c-d74d-415b-bff2-573a8ae088d5", "value": "revised PO201128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069d8583-d9b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625065708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065708, "uuid": "d15c06c1-869b-4803-acde-89813dad2ca8", "comment": "Malware payload (Mirai)", "value": "6a3ebb8aeb33965bc93410b2bbfde0e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065708, "uuid": "281ba39a-a2cf-40ea-83f9-9232b44c28c5", "comment": "Malware payload (Mirai)", "value": "e3e241ed9e91445e79ee6c419f4b26f26cd46cd32cb543b3748f82f729eb352e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065708, "uuid": "1fb6b24a-caf4-43a7-97fb-3834a28c5797", "comment": "Malware payload (Mirai)", "value": "7ac27d9f3c1ebf5936ffcfd78e2ef3a6e04e3a79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625065708, "uuid": "ae1efd45-8efa-4a4b-aaa1-cbfbb4084b29", "comment": "Malware payload (Mirai)", "value": "eb6625ec27825fed00116250e7b172381219980fcd44f0358f929d008622f70d34d266f1195a11574a6b554a9ea35cff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065708, "uuid": "91a641de-81bc-483f-9fb7-56764e6f0c43", "value": "B6A2C0E4C17B4D55DEEA9F702DD3C6CE3BE15E4F71964CD71191FB52222A8A24A88CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065708, "uuid": "64b23c5a-8970-4601-ada0-da6346675612", "value": "384:mjqkELJFswRcYiHRBoG7yLOLUm6yE6+8cbPDRM4uVcqgw05LxJ9F:FlJFswRhi3ZXLUR7+4uVcqgw0zR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625065708, "uuid": "3fd61f11-61b7-4f04-8e0f-b26140c5eb19", "value": 22280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625065708, "uuid": "0156a82a-f822-4150-9ab4-48b79c1f0c98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625065708, "uuid": "a96ba5b1-dffa-426c-927f-2fa67ed346ea", "value": "6a3ebb8aeb33965bc93410b2bbfde0e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d428218e-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625019238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019238, "uuid": "889ea0cb-f24e-4cbc-a73a-4c8730d77f5c", "comment": "Malware payload (Mirai)", "value": "12c8dd2aa671d5df2b6e841d50b26081", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019238, "uuid": "c034f135-ec93-4764-a395-e72fc79b909c", "comment": "Malware payload (Mirai)", "value": "e6523f691d0b4a16cc1892ec4eb3ee113d62443317e337412b70e0cea3e106f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019238, "uuid": "1981dd6e-2bb1-4638-ba61-1ead8a628968", "comment": "Malware payload (Mirai)", "value": "5bd05c17c26dbc358585e6d4f582ca830dd815c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625019238, "uuid": "60d70d8f-c9fb-4b79-9768-fe2fa4042160", "comment": "Malware payload (Mirai)", "value": "b29f6f9b60afc8f91b25c5ca8d3c98955bbb806c1661d71bdcd0ea30675ddb31af658a17b36dc3f904cfdb986e614c04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019238, "uuid": "d0cc2272-4af7-4ad6-b390-a3eb42cf46a4", "value": "8E732B52B781DA73D10310F212E2EF260532FE7F2866E95AE3A57DB4DA390C09611F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019238, "uuid": "7db05dbc-15fa-48a3-b3a3-7699410af474", "value": "1536:LJCaWbNSwUdctHB2QvoBlSdcLKx7ya5/tEmZ6:LJCa4SwUdSHBCBlic2x7yIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625019238, "uuid": "38de1e02-3b1d-4e2b-ac7d-b6a5d16f6204", "value": 74104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625019238, "uuid": "de4be7ca-9a28-49b8-ae5c-2ceb8daa8645", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625019238, "uuid": "633988dd-b456-4546-898c-75cc6e880cbe", "value": "12c8dd2aa671d5df2b6e841d50b26081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff695ad-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625059067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059067, "uuid": "abfc962a-342d-4ec2-9fa9-5f3f331c0b8d", "comment": "Malware payload", "value": "0a5da55c6efe4bf83da5dd72a0477004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059067, "uuid": "786b74d7-b7ff-416f-9313-988a44e7ef61", "comment": "Malware payload", "value": "e706fc394ac5f6e433c9ca43924c703584c216b539faf383690e7062014edb8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059067, "uuid": "8f6954e4-0962-43c6-a47c-7fdff2b1a8f5", "comment": "Malware payload", "value": "d3c535eb63613ecb4dcb27aa2f20c953757b70f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059067, "uuid": "77bac5bc-6f10-47e7-a90f-de87276d557e", "comment": "Malware payload", "value": "6c9930a4be8d0d9cc0cb7b85dbf5fcffe50ad975196f5108a47a137e573a53cc3f116c08965e5ff40a1d3d62c803f9bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059067, "uuid": "14a7e2a2-635a-46a3-ae1b-50a4a8dbf1fc", "value": "13155BAC329035DEC467D6B9CAA8AC74AA653C66431BC107909709DFAE0DB93DF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059067, "uuid": "3194ea4d-571e-43fd-9c2d-153507969b7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059067, "uuid": "b8ea5465-6718-4137-8fe0-7ba0e39695e3", "value": "12288:nwiTM0VKmkqLt+ranftid4VEXXjYHQyKxrPX0HxMvWgznlziVYwUnfSj5ETZQy1X:rTzLtjsdPXjM32XUYbnlzZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059067, "uuid": "aa9606e3-48af-4652-ac1d-0953dd449734", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059067, "uuid": "5d893a5b-fb61-4239-acbb-be7ee191a4b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059067, "uuid": "67983861-0cc7-4828-8e02-d57bf9d46cde", "value": "RFQ JICPRHR10631 Office Furniture.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b992a44-d9a5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625059033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059033, "uuid": "e646832e-82bc-4dfd-9729-c29d2acd44cf", "comment": "Malware payload (AgentTesla)", "value": "c31881c06f1b29c911a463e4e1460d90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059033, "uuid": "7aa86df6-4d64-473e-ae83-c81e01e3c2fa", "comment": "Malware payload (AgentTesla)", "value": "e74a9b3b43652b7e810bce899bc41a5ad626bd252cc5ddb5fc4a65ae863cc761", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059033, "uuid": "a847ec2b-ff40-4151-a6bf-aedb31de8057", "comment": "Malware payload (AgentTesla)", "value": "04bbb5fba6de56eb86a2d39a0902599a9cb7296c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625059033, "uuid": "9668a387-e2e2-483e-a453-08761dff34a3", "comment": "Malware payload (AgentTesla)", "value": "b8757bb956432ccac75a4d72cc6c62e25d8d7634b5a9619114a74b4767d2472023963fb7d0fe95534a075ad7df1144bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059033, "uuid": "82527398-d36c-4b24-8230-384be2b7af13", "value": "E2659E3D19BE2237D2BDC3B98BC88C2BF840966B70617E7858D753A54706A4379D213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059033, "uuid": "f243d910-d552-432c-9148-2579daa02999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059033, "uuid": "240ba48f-bfe5-4b4d-ab64-b92b28fd839a", "value": "3072:dwPsuT6YguK50aomd1DfhLexVvEdlen998c4aug4KjyPS+gbDmYdF2+Qc9OaVspN:DgKR5hixdEdg1eaL3jdYpaVahFVBbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625059033, "uuid": "090cf54d-36b6-4306-8dc8-efdbc42aa58f", "value": 1549312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625059033, "uuid": "fec19aa9-229a-40e0-a1e1-a98f0eb9f136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625059033, "uuid": "00a6519d-903d-475c-a6f9-a131b9b262eb", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8152d67-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625074650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074650, "uuid": "ee3a1025-e2ed-491b-9c9d-ff7d804e8f11", "comment": "Malware payload (Mirai)", "value": "c49ed40a19cf34879be308ac262790f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074650, "uuid": "e33d702f-d350-4df6-9c27-815fa4f5d9cd", "comment": "Malware payload (Mirai)", "value": "e7c006c0267f9eff3dd8c261cb5647bfaa48a30cfa5bd2077ae2afd9b4a32328", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074650, "uuid": "b165767a-417c-475a-811e-2d234b3c13e1", "comment": "Malware payload (Mirai)", "value": "b1eb4ea5ddd8ca11652cb276c8ef0dde2cdaa7ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074650, "uuid": "d002c6dc-e8e7-4edd-8b07-e7cf05c6a08c", "comment": "Malware payload (Mirai)", "value": "4350f2a177e2a388ce36bf823a91634aefdacd225eb47b63935a9d8e257cddbbc2ea6b5c56e03b268167d493a500cece", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074650, "uuid": "0a16dfa8-4fff-415b-8b97-5559531b28a2", "value": "0203F2C5370DE97289A42C7CB967410652ECEF38A4E8FB57B64D426989C3F04927C41B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074650, "uuid": "d0f174c0-98be-4abc-a2ef-aa30fdb12786", "value": "768:NyvfY6RLFjh6jTCkMOnK5YIdHHZTFzul1/J7pnXq3U7jv:gRLFhiTC9OnxIdHNVkJ7pLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074650, "uuid": "16111c49-aaea-4772-99e3-2780e623539c", "value": 40312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074650, "uuid": "358eaf64-fedd-4249-8326-4f6b5b154400", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074650, "uuid": "e54f441c-4639-4163-a42c-6177acf11957", "value": "c49ed40a19cf34879be308ac262790f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406b7330-d997-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625052920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625052920, "uuid": "a0187e76-4148-4d1f-866f-751e6d53ec04", "comment": "Malware payload (AgentTesla)", "value": "b8b983659cce2f715b3a81d650c80df7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625052920, "uuid": "db48edfa-722f-479a-84f7-4908e96661d2", "comment": "Malware payload (AgentTesla)", "value": "e8e003992f2171cb3a00363655a00a66c73de119bdee835340507d2343857bc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625052920, "uuid": "9148b8bb-9285-42df-b517-97664279cfc9", "comment": "Malware payload (AgentTesla)", "value": "49f1de88866bde3c83839255123571f87a551268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625052920, "uuid": "6e13f3f3-28b8-40bc-9d58-1231462b083b", "comment": "Malware payload (AgentTesla)", "value": "ab44ce3bf81ef675b9cb7c47a353ff2233d314eee20a1242f3e2c8528da5fc4c3ef51bb23bac9886ef63f963d6ffafea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625052920, "uuid": "71007415-a539-4aac-8168-4003683af729", "value": "02558C20B994D519E0BA5F3D8AA5941462BEBD637F23DD5C3DB933DA0733283C8A015B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625052920, "uuid": "9a07fa39-7f20-467f-8da6-0ac7fa576d2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625052920, "uuid": "100dd556-6ef9-496d-8526-0b12672d0eca", "value": "12288:jHOWKUXBbX5TyT4y2pt+4y2ptZoQ13Bg4pTMCO4mAnSA/eXhu8f+D6Y512bI6Ky4:rrKuVyoyOBpqBI/vJDw86Ky/8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625052920, "uuid": "abc6c86c-9391-42ca-98f2-87cad562a02b", "value": 1337856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625052920, "uuid": "0beac095-9afc-4046-af60-dd0a7cbbb0f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625052920, "uuid": "377a965a-873f-4640-904f-e66336e30a25", "value": "b8b983659cce2f715b3a81d650c80df7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4f6bdb-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625032974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032974, "uuid": "33baeda3-b131-4961-8cf7-78d19c745e28", "comment": "Malware payload (Mirai)", "value": "900038aa78670e7d928874f9d8a96cca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032974, "uuid": "8689e84c-f6e3-4018-b0b4-a84879e50fb6", "comment": "Malware payload (Mirai)", "value": "e9335ba971f70d151f9622639e988a5964c5b140204a1290ed53040ae04bc457", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032974, "uuid": "cd139f3a-e997-4d8d-bd55-32b242afe99a", "comment": "Malware payload (Mirai)", "value": "e02d7b8d2b266a276bc31b96333f1a430ae56932", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032974, "uuid": "7dc1d9a8-2888-42cc-a01f-5bdffc1d2c8c", "comment": "Malware payload (Mirai)", "value": "3ab8e14da66129ccfa61c71a5e8e640269113bd061a152df9138efe34ab5182128897adea1cf36ef594f181ae8de52d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032974, "uuid": "3e2dba03-b0b1-4d97-8876-0502a4ceaca6", "value": "0D93734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032974, "uuid": "42586271-1291-457f-99e3-994f341cba57", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOA3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032974, "uuid": "9f4b9630-ee65-4484-85a2-628ec93c2135", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032974, "uuid": "8f0a965a-9419-471f-98d6-4c9676944c9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032974, "uuid": "426974a3-7e99-4d59-9c6a-2fd017c0cad0", "value": "900038aa78670e7d928874f9d8a96cca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccacf5cc-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625032969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032969, "uuid": "fc62a606-7e9a-47c8-87bc-3518b87dd9ff", "comment": "Malware payload (AgentTesla)", "value": "a7f717072a0d35f306a3ff529570800d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032969, "uuid": "e5a01d99-411d-47e0-9cb9-92a16eba0522", "comment": "Malware payload (AgentTesla)", "value": "ea1f0cc9f1ed750600f0868ef8e52edc38ad36dae0d15af99de11af3176d3487", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032969, "uuid": "e4384f0d-0218-4af2-9271-e9aed63abd0f", "comment": "Malware payload (AgentTesla)", "value": "5916f3231c24971ac1192a384b558bbd8fd9f88b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032969, "uuid": "7c48bf39-0d2c-4c99-a069-03c1b05ad6f8", "comment": "Malware payload (AgentTesla)", "value": "a12567879b3801097632dfd8cef0741655a5e50eb8679dce197b7153af3d497816b6b8f938b6384386be1d08439babfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032969, "uuid": "b7b7f078-9368-45d5-baa8-49c117d89cc6", "value": "9BF4BF342EE95625E1BA9FBD96E06451A7FDF2236F17C86D3CB502C50313E42C9F122A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032969, "uuid": "1d832f62-9008-4058-9b5d-50af24bd5e9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032969, "uuid": "c7fe6995-79f1-44e6-8fd7-787185a7c6c9", "value": "12288:aiizba08w/BZkanwBbX5TycSQ5hBZmgfI1p4rRLQw2topkeo8ji/FrYZI9wjnUMv:Wwl/5hHmgA1pwRUKpkrzuQrbJomK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032969, "uuid": "77258506-b160-48ef-b435-a2539fbb2d58", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032969, "uuid": "e401c5aa-317e-4a83-aa4a-1dbe092e37f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032969, "uuid": "3b056b32-5f2f-42f2-a5bb-d3f4c2420fb1", "value": "a7f717072a0d35f306a3ff529570800d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ee8180-d963-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625030644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030644, "uuid": "8da3189f-9492-4794-97a7-e76368e7f03a", "comment": "Malware payload (Dridex)", "value": "4bc3b81fe5730c4f791f3dc2b1f3138f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030644, "uuid": "97774cdd-59c3-4ea9-bf0a-1598c43b01b6", "comment": "Malware payload (Dridex)", "value": "ea71b5f8a02b2951e03de8faff5d87e52d8d51dcef386d513727ee33520fd215", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030644, "uuid": "ce3f9895-2784-448a-a1b8-c777d03e9d7c", "comment": "Malware payload (Dridex)", "value": "cde5f760279ceeabd3e959151f5672164ea32c1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625030644, "uuid": "90711269-94d7-44a8-b443-64ebe24e3637", "comment": "Malware payload (Dridex)", "value": "568d2f3568fbec702385b77ac23f965a5f384679ad2b8b983579149a042d1b7c57a6275334fd52cecf44e09c35949c1d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030644, "uuid": "54cc80e8-f596-4795-a39f-3e1bdaaacf1f", "value": "2DF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030644, "uuid": "e453b9b1-9f29-4fc4-b69b-ee43bab154be", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030644, "uuid": "fb0c2c62-6a1c-4e6a-b29a-ddb2bf8a7b39", "value": "3072:OWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:O42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625030644, "uuid": "0902aa22-7a03-46c4-8594-a9610db8f54e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625030644, "uuid": "e3ff631f-9a2a-400b-9176-619a5863d053", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625030644, "uuid": "ff73cf83-c840-4e4f-9da1-f48e3bdccd0a", "value": "4bc3b81fe5730c4f791f3dc2b1f3138f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc16206-d9a4-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625058822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058822, "uuid": "d33fb3bf-e851-440f-99fa-8ac1a7108036", "comment": "Malware payload (SnakeKeylogger)", "value": "2c9aed0661ce0491e58436b9c47d1245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058822, "uuid": "6cf40272-49b1-403f-973e-20a3fb179b76", "comment": "Malware payload (SnakeKeylogger)", "value": "eabc684c6ec2632dec308766f3a11dec1bc238a96cb65fd07733aea1d6052c3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058822, "uuid": "07391e6c-fd58-40a0-bac4-c500f8e5078a", "comment": "Malware payload (SnakeKeylogger)", "value": "ca5b8d9a14a5774b59a26d8c7576e2514e7b0f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625058822, "uuid": "42deee3b-a3d0-4261-a788-18806b16dc9a", "comment": "Malware payload (SnakeKeylogger)", "value": "41240b036b89c25943ef6de012ad2019c816781c93d6b94598a8491e7a04cd96cfb0f13ebf2a785a78d39b8ed0da450d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058822, "uuid": "022c1b29-76ab-4bc3-b922-d7d21b14b365", "value": "FC059C3D59BE113781BDD3998BC88D2FF880D66B31217E7998D743A5870AA8375C213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058822, "uuid": "d58a2ab9-48d4-4c52-afaf-99559e319675", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058822, "uuid": "40bf3161-7144-4eae-a538-9a5ea5d52abd", "value": "3072:LlSqfUfxcsdpVru4fi1v5Fp6uad7gT3epkuN727tIbfCsXzUgmgz2urCm4uNX1Ug:4qAxBp04qj+u3DuxII+swgLpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625058822, "uuid": "503b7889-99a5-407d-b3fb-30ddca3984ed", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625058822, "uuid": "861823f2-1726-4050-b9f4-c7cd8521610d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625058822, "uuid": "f49b2bf8-3d6e-49a1-8138-459990313f15", "value": "microF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ab54bf-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625032734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032734, "uuid": "0b626b88-9269-406f-80b4-978a4bdc176e", "comment": "Malware payload (Mirai)", "value": "31c0c3af728afdc9f97a2eba345dcf26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032734, "uuid": "4a11ab9b-2d34-4f90-8e00-5ef07aa5eaa6", "comment": "Malware payload (Mirai)", "value": "eb0f986d2fccd04197a1815445f12c7d58607cd8ab16c12c97d0ba579235e705", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032734, "uuid": "df481b54-a788-4f39-8d87-36f87947a37c", "comment": "Malware payload (Mirai)", "value": "f806b46be81459b7313de1147a676423b72f85e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032734, "uuid": "b0469f85-cec6-4f1f-80ed-012209efab48", "comment": "Malware payload (Mirai)", "value": "8a19c179c16bdc8d03f5e07c442d655ef194fd559a442a8ad00e24a2fe5e35c637339e617ddefe9e951e21d5b3029a92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032734, "uuid": "440104ae-1c32-4bad-9891-705f12fc7699", "value": "115329C8A593F8F5DC140978307ABB66AEB3F13F7035E99BC3D86927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032734, "uuid": "a4498e58-d436-4b32-8629-78d631b81c82", "value": "1536:IIG9170vwHbQXZ5+qXDEuXi9aBSW7V/DjObeFt6PuQ4Zo:I917iwHbQXZ5+qXA59eSWZ/XObeb6GZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032734, "uuid": "40c1a314-07e4-40c3-aec4-10240577973c", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032734, "uuid": "0a2507e8-59eb-421e-a308-0526d39d9e55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032734, "uuid": "7b52084f-0912-47fe-8b83-a14522f9e9fe", "value": "31c0c3af728afdc9f97a2eba345dcf26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963c5802-d9cb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625075398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075398, "uuid": "5cebf0e1-5228-42a5-a925-2e0778f7bbc1", "comment": "Malware payload (AgentTesla)", "value": "3f977a00307463d3aed02845e4601001", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075398, "uuid": "c72b44e7-c1fc-47d7-ae39-81ec9c1d7070", "comment": "Malware payload (AgentTesla)", "value": "ec62cfe26fdfab4405986ac6ec9a42b5ff016500a9b69ede745b948b70c31625", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075398, "uuid": "7a3912fa-de00-4e94-8c6e-b4897d2cc883", "comment": "Malware payload (AgentTesla)", "value": "21d015db91ce39945db47157812f9a351ad27087", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075398, "uuid": "267c04db-697f-4cf8-b8b7-e2d904a56443", "comment": "Malware payload (AgentTesla)", "value": "d3c29d5fcefbb3b06ce976dcab558bc964f92f6551d201a794327090d8f0e5ed82c0c7c2d2fc23bb7753271bb7de8413", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075398, "uuid": "3ef1390e-67aa-4e91-91f6-268421f59c0b", "value": "90F4123835FE8405F5BF4BBE49E5608097BB64763633D60E244D114A0F53B928EA2B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075398, "uuid": "91d81fbe-e2d6-422e-8cd6-270c4ab041c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075398, "uuid": "941b7652-2f54-42a0-a6b5-373344e4ac35", "value": "12288:axrdw199YchTtGwSfy8Vq3/lnsCzpVQ4jSYg4QBci96SBC5PWSe35wKNrSlwTESy:qrC1/YSkK867pVQxYYBci96yGPW5Jrra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075398, "uuid": "3ac1d610-f3ad-4e74-986f-d1e54bb00989", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075398, "uuid": "57b59485-5d5d-43c8-b4b3-43c40a1a64bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075398, "uuid": "a2e4b05a-5200-4865-ab08-d4d6b1e6115a", "value": "3f977a00307463d3aed02845e4601001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b1b942-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018924, "uuid": "0eadd41f-589c-451f-9051-efdc76f464a6", "comment": "Malware payload (Mirai)", "value": "83798a75fa3b4e3fb2ccb45f3070ed5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018924, "uuid": "8dea99fd-4689-408f-896e-2d88aa2f41aa", "comment": "Malware payload (Mirai)", "value": "ec9387b582e5a935094c6d165741d2c989e72afc3c6063a29e96153e97a74af3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018924, "uuid": "cd863dfc-ae58-4940-aaae-1a1d01c4239b", "comment": "Malware payload (Mirai)", "value": "634686fdb57fdd4d7f6567a5558d2f0ebabc54b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018924, "uuid": "18d22411-537d-44d7-9667-b2af92664ae2", "comment": "Malware payload (Mirai)", "value": "d61494d941f4e825f7f24277a18e77bff722ba8a015a0996985779299ff2659352826029df0d13c8eda445fbf75b5046", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018924, "uuid": "4c08468a-cc01-4bb6-b5af-dafb89f055d5", "value": "2EA3B62B6B230F23C0D6107112E31632A8B9DF9934BC97D769E07C9D5F399883456AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018924, "uuid": "8f514b34-f447-4118-a718-1dbbeab765d1", "value": "1536:8EjcPRg3ppMuhBYyYE1Zk1hN95l/1tprtYcw:WMpyjETMhNPl/t/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018924, "uuid": "c6890d01-1928-4811-8e6f-2ad95d219870", "value": 99728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018924, "uuid": "4f20e56d-8312-43d1-ae00-9832f4c9be46", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018924, "uuid": "6cfd2306-b9e8-44fb-a104-446af33a49f9", "value": "83798a75fa3b4e3fb2ccb45f3070ed5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb81798-d947-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018878, "uuid": "f08d1217-20f9-4004-b2ed-b48b957f20d6", "comment": "Malware payload (Mirai)", "value": "59e7a95ba0e60d659f9e3ba36d7e7807", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018878, "uuid": "9057237c-393d-494b-90e5-4354e6d07d4d", "comment": "Malware payload (Mirai)", "value": "ed2eaf4c44f83c7920b2d73cbe242b82cc92e3188d04b1bb8742783c49487da7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018878, "uuid": "5268dfd9-e5f1-47b5-af38-968ac17b0145", "comment": "Malware payload (Mirai)", "value": "3229ea0cce9370465e698b692e71a5b7f85e0aba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018878, "uuid": "bee65c41-16a3-43eb-9a8d-fb8b6bd658f4", "comment": "Malware payload (Mirai)", "value": "42d4fa8cbbce74e929c429df0aa8f9a05657d747310172c6d646b62f8b4a3badda3a317bcea7cca4af870aba6c796ed0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018878, "uuid": "b3dfee45-2536-4709-9741-62d58f7630c8", "value": "D6A30944E560971AC3E333BAFB59418E32231FA8A3DB30259934FFA423F6BE61535525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018878, "uuid": "12c4a514-e55a-4ecf-a1ae-2874e660ab44", "value": "1536:5gnn1WTef9i6qHcJBNlBaHuVCEdZ7ifDEI3gfHOaO5jBY2CW7Yeclq:rrvHUDBaWkEI3gfHDORoIolq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018878, "uuid": "83ed2510-9a76-409e-893a-c7e66a9d6e7a", "value": 103244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018878, "uuid": "3eab8295-7ac3-4d0a-a439-bc76d2fc73d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018878, "uuid": "6ba6e0e3-093a-4aac-9ca4-353b4049da7b", "value": "59e7a95ba0e60d659f9e3ba36d7e7807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8393320-d9dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625083294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083294, "uuid": "03ee5e46-c941-471b-bf7c-1766febf50f0", "comment": "Malware payload", "value": "a46558b1e3059e8f9fd03cddedaec16b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083294, "uuid": "699da14e-1d1e-4ec2-89c9-3ac5df4bbe71", "comment": "Malware payload", "value": "ee4cdfef12991454dd893fbf83e7cac2a5f29e60bfa9ed2a7f1e78d9e69bceb2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083294, "uuid": "c7f3eb92-6c3a-4895-b31c-ecc43848c010", "comment": "Malware payload", "value": "70f1e56e0691be8d4f7a52ad25bd9a6da034deaa", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625083294, "uuid": "3bc545ca-71a1-432a-a46c-69310b0277a2", "comment": "Malware payload", "value": "23372d0e2b8500e78fecd0c7548ed9b882c871f3811a8528ceef4dd27c36bbf710a67c0d35db5b9817a72b19203a48d9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083294, "uuid": "aa01b535-3497-4a9e-b95c-aaf97c5a7808", "value": "47241245E12BE811EF8F547BAAFA2EF5136A0863050805339635346CD5A7C6FD2287FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083294, "uuid": "7643cb5f-9883-4f4d-86d0-46c3f9e86250", "value": "6144:fkwPMpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56RF:cw0u9l2pgxjt6XUyNW+Md567", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625083294, "uuid": "f778c024-7687-484b-b2c6-3ab2db2e2836", "value": 218318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625083294, "uuid": "29b8a9d1-bfc2-46fe-b9ee-5b838caf87ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625083294, "uuid": "b77e0ee9-68e7-4d2a-9aa5-50ffbd0566cb", "value": "PO 491196.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fb53b9-d977-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625039162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039162, "uuid": "e9a5db20-f20b-4c1e-810d-42634cc88192", "comment": "Malware payload (Mirai)", "value": "ed7e2a04200d3fa79aa286a5a116f222", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039162, "uuid": "1331018a-80fd-4bb1-904b-c93c9496948c", "comment": "Malware payload (Mirai)", "value": "eec0db2bc30c8aa42d7bba8d8204c2eb392eb670fff1346939bdceab88a19dbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039162, "uuid": "743bbb02-e0a5-4167-a68f-97fd8cdca362", "comment": "Malware payload (Mirai)", "value": "58c8fac0ecac4586474669471531efd4a577457c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625039162, "uuid": "25e57cb9-d670-48e7-b5ca-546fab3dac85", "comment": "Malware payload (Mirai)", "value": "cffeb86d5262d0d862d8bd96dafac8de599613d55c4710bc5461f890cad51bf40a03bed804bcf211adbed832515cbebc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039162, "uuid": "f6393831-5b44-48c9-9730-4ed7b97ea95c", "value": "10F2E032F1C91DD1EAEB8AE05CB59BC07FF4DAA522D385F0D5C2AF04E6225727104AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039162, "uuid": "a9cbb430-ff29-4f7f-8875-ee12e7564a7e", "value": "768:L5nGGh+LqlSQxpnzptaFDv2cQGzDTkEnUFHUEJsu54uVcqgw02NWXm:BGGeuSapzHGDv2+zDwGMUI4u+qgw06WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625039162, "uuid": "1f4c43a2-4491-4b98-89cf-c95bb8e32509", "value": 36512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625039162, "uuid": "a276a5fb-49eb-4d7a-8ad6-e2baf4e59428", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625039162, "uuid": "56bf70ca-4657-43be-88cd-3c2fa577b266", "value": "ed7e2a04200d3fa79aa286a5a116f222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afd7447-d976-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625038899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038899, "uuid": "64c41db9-6c37-4871-ae80-1b7d4d2bba24", "comment": "Malware payload (Mirai)", "value": "d603f5129366f3ebeff41cf5443f0c0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038899, "uuid": "60470b5a-58e6-4aa9-8812-0454bbe4322c", "comment": "Malware payload (Mirai)", "value": "ef7be3bb2f3b92df1bc78c9fca091a126ffc5c8a99570d62d654c500cca8956a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038899, "uuid": "65e98f80-247f-40c3-8cba-2cc0b878483a", "comment": "Malware payload (Mirai)", "value": "c9a92289bda0149224151e190810b2e9cbab8f87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038899, "uuid": "9cf8125a-01a9-4cd0-896c-ddd8bd7cd7f7", "comment": "Malware payload (Mirai)", "value": "7c9dd2e0b81facdae689e6f92b7fa3284b040517f783856d64f0d0533c4da30c3f2680a033eb36995d73f3277b9546eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038899, "uuid": "38518427-d22d-4d38-b24c-65a545965f12", "value": "C8F2E0739188B072DA541871A0EA06CB337D1EBCF4D3621506CC976CF666067AAFF51B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038899, "uuid": "88a32520-b0e6-472b-8d39-308a15996d9b", "value": "768:inhWYMpSp93FZKG0E0hdyS2SNXcp9+5fh/JXWU6C/3Uq:inhWYMopoG0E0h92S6p9+dh/JXWUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625038899, "uuid": "bd924acc-197e-4f1a-b83a-9f5de5f68ca4", "value": 36940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625038899, "uuid": "ea98925f-4f0f-44c1-b265-eb8dbe4a31fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038899, "uuid": "7eaccfd9-9299-4dc7-8115-7e427bc79f23", "value": "d603f5129366f3ebeff41cf5443f0c0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e44a179-d98c-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1625048219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048219, "uuid": "31fc2556-6514-4363-b3cf-ae58d9722ed1", "comment": "Malware payload (NetWire)", "value": "f27164ca71ab7c3f37423a20d80b82c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048219, "uuid": "9ee6ab69-12d6-41d6-80ca-6b2a54f4f122", "comment": "Malware payload (NetWire)", "value": "ef9d94b683a4354982f31afb73185d5d47d50b908168b0e612f7895eb4e0d757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048219, "uuid": "caac4c0c-3235-4691-b6f2-959e0d8d6f0f", "comment": "Malware payload (NetWire)", "value": "234f4c22fc1e435effd208c3b8276f8e65299e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625048219, "uuid": "97f0c74a-bbab-42f1-a4c9-9f247c818ebc", "comment": "Malware payload (NetWire)", "value": "8fbdfd0ea074f797185ed5fa3296a277258d2b851c7fcfda3a855dd45c5c791af2ce1d66071fc464592b448def878113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048219, "uuid": "37943183-34d1-4624-b5c5-a8cdc0f9d78e", "value": "9BF31719FA8794F6FE0B1D31919BF33F0B757A01C130CE92EF541E86EA23C26151AA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048219, "uuid": "06636ae7-f0df-48d8-9e31-37a3cfd011dc", "value": "4563c74acbd357d386b177e402b96ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048219, "uuid": "50b9c652-4bc6-4843-8ae0-6bc85638c266", "value": "3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvifYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/kzQqqDvFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625048219, "uuid": "182bd03d-927d-464a-afbe-5123718dd6b1", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625048219, "uuid": "6cb483b2-f136-4d1d-b7e4-74dee6c472c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625048219, "uuid": "157b48e9-d321-455d-b5ce-58b381559f90", "value": "F27164CA71AB7C3F37423A20D80B82C4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9c30fc-d9cb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625075305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075305, "uuid": "07a0a1d9-4a61-40a5-ae66-f4b6b4be4100", "comment": "Malware payload", "value": "d8bf15ff14b3d691a55c79198b965cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075305, "uuid": "a5d2bd9d-9845-4feb-8f5c-fe52ded5dcae", "comment": "Malware payload", "value": "f0384e2d435f1956072c37acd61add6ad74eb9249e282e8a5fccce4bcdb13d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075305, "uuid": "da03db6c-66d5-4f88-8930-61c8a4d9dc36", "comment": "Malware payload", "value": "a3534d7d150aeacb282ca4a08ce0543b540a27fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075305, "uuid": "2433e7f5-6cde-426b-a9a2-03cbf997cde8", "comment": "Malware payload", "value": "3da3b013e7c2deb4008d44f28139557851e91c98614a60e8d6c43e15a8f4a52ee9f9a699bf31acac52b07319ddecb9d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075305, "uuid": "d272de98-cb70-4271-926e-13d084e8a7ec", "value": "0FF44BAC315435DEC567C6BACAA8AC74EA617C6A431BC107909309DFAA0DB93DF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075305, "uuid": "18bcbcbe-b3fa-4ff7-9502-eab06416dab7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075305, "uuid": "18ebed7b-a73d-43cd-87a1-5fd2daacc815", "value": "12288:wwiWdwYgrn+Lmnen1XdGYHE9ThBpLhtLVdCN+H8KQVfahle6avea4gxDQMyUBouX:ya+i1NGz99BpdtLVK+JQVfOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075305, "uuid": "8c0e2994-321e-4c5a-ab5c-ce3f629992f2", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075305, "uuid": "47b467a6-e887-4b96-a94b-ed3cf0d38c2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075305, "uuid": "06c8e29b-21df-4971-86bd-facf672d8aef", "value": "d8bf15ff14b3d691a55c79198b965cbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d2e304-d9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625074374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074374, "uuid": "02a3ed44-9787-471a-984d-9ef7333ba913", "comment": "Malware payload (Mirai)", "value": "d4a00608de1432b8e0ee77cca2504f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074374, "uuid": "dccf329e-51eb-443f-a8df-c97b7da83b8b", "comment": "Malware payload (Mirai)", "value": "f03eb9d8259c360189062bfe9d73ddb1358448c401bb76911fc0c413f3b85684", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074374, "uuid": "2cb24223-4bc3-4c52-8520-73c78ae8e1a9", "comment": "Malware payload (Mirai)", "value": "423f17fcc5919811ab50b1deb53b4011805e8784", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625074374, "uuid": "efa712cf-8a5b-4de6-a1ed-ccc929bb7d4b", "comment": "Malware payload (Mirai)", "value": "7a943f69c8cd60d7375c8d53da7ee11110c90278e9efe1bab6687e976c420d40d007461d4f9304c3ce19d3f80f4f565a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074374, "uuid": "d9afdb5c-ca55-44f8-ad78-ec848e0d475c", "value": "CFD2E035D4EA8A68CE5850F238BC3F4F08A1D50DC580DA66AFDCA61EC853F642B65117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074374, "uuid": "bdb8f30e-fc99-4d18-9985-3daf32d14c0a", "value": "768:183B+Bl2vSrM48Mxy47oD/DpkknbcuyD7UryqQ:C3B+j8SI48MxoD/Gknouy8mqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625074374, "uuid": "ae8819b4-2621-4886-8a01-0d170ef61c4a", "value": 29068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625074374, "uuid": "96971203-6191-4731-88f8-e37295951792", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625074374, "uuid": "e28460b7-bfaf-48e7-923a-c3eec82b6683", "value": "d4a00608de1432b8e0ee77cca2504f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6826a98f-d9aa-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625061147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061147, "uuid": "39554790-ae13-4f31-a895-7617b8e3f391", "comment": "Malware payload (SnakeKeylogger)", "value": "c89c003d0aa6ff34b21a3adaa59f6e72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061147, "uuid": "60cc027f-effc-4110-a7e0-df1bf33df80a", "comment": "Malware payload (SnakeKeylogger)", "value": "f0902ede0b201bd7e768476cb397ba649c81a682f0a776dae35edbcc0481dac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061147, "uuid": "ef36bfc7-0ecc-40e1-a3b9-bd81c8d6f5aa", "comment": "Malware payload (SnakeKeylogger)", "value": "0324e0b1031c5bb30057400bfb228a41e63756dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061147, "uuid": "e1013f5e-b425-41e1-900b-6830d5b1ce08", "comment": "Malware payload (SnakeKeylogger)", "value": "9aeec76f0c335c377833cf0847998997fa60ba407090e6bc916b64484ff8999606ddee94b3158d1f314df17f687b3344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061147, "uuid": "d1efeff8-4d5f-4bd3-bda8-eeebcaf57da8", "value": "7F05AF3D59BE213782BDD3998BC58C2BF840D67B71217E7898D747A58706A8339C213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061147, "uuid": "c7fddbad-5676-43c5-92f9-71c73b595950", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061147, "uuid": "ce404c61-1b3f-4c86-83eb-a9c6d97a839f", "value": "3072:nlSqfUfxqsZpfrK4xurvVppeund7mn/Zpku4zq72IDfUs6zQgMsz4JqBomK7JGty:8qAxbpe4ch2uscumTIYsRgZ9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061147, "uuid": "062192b4-63f2-45d4-a15e-6dc6df0331d0", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061147, "uuid": "ceedcac1-485d-46fe-8da5-567abc85cb9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061147, "uuid": "bde9b566-1141-4f54-ba8c-bbe34886720a", "value": "SecuriteInfo.com.Variant.MSILHeracles.19796.17611.2670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c38314-d94c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625020831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020831, "uuid": "df3d65cb-810d-4883-9aec-2fa66c8e88f7", "comment": "Malware payload (Mirai)", "value": "2bce2865201bdeecea7e8b0a35653459", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020831, "uuid": "a523b216-3422-4a37-a359-eb5fe8876251", "comment": "Malware payload (Mirai)", "value": "f0b0e70bece6696f2ed88302b10bb78e902dd08bae5340ce613b10b14f35e7fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020831, "uuid": "bfeffabc-1440-458c-ba7f-8cae09d210e1", "comment": "Malware payload (Mirai)", "value": "948679427ae33b029caee9c86fed5fe378fe28db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625020831, "uuid": "b58a9c83-7700-4c49-a498-a4861757cfad", "comment": "Malware payload (Mirai)", "value": "6ba33d256f18cb60aa8ce652552e43e3fb8e6365ac372c43034443448cbc5c1b04555f8000405c833221728eba432a8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020831, "uuid": "d943531c-8429-4e34-9e94-7c289b11f0f4", "value": "6463ADA8D078ED9CC66586B8F54485355B23E008A2633DF7DA83C3A6406BEECF5057F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020831, "uuid": "78d121c0-2f44-46ac-9267-61f9da1978e4", "value": "1536:C/de+O0oGXaasT2CC1VFNO+XjsrzS02cfs3oGb2BbagqC84iZ:CleSpXsC1VfO+6zS0Rf+NChagqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625020831, "uuid": "a25095c6-9e32-456b-9fee-a34da9430f57", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625020831, "uuid": "e6c00150-d83d-490a-a18b-a1341ed85791", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625020831, "uuid": "4d3326df-47ce-42f7-aa6b-95377a9ae685", "value": "2bce2865201bdeecea7e8b0a35653459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902ae3a7-d9ae-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625062933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062933, "uuid": "4e5dc04e-ca7c-449f-9e7e-af29eb25759c", "comment": "Malware payload (Mirai)", "value": "07b732f55d624f4144f43664849d8f4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062933, "uuid": "16de5046-255f-4e9a-820a-1a0720e13589", "comment": "Malware payload (Mirai)", "value": "f0f579548633e7936dfb5fd217680337dfce667e8098a43b45592eb88cf8e614", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062933, "uuid": "cd01d8dd-23b4-43ae-bb27-c228eed74503", "comment": "Malware payload (Mirai)", "value": "9159eafb77daef109a40ec51ddbb53c40a3c6ce6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625062933, "uuid": "cb61ed05-74fc-4f92-af39-511c4a2e90ae", "comment": "Malware payload (Mirai)", "value": "2b1514267d753784b83055d5b4c1d0a5e68de79ce06efaf83d8b85c7676b23af94405165b4f536ceefa01b3e0b1f0924", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062933, "uuid": "e284d88a-97cb-4e7c-8204-8c5411d22dab", "value": "12B36C21AE791E27C0E5A07B21F78221F1F2270D36B8950E7CB20D5EEF2865075676B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062933, "uuid": "a7beae3a-1f3b-4e26-be4d-9d70fa199214", "value": "1536:5FUw0avxi6XXPti3pWQBCF9erSGhFgEJnThzhncaq0w+75TtvkT1Fjq7:P0zEYHP1PxccNVCq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625062933, "uuid": "57e334eb-b920-4917-8037-6589d9253db1", "value": 110464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625062933, "uuid": "3eea12f0-280c-4a47-abd0-adb361b3398f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625062933, "uuid": "28c4fd1b-cf76-4b83-bcd4-27cc54efc8f3", "value": "07b732f55d624f4144f43664849d8f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7797cf8f-d9b1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625064180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064180, "uuid": "8a7530fe-e06a-49c2-8150-59aa0208b3b1", "comment": "Malware payload", "value": "51f1f4051640de1742d7827c46f4c981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064180, "uuid": "1d713f05-c1be-48bb-9503-fae1499fb0f6", "comment": "Malware payload", "value": "f244087d25c09a29fd740624231e44d1bc8fcf036f55bd4f29d895ee6f8e4144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064180, "uuid": "c226c851-9d5c-4bfb-99c6-db71b116ad6a", "comment": "Malware payload", "value": "540bb6972ddcef6f02ba0d6f5272cbd0c4e9f3bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625064180, "uuid": "09d54d56-9006-4041-a140-3921a6159584", "comment": "Malware payload", "value": "47c7141af9e70dd798a64eedca5fec6149838d5f130abcc4d59deb5b79d93e0de61ba8a0d7a967f28c1062298e3e896b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064180, "uuid": "9f0163be-85d1-48e3-9316-348762462f5f", "value": "1D830206E6458B7BE3350F31A1A57B1A0FB6E209DA33DBB6C355620B2D31911E8B1C75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064180, "uuid": "4276629d-2523-4cad-a087-0c4c4f4db52b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064180, "uuid": "0a3fa0c2-3975-4fb1-b01f-c38c02327cb2", "value": "1536:zDoBWFzI0Ma2OKh3JhYA9ITIQCLKMMbiF/RvqxHzIwJZXzUnFyONSGXcyBtftBcq:QszI1aZK7heTcUbu/RCZfJZDUD5BptBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625064180, "uuid": "c7647d18-81a8-4d99-8283-a63c4cc9f0a6", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625064180, "uuid": "68e1ac5b-8198-4a40-a757-b1e9a947fe86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625064180, "uuid": "ca237ed7-46ab-4d7c-82a4-54e59d5c8358", "value": "Qqwcvwbi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1de35a-d94d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625021315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625021315, "uuid": "e30c1787-53bd-46ad-a4e3-aac731d9a331", "comment": "Malware payload (Mirai)", "value": "e9793e5b74dcf4bd6c81f81758fd6775", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625021315, "uuid": "4acecd96-f605-4b9a-9f33-2df8536d3772", "comment": "Malware payload (Mirai)", "value": "f2dd0d90c39ce22f13f40c242062cb1d8dc37c747e27ee81f05fa7c3132b6f44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625021315, "uuid": "15dfb69a-6c86-486e-9518-3fe51077971b", "comment": "Malware payload (Mirai)", "value": "068ec5502c9013686c5f765030019b19d799b3cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625021315, "uuid": "5ac1b073-7a75-4676-8127-cf59474fa526", "comment": "Malware payload (Mirai)", "value": "a5fa83e00cbfdfeda7638bab46d639b344f3d145ad11faa1fcad591783ec6c43b72c568c4ad56d11458a692d04cc2fe1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625021315, "uuid": "001a20fc-c806-4c9c-be1f-1670e9db5a3b", "value": "4A834C20A97D2E26C1D0B57F22FB8315B2E2270E26B4965D7C760F4FFF2464068572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625021315, "uuid": "3531c9e8-d60c-4dd5-ab6c-681789ec3fda", "value": "1536:49eb2RVvTRssZva1/2ncGZcq7x3axNcFFhzki6vFf3fAfiqFtAFFp:ch+NcKvFHAffFtgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625021315, "uuid": "20041320-e373-493e-9741-c60634438135", "value": 82764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625021315, "uuid": "9ce26bbc-67ce-4dc0-94fb-0580076603c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625021315, "uuid": "1d20cfb1-e6d5-46bd-83c3-2ec488a1234b", "value": "e9793e5b74dcf4bd6c81f81758fd6775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac24eb9d-d9b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625066416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066416, "uuid": "46931273-c4ae-4888-89a3-8bea2cd93ad0", "comment": "Malware payload (Mirai)", "value": "7ed054dab5c95db42bbc52a1791c3810", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066416, "uuid": "5ee2e5d0-726c-4747-9759-b7b7448cbe63", "comment": "Malware payload (Mirai)", "value": "f2e7640072ac9c573c3bdfd4ba6b3696dc3817ae3bbf564d79c4e77d6ff294d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066416, "uuid": "ff9c6392-56cf-4a27-80a1-a7bebe5677f0", "comment": "Malware payload (Mirai)", "value": "f4dc48cbc1101bac784642705174929ef4fa5235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066416, "uuid": "507980c2-7ce1-475c-a55d-993e92197944", "comment": "Malware payload (Mirai)", "value": "0ef9df447cb765bccb6a67f08c6c20cb8052faa482cff0b7ff94be9c67ac3faf5e8020958e2f6d933103043bfdd1e369", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066416, "uuid": "0bbe25d3-3fee-41f9-8750-d481a0ef1eef", "value": "0EB2D1E42D4289DDE4B1E0B513B30F021D325B6284436C43648AAE4FBC6E47DBED2F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066416, "uuid": "4bacda25-4d20-42ea-8f40-297511433d34", "value": "384:0MmpnBBT3enW9Puy4Oh8WqBGe6udx5eunZUbqnHq+VKEAiLFW/v5JJgGlzDpH7uF:5mBunWkSqe4x57wqzLAY4/vTJgGlzDp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625066416, "uuid": "8d120f59-f344-4d95-a9b6-cc18c8c27a67", "value": 24044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625066416, "uuid": "f6363519-a7ff-47a8-be1f-5d014378e39f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066416, "uuid": "8dcb512a-6645-4939-a787-d1aa8178df06", "value": "7ed054dab5c95db42bbc52a1791c3810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eff4dd7-d968-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625032866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032866, "uuid": "ec411446-3742-4326-8472-ec0411255828", "comment": "Malware payload (RedLineStealer)", "value": "e63ada8c3c27e50021b518413c313ec8", "object_relation": "md5", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032866, "uuid": "fa404bfb-3acb-4d34-84dc-c4b71a1f2597", "comment": "Malware payload (RedLineStealer)", "value": "f309070dc92c2856a205c4a76f0e88e87387600b9006f2668a1a753d0c2c8455", "object_relation": "sha256", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032866, "uuid": "6e4367cd-f55a-4a9e-b435-2e2d53083ada", "comment": "Malware payload (RedLineStealer)", "value": "89401010674ab1c804cca069bfeb9f5a640403b0", "object_relation": "sha1", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032866, "uuid": "ccdf6b85-f1e6-4eda-a735-8ce049b9a499", "comment": "Malware payload (RedLineStealer)", "value": "f3827d8e4df437196fcf5db151430eb2580e62b0ad2e2593026a5f7f100939381f6870f0bbf34a257916ed3a03714ab9", "object_relation": "sha3-384", "Tag": [ { "name": "Amcert LLC", "colour": "#E3CD52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032866, "uuid": "9dd739c4-a632-4592-9a6e-bbc3547fb2dc", "value": "AE84262864BFC01985E3EEA12DDCA8FBD89A55E3640D743701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032866, "uuid": "13a1add9-3380-4175-95ae-20e67756d692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032866, "uuid": "6469b53a-ee41-42a6-8fc3-9f501b4e5d6f", "value": "6144:V5YqofbJT4Df0Q8axsjdDLd/6Tv/3RrDfBmDZaR:V5Y3fbJT4z0Q8axsjRLd/6Tv/3RrDfBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032866, "uuid": "13b8e051-fd85-4e0e-a27b-68f32e7acfcf", "value": 392584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032866, "uuid": "8f25f73e-bc17-4da1-83ae-05e7267fb1e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032866, "uuid": "b036e736-7cfc-45e0-a257-05d180da7f83", "value": "f309070dc92c2856a205c4a76f0e88e87387600b9006f2668a1a753d0c2c8455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4348294a-d9aa-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1625061086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061086, "uuid": "d6c1e206-3191-4567-aa9b-da0aed7c5779", "comment": "Malware payload (RaccoonStealer)", "value": "1f07b4740e8435347ad7dbd456838bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061086, "uuid": "23833475-9d7f-4145-a93c-49d8825890eb", "comment": "Malware payload (RaccoonStealer)", "value": "f353dc700a77a88665e2d6cb4f73396ba3b4437cc3ee9a6a7e095de5f77277c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061086, "uuid": "d5a9535c-511e-4aca-9ac8-2b2ed5c96bf9", "comment": "Malware payload (RaccoonStealer)", "value": "e520f0ce60ec6e79f9067bba1f1f451ad1beb338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061086, "uuid": "cc34de0b-ec7f-4da8-887e-6d8108fc8929", "comment": "Malware payload (RaccoonStealer)", "value": "2d74b7e8f5bcf573b127728a1af7f200794062faf9c7fb22df96152e57ab1c983b69eecacb0bea1caddcf7f3f7b791a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061086, "uuid": "8524b86b-c074-49ec-86f8-b5a771e21824", "value": "5E55BFAC325435DEC567C6BACAA8AC74E6653C6A431B8107909709DF6E0DB93DF201F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061086, "uuid": "f1c5a99d-1a44-4a33-98c8-88536883cf99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061086, "uuid": "d27e630a-3452-4e4e-9327-6270255d5da7", "value": "24576:zNtxbxY6ymKMGlz8R9MTLDeHP8T57Vg9ueOCp4EKs2hCh33iE:z5iRz8QfDeUYOCpRT2hC5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061086, "uuid": "7d6d28bb-5fae-4f02-b52f-ee6e2b6472a5", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061086, "uuid": "a954e588-6347-4e59-8017-fb9739977213", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061086, "uuid": "daa6ba08-84e0-4b79-a5ce-34f23ed4e82a", "value": "1f07b4740e8435347ad7dbd456838bd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faacec06-d9ae-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625063111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063111, "uuid": "365745f8-0110-4007-b47c-826276738a9f", "comment": "Malware payload (AgentTesla)", "value": "5140f9f0a829e10592e1d6867d5bb5b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063111, "uuid": "35cc42fa-f756-43e5-a8b8-240e712ca267", "comment": "Malware payload (AgentTesla)", "value": "f58908fe6ee795a218f978f8c7d01433f5189f523625c3327fa5ae3d520bd442", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063111, "uuid": "268689d5-d0fb-43b4-a215-555849776f24", "comment": "Malware payload (AgentTesla)", "value": "63cb281b966c7efa5d6153c863cb3ae5d58aa046", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063111, "uuid": "871dc86f-4e7e-40eb-9ab0-ce4bc198e67d", "comment": "Malware payload (AgentTesla)", "value": "82e8d2f430e5086eebcda4def54f7eee5962bc23c6cecd6aaf26ec583e6d7f180043fcfc65bacbc480f77be3dd6a2199", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063111, "uuid": "11dd26a4-51ca-4314-aa52-3a4d92f27a53", "value": "C8D423ED5A9DA6E091EF4B5DFACD01F10C8F33020E05A5FA2566257922DC0DFDEE1886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063111, "uuid": "e626ddda-ab7d-4c0c-a245-95e96373d4a9", "value": "12288:URGFrF3AEcxJxl1qWbV/sy2to+mB30BW1Ht8v40nK0U2BEUfc6lwNhLNkDIKQsa0:UYFrNAE7y6o+mwWJt8NK0++cjLN2Isz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625063111, "uuid": "03951180-db73-4810-9528-95f316dd1bed", "value": 653662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625063111, "uuid": "77864898-bfc9-4659-98af-31023401b617", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063111, "uuid": "ba69b7e4-5003-447e-bd17-0e80a602c6ca", "value": "swift transfer_copy.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df338281-d9ae-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625063065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063065, "uuid": "0794ca13-7c8d-4bb8-bf68-020f454b11be", "comment": "Malware payload (AsyncRAT)", "value": "e75874847337299bc1a57e6f0708b7e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063065, "uuid": "5095d1d0-122a-4889-9deb-5351cc4b1680", "comment": "Malware payload (AsyncRAT)", "value": "f5c91707f5308a187b11f2041f0e2fe5a8d4b58b92d1406e28b1475e240f5380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063065, "uuid": "25e58b50-3e60-4b10-a63c-d6912f665cd5", "comment": "Malware payload (AsyncRAT)", "value": "9645580902d0ddc033f1c1b510dd0b12b2bba898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625063065, "uuid": "278e28ca-e483-436f-8e89-6192509c1140", "comment": "Malware payload (AsyncRAT)", "value": "4cf3e093b002f4c13777fa1c553083da418e823c533b1d2d768a3100fdb9585b297be687bb371e4031425f332c31789c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063065, "uuid": "7733c316-3367-410d-a054-e345bb5cbe50", "value": "B1055BAC325435EEC567C6B9CAA8AC74EA617C66431B8107909309DFAE0DB97DF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063065, "uuid": "6d391428-7a01-4d7b-a63b-167ea1342f08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063065, "uuid": "57f71f03-4bd7-4230-93be-2959f1e25f53", "value": "12288:mD4F8ZAn++i6rOk4E9CRwwFhtml/svdbbb/u6j0fZF9MtRrH4PFmODd1H+UJSKSy:TF5Li2p9CR1ulW7/uqkZF9wHOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625063065, "uuid": "37d7604d-11d7-4e31-a760-7190e9891a7a", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625063065, "uuid": "16c3e299-c3d8-43f0-bd03-e1e9c652422b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625063065, "uuid": "7b213c8f-58b4-4095-86d0-97fe0013d321", "value": "Request for Quotation - ATLAS_Batch#001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468debdc-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625075694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075694, "uuid": "28d18f55-f1fc-43fa-a580-c2f2664574ef", "comment": "Malware payload", "value": "b0f851f45811cdd64d8dc692d97903da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075694, "uuid": "70ddf917-3738-4ad4-86aa-b69726733668", "comment": "Malware payload", "value": "f72c375f5e423f5213174a9e4a7676e34d2cab593802c75d6dc27719d8e7eb00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075694, "uuid": "874b84a9-66f3-41d5-8b57-50ad57a41843", "comment": "Malware payload", "value": "47bf81ee2e9afe8290006502c1744b8cae7439e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075694, "uuid": "d1c0ab96-fde5-4720-bf19-2a4ed21d7f8b", "comment": "Malware payload", "value": "b1c19e44de3cc451b64661ea284571e771128466aeb66ea2d065d14d6d23727f9acc331fe4203fdcf6903123fb2e7f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075694, "uuid": "1fdd1a9c-c703-4bef-8a52-79d530d77e88", "value": "A765E13151FD683AE431F37E9ADF453BCBA29FD6B11200AD676139598EB2300DE63162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075694, "uuid": "5c9545c8-bd91-44f6-8074-d66214c30020", "value": "96778352d99ca84b52328b0725ee1935", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075694, "uuid": "9b04dfe9-d797-47c5-876a-4e5b2b9968d3", "value": "24576:s2ANDTYcEbLkP+8UF7syGP/sU8XHThFhSpTXK2Gatg1quyy:MxTSLkPa7syGHslXHdFwuatg1qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075694, "uuid": "27fb82b1-2adf-4b6b-a349-36957608b7ac", "value": 1519896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075694, "uuid": "ca84cb60-3038-4ef8-a2ce-0fd52a43562e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075694, "uuid": "6a9a7f57-f02c-4ff5-b1de-b84dfa5e2c50", "value": "b0f851f45811cdd64d8dc692d97903da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c47cac-d946-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625018190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018190, "uuid": "c97cae87-e510-4c3e-a200-6cf56d14b86a", "comment": "Malware payload (DCRat)", "value": "a97c109cedec8a89cbe653a044790c9c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018190, "uuid": "d4ec7553-9550-435e-9850-5b6c1a0815d6", "comment": "Malware payload (DCRat)", "value": "f72ed28a8d7614678ca40fab28ecdd8812c1a52169c68a29d27750999f2270a3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018190, "uuid": "8a8de441-b944-4dd9-ba00-2db52d685936", "comment": "Malware payload (DCRat)", "value": "6ba05f238a0c3e4faaa6871a03fe423fd845015e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018190, "uuid": "2312907f-c979-428f-818b-1565f14d171d", "comment": "Malware payload (DCRat)", "value": "812d443cd5f87abab07cce54102e805e2136a5f3fa82f69b6434f6960c695ca331dcae7c351a0dbd54074111898f4c72", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018190, "uuid": "3843af4c-11aa-4a00-8a7c-68dd7f707e8f", "value": "95752B31FD46D932D0281F36D4FF5478C7AAAB002E25E61A7F9B339867713A20D195CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018190, "uuid": "20f973f4-3dc5-4ae6-9a2e-55e4e6b8b08d", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018190, "uuid": "995ef700-7208-4784-bc21-4880a27a1dd9", "value": "49152:hbA3Ar+KURIqcMRiHwW7RlvwW7RQNvwW0RWNp3wW4RPOpa8BwW7RPU/a1IhSVH:hbv+KURIqcMRiHwW7RlvwW7RQNvwW0R2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018190, "uuid": "05e30314-a09c-4abf-acce-527a9f98086d", "value": 1652467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018190, "uuid": "89ff89e1-da7e-4ee1-9e0a-b4488813c0a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018190, "uuid": "bc5b8ffc-9f1c-4b78-9f9f-385487b545e0", "value": "a97c109cedec8a89cbe653a044790c9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a18024-d9b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625066438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066438, "uuid": "b714b6b8-5895-4597-90d8-0051bbfdcaeb", "comment": "Malware payload (Mirai)", "value": "2ee07756f41d1f7ec72e165b1f358eb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066438, "uuid": "67c7b53c-be3c-4c69-ab4b-27512525aea5", "comment": "Malware payload (Mirai)", "value": "f73c4020a1c62a94c4f12d22e5fac61dfaab73e113f2aaee812fa672330ec31b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066438, "uuid": "d9d057ee-4747-4bac-a938-b01462d5af94", "comment": "Malware payload (Mirai)", "value": "4f9d15b1c30f22d1344d634afbd37c2532d27e31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625066438, "uuid": "b0ecb0c9-bcc0-448d-9983-09c07c1f2a43", "comment": "Malware payload (Mirai)", "value": "adf9b3586d0486da0a7c524cf811700b8c66426582d4ad9aa70bc14482f5b9ec0bfead1bf02da8c86280014a2a2b86cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066438, "uuid": "676e2ee7-a538-41bd-af23-c5d720948c92", "value": "6EA2E1212BC99C10C3B11971CE3C0C9376872BECB6FE369916B4D164BBC564BD9B95C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066438, "uuid": "dba64d27-47f6-4960-b8ec-589d5247dc49", "value": "384:UglXxFn2W8cuADu97MNAR5reJer5p1IpLRzZs5Pr/IvXX+UMUhymdGUop5hs:3lXxMJ4DuRMNAXecpQRds5Pr/Mn+UMUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625066438, "uuid": "edbe1559-f6b5-4baa-97c2-d8024f12a56e", "value": 22480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625066438, "uuid": "8c370822-735a-4e7d-843d-c3197e62036f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625066438, "uuid": "dcee461a-4a0d-4f62-bbeb-0b90617bb3ce", "value": "2ee07756f41d1f7ec72e165b1f358eb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988dcb4e-d976-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625038895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038895, "uuid": "e9ca68c9-93ab-48fa-94c9-66a5bed3b41e", "comment": "Malware payload (Mirai)", "value": "6ab19c23d3791aee2d56638a89b872ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038895, "uuid": "49f42aa3-b5d4-482f-bfd2-a642c4f96504", "comment": "Malware payload (Mirai)", "value": "f78b9af62f43b09d2f986817271fd78733930f8d3a666a5b01d089f45f3ee510", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038895, "uuid": "e9d8e583-3393-40da-adf3-f0d24a687a64", "comment": "Malware payload (Mirai)", "value": "db7b24780a55dda357f2ffea8f38d8e209d5ac2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625038895, "uuid": "8ba4b0b6-4b19-4ce3-bdc3-c083bfa8d9bd", "comment": "Malware payload (Mirai)", "value": "2a8bc2c3ecab425c85c05c49242633fe657d3bd3754e3cd8e36796781c8b850c97679a90bc13630e2bfc7cbea81ab93c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038895, "uuid": "221851f5-e1c7-40b5-9e26-9632403206bb", "value": "17D2D063C1861B98C7AA0932E82B3C0C6978BB09D57D06B4AFEDF1058D71F255BDCB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038895, "uuid": "bbafded0-3501-4f36-98d8-f9dd6c2d291a", "value": "768:iYicrAqMzfOwAHnMZvPFInoL1FKQTCEnocnbcuyD7UryqV:1zAVfgHMZvPWovnTecnouy8mqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625038895, "uuid": "b6ce48b3-c1b2-440c-8995-e31d4e391ec1", "value": 29508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625038895, "uuid": "fa07e9e9-2551-417c-9db0-a11006861553", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625038895, "uuid": "2d463a65-731b-427d-9dac-efff0a65714f", "value": "6ab19c23d3791aee2d56638a89b872ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0c953e-d967-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625032275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032275, "uuid": "a4189ab5-9e20-493f-9452-30b019aab520", "comment": "Malware payload (AgentTesla)", "value": "14c247fb6eb9d2b6ce29c4e520cc9b9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032275, "uuid": "ffcbf920-edbb-4fab-8ded-9646c372a4df", "comment": "Malware payload (AgentTesla)", "value": "f8e54878f6a6f4f3679e0c4d8d53c97ca26c9fde2ff78ace60d6226d8794fffc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032275, "uuid": "38e22696-b1df-4079-a06f-6c3c155e3b1a", "comment": "Malware payload (AgentTesla)", "value": "acbf4a8248052f2e378983d21b47050a34aba183", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625032275, "uuid": "ef5b910b-ad94-41fd-a155-57e7e7b177ce", "comment": "Malware payload (AgentTesla)", "value": "02a6b6a8a37670994899edbd336b926c4a1aeee7989dfd7d90fe2ed7349321f0d69511047a5077b8b4f6309f189d0c5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032275, "uuid": "7f314ef8-9977-44bc-8bc1-39628e20be71", "value": "88156CAC316475DEC567C6BACAA8AC74AA613C76431B8107909309DFAE0DB97DF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032275, "uuid": "012dca61-714e-4cce-8209-767ea7627335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032275, "uuid": "23b31224-a551-487e-ac0a-a5d2ef4677fc", "value": "12288:mQRMkAw8fobXDe3LtmiZ7LdEl4i81DdAam307F5I1DkpiLfI8LrwmlC0EX/V4IEe:f2wDXDALtXU6i8ldAfkHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625032275, "uuid": "6a2ddc02-a011-4fab-ac8e-4ef23955b06a", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625032275, "uuid": "69f5e51d-e405-4135-a5c7-f9ab5a3131e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625032275, "uuid": "261c86fd-9ebc-4103-af83-befd3c76bc5f", "value": "8P9PkD3CxlIJhat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158eac01-d970-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625036098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625036098, "uuid": "9f69d75b-249e-4193-888d-8009053ff94b", "comment": "Malware payload", "value": "c091a0066415a6b19dffe02b9d625d16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625036098, "uuid": "a45bb762-12b6-4287-9e0c-595dc9529556", "comment": "Malware payload", "value": "f94522b7adb7ad83d04a493601f0b1c71d4d8237837bacbd6732bfb851a0e1b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625036098, "uuid": "29040e98-8ed0-4862-99d3-29383393241e", "comment": "Malware payload", "value": "8ddc79e59320d5b16fdc8567b065b9ff2febb522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625036098, "uuid": "196b8e62-c2ff-4447-8c9a-129934654623", "comment": "Malware payload", "value": "8efa8154f2dce685a2265a8670beb0215316b71badca3793cf137885914937ae587ddc63c795d6bdad036f2f02136a3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625036098, "uuid": "b3cc56a2-f31d-4c7f-b47a-7aebb7938888", "value": "D956F51C2B5EFF88F6B205D274454A68C72E9698F30928509E5F318C87FC9A23759ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625036098, "uuid": "5bb46ab4-6c6a-4747-8f11-8bbb9188d93e", "value": "6144:PNoP3eJAtq+tL3BwV7erhE2g9PBJk5p0YyZVr0DkZmb+WtRGMRfrhoZqKwwY0NxP:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625036098, "uuid": "b64ce934-d31f-4fc3-9e29-359e61e61c0d", "value": 6323200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625036098, "uuid": "074eef4f-2633-4586-953b-f0f0ff260e8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625036098, "uuid": "2c57c842-d2ac-448e-b5a7-f9bf8fe6cff8", "value": "c091a0066415a6b19dffe02b9d625d16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bfbb7d-d9cc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625075751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075751, "uuid": "0f799d20-080a-4eb9-8a9e-a52175a015b3", "comment": "Malware payload (AgentTesla)", "value": "28b5f13cc6ef8917ed613f8bdae0e0a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075751, "uuid": "d89717e3-8be1-4cc2-9310-4cd25def4884", "comment": "Malware payload (AgentTesla)", "value": "fa04f8c0aa18a8fb26ea6e8b46f77ce4bb86211657db3d8d37527a5d87934a9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075751, "uuid": "df9f8bdc-ac07-41af-8851-d4dfa61a11bf", "comment": "Malware payload (AgentTesla)", "value": "db5d659052eaeb08a687b53f44a831c97d5e62fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625075751, "uuid": "98ee930f-499f-4190-b921-bc9dacaf33a8", "comment": "Malware payload (AgentTesla)", "value": "6627d324c62967dfd520a6447ba0e57ee4e6f1a3990800eeff007da13b47a87291a98487b4aa38ca7e1e38d9202e7389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075751, "uuid": "c8c39d10-1fe9-4917-b3e3-3346386cd0a7", "value": "66358DAC369471DEC467C5B9CA98AC74EA227C76531B8107909329DF6E2DB83DF101B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075751, "uuid": "ca913adf-cc4f-413a-92d9-0ee297811e13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075751, "uuid": "4e2526d2-6d39-4e5e-8687-5bb5039ec0a1", "value": "12288:O4ZG5SdO47IeIJt7TimSHSmKGNPAPP7hIUQCXgs3Zqv9XYtRIB5BsjmFIRZeRkqk:CSdwJt7+mA9IPjAv9Vy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625075751, "uuid": "5f399013-01be-4214-8451-d4db64fa0a59", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625075751, "uuid": "933b8c76-a8b6-4dae-98d5-657b08dc2b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625075751, "uuid": "05aad822-127a-46ee-810e-3ee2180694f3", "value": "28b5f13cc6ef8917ed613f8bdae0e0a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4247946-d9ab-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625061758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061758, "uuid": "47942295-2b11-45eb-9979-b9a5298c44a4", "comment": "Malware payload (Mirai)", "value": "6f2883216d34cca40fc3d09eeb93d184", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061758, "uuid": "ccf62352-1382-40dd-80cf-10c6d143f8c1", "comment": "Malware payload (Mirai)", "value": "fa2ef090a900a9bfd364bf533145dd97364d163911f146e3e405fe23460a1635", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061758, "uuid": "c07d83c1-c6dc-4324-8daf-eff77599ae5a", "comment": "Malware payload (Mirai)", "value": "ca74bc94c99fd606b93a9b525ee78917010e15ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061758, "uuid": "6171ac1f-18b9-4134-9947-98df1bdfeea9", "comment": "Malware payload (Mirai)", "value": "1d26ee3939698782bd733032705c99fe11684a53435a2b57c2820733e1246285af68f6eca57d526381246b6a3c5ddd82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061758, "uuid": "f5e7f182-2ce9-45eb-8a85-bcbae8cbd9a3", "value": "0713E0A4328864A0A11164B1DB7E8781FDEA13BDD9DF73296500827AE48FE6732743D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061758, "uuid": "3e397bf7-21a4-4412-97c3-489872badd90", "value": "768:EkCcbBsBZTWHzuJYgoActit8O8JDAG1BKvb0i/2Z9Z7kq9MFv+cdcVOhSs3Uoz+:68BCZKHzmvctR7ZHBIbfEf7kgMFWohPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061758, "uuid": "3cd22dfb-cee8-4fae-8996-0f8a51026552", "value": 41524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061758, "uuid": "88963050-232d-4dc7-af9e-74b319338796", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061758, "uuid": "fa75cb89-380f-4b97-8a83-58d1b94c110d", "value": "6f2883216d34cca40fc3d09eeb93d184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236765aa-d948-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625018941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018941, "uuid": "72617464-083d-4910-884d-255b096b5830", "comment": "Malware payload (Mirai)", "value": "3f1237f87d026f00253190ec69d68df8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018941, "uuid": "1c3a641a-1082-476c-a1be-26e5ef55171f", "comment": "Malware payload (Mirai)", "value": "fb827ef4f20920d1b1c0bf6df3c5b1ebdb22eb8000310aaec35dabf945cd17a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018941, "uuid": "4892290f-d3e6-4086-a6af-bd14d5d340a7", "comment": "Malware payload (Mirai)", "value": "00e026d7ddc634219e1e810c07d9231a9ce5e5e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625018941, "uuid": "62a886a3-0e0d-4606-a166-4934734b0c9a", "comment": "Malware payload (Mirai)", "value": "89f717fa0060f1ea711f5deacfef1614a12d397dd6260fdec25ac0ec0096603ffd6a5763a1d12f3c7aee7d83b61c24c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018941, "uuid": "2562441d-d1fa-4324-bcff-517a6d7b5e62", "value": "2E434B5172280B1BD0932A70353F4FE09BBEEAD021D0F686B99F9B968535D334546F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018941, "uuid": "4f8076bc-996c-49c3-91e0-3ad0f0292f4e", "value": "768:zaVVRLWYgnvRYDCi1jAZZkXWorKquPduNZiT+eN4T9qKnZY10Ugv:EVUv8CiNPG5TH4hVna101v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625018941, "uuid": "5d4a3c9e-6f4f-4882-ae59-e542bd10632f", "value": 55908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625018941, "uuid": "5386d197-5a9f-4596-860b-3e201be8bf23", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625018941, "uuid": "e0d20e79-a783-4d80-b9ba-d6ba70005828", "value": "3f1237f87d026f00253190ec69d68df8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926f7032-d9f5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625093431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093431, "uuid": "1162b658-090f-4fff-a60f-83ab3066a305", "comment": "Malware payload", "value": "b913ed9e030cc8fff0633815b65bab5b", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093431, "uuid": "377afc00-268b-4966-a8d0-80b89070d8a4", "comment": "Malware payload", "value": "fc326e9feb2d74f98c048172b778f04084be3d766f0d55c08886b4e22edec652", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093431, "uuid": "c96aac1d-f981-4723-a171-189e711e7808", "comment": "Malware payload", "value": "e8c07dd2d4b58777bb989dde26a4b22b70938551", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625093431, "uuid": "e3301cdb-019f-4be5-8aaf-425cfb573441", "comment": "Malware payload", "value": "b8a147b03aa3846b5636d7e4ee045b92de62cd7c495be22c8a4ba26d1d26b76de7188ebe3bc1b7b0cc5a2d0346003771", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093431, "uuid": "019e7061-2234-4c4a-85d3-e6fd32944cfc", "value": "DFC412127B52C171D99A06314866EB769B3F3C129E70548BB7943B7EEE30BC04A3865F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093431, "uuid": "82da8917-3363-4682-8213-6fcf02d0b494", "value": "5762922cfa7a1067c1b0a201372e7196", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093431, "uuid": "dd05b55a-e013-46db-89ad-a32f58a55ef9", "value": "12288:/DudFfD68wjnjHPHQRG9ybJRYpLPPjN4vPBhBqD:0FsQRGgJRYRjUBhBqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625093431, "uuid": "5fecda24-2948-4800-9b4b-efccc0226e83", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625093431, "uuid": "3c496b79-3911-4cf9-ab6b-187f7e0b3579", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625093431, "uuid": "34e065c5-0d14-4a50-81fc-36c150006bac", "value": "start.wll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbacb858-d9d6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625080239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080239, "uuid": "964acae6-64b5-4dbc-a8b4-925da0d1323e", "comment": "Malware payload", "value": "bf1d76808e491e6b1147ee894724b40f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080239, "uuid": "247b55b8-1476-4566-95f6-b6cf523df6cb", "comment": "Malware payload", "value": "fd5863498a52f04cd8efb69a9374f0078bf4877c190eafaf2da72941ba75f1fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080239, "uuid": "45c03f99-30e4-4760-a43c-d41e400867e3", "comment": "Malware payload", "value": "6d9a98581c5f1b5a35873778796aeccf5f6824db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625080239, "uuid": "0a9ff668-c54e-493c-81bc-f2558920292e", "comment": "Malware payload", "value": "09aa81ef9ba9bc703271f87988baf119c9f303940313954d3d848d5c45a145241b83654f793b068251c5623cb7fca3ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080239, "uuid": "70c16998-eef1-4add-b5ac-d138e4d734b9", "value": "CC058E3D19BE213791BDD3998BC88C2BF840D67B71627E7898D707A5870AA4375C213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080239, "uuid": "f7c6c5c4-b40b-401a-b978-e7b41e295d56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080239, "uuid": "5f9139b6-98a3-4d2f-a296-04ba59540bda", "value": "3072:/lSqfUfxasZpvrK4Bmrvipp7uMd7IGampku7Tm71I7fzsdzcg1kWzhqYmci2KQId:EqAxrpu482DujDuvsIHs6g1DEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625080239, "uuid": "ba5dbd9d-d230-4b72-a32e-2d5149b0a9d4", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625080239, "uuid": "acdc1f45-aac2-48ab-a634-744e44be489c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625080239, "uuid": "6d501fe7-a8de-4c6b-8303-878a354dd3b3", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b655aa04-d969-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625033361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033361, "uuid": "dc068f33-b2c8-471a-8f5c-d642d6ac758d", "comment": "Malware payload (AgentTesla)", "value": "27909585332a11129cfe42fd5a1ab478", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033361, "uuid": "e7577e7a-d249-48d0-9b61-906dc49074aa", "comment": "Malware payload (AgentTesla)", "value": "fe967c589254c4491792f5ed4e416699e281d74d5ef1ec6a1cbdc10a0b32fa16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033361, "uuid": "49f3eda0-3080-4fe0-9004-2d0f1d0c32ab", "comment": "Malware payload (AgentTesla)", "value": "a6b533142fa60f5cb2151852695b15c73c2e7c97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625033361, "uuid": "b852a100-5168-40e4-8196-cec7a2926d93", "comment": "Malware payload (AgentTesla)", "value": "97ac896a8443aac01b98b14f499bc4f20e90d8379a51c3e6c76edf4987426dc1702c76541071c6b195bfda4b5a6db01e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033361, "uuid": "26fb257f-c97b-40f7-8263-3e411bf56306", "value": "0435E1127208D959D0BE17B6C8DF05104BF8B603E723D9797FE436EC4E923A2A91B18D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033361, "uuid": "e17203e0-db29-49f1-99b2-004423015379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033361, "uuid": "cc926cee-f669-440a-8916-45f883f36546", "value": "24576:qRfgv5gNfmfzJjKYW2X0xutgQiXAEqKO:2fS5OfmLhxWDutg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625033361, "uuid": "393c6568-9fdf-49b1-a319-7eb975dca951", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625033361, "uuid": "4358c04c-4291-4db0-b431-55473d1ed961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625033361, "uuid": "4351a020-4bbd-45d2-8b93-ad4073e0a843", "value": "DOCUMENT ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581de5eb-d9e5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625086461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625086461, "uuid": "5ae54c3c-14ef-469d-84f3-deed20304b2f", "comment": "Malware payload", "value": "61a09af0df7259bf97a656b8a4d34338", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625086461, "uuid": "41748ebd-c224-42d7-8071-f0c8f5280c76", "comment": "Malware payload", "value": "fee6b3937d208b95c17dc253ba951f3c7c5a332af98f4e0117ee5bbd47e38843", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625086461, "uuid": "1661c5bf-3efd-436e-86de-0e85359ca384", "comment": "Malware payload", "value": "d22a1f955b1bb6768a631fb99423eb7f72c453ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625086461, "uuid": "6ce20384-ebac-4460-a007-6747f165445a", "comment": "Malware payload", "value": "3f36c938872fd233cd486fe762ba52281da9b49229fcea7f7c3f5069a8e3224347348ca8c6f98c953b808248b3253f16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625086461, "uuid": "df3acd0f-e8aa-426b-9b08-0100acdeb265", "value": "8074E635EEC18FA3D0D30EB51353E7800AF9CC6A4B05D6CA62667944F1BAAB754C963C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625086461, "uuid": "10a439fb-fc03-46a2-9ecd-8f1c2834b375", "value": "64f1814b769b7e8d7e61f45d0e9f5051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625086461, "uuid": "7272baca-9f2f-44b5-be8b-6d4b7e6f22fa", "value": "6144:v19x3DRKzQ/ocBrsEIbXaCC83jL7j51QzDTUnHgm:d9gEyX3jHNiQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625086461, "uuid": "01393acc-8030-4dd1-a28f-952c52092d3a", "value": 353448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625086461, "uuid": "f1cf9791-eeb0-4e22-88e1-4f01d3bde2a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625086461, "uuid": "c91239cf-f872-4823-8a50-8411e6ae6534", "value": "7GPtF4bk.php.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72d2044-d9ab-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625061763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061763, "uuid": "8e2d6ac6-dca1-4f8b-a17b-b3ecfc5c5853", "comment": "Malware payload (Mirai)", "value": "544f7f772b240feb390e3b2a0ac842a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061763, "uuid": "a7436f6a-e486-4d5a-81df-541517a89397", "comment": "Malware payload (Mirai)", "value": "fffbe9c5770556562800f86e9e945943647ff610724556094f0976249b20e58b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061763, "uuid": "66813be5-3bf9-41da-904c-51bfdd82dc47", "comment": "Malware payload (Mirai)", "value": "4a0848af83599a49d2bb0a506cac047965a23e8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625061763, "uuid": "c5a8bdb0-8324-492e-a023-92056a400a7e", "comment": "Malware payload (Mirai)", "value": "3c960a98f730463d898d4891bfa15c4dbd9ab4646561445cb25f766d7eca1ef396c91cc1e899560a0d85fe34e03690b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061763, "uuid": "aaf91978-85ef-4fb5-9520-9ee324830424", "value": "DF03F191C19D5DA3EBBF11F5DFC2A9E1A2D00E1F61468E9BA402F311994683B3D09BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061763, "uuid": "1de959f9-2ccd-4dbe-b85e-41535c85a672", "value": "768:Hc7Lj7a1GtmGilk1grydvBMcCRnONAyAIXdIlVVyJ4/STDRlu/kW4uVcqgw0zP:Hc7Lj7a8y66SecC0NMIXdAVVyJ4C1lc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625061763, "uuid": "4393981f-c21f-4020-b60a-d3025c0a99d8", "value": 38972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625061763, "uuid": "3207c543-4cff-418b-8e4a-a9a5d099e4af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625061763, "uuid": "90cd41e4-b6cc-43c3-b8ea-d15054e1adac", "value": "544f7f772b240feb390e3b2a0ac842a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }