{ "Event": { "published": true, "date": "2023-03-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-03", "timestamp": 1677888181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ef7f8748-ad31-418b-8ba9-7c3e12aedd33", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3ce359-b9df-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677860508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860508, "uuid": "6ffa0df9-f55a-452e-98cd-3a0bd0cd703c", "comment": "Malware payload (AgentTesla)", "value": "e3602917ee3758b7f6bd1e098d82a9e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860508, "uuid": "9dbc251a-9acf-4ae8-be68-a6a9515566a3", "comment": "Malware payload (AgentTesla)", "value": "0007f855c65b913a538d9a7680c5078dcdf8f49e26f37a130ec982c275bb693b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860508, "uuid": "9052ff9a-6c68-4c07-8cee-2427a9a0b2c5", "comment": "Malware payload (AgentTesla)", "value": "812a778166e467d3512e0adababe453058d0f13e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860508, "uuid": "11c3f3d1-5223-4748-ad83-856a54f28f34", "comment": "Malware payload (AgentTesla)", "value": "6631650d89e9258af1493ed3a77609e6aad78a16decc0d81c3584529402c029f26b77b4b09f0aa9f52d9545d33ecdf8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860508, "uuid": "ce505529-60ff-4214-a7c4-c007fc7ddd59", "value": "T1DE54131076E08573F87B87326A32C3746BF9CC312569951B23605E0D7A33A22ED1D7BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860508, "uuid": "eccfd8e3-4d78-4b26-b49e-52eeb8820aeb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860508, "uuid": "a3f28724-d4fc-4992-b837-1a092049c7ed", "value": "6144:PYa6ajbSe4h+mT2g1pZMyg1LgagWbqwFfteR3Se7v6Y:PYcCe4hPMt1Lga1qwFftqCmyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860508, "uuid": "c81a10a8-5c4f-4159-b613-0f51a5d97585", "value": 283439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860508, "uuid": "9dcdc7b0-bc5d-4f68-b2ba-488ebe495237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860508, "uuid": "0c58a5da-3d64-43d0-90f6-2e06cf718668", "value": "e3602917ee3758b7f6bd1e098d82a9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09ca3b5-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1677830123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830123, "uuid": "4bc463c1-3d30-410f-919e-3de774441073", "comment": "Malware payload (TeamBot)", "value": "ae1a6c46eb913913ce9657d95e08d18d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830123, "uuid": "cb34e3c7-bfd9-46c2-ab74-27dfa2c0f973", "comment": "Malware payload (TeamBot)", "value": "00685d120a9934e93e6efb7c154ad8efaa9d43bcce95ec1c7c6ed4c6a62c0c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830123, "uuid": "a5b93576-8409-4249-bd17-6b4690939e92", "comment": "Malware payload (TeamBot)", "value": "0ce678227bf82b32743c44007721001b1e6fea1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830123, "uuid": "b54d7fc6-0e5e-4e99-bbc9-2abe0d8dde41", "comment": "Malware payload (TeamBot)", "value": "28d62a6606d54284801f847269330d06f0543b14f1304851ba33b932ffd1c0034de9c0405368985058d31120aa65d278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830123, "uuid": "c4c1bc0a-7e0e-477c-8a58-71962fb38c79", "value": "T1DC64D02275D0C1F2C44A4D347910DBA05B7BB8394674CA87F3981BBF5E382E19BB671A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830123, "uuid": "d77817fa-ff0f-489f-958f-a51a3f71dd13", "value": "f37943ad193a52d7b21e245b891de4bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830123, "uuid": "a8cbbbce-d9ef-47a6-9510-93214248660b", "value": "6144:OpXAvLnFxcwKiUpv0oZIg5fKpjE5avMiOG2:5zFx59Upv0CIg5ypj5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677830123, "uuid": "e9ba6c7d-5adc-41d0-89d7-7c685b97295d", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677830123, "uuid": "512363a8-4031-422c-8454-e89079e5de88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830123, "uuid": "b6fe4b3f-6c02-4fa3-b8af-3a6f302d2dbd", "value": "ae1a6c46eb913913ce9657d95e08d18d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae78c33-ba04-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677876607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876607, "uuid": "97aa1ebc-7c9a-4316-b204-89479bfd42df", "comment": "Malware payload (Mirai)", "value": "1658cc71e3d06c70d75e3843748fe6a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876607, "uuid": "85d944e4-0166-4beb-b4d2-4f986ec5d2c2", "comment": "Malware payload (Mirai)", "value": "013b9968e0ed349a51240406f8cec60ba6102915aac00463e534c820f1cd1d3f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876607, "uuid": "70482c12-4a03-4329-9d49-96a7127e5020", "comment": "Malware payload (Mirai)", "value": "12ce4873e666deb3f827f3691d65647bc89273f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876607, "uuid": "9b887326-af3e-4dd8-8ca1-074809bdd914", "comment": "Malware payload (Mirai)", "value": "8902507a719d6a614d636178a26d73a27d698f62097cf699fbada9ad640ea125309e5edfa8aad43264007c6d49c550b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876607, "uuid": "1609713a-a1c3-4d55-a7d4-5a71b0be3b0e", "value": "T1BBA2E11572532D66F3AD1C3DC86A825BB9671BFC80F6327579405620C94D24B3E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876607, "uuid": "87214b79-fa17-4523-ba3a-ae49243781ea", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjrRhymdGUop5hs:UvQn4j+ZO5fKAlxJs3UozC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677876607, "uuid": "338f8731-efae-4b49-a912-48543672d5ea", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677876607, "uuid": "bf9a3100-d893-4efa-9e54-ee51bf1e97c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876607, "uuid": "cdf5e4bc-e596-4f6d-bbe3-33a39016dc5e", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170eabdb-b9d0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677853890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853890, "uuid": "c635b93c-8b59-43c3-bf73-286c9007ee1b", "comment": "Malware payload", "value": "45d2800b48f25656e6155ec5a843815b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853890, "uuid": "bafd0300-15fd-4af4-a621-d26904a2d54f", "comment": "Malware payload", "value": "01e777558c6af959aedb00a0285614cd9fc073f0c084c1a109f72b7e0b19bd18", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853890, "uuid": "7592942d-ac24-4643-9a24-50cc5e0be2d4", "comment": "Malware payload", "value": "95e73d7dd37cc4158a60870d65e19dd767c1c01a", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853890, "uuid": "3b4e3cbc-a5c0-42ff-a3c7-38bccad3222d", "comment": "Malware payload", "value": "51483a2d9e02045a3d8f260e4229622e363eba0d4e4d8d343153f9c7fcee251f1e171c33333dabe31a1c018015bf3d0e", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853890, "uuid": "4884e721-41a3-4edf-8bb2-639f5f6a2d9d", "value": "T18324235EB5C636E5CD9177BB8142F28B82A8DE27045BC41501E5CDCBB286C3C89B778B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853890, "uuid": "db86c54e-ab26-48e3-82d2-c6d4dde2921f", "value": "6144:YSY4EkSL0SkchQXMZ60JCAC87rWLeSMsEdVqU:YwzSLjKrBAC8nWLepsm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853890, "uuid": "ea4ed478-78ea-4744-8150-4a04fec704cc", "value": 222901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853890, "uuid": "b786ff5e-1d70-41c8-b8f5-77996acc55ee", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853890, "uuid": "1a3e062e-8d70-4be2-94f2-6620644e6611", "value": "PLZ Corp Order No.11500822.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7714431-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677856710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856710, "uuid": "fd38f0bc-de8f-4994-95d7-f57bb0e5244a", "comment": "Malware payload (Loki)", "value": "d15cf35cde2a620d2511370c646b1490", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856710, "uuid": "fce0f6c4-03ae-4468-b1ce-4398254aeef6", "comment": "Malware payload (Loki)", "value": "0220e6193329f183a7c942a3508d3c4c39666b29bd3a4f56eecb876d16321f77", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856710, "uuid": "fb276014-8f44-42a7-8326-056efbe2257c", "comment": "Malware payload (Loki)", "value": "211b32410ee78c2f2bdfc3e73d45b391e1aabd45", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856710, "uuid": "d6ecdf1f-bada-4065-a1ac-5025a43864ee", "comment": "Malware payload (Loki)", "value": "46e835ddbf02cb25a0a7ecb0d356a2561d5259541bbcc494737c288e45865b2a5ce43fae009743906b9d42b910bfdebd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856710, "uuid": "917bfb5a-f5c9-4b4a-a6d1-bff1f4f8aaeb", "value": "T14555F1036138AD8DE212C7FCAA3F755D400E7D7771CA65CA5A44B70A4A73EAB51BF108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856710, "uuid": "091c31d7-4185-4404-9543-0a453eff74f6", "value": "24576:gLKiWQmmav30xaBrWQmmav30xuWQmmav30xpB6OWQmmav30xx6EzJDqS0ULOHl59:gLKnQmmQ30gUQmmQ30hQmmQ30nUDQmm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856710, "uuid": "64d32b90-6f2e-4544-901b-947413747f60", "value": 1380352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856710, "uuid": "5351a9c8-6ae5-4174-a90e-98d53e8609bd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856710, "uuid": "34fc5882-f643-4a4f-a774-340753c84f5b", "value": "MV. WINNING OCEAN.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aad218e-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677856635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856635, "uuid": "ffc988ad-d031-43eb-8c0a-872d57d005a8", "comment": "Malware payload", "value": "23875486638e44c262ae298c801d6397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856635, "uuid": "571a44d0-7404-4f90-a08c-539108016600", "comment": "Malware payload", "value": "02b90a4148ee0fa8fd8c94585296952f52d56f42da3eb8739b6dd297b5d29b95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856635, "uuid": "3094149a-4a62-4e5b-b31b-e2cca726c7ed", "comment": "Malware payload", "value": "1dcb9bf831cb0fd38c3f991ac3a68988a4e22138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856635, "uuid": "ff92fe24-06c6-4fe5-b4c7-fe704bda79fa", "comment": "Malware payload", "value": "9379f6bfa098c8fa2db803a4fda7ea71759694ddd318453fed516c2b117edd47618c90bdce3a34e834014fa041df6939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856635, "uuid": "15c536c5-5f81-4616-93c4-770782d93973", "value": "T15856237323DA1540E9EA8C31C533FCE972B6576B8B819CFCA5C67DC12A125E5E603A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856635, "uuid": "bf26a08b-a045-43dc-9413-acdaa81900d3", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856635, "uuid": "fb3eb82a-8fd0-4dcd-93b4-2b75bceec2f0", "value": "196608:oYhp3amiyWG55ZGn5/p8BFeToXK6bL91Ip:oYhpKjybbwnfTohQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856635, "uuid": "0d98fa3d-6bf6-455b-88a4-4720cc121f4f", "value": 6325248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856635, "uuid": "ec2cd94a-4ce7-4441-9edf-e1466a12954e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856635, "uuid": "56661116-bcfd-40de-8e10-8bba849889f1", "value": "23875486638e44c262ae298c801d6397.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d23b09f-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677850545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850545, "uuid": "2df5f662-4d50-434d-89d9-88a8caf0a47d", "comment": "Malware payload (Mirai)", "value": "b76b8057d71d7149327bdcc61569424e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850545, "uuid": "f00553b7-0597-460c-8adf-fc8b9a40ae55", "comment": "Malware payload (Mirai)", "value": "0313ec1e9bea16c07c9ae23d757772dea857b7a0e424ccb5281ed0c980f8c008", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850545, "uuid": "d9feccf4-649c-4485-a714-026c2b181b83", "comment": "Malware payload (Mirai)", "value": "36c592116244d77d649ca98484e607e550dc58bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850545, "uuid": "efa74856-a461-4953-9048-599ecb7e66da", "comment": "Malware payload (Mirai)", "value": "6ee6b1d382ddace7a45c92fc03fa29656fea6cf84585fd87cf7331ac262d35e7b9198bd6ae7d61a699ada5ac68cd8638", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850545, "uuid": "4e47674e-60f8-48fb-ade8-93017be01bce", "value": "T1F083D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850545, "uuid": "b4ae08a4-3747-4ce0-b3ba-7adb8dc82758", "value": "1536:iVLyu95K8Ukj752dCexuV/8UZlDwfkJ4MYfWX:iVLyMgSFezxu5VD1eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850545, "uuid": "6c96c292-e510-4afb-bbaa-031c175dbef1", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850545, "uuid": "2a96c4fb-f882-4167-8943-28dc08274561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850545, "uuid": "515a2ac4-4ee1-41fb-9eea-4efbfc660bcf", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3dba35e-b9e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677862314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862314, "uuid": "284bb21b-be54-45bf-815a-aad83e321aab", "comment": "Malware payload (Formbook)", "value": "fb97b15e62bdb8e9d0124d788cdb9c0b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862314, "uuid": "66a42673-152d-4643-8897-edec5c0ebcb4", "comment": "Malware payload (Formbook)", "value": "033a48733a81f04e178d4e8769f3995cd0abda76ff5856dd0d10ecf6cba09963", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862314, "uuid": "2c7209c9-d9e1-4d1b-a9b4-852efc87e550", "comment": "Malware payload (Formbook)", "value": "ab985252f0589127250c0f15f899459ee5e500de", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862314, "uuid": "23c0565c-c8ef-41c5-b001-8ddbcfee3e09", "comment": "Malware payload (Formbook)", "value": "dbcdddc720b5588c78a2af8fc2d9de14389eb282943515c5c521d01ee56aa16c381449b7ae614f4e836f546e65fedd37", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862314, "uuid": "0cdd82a5-d6e5-47b9-b74c-b10b7b9432f0", "value": "T16071F97487890AA7C5671DEBC8BD7D4508A3F61906CB0ACDC09AE9F0016327369338D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862314, "uuid": "e331762e-090c-4cd0-b1c1-324e699e115e", "value": "48:WpDUBDN91KhElkBMkz/NYR1FdS+MO1OWXBg2wyU83GsUnFroh4WfxVeLSa2uyLAM:WpQBLshEGBdi1JO6y52JWWhu1+Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677862314, "uuid": "ae27e4ef-2a84-4149-8fb0-39f14262dcdc", "value": 3699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677862314, "uuid": "b4005291-b140-4fed-8c4c-d373a1ef595a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862314, "uuid": "1d59b7e9-70af-452b-aec9-d2bb3ab6b2bf", "value": "ECOTEC PRICELIST MARCH 2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76700c39-b9c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677849326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849326, "uuid": "12fb9301-49a4-4325-9b55-42f1b13db965", "comment": "Malware payload (RedLineStealer)", "value": "12f9acf39bb1fde5cf7fb467fdbbd39f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849326, "uuid": "f5ab7ef1-c025-4d60-9a5c-9923510f8511", "comment": "Malware payload (RedLineStealer)", "value": "049dc4bde6ac879a23950d749d93ee9f6c5ea2a9ced45a0aab02af4466590180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849326, "uuid": "b72c4799-f1cd-4e92-9bdb-dfe08ff4f37d", "comment": "Malware payload (RedLineStealer)", "value": "6419c02a0132eb08b0a16c6325c170231c20966f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849326, "uuid": "ef0c5f2d-461e-45b4-9d7f-0af9a13dfe53", "comment": "Malware payload (RedLineStealer)", "value": "0c37bfed969e237ff9a74ad3ae920cec7cf169ee73a910c8e3ea906238dc0b65d99bbbb1b416562ebbe3d43ee8e59e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849326, "uuid": "249e84ae-33d3-4859-b24a-2c88ed789557", "value": "T123151217BAE88177D4F54B712DF603D32E36BDA06634935A23CBE80E18716B0A671367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849326, "uuid": "9332fe70-43d5-48a7-aeb0-70946af71cb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849326, "uuid": "9e8cb7b5-c9d2-4a74-b145-3bab2f615a0a", "value": "12288:+MrCy90TtynV6ks7aX6g+ji8Ap0EwzysfXoVGz4IH92RRtQyPNj1Vezx1gE2bC1J:IyGtkV6F7G++KEwE2J9WxPNpVYSbuBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677849326, "uuid": "38b39043-cda1-4268-9bd8-0607dbaae1bd", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677849326, "uuid": "0b0ed356-af64-4482-8516-7c5256645041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849326, "uuid": "bc85d9a2-54d2-4fd6-a210-759629183916", "value": "12f9acf39bb1fde5cf7fb467fdbbd39f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac5a2b9-b9cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677853494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853494, "uuid": "1d1e3c18-5c71-48a1-b008-2eb45ccb93b4", "comment": "Malware payload (SnakeKeylogger)", "value": "872324d761f8b173becd96e2c273b2c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853494, "uuid": "a77173ab-0742-484e-b776-c21c7911a1f7", "comment": "Malware payload (SnakeKeylogger)", "value": "05bec361a7f7ce8bb453225e15f0911068f103c51eee5e553f783955f65ed54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853494, "uuid": "3cdb0eff-b99f-456e-9f21-5edd2eb66ae9", "comment": "Malware payload (SnakeKeylogger)", "value": "aed94712d9df96983873fdc1e23fb12574e225aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853494, "uuid": "723e011e-d013-436d-bd47-c23fa50f4b23", "comment": "Malware payload (SnakeKeylogger)", "value": "da4bf09fa889a4bb1888907aa30b06b857c4558efe4b115f000b4d0f9e1c3b1e0bc7b54b252b1382223311f5bebde62d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853494, "uuid": "84d11f06-5011-4f8b-9a2b-d4b1d0b45d32", "value": "T1BE3412247068D16BF4F147B189796B37AEB9ED2714B8830757A09F8D3671341EA0E3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853494, "uuid": "f598d1bc-d21f-42cb-8a4c-d24d4c8daaf9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853494, "uuid": "5bfb2e94-229b-43a4-8f26-3fe83b7cc296", "value": "6144:/Ya6VsEd85CjY6P8RQuawPMXtTZGATWkSxb7VkPPNFUGL01Ck:/YHy96TWPitjT0pkPPNFUGYok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853494, "uuid": "e8dd5c0d-3d44-4981-8099-c90ea3c3f965", "value": 241079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853494, "uuid": "0a2f4bfc-b911-471e-9c5b-6dce6e344c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853494, "uuid": "4188e169-3929-444a-8eb8-17a9a7cc2b10", "value": "OHPL PROJECT ENQUIRY 332023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11054b6b-ba07-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677877503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877503, "uuid": "9145acb8-e279-49cb-a5ea-895c0b287577", "comment": "Malware payload (Mirai)", "value": "f101e423368a233f8b93d43839404604", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877503, "uuid": "436b9a6b-b1b3-42df-b488-7cd796490184", "comment": "Malware payload (Mirai)", "value": "05fcd00d12151d340fcf1fe51da234c287185160a2cf8a1422acb80498d6379f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877503, "uuid": "8b54c5ee-1b7f-41d3-9b3c-49aa95fed6a1", "comment": "Malware payload (Mirai)", "value": "992b4d266d55406d8a28293fdc3d74587f092bb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877503, "uuid": "b301ca23-cf9c-4563-bdfe-b7d688e87ebb", "comment": "Malware payload (Mirai)", "value": "ea51361d4f715a15df892a6e591a78445f84cffb6359daf228dd820bd40cfa542cbb1199cb1a747aca528dd58bcfc309", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877503, "uuid": "ea79dedf-99b2-491a-bc95-0e61595cf5b4", "value": "T134330A8EB8029D3CF90BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877503, "uuid": "7289d008-914e-42c8-b224-5c9456d28c35", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oG4:r/hqaJMeteqK806MHdkfQX6HuC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677877503, "uuid": "d5037dc5-072d-4812-90ca-9b8b8d8067e1", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677877503, "uuid": "4239ecae-7814-4d1e-a616-b61423dadeb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877503, "uuid": "09c28be3-7e1c-4934-8c0e-ac0cf45afc53", "value": "f101e423368a233f8b93d43839404604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f911dfa8-ba04-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677876603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876603, "uuid": "3a03968b-dae1-4fa2-9d04-4dc2f50d6659", "comment": "Malware payload (Mirai)", "value": "e88e5d397e8e622ebdf7e9acdd8b3687", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876603, "uuid": "77deb2c8-4af3-4270-a3b5-084957ed4562", "comment": "Malware payload (Mirai)", "value": "062b2a622a8c5efab5eec45fca53a5c179e10c5d632b051ed5dc8d5be0dd66fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876603, "uuid": "c39e9d33-b206-4c3d-9789-fce9417f5e06", "comment": "Malware payload (Mirai)", "value": "6820deece907a01d3f38a7862ba73a94481ef05e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876603, "uuid": "0dfae0b3-9d9e-454d-9109-72f1bcf669a1", "comment": "Malware payload (Mirai)", "value": "0a9cec08e41b722c5be3355e06a55c638304adbcdbe8ddaf3aa5c0d6725919168ff5e961ac78679f3e010633bdffc429", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876603, "uuid": "49ee36fa-9a2b-4b46-9627-60c6c33488f7", "value": "T1EEA2E0257F1DE88FCC37B27886E5E9C693D07D24D2DC89866741C12FAAA36846830E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876603, "uuid": "97d41db5-9790-409f-9516-b0881449daf8", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtfDlSD:x98o08kxofBE+ZkXaT47C2Epitnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677876603, "uuid": "1b943179-e22d-47ce-ab42-995346f23067", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677876603, "uuid": "8d2285ea-af2d-49ad-b634-aabc681d8f4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876603, "uuid": "1cfe7d77-1654-4d13-b0f1-396717adb09d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dce1f5-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677857561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857561, "uuid": "f1c2cae1-a83e-4076-81d6-a8851a8dde79", "comment": "Malware payload (RedLineStealer)", "value": "25aeff189af517d8fb2678c98a28dc24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857561, "uuid": "1798d061-bf56-4915-9eb3-7b20a93db564", "comment": "Malware payload (RedLineStealer)", "value": "06c315304e58078deffa97fc02b766be633ed54d2401dd87ea589781c8f45f18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857561, "uuid": "34cc9ee5-cf7a-45d7-8f0a-c2e07e030b6d", "comment": "Malware payload (RedLineStealer)", "value": "cf73e427938dca7a849852b6f3f8f5e19e58c21f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857561, "uuid": "bc87dbe0-f43c-41af-9bd8-617294ea4cde", "comment": "Malware payload (RedLineStealer)", "value": "157f82ae367b69ea85cc5e954607323c9ff249f25fda5f4497dd2c35885c40092784738be87da84ec94687893e3d2f5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857561, "uuid": "5d9a0213-39f1-4332-aa17-e8394767057d", "value": "T12E151307A6DC5037E83993B14DFB43D30A363D60AAB847AA275F5A1E0C727607A35726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857561, "uuid": "1ed0e914-e869-4eb7-9e1c-b3508fd729eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857561, "uuid": "5acdfa1f-dd89-41ad-9070-7d93e462183f", "value": "12288:rMrNy90YlAqLX/s/bCh0ZbpbpX86+FCG9u1NY8Z7TNHh/GZCkG2txLfYjJKpESN:yyTlT0TCh0S6+YBB7TNB/MnGeR+MEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857561, "uuid": "2b2bfefa-a93a-4930-8a54-1e08b33e01c3", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857561, "uuid": "0db8b6a0-f013-4018-ae17-11c9e0708374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857561, "uuid": "9b63b083-f99e-41a7-b2c3-32a53aabb71a", "value": "25aeff189af517d8fb2678c98a28dc24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92e39e5-b9c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1677849035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849035, "uuid": "44ebe72e-171d-4d5c-8230-ede5e225acc4", "comment": "Malware payload (Vjw0rm)", "value": "937dc6d86aaec946b8b1a85c18dfc0f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849035, "uuid": "5d6b9a0d-f2c3-44e6-b0a0-2c66d022678e", "comment": "Malware payload (Vjw0rm)", "value": "0709e45b9186e29e63b1201836886b878e3d58ab49839aad499982909e6f2a70", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849035, "uuid": "482bf700-75cb-4dfb-b18b-dbcd4010a8b2", "comment": "Malware payload (Vjw0rm)", "value": "54cffa114d9190531e7ea511fcb3366891cdec78", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849035, "uuid": "b9ee3af2-5678-4d10-bfc1-3a54834e9be3", "comment": "Malware payload (Vjw0rm)", "value": "7c51565943c1c863f8ad585f2d7eb6536b95c900cc47636b22a26d54a01d98830000e6356a7f102575ee07010d11528a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849035, "uuid": "a33c708e-3c88-49b5-96a9-e5d617119bc4", "value": "T10A05EE4C39D330F6BA838190676B48C5D27E4B76B90C484ED25DE4C0ACE9D36DD29EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849035, "uuid": "f0a092f7-9c9a-4202-990b-40f516470cd8", "value": "6144:ZPCzWsMvIvVtVys9ViggID8N7dxjZNQySzE70Gd:0MvQ/VnQAD8JdxjZKO0Gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677849035, "uuid": "7de9a05f-d862-475a-8d0e-46fd4440a668", "value": 871467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677849035, "uuid": "611c5488-31ca-4e62-8853-7834f0c070bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849035, "uuid": "b708faca-645b-4c24-af1c-18d195012542", "value": "swiftcopy29,000-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f2afa2-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677845133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845133, "uuid": "2928d23f-9544-4862-8937-be8af489adae", "comment": "Malware payload (GuLoader)", "value": "cbf99e523ac756352b38d590878a1654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845133, "uuid": "708c0362-c0fe-4252-8d98-08d8bf25be77", "comment": "Malware payload (GuLoader)", "value": "0796d52f6848f865a436252ae890f340c61e02d793d593e59ad83ad5735aeda3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845133, "uuid": "b6b8052b-81c3-466e-b74e-d0c13de45363", "comment": "Malware payload (GuLoader)", "value": "38008f2177dc3acb2eaa2035dfc7f36f46697430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845133, "uuid": "86395136-ae81-40c4-8549-fc67f1f1c7bd", "comment": "Malware payload (GuLoader)", "value": "8df1853ce981901128627629c10fc8d8fcc843de14d2bdee671bb1dd85a7145addd0e291b9ccf6752331ac9b0a05f6ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845133, "uuid": "4de2a029-0557-4ca6-9c91-f795b6cedbf4", "value": "T10354120517B1082FD6C645B118F7FE39FBB9F90602591B0B67240F7A287695BDB2E02E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845133, "uuid": "cf0e3f02-0fbb-49b4-aa6c-051b781e6d8c", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845133, "uuid": "200a533d-6e2f-4f46-8450-7593f5d4721d", "value": "6144:nzAJ6naFJhPjbf976roX/XBZdsitTS+JmTupA3aTPjeXMj:zLnaFfv8r+hsitSTgAqTPjeXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845133, "uuid": "56e4f78b-6439-4dc6-a334-d4a5aebf3c0a", "value": 285899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845133, "uuid": "0f50f082-9265-45f3-aaba-7c51efc0a21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845133, "uuid": "68d219ea-0fbd-4494-aff8-763fc6f310f6", "value": "0796d52f6848f865a436252ae890f340c61e02d793d593e59ad83ad5735aeda3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ac260b-b9ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkTortilla)", "timestamp": 1677865917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865917, "uuid": "455eabc3-4c7c-4d39-97fc-42de99a6bd20", "comment": "Malware payload (DarkTortilla)", "value": "c641f658cac62da55bf8024703d4934b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865917, "uuid": "613ef070-b77d-43a6-83a6-90239483efe9", "comment": "Malware payload (DarkTortilla)", "value": "07f0b6c15893112b6628964ef8f474aaf97118de6fdb86b5eb5a62ce6ec496bc", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865917, "uuid": "bddd0960-d660-42ae-ae42-5e1c99aa1781", "comment": "Malware payload (DarkTortilla)", "value": "ec3e4d63960b2215f14a4134f2108488c12d160d", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865917, "uuid": "bcd92cce-146e-424c-808f-1b29689f2c36", "comment": "Malware payload (DarkTortilla)", "value": "b8abf84e5c8dd4cc76ed47f3f5e94e0d79d5f8074f6a5887ca405aba2630092b9f3074aa8c3c8d2a31b09d296a04997c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865917, "uuid": "75423825-7372-4938-bc63-ff8df035e432", "value": "T1A3154942A3A14A10D5B5B37A86A5E3321356FDF31612C60A4BCB7CD7767B3C62E0CAC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865917, "uuid": "2fd22ccb-139d-4839-acaa-a5212546d749", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865917, "uuid": "dedbb1fb-5528-4c16-816e-b17b60a0c340", "value": "12288:aDixmGng+cZuX84vEm47Vqvzv2rgilF9yw8ib+giqHcAPmfRF:Pi+cHn74rv2Mil/8e+gN8ImfRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677865917, "uuid": "9e4394a2-5c9d-4960-be3c-111d4aa7911a", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677865917, "uuid": "db9131fe-07cf-4a80-998e-c6015fd035be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865917, "uuid": "87a662c0-1509-4131-b230-f77a9327b286", "value": "Bank Draft Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c33ddfd-b9d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1677856073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856073, "uuid": "0be9080d-21c2-4f95-9605-8cd642b85619", "comment": "Malware payload (LaplasClipper)", "value": "18f4187feeb585981ef0d9d8169367ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856073, "uuid": "761f72a2-d075-44c7-af84-1239537d515b", "comment": "Malware payload (LaplasClipper)", "value": "081d0c30f38adce3f0a41d0a93b7a421031284c467df1eb65b66c6867ac9a7ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856073, "uuid": "4824e2ba-1692-45c9-818d-586d14bfd323", "comment": "Malware payload (LaplasClipper)", "value": "7ec93fccfde4cab7cb5c0a364621e788c861e33f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856073, "uuid": "173d8b15-cb8d-44ce-a7a9-f313cae0dfbc", "comment": "Malware payload (LaplasClipper)", "value": "89fe6dcc599f40998c34a5a07f46e994848c44a66d349b803d6c886336653208b37133896e171636996de8e067974219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856073, "uuid": "6009c001-0f45-4937-8296-33d3c4a041ec", "value": "T18595330179D3D1B7D24703B8CA21C7E13A26396684D5C5EB372937BB2F206D263B7298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856073, "uuid": "525a4842-fe76-4607-a18d-f9893b90a701", "value": "be36bfc6ee575499ccdad85ead6d31cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856073, "uuid": "1cf1049b-60ab-4101-b790-be08b78d5941", "value": "49152:oGEMFTf7kWgRyFCo66Ux5UjqTpGow86b:oGEibAWgoFJs5cqTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856073, "uuid": "764f6ecf-c5ad-449e-8dd0-68fd1151d873", "value": 1952256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856073, "uuid": "58394754-9679-453e-a961-544de2ee458c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856073, "uuid": "89289ce4-cebd-4b62-971c-ca4d432d7aa4", "value": "18f4187feeb585981ef0d9d8169367ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca28ddb-b9da-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677858571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858571, "uuid": "f3567ee8-241f-4963-bd8c-e34cf90c464d", "comment": "Malware payload (AgentTesla)", "value": "f36b76468ce56f91d03111d9c131e511", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858571, "uuid": "9ae631d9-a33a-4189-8efc-52e822a0f187", "comment": "Malware payload (AgentTesla)", "value": "0879a6e9e1a48d860e335ba9d34d0af515d5a0b1c14fb140a5cdb56e4b577ec6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858571, "uuid": "3703f46b-2654-4391-a627-0c22a3c74631", "comment": "Malware payload (AgentTesla)", "value": "4a35857680750254b8668cf61ca6c3fce14fd33c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858571, "uuid": "c2ff8f31-a476-4824-8c92-f7c21217f3f9", "comment": "Malware payload (AgentTesla)", "value": "9d1f1c67c2dab59373e281093fb5a2fb7ef0ea9c799164f15746c5b0d2b22cca68cc2d284fc926fe3dc9af3157d3d6e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858571, "uuid": "f2a5cdd2-dd0d-4a11-8976-e287e1e937b3", "value": "T1C344234FA0C25114E834E8B34736A7BF02697BAD9ECD64D89FCB51B9EE741112A423C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858571, "uuid": "0a498411-536f-4eba-8d71-cb6d72e10887", "value": "6144:M3lsoHMoQT6yWh+vZ13RJZh0ADKvDj6YIu5Zp5uEFsyntdR8:I1HMIyWhyDvz0UYvIyFuE+ytg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677858571, "uuid": "a6f30283-91e4-4056-839b-a8fb5742dc52", "value": 268763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677858571, "uuid": "3373f907-2fca-4fb2-a2eb-aabd4239d4f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858571, "uuid": "61f30110-bbdc-4895-9766-3d2b73d39b27", "value": "Shipping Documents 5109360.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c198e04e-b97a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677817240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817240, "uuid": "bd7c8fd8-26d0-4e24-8c4c-316f127f4e14", "comment": "Malware payload (SnakeKeylogger)", "value": "e65c722b00600584d7d4b3d076677fe3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817240, "uuid": "6fd65bcd-232d-486f-a4f7-8f1b0f60b278", "comment": "Malware payload (SnakeKeylogger)", "value": "093aed8321e0c99537fde1bd8c9cd7e2bfef3fdcde9ddd5122f4d63665a9e602", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817240, "uuid": "3c444746-0d4a-4741-b2c1-5deec125bdb8", "comment": "Malware payload (SnakeKeylogger)", "value": "852f00f649d43f8df47d730a57ec07db9ce29a4d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817240, "uuid": "2b395c0d-a38f-4f83-bb98-fa4b95f3771b", "comment": "Malware payload (SnakeKeylogger)", "value": "85caa7500673c6b0674315f2cd17d84bb2e7da402c7187b6f958a870697b0ead501cae43be52af558166ee11c5da9f2d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817240, "uuid": "ac8bf4fa-cf98-418f-ae05-8313ddbdd1f2", "value": "T15C525B404BCD84B18399F1738165C8080ABED237346616F9F99ED4923BBD70D9AF89F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817240, "uuid": "6c0732fd-76db-43af-9c8a-31a329a3de85", "value": "384:/TzQ7OauCOpdDuH+dmq3cP/HbjHcoKM3fyG6ZS9v:rz0OrCOpg+Mq3c3HtKVZS9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677817240, "uuid": "03ac58de-2eaf-4543-9656-1e0b0d162f5b", "value": 14305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677817240, "uuid": "dc8b701d-ae67-4e3e-a483-c740ae686450", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817240, "uuid": "e7713c59-f1a2-486d-9cc5-1f8879807ef4", "value": "e65c722b00600584d7d4b3d076677fe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffa7cb2-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857341, "uuid": "fa26fd67-a49a-4646-ae31-585349a5e32d", "comment": "Malware payload", "value": "aa1f18f8c041deb83721d53cc2f06a4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857341, "uuid": "f95c9345-73ca-445a-85f2-6809035bd219", "comment": "Malware payload", "value": "0a440a4422a0d78491a519130614322102e5476a766ec538dbda5b416fae75d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857341, "uuid": "63e0279f-fffb-492a-b715-53ce6499ec9d", "comment": "Malware payload", "value": "38f53babba76fb636639f055eb61c17aab443b76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857341, "uuid": "7d3fd449-939b-4a32-bd23-86a4a9b18128", "comment": "Malware payload", "value": "d9cbf5e396318155ad1a5443099fc484a2db7f6fcd047657b7efae250a7733cff47ea42b49029aafe2a9888ed39761be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857341, "uuid": "39e89513-4e1b-4dc0-a8f5-30983e57e0dd", "value": "T1DC26F28FB5A941A3F36BF93C7F706F327A50526642934C0ACF09C1E4B2815775EA9632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857341, "uuid": "07c8a939-a145-4913-8404-db169fe8ad5d", "value": "adc8d05555d8c832390d0979319844ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857341, "uuid": "7fbfce94-56c7-4a7c-8d28-a2a1f3324e27", "value": "98304:oc31RBC96etJeZ3G9LWme1lZW03xLiSJOIQMEy8PyEpzVQa/H1YMlJ:p/+64JeBILWmeLw03dRJpP8PHb/HNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857341, "uuid": "5b2a822c-a3a7-4671-b90a-7e3e01ccc1ee", "value": 4637184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857341, "uuid": "b1f43fdf-84f1-4e31-b90a-0d693aad7440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857341, "uuid": "94955dfa-6f6c-4b3a-b215-422f8f42aaeb", "value": "aa1f18f8c041deb83721d53cc2f06a4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77869125-b9c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677849328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849328, "uuid": "ce5ac356-f2ec-4a82-9d70-3358da89faaf", "comment": "Malware payload (Amadey)", "value": "975e10c1763042c45b9778af90d982f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849328, "uuid": "9a4274b1-83b5-4b10-b609-c3fc9b22d36f", "comment": "Malware payload (Amadey)", "value": "0acd71939ac63662f0a0174fdd7930b47a712cb6444cccd14e6f4248398d908e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849328, "uuid": "a8e2fe0f-983a-481f-803b-f16793781030", "comment": "Malware payload (Amadey)", "value": "884493d24b7a814107496b296110bff7e76fa26b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849328, "uuid": "b5bac4da-350d-47bb-adb6-1838adf20061", "comment": "Malware payload (Amadey)", "value": "fd0e41984570d3ae7a26a8cd6643dfdd80924fdca90a6ae0d6bfa36e82a795118a473309fab36869166d58e1b0d5e4c7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849328, "uuid": "b50b89c3-2f80-4d50-ad83-1df7f11fdf13", "value": "T12B14AE2272A46A70E4F25E319E2DE2F46E2EFC524E78569B2374FA2F0D701D1C572712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849328, "uuid": "47da416d-2f36-4be3-8b79-0ad49b2d58be", "value": "31e8556425ef4035dbfc678a002ad91b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849328, "uuid": "2c7b9495-39f3-4341-83b7-027e7846e8b5", "value": "3072:hz/646eAHV60iUNWhCJ8Z1be6KlzFrmvjaPDwCIv+j3:Ni4EHV60rNWLrKlxQoDwCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677849328, "uuid": "bd88cc64-2639-4db9-8d97-f561dd9ebd12", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677849328, "uuid": "cabc7927-aaa2-48f9-8315-e6848e579bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849328, "uuid": "7e376897-6634-4042-9610-1f40129fce5f", "value": "975e10c1763042c45b9778af90d982f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284d1fb1-b9e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677862939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862939, "uuid": "f3091ed1-33a9-4c0e-867c-703cd74541d2", "comment": "Malware payload (RedLineStealer)", "value": "f766e02da046dcd0b34eed69e2c68182", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862939, "uuid": "daf58a33-19c7-48fb-8cf2-e467e602b8fc", "comment": "Malware payload (RedLineStealer)", "value": "0bc3bf3d578af6f367f2ba1e2684c686ab2339fbcaa3edd38e83789a692df1e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862939, "uuid": "14eae7c5-ee3d-448b-b4ff-02b8acdb9d9a", "comment": "Malware payload (RedLineStealer)", "value": "b37a62cc2e299e204f64a741a532685bfd42289f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862939, "uuid": "349984bb-8df0-45f5-b4b5-68a25b34d1dc", "comment": "Malware payload (RedLineStealer)", "value": "d82df4d3e96e724c3c130a3b1e1cfad96e0c6f07b648dead081631641cbb94feb825f703edcc8d1d3d24e404bab928f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862939, "uuid": "f50ce0c2-e2c4-43b6-ac99-6c9279a4089b", "value": "T10F64E03072D1D831C0B21A31CE7586F1963BBCA3AD79549B73943B2E5EB02C1896D7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862939, "uuid": "f4a5cb13-bb13-4a75-b309-462c07e456e9", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862939, "uuid": "9f60a1b3-2ad5-47df-a271-f6373655345f", "value": "6144:Q+kiHuUvh9Qfpe08PcowUm6GQhT+hF96JRTTfmCtdS8tpqj:Q+kiHxzQfpN8sUmVQohF4JxNdSm0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677862939, "uuid": "263dddef-4bf4-4d1a-9c1f-d7d479e145a7", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677862939, "uuid": "21d77c64-12c7-457c-b0ed-adf12c963846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862939, "uuid": "f0b47e28-71ab-4a54-a101-2569d9bbbc46", "value": "f766e02da046dcd0b34eed69e2c68182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a013d3b4-b9e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677863140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863140, "uuid": "611b8353-b1a9-47e5-9619-e166cd158ec1", "comment": "Malware payload (Formbook)", "value": "ce63ed60e6de78acb8a836931b09c2bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863140, "uuid": "2aaecaee-c861-4204-b26b-d36779fbf2bf", "comment": "Malware payload (Formbook)", "value": "0bd096a462dd6ca8fd6563954bcb47167296672ce207e0a1b8b2407a796760a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863140, "uuid": "3c75e1de-11fe-4433-a3e5-79c15068435c", "comment": "Malware payload (Formbook)", "value": "8ddf66a0b28ed3e92adfd8a1ae385dca630d5b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863140, "uuid": "226c4868-9bf0-405f-8054-32ae1abcd446", "comment": "Malware payload (Formbook)", "value": "9e8762fa55fa39842797c62be2cf23c5259e66b1683da6589884d2fac1c79c8143cd82aaad1061a757aab875e1f812af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863140, "uuid": "312c3857-b1f5-40e4-bc96-f3699c7c483d", "value": "T17C3412187470D02FD9B789B35D35861B6BBBB82130E1A34713052F9C3ABA982D55F762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863140, "uuid": "0213b193-ef71-48b1-bcea-dc0e4fa97654", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863140, "uuid": "a4fff5c0-92ed-424b-a4c1-39f39c4679af", "value": "6144:/Ya6n9Ni/AVfglawdXGdQgidL95+Fx2Z3:/YlLiG/wd77+OZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677863140, "uuid": "fe6efa1d-46fb-4b37-8e93-63f87de68192", "value": 248279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677863140, "uuid": "e10f78cd-ab21-4611-913d-b346593407cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863140, "uuid": "2baef237-cd24-4393-9813-33daa8a32bfc", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ceb5441-b9e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677863134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863134, "uuid": "4b1a7dbf-175a-4387-b933-88a772235cf3", "comment": "Malware payload (RedLineStealer)", "value": "eaafe94e49903dc509d9f7b14f0b7ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863134, "uuid": "efb940aa-89ca-471f-ba39-1fe1d8a9cc9d", "comment": "Malware payload (RedLineStealer)", "value": "0da48eb333b5c87c425d7b3020068b798c87bb86d9fe98f80c072a14d5d56207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863134, "uuid": "04611391-e06e-4a52-a5b5-c786bc8a8bdc", "comment": "Malware payload (RedLineStealer)", "value": "da9b87992edca8edcde5479533bbbb8cb6db6484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863134, "uuid": "36787c70-84fc-4174-b6d0-5cf0c6748353", "comment": "Malware payload (RedLineStealer)", "value": "0ba8635495710b24f0560ec5b8d8639750656d72f32fcfee969d96ccb7a72c4ababa8cb78aeaad7b0b5795fdbd26135e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863134, "uuid": "b1b1083a-5db5-48ed-b16e-7710d8efe98d", "value": "T18715230BF7E89422D8B657706DF103D31A367D905738825E638FDC5A0CB25E4A6327BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863134, "uuid": "28b2782f-e17d-4032-81c9-71b41f6fed83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863134, "uuid": "bfef57b4-88a0-4e4c-8af4-48e4d12900ce", "value": "12288:wMrWy90+o4vSTLVYZgTTDYt1K3+1LGWZznZ3ops0r5OcnfA2GiGlrTlgex8nV3wm:2yiJVT/DYX8aVzZXDio3dxSwNvJShz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677863134, "uuid": "fe80fc3c-293b-41c3-982f-a04cf402010e", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677863134, "uuid": "41314abc-7746-436e-a890-580b9a2170d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863134, "uuid": "1e9dc1c4-87f7-414d-8334-6ab9703a729f", "value": "eaafe94e49903dc509d9f7b14f0b7ee8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e884ede-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857339, "uuid": "f2e38504-8099-421b-a7fe-59ed9847ed4f", "comment": "Malware payload", "value": "175d5e42a925185d216d84dc5f448769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857339, "uuid": "bfbc3744-6c79-44cc-9e5e-f32f29c9d085", "comment": "Malware payload", "value": "0e2fb00f8ea7dd05c3380f1809a7f3326152c4dde3f79446f22f3f9c05d9d12f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857339, "uuid": "0ddbf1bd-99e3-4525-8806-6921e87ac8e7", "comment": "Malware payload", "value": "b0785e4cab8e6b4606994d1aad6a9936527012ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857339, "uuid": "359862f0-5e06-4c4b-a612-23d0e094a918", "comment": "Malware payload", "value": "5aee02514c1d20a06219da90f40ff879d7aeb357b19025e82346a5b56b826d017c4f3475c572f23a8dfa9ee7debb4608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857339, "uuid": "6162eecf-05ce-4ede-a369-0e6e01da826e", "value": "T1CC26F19FBAA541A3F36BE93C7F706F327A50526642A34C06CF09C1E472819375DAD632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857339, "uuid": "d918ca21-9601-4d2e-a753-2891ae97abd1", "value": "adc8d05555d8c832390d0979319844ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857339, "uuid": "7b1b5b26-e1d5-48fa-9571-3692115c8af5", "value": "98304:8DCfl17FH1iw3Hpbjtt1P9j7AxM5HY2GEiGDf60ilqfX2:8Di17OCpt/P9ppxfDf60iQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857339, "uuid": "e2f16804-826c-4f4f-bc03-6977ee067241", "value": 4661760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857339, "uuid": "5891e68d-c248-403b-979b-31b4ce2dbd3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857339, "uuid": "a4c580a6-0bdb-4717-9c2a-7425b48488bd", "value": "175d5e42a925185d216d84dc5f448769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c22e3e-b9bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677846635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846635, "uuid": "a09b623d-5271-49d0-8d3a-fc1b638e3337", "comment": "Malware payload (AveMariaRAT)", "value": "0144ace487120c3c08fa6a24b0ece3c9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846635, "uuid": "5741f61c-e3f5-4f34-83fc-7d3cff39f22f", "comment": "Malware payload (AveMariaRAT)", "value": "0ffeab62900e5c6a8ad0758cb88fb684798df3d14dc76563cff8fc41687ad659", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846635, "uuid": "afcc44a8-adeb-4275-8631-22379b91fa2a", "comment": "Malware payload (AveMariaRAT)", "value": "289ac160d0c978b1ee898ca5a7da11225236d388", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846635, "uuid": "ffbbc1fc-94cc-4239-997f-3f8f00b4dc8d", "comment": "Malware payload (AveMariaRAT)", "value": "4edaec8de136f543947c3bfdf932a68137a2dfcfec465e8edb8eb868174dce48fd5d1706da3befe01075f00ee9d71bc8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846635, "uuid": "314ba353-ea8c-4fba-bbc7-61adafb1223d", "value": "T15205E53A29BA5BE6D135F72352E3E020B2FD9456B303CD58FDD60AC50F40981AED992D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846635, "uuid": "a797389c-a0ba-4eda-a9b5-d5d0bb9efd9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846635, "uuid": "2b99ce7c-c0b8-4d33-b761-a18324ef5791", "value": "24576:tiSuYTsIBMNjnNNOhAe/S0L4JpctxmwwQVxDphOqy5nC:0HJiKqThOP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677846635, "uuid": "f228af47-ca70-4ff4-a340-3b56d116ab73", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677846635, "uuid": "e0b783f1-504e-4ca2-a05b-961aa5f880f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846635, "uuid": "5b1c9ce6-4733-4643-b541-59f55437f8ef", "value": "0144ace487120c3c08fa6a24b0ece3c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cce414-b9d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677854690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854690, "uuid": "d4611f8c-bb8a-4319-842b-3ecd8a07e2d9", "comment": "Malware payload (Mirai)", "value": "7699d19897f26b2e6db4296ac94a9d64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854690, "uuid": "a526626e-4fcc-4df3-8e11-690e66b00a85", "comment": "Malware payload (Mirai)", "value": "11dae1bc4584c492a24f945e12ee5c207ec4861898dc535e198bec03a7626b5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854690, "uuid": "2bb9d66b-666d-4222-9c57-2e787123d664", "comment": "Malware payload (Mirai)", "value": "e3bf99b73399da3be57821e1220a330b4cf9517e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854690, "uuid": "94d4710c-bfe5-4dce-bd15-54c34b078293", "comment": "Malware payload (Mirai)", "value": "ee08a226a7b68b78fc14b8f710261039c521ad53c7fc134502f2e17b3cbe1cca4f44f0bcef3a8652c5b06662830b3666", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854690, "uuid": "75cda22a-d2b1-4203-b006-4e5f38ecaecd", "value": "T191633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854690, "uuid": "b67b9ec2-3b9f-41b7-8395-1b89d97cc166", "value": "1536:lGRaTYmol/hGIAs4PNvApQOGm75123tStnl:lya7hJ4GmVDJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677854690, "uuid": "4946cf31-220a-47a6-b3cc-5fcbff85600b", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677854690, "uuid": "1356bfd1-eefc-4152-974f-ef95bb45fcca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854690, "uuid": "6cbd3595-382f-4970-b634-eed823df3744", "value": "7699d19897f26b2e6db4296ac94a9d64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227b5497-b9b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677843172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843172, "uuid": "8bb7a4c3-b21e-4aef-819f-05576c7bf564", "comment": "Malware payload (Mirai)", "value": "d339040f41cbfcfe3a627319c4b715ce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843172, "uuid": "a13d011b-edb8-4d1b-bbbb-bf7ad89c4833", "comment": "Malware payload (Mirai)", "value": "1318335a02aef82dd42f740e6f0464e1747537176a6cf25b6135695406fd6f12", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843172, "uuid": "07029b37-d60c-45ff-8d8b-22c539f0a2af", "comment": "Malware payload (Mirai)", "value": "55b001d71bfdfa66abb4d49f21182262b3b4c01a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843172, "uuid": "95df82a9-bef7-416e-9320-4f0ed125f7b6", "comment": "Malware payload (Mirai)", "value": "08190098a9b74ddede1802fa486e001e04b8c6729043703a6576b188f04a344aeb176a3739aa2ce67b1c85bd13150e49", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843172, "uuid": "7a84bde8-7401-4170-ade7-284423c0483e", "value": "T1D2730856B8814B12C5C5127AFA2E128E332317FCE3DFB2129E146B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843172, "uuid": "ff69c8b0-9311-4baa-acb8-8c8508c5b6ff", "value": "1536:mln25xPBXk1wnnkL7+KE007kMVkyazN0bIqvikNnsvHTGsV5GYIWW:rxpXCMkM/nja4NnsvHqsVERL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677843172, "uuid": "93c4fb4b-93ca-4660-94b5-c79a5f0b2097", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677843172, "uuid": "f6843468-07c6-4943-92af-d6ff50cbc550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843172, "uuid": "d765ff46-2a14-49c2-a037-694a0b73aead", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd21ac3-b9fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677871971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871971, "uuid": "ffa3cd3a-9b55-4be7-ad44-981597f12cd4", "comment": "Malware payload (Mirai)", "value": "ab41c3ec386120da79a378f3c28918a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871971, "uuid": "4db1d527-3977-458a-a770-540b0420ed51", "comment": "Malware payload (Mirai)", "value": "139921d5de29bc9f679705dfc7def71c77a76f4ec86fd76b8420beb454ea3fb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871971, "uuid": "ddfa6a3d-35ce-4abf-af9b-2193e7d8f47f", "comment": "Malware payload (Mirai)", "value": "ff8d48fe198bfa929958642fb4b6ef6cb8912ce0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871971, "uuid": "5c5e858a-5baa-4d5a-b6f9-5d1d36f7d021", "comment": "Malware payload (Mirai)", "value": "42c16bcebdbfa901762883d5981a86a6067850572666accae71445e02a5ef18ad03e748fb225aeba5be2c96c53595b50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871971, "uuid": "872b094c-e72e-436e-a2ac-343b4014cfb8", "value": "T179C2D1881B451EE9C2F9C13D47A80B6C1DA40B66F809DC86B8F8F7629D8E5753027EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871971, "uuid": "b3412f15-b063-4515-8038-91b025c307ef", "value": "768:f2G214DFyosXqgvV9o1ndB085JgGlzDpbuR1JY:f2GdDgosaaO1ndJVJu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871971, "uuid": "3b27fd9c-be09-435a-b006-9a0bfe9bd0be", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871971, "uuid": "8fffe316-75a0-42d8-b175-209dde0594f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871971, "uuid": "4d73f96f-e3ff-4e37-a7bc-f26509aa5279", "value": "ab41c3ec386120da79a378f3c28918a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4583222-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677856812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856812, "uuid": "77265881-5b9f-468e-b7a8-748a22d123c9", "comment": "Malware payload (Mirai)", "value": "0d2139382d96d0193cbc3261b92b2278", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856812, "uuid": "ff3a925b-c9ab-4e8f-b0dc-39e3956804f4", "comment": "Malware payload (Mirai)", "value": "15798cab021ec29430280ac9f55eafbe50cb836be7fe995e92213eba43b92196", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856812, "uuid": "b20ce2f2-c6c1-4c27-ad80-f7d9c13b2b55", "comment": "Malware payload (Mirai)", "value": "39946679e04ddfc5266b8de6e3a4ffbd082c6b49", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856812, "uuid": "db8ea1d5-8648-47a7-b40b-8ae579784803", "comment": "Malware payload (Mirai)", "value": "9e3ac2d9c7b93881f854338805cbb496cdf89133f1bd2fe611ee98dec6be4dc2a16e2172eefe5b020e1bc7875e745068", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856812, "uuid": "168f80b0-9559-4357-998c-5c62a4cc4143", "value": "T116534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856812, "uuid": "a65ea88f-3acd-4306-9e1f-4df7ba9b0e9b", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQwLiKimfFoktCe3fYRM0:WShU3q7cEDlCK/0DI9i8Fok06fYR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856812, "uuid": "0d932942-b3a5-4db2-9f9c-cd0ccca9f170", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856812, "uuid": "046873ee-063a-4fed-a995-66c9e0ea9741", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856812, "uuid": "f0523c1b-aa6f-43d3-845f-ba056fea9895", "value": "x86_64-20230303-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b6c7c5-b961-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677806454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806454, "uuid": "57c3f2c4-700d-4776-9644-2e3dc2730c04", "comment": "Malware payload", "value": "ed33fc318b25e147adc52caebbedf8dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806454, "uuid": "44a73fb2-0f6e-49fa-9fde-cb4ac3a3dca8", "comment": "Malware payload", "value": "1589eb2396bd2be374ad9b323daa725cb3ddb1f67cc34d367dc5f5b422f04117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806454, "uuid": "d41350d1-d7d5-4373-9d80-7b7121efb7ac", "comment": "Malware payload", "value": "3a8962643c97f441cddce8f316b85e71975a1b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806454, "uuid": "0dc4b2e9-cb3b-4db4-b8c7-db148b6399d4", "comment": "Malware payload", "value": "d97e3f0e93d419a77dfe9ed5d0ffa603b0ec656a83c0fef6338ffdb8c2dec311b4b6ddc3b885584d760455c0ad884017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806454, "uuid": "68093687-5f3c-4e9f-b400-9fd95534dda1", "value": "T166D53302BAE18C73E9B35A312575DB22E57C74245F2CDB9E67C84D3DE971280A620F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806454, "uuid": "65c6e028-acdd-4080-8c4c-448e15d6a985", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806454, "uuid": "f066acf6-2727-41a6-a327-2b0d01e96372", "value": "49152:nJqZRiBx1KVrfg26zQ20D4nuHdgbBmPqwLhXIDIMRxQ8FB4Xf14QLmKGmLCNM2tn:J0EBxkhY020CuHGbKhXmIMnQ8FBcf14p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677806454, "uuid": "5acc42c1-7d2e-4fd2-9064-0220bb7b5acc", "value": 3015455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677806454, "uuid": "417e7b5c-6ddd-498f-8aba-b5f9c7893170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806454, "uuid": "b7f2b498-f5a1-491e-801c-5ea2831cdf2e", "value": "Codelux_Crypter_v3.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b83b46-b99b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677831251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831251, "uuid": "ac138b9f-16f6-40f8-825a-0ba111e73a6f", "comment": "Malware payload (Mirai)", "value": "7f439c82c3761ec4bd38bf03ed03a57d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831251, "uuid": "54e1596c-b5fc-4ac2-a4e3-d903eac770ea", "comment": "Malware payload (Mirai)", "value": "160d753443dd1bec07ea9c1901dc964ab7bb16ba89a16d12c3655eaf5c290fab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831251, "uuid": "36a40b5f-0901-42da-b1fc-0b84c0deb3bc", "comment": "Malware payload (Mirai)", "value": "d4faac64453f0b5242c87a8e086aa2b2edf6ccd4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831251, "uuid": "7bf93193-1034-4dc2-80f3-616aa19c1b0f", "comment": "Malware payload (Mirai)", "value": "cac335b69a12a950316393f94d54225f02e13f78cbdc0eb4f6c529c0db51cc352661c7ed939208e9e466587ccb695fe9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831251, "uuid": "dcbe9bce-cc50-42f4-8be6-1a694d7f634d", "value": "T1BB534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831251, "uuid": "89585eaa-a314-49f0-a6eb-fbb52c5bd1a8", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQ+LiKimfFoktCe3fYRMM:WShU3q7cEDlCK/0DW9i8Fok06fYRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831251, "uuid": "ee0f9f49-d7c2-4d11-ad1d-d92a24e977f7", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831251, "uuid": "b72421d3-4689-4384-af2d-216384a514ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831251, "uuid": "1773d020-df91-45b7-84b7-77c2d20e4224", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac6684f-b9c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677849629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849629, "uuid": "65ed4de9-1593-4350-b12c-d85e48d0c63b", "comment": "Malware payload (RedLineStealer)", "value": "18f1a6f5e0719f5b830900cb2a9c0692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849629, "uuid": "c0078bbd-561d-416b-8752-330a19d3693d", "comment": "Malware payload (RedLineStealer)", "value": "16d4cb9b2ada41a6da2001111dc290a6988a0c84757be9c03eb41b89175a93a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849629, "uuid": "fc02fb7a-a292-47bd-97f7-2591962ad7c2", "comment": "Malware payload (RedLineStealer)", "value": "d4b723e85e64447e09efbbe8c41ce74aa61f0043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849629, "uuid": "49d0cb63-15c8-4fb1-bfda-524ea200aa2b", "comment": "Malware payload (RedLineStealer)", "value": "d1caa2df0878fe6a569bd6eb4d631bda1ff5592c1f4c4da6eb2bcee4e49bcadd732f8502a9d2b16f8963c4e0ace265f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849629, "uuid": "b42b1b9a-72d6-4549-919e-115d02b85f89", "value": "T13B151243FAFC4462ECB0573189F603D31B36BD616B28835A179EA8940873265F63677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849629, "uuid": "1a427948-5edc-4bd5-be15-5e79e153711e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849629, "uuid": "cb775f22-2d27-45e1-ba36-875a8d5258e4", "value": "12288:yMriy90mCuXugG+GqPyppCrFs2VMS/xi+jklc5TPYwMNRrs9KtEokvuHIYX:syX6gG+Gq6PivMSIkkilQwMNRI9KWRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677849629, "uuid": "cf544f73-2f61-4212-bc51-df4285b1965d", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677849629, "uuid": "500cce60-a23d-4aee-9502-b94b769f27ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849629, "uuid": "0f94ce6d-e6f2-499a-a585-87dbc82c4aff", "value": "16d4cb9b2ada41a6da2001111dc290a6988a0c84757be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354d5460-b9f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677869403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869403, "uuid": "cb9e1c21-e27b-4617-ba73-a127717123ef", "comment": "Malware payload (Mirai)", "value": "77d58c3e6c3e94dfcae6f754b3d40eaa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869403, "uuid": "90f546b5-bf13-489c-b2cb-f195cfce9673", "comment": "Malware payload (Mirai)", "value": "17098cdd3f191fe4f9ed13ea98c5202b4e8a7a09f5a0debeb8ad6b862b7be4ca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869403, "uuid": "34eb0d02-56cd-4bcf-b188-de13befa41d6", "comment": "Malware payload (Mirai)", "value": "64e7ae9213b1f8eadf998ea462071c96c02df889", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869403, "uuid": "a0375602-0fdc-441e-9fe5-21d2f3cde37d", "comment": "Malware payload (Mirai)", "value": "328d69e6a74a518b45ffb9462861c56cedab4f21c7dba93de134bf98f5b0250ab79eda35058b43c54316ae5d826edcdb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869403, "uuid": "3acc2fc3-fed8-406a-addd-55570577f3b6", "value": "T18AB2E189D6FB1BC3C2A1C336D47C5A5DE1B21AC10747451E6109B24E62E760E8BFB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869403, "uuid": "5eac71ac-861f-4875-b93c-07972f431687", "value": "384:M8DKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLZ:R/QOC0Yhn6ROHWFlAcwNEFCnNBxctcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677869403, "uuid": "4fa36827-baea-447e-b905-b6c9b196f427", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677869403, "uuid": "9b7b58dc-2cd5-4222-91c9-2e7fd79eb37b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869403, "uuid": "0237ae09-a161-4745-bc6d-95e9e1ced470", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a427bf2-b9d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677854728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854728, "uuid": "46793a0d-bad9-4f23-a221-40c52d5f252f", "comment": "Malware payload (RedLineStealer)", "value": "0d2cfb9a2fc13315310d61fe17f5d418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854728, "uuid": "21e334fa-5944-4f24-ad56-8c512f35daad", "comment": "Malware payload (RedLineStealer)", "value": "1763ca201c7137c9b105cec473fc8099384a951925f8c2abbce55fd976fbd26f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854728, "uuid": "958d8019-8e82-4e0e-901c-266a0f9c1451", "comment": "Malware payload (RedLineStealer)", "value": "fd7e0a8d6e72ee3ac85cbf2d069736f6352642b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854728, "uuid": "9b107b31-3507-4f2c-9c61-c5b7d0c22580", "comment": "Malware payload (RedLineStealer)", "value": "fa5ab4f1739017f32e07d7adfc52258eea8c8e68422c1f956c688f77e1f3d770a10c6d7a516499642d9072c135f3f864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854728, "uuid": "ce36f5b4-1678-4e78-be36-b409955967f8", "value": "T14115121FE7DC9471E8B947B058F503C3073A75616B3887EB2B4AB85A08F25E4A53532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854728, "uuid": "1e396a76-38f2-4026-b095-0cb98daa413f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854728, "uuid": "269f544f-70d6-45d3-916f-360d69ad2f62", "value": "12288:tMrZy90QEYNJVWaMb7R5c5TC9AnW/LWaEGhMCzZAoc0BwWwFh/4Hx4q7cjA87Vk:syxZcv7R5TAnva9fvwr/UWq7QA8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677854728, "uuid": "f1948f33-a0bb-4ad9-b023-7b8b4b5cde1e", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677854728, "uuid": "1b0ba8dd-946c-47ab-9409-b966207099e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854728, "uuid": "8210f092-5fd2-40c4-b614-ee59e1b5e23a", "value": "0d2cfb9a2fc13315310d61fe17f5d418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a619e2-b9fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677873543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873543, "uuid": "68c5a64f-7729-411f-8092-dce05f856a76", "comment": "Malware payload (Mirai)", "value": "c8404afa5cf2fb1a76f132c138bf8848", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873543, "uuid": "3b7707d4-9438-4754-bf57-d49404319300", "comment": "Malware payload (Mirai)", "value": "1790cdb81e5751510190df985c9536f0df6999f7706d2b44ae90cadb2e2801b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873543, "uuid": "9db17b0b-19de-4f12-a9dd-1e719ae92f13", "comment": "Malware payload (Mirai)", "value": "793d469b8aef1a776178bebbe41343744098607d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873543, "uuid": "60e4f5c7-cdc2-45bf-ba33-ac6eb4e493cc", "comment": "Malware payload (Mirai)", "value": "9ed9d6bcb4df780184bc3df984563f2c1b474bcc0e2cf74a781ade887d997fad81832ae61d214d092ef2e17b2713d1bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873543, "uuid": "c21c8e29-dffc-4011-a28b-5429417a2aec", "value": "T15083D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873543, "uuid": "c464e4eb-7781-45c0-bf5c-122cfc708477", "value": "1536:iVLyu95K5ukj752dCexuV/8UZlDwfkJ4MYfWf:iVLyMgJFezxu5VD1eS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677873543, "uuid": "eed85822-eb62-40d9-af71-cb47ef17e266", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677873543, "uuid": "96ca1bab-a22c-4176-915e-83a893b6ba3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873543, "uuid": "3fcec46b-4050-4ce2-bdd6-043a6d249246", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bcd315-b9dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677859306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859306, "uuid": "562a2998-3305-4529-9e19-b4d4c0ee4239", "comment": "Malware payload (AgentTesla)", "value": "c1824f3b2ba290f401a7cde9237b5509", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859306, "uuid": "0c44ceb1-1681-41f0-8a3f-251982e7bdd9", "comment": "Malware payload (AgentTesla)", "value": "17dfd98920592e852aad1e6f437342f8c8131690d95e9a7771f4c1e7e901639a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859306, "uuid": "16ddbd96-7160-494f-81d8-2f09d1ccfca6", "comment": "Malware payload (AgentTesla)", "value": "be24ddb8ab1585e885e7b26b3ea09ac5bee0ede4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859306, "uuid": "875f65af-db0c-4330-8f7d-41b9fdd47ad4", "comment": "Malware payload (AgentTesla)", "value": "abe4a7f68e17276c83781c32b1236d5f567e137d97a52903a9a801dd7030488e5880f70cec296ab8bb128b3ce3fa3972", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859306, "uuid": "eefe0f6a-ea6c-416f-a93f-fa043b1f4976", "value": "T18664232071A0C8EFED664A735935A36A8F8CE12525A4856F1F408F1B7D770D7AB1E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859306, "uuid": "31b21988-19d0-4edc-8c86-7d332f5a3378", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859306, "uuid": "4fae4a56-7bf7-4c98-acdd-af8de58700d9", "value": "6144:/Ya6Na8MSYHk//HG43V8H2fJY6QuaWFotym3GjifYm3L1cwdYt17z3GBe:/Y3a7SYE3Hj3eH2fJRTF8737Ym7Dqt93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677859306, "uuid": "c75c9a0c-c20d-438a-84ef-5c8df3ea4f91", "value": 324349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677859306, "uuid": "ec4e2d66-6a77-4591-99fb-e41b609dbfd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859306, "uuid": "99290aff-1c89-4436-90ae-3649309c0685", "value": "Proforma Invoice 01032023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dce3964-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677845017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845017, "uuid": "55f22692-bc79-49a2-8a7b-8454b4225da8", "comment": "Malware payload (Mirai)", "value": "06ff87da87225a191b32dc5977b7b64e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845017, "uuid": "8bd2c682-ee76-4067-bfee-7b7c41e8bb78", "comment": "Malware payload (Mirai)", "value": "18f005e3d5e92d8581ac624b9f504c0638fd222035897bb290043dc49bddfc1a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845017, "uuid": "9d8c68a5-d8d0-4bd8-8299-bffee459dff5", "comment": "Malware payload (Mirai)", "value": "c0957c013f38a5d6a63a7f6d810b8cb3de0be814", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845017, "uuid": "728df1d3-a2e9-4f41-bc27-ef510d65e4a0", "comment": "Malware payload (Mirai)", "value": "7149f07062b8fc4f4fc606d4556a7e3ada8ce81744acfdd95db0cd416c4d29132a7397c6016aa9547702421749835806", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845017, "uuid": "1ac9ecf4-f310-4c9f-a7e8-4768c1df1d54", "value": "T1BF436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845017, "uuid": "65067b90-e53d-4632-81db-21a534542159", "value": "1536:JeESt/basV2rcZhG6ySN7naOlSR9zWOIaEjrqMqs:JeESt/basVTgS7naOQRVtXESt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845017, "uuid": "e0f23580-993b-4b66-b9e9-e79738413432", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845017, "uuid": "3c753c3b-fe0f-4380-b656-3c213ea8e51b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845017, "uuid": "86a6966b-0a3a-4b32-ab41-3f09fd6d5af7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78073c32-b9ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677851476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851476, "uuid": "2284b745-f98c-4f92-9cf9-1861bd852921", "comment": "Malware payload (AgentTesla)", "value": "1e1b48741b7ace321dce2c52ca3dad60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851476, "uuid": "ab3903ec-f4b9-46c4-941b-f5b47c1ce5f0", "comment": "Malware payload (AgentTesla)", "value": "196606975c95aba482df057f8a6debea36bf1dfdb173c55eb865e3954b49c938", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851476, "uuid": "aa6184b9-89d7-4c3d-8b86-6d85c66f050a", "comment": "Malware payload (AgentTesla)", "value": "f7ab752707d6ee2feca9ddd0ce22768bc27d3f47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851476, "uuid": "e3a0f02c-a0bf-4540-9fcb-4cc771820ee8", "comment": "Malware payload (AgentTesla)", "value": "da8cc666558dd923bec78676b6e859d1195d4fd3ce40c1fcdee6c52698339485053fd9ee0bf77680d3aa6ec7ee4c084c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851476, "uuid": "52b57aae-a302-409c-980e-83d935fb2478", "value": "T1F0D46B8DC5BD4212EAFD0F7DB19F29080DA0054A266D4D3B97E7F880E57322A707EA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851476, "uuid": "45ae6f9e-c42f-4d9b-baa6-0e078324e076", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851476, "uuid": "227151c1-ac52-4923-ba1f-3d2b5174d4c3", "value": "12288:fjecesJ0kpwDOSQtsnxFoWQVRNYv5CJ5bmeV8v6wgN1idUoo5ZC:acesRpkOviQ/NY545ieVC67N163OZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677851476, "uuid": "1d586630-193e-4994-9a7e-be75cd0341e2", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677851476, "uuid": "8ae85e6a-bb6d-46d7-ab72-0116e25c94b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851476, "uuid": "93db79a2-6995-4e5d-941e-e55e1146916c", "value": "196606975c95aba482df057f8a6debea36bf1dfdb173c55eb865e3954b49c938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79368331-b999-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1677830433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830433, "uuid": "96741788-f1ec-4fe3-b13e-76598df75774", "comment": "Malware payload (TeamBot)", "value": "67968d30a7f706affcf485e74a4c3685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830433, "uuid": "08c52c40-6014-4acd-9b86-347dfd05f753", "comment": "Malware payload (TeamBot)", "value": "1a3cf88afdf4c311903a7423acf60d5bad5ce65e604a39635e3f13d9e6b36ea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830433, "uuid": "cc251bbe-0a20-4780-b7c0-60dcf4eaa761", "comment": "Malware payload (TeamBot)", "value": "9a391e058016a1219f108a61d2a313165051c06d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830433, "uuid": "bb697ca9-6a71-4fa9-a620-f1106e89d4f9", "comment": "Malware payload (TeamBot)", "value": "9ad29b8189dc6f6d7c9043dff90be64828927c1e44abf78ab0e3521c2438577286cdad28979dafe25d56b988cde0499f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830433, "uuid": "b670582c-9cc9-4496-8d74-b2a604986113", "value": "T1D164CF2276E1C072C44F04748925FEB06B7AB8715665C6C723A81BBE5F303D19B3A7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830433, "uuid": "58c3f9b4-aede-4fee-b36f-b1a195806ef2", "value": "f37943ad193a52d7b21e245b891de4bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830433, "uuid": "4678ed77-8dbd-43e5-9922-dd3e90a17b4c", "value": "3072:myYuXTOfZLBC8TMFdABLdvd4Jl29J1nm41zaLM47O26HnXjbbF2G6:quXqZLBDMFivj9f147O26zbbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677830433, "uuid": "2293acea-56ff-4cde-bed0-69495bcb4149", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677830433, "uuid": "68c2b69b-457f-4622-a205-88b8781cb64a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830433, "uuid": "9034968b-fb9b-46c0-b2a5-de3f8110436e", "value": "67968d30a7f706affcf485e74a4c3685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8448c2e7-b9f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677871254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871254, "uuid": "231889bb-aa38-442d-94e7-bbe38ce4ee0d", "comment": "Malware payload (Mirai)", "value": "f051c7f63aacaac66bd97147f7ed2153", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871254, "uuid": "15eebc03-fa79-422d-9592-baaaa37b49f8", "comment": "Malware payload (Mirai)", "value": "1ad2d0576000a50981e6f3814c8f014822f1dbcdf916b279ce00c18fb18c6d7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871254, "uuid": "29de0965-72a5-4100-999f-e515a6661b0b", "comment": "Malware payload (Mirai)", "value": "22e81444230571d022a38d6d5b68ad59cfb27bff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871254, "uuid": "e2ebbfaf-bc85-4747-9ec3-89ed3457a306", "comment": "Malware payload (Mirai)", "value": "66ad463429c504eec36dfbf1081467df249fdcc915a300b6750446835c166451dc640a0b0686a964c03ddff143f79026", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871254, "uuid": "6cccb06b-e2a3-4d07-9d29-e535603607d2", "value": "T1FDD2E0026241FEE1C5B00231E9668A9BB2293D79D1D134FA863D0DF8A6E9A1D47F8D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871254, "uuid": "bb8099f1-d4fa-41bb-8672-63d659fe874f", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXg19q3UEL7/:WRwynNIOQQ1KMwILD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871254, "uuid": "2a564834-82aa-4b15-b08f-e12d40280bdd", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871254, "uuid": "0fc6a654-068f-478f-8344-af2169621f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871254, "uuid": "e297a2ca-48cb-4d5e-8ac0-4f3fd31d9e9e", "value": "f051c7f63aacaac66bd97147f7ed2153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a55113-b9b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677840173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840173, "uuid": "09639422-0fbe-46ea-883d-b631312f63f1", "comment": "Malware payload", "value": "915f25e260414c3c11f10d48faa3544d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840173, "uuid": "59efc549-cae4-4c9d-a5ec-c350c4549d46", "comment": "Malware payload", "value": "1af33429697d89baa64114e9e2842bf04478a386e42c0fde6d912ab495ad7f17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840173, "uuid": "a1bd22c0-bf23-4c4f-9587-53a6f60c0e05", "comment": "Malware payload", "value": "4b969c7f5cc837bc1928e96c8704912e28f4b5c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840173, "uuid": "d3b13995-a001-4a07-b35f-0512c48d4a15", "comment": "Malware payload", "value": "d3c4b6832d2debe6060aa3e222691692d58b47f25657cfcb231ac4b3b3395df863a6d029cb59f0beaef9512319329c74", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840173, "uuid": "a828fa68-7944-44c4-ad40-f896fdf10ac6", "value": "T1E7C17312EBAC4A76E8BF0B3C4DF313522BB4E5615B37974F58800326BC157549A227A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840173, "uuid": "86ea3df9-93ec-4eb0-95c6-1ac67667a9cd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840173, "uuid": "b994e78c-4d08-413a-a7ac-2db9fdf45371", "value": "96:BgDe8Pm+RYGfYJQsGWcwKWqYsUloWVMAHK:Bga8bRvBWtKWqPgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677840173, "uuid": "fa5baa9c-f05b-4495-8f96-56494a176610", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677840173, "uuid": "1165b274-0581-48eb-b965-d4e82bdd6152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840173, "uuid": "e3f68abd-73c8-430d-b9c1-a0c8103a7597", "value": "jkpwfdrq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a445e2c0-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677856704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856704, "uuid": "2b7b3c3b-a54b-4c6d-8fda-8c346c3a4556", "comment": "Malware payload", "value": "9cb5e3703c05e7529a5e48977028ff1b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856704, "uuid": "acad11fa-e13a-46c7-a900-467d12eace16", "comment": "Malware payload", "value": "1b218ec08a60ed1dfa64cb87efbe2e1f46d98c729fa8211f7f040039ec9f9fab", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856704, "uuid": "f99be5b5-acac-4cbf-95f2-0929595eddd9", "comment": "Malware payload", "value": "765dd983d92284607e07de70d801abbf4bfccdad", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856704, "uuid": "03d02054-b63c-451e-b660-8ab319f2c4d4", "comment": "Malware payload", "value": "f3fc941045ffd50ac306027e689e6f2456ec2c8c11f625917d7a1dff6f7d319d7c240e4f76158b38e4d71b7279ffd681", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856704, "uuid": "56e9f5e1-62e7-477d-bee1-0052974a7b97", "value": "T186B4234D7AD6DF56CA2F36B0CEC4DEC25711BE229B5B8107AD00335EB139B4CC5668A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856704, "uuid": "c5b6af92-9bd0-4c39-9357-6a95e4e3fd27", "value": "12288:Kp/tqYNIUvy1yuJsdVl5Ys2lG9QXKBZXyz:+Vq/UK1yuJCd28QwXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856704, "uuid": "9cf092d3-31ac-4cff-8fb6-8c577423303f", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856704, "uuid": "56298882-02ce-4105-ad3d-840eac241856", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856704, "uuid": "5f9c9ff9-9500-471d-8b2e-1ab69998ad6a", "value": "623.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d0523b-b9e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677863099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863099, "uuid": "a6809fd2-8e94-43d9-bb57-a227479a6713", "comment": "Malware payload (Formbook)", "value": "70c205ed1ec81ac0a9aa8f33fda26a22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863099, "uuid": "626b1895-48b5-4f09-9474-700f8e51344e", "comment": "Malware payload (Formbook)", "value": "1b5f369c7130b28ca132dee4fdbf98f31adb433b203088c29c198244da57ce76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863099, "uuid": "2f3cc235-b4f5-469d-ad0f-c852c389a0b8", "comment": "Malware payload (Formbook)", "value": "a2fde78603ad86a828b9a4680ff26c313d8bcd7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863099, "uuid": "ed73d40a-45c1-47ec-95dc-d3e89c3f8e21", "comment": "Malware payload (Formbook)", "value": "8a3d6c7e31fe628e38a7cc1034d96683b00cf4f062ce9355aabd0ddc6b6b98d7d0041569d43482a35334a5c668330d7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863099, "uuid": "275acdcd-ace2-46c7-a05f-f97a89eb0271", "value": "T1F345A82809FC0EF28571F1FD9FE4E753BD84C8E6AA049D9982834B89555391720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863099, "uuid": "0bcb41b4-3377-4f18-b71f-df506ae1aa05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863099, "uuid": "d7e55c74-947e-4253-a0fb-4d948ff8a067", "value": "12288:1jMOEAlI3MzSSV93D4CsuwlmMiy7h5cilEv7NvbXK89eiDlb89zbydfCwKGcH0kb:1IYdSS/Q3g3yEiCv7NvH4O58cdaecU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677863099, "uuid": "67cbb883-5f71-4e81-b673-f82714b1af99", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677863099, "uuid": "20358e2b-d00e-4380-9aa1-eb07e8eee8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863099, "uuid": "abeecfbb-6124-4481-9756-edf25a7cba23", "value": "Copia_de_pago_sin_783947.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35446539-b9f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677869403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869403, "uuid": "15eb028e-d50a-4ad8-9329-cf38d5e1aef0", "comment": "Malware payload (Mirai)", "value": "39d32c73e13d86747653abb074f5872d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869403, "uuid": "ae84e18b-8647-4ee5-825e-046fffb60835", "comment": "Malware payload (Mirai)", "value": "1b77a3fca5cef41f808aef35e4d2cecbec8ca733a9d479984a465e86dd10a533", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869403, "uuid": "908dee98-c9fa-4382-8af0-3b5204adf1d6", "comment": "Malware payload (Mirai)", "value": "38ff13478351b9c2153de8aca74647ce0c748917", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869403, "uuid": "6a928443-4e73-4698-9fcc-82f1f67cffa0", "comment": "Malware payload (Mirai)", "value": "070f75000e742cc75c619b4d66b2f11d85b08735285cbde527553ca73e22790073393a084701232a9c804ab7f93f4147", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869403, "uuid": "349fdbbe-211e-46ff-8d36-9de3f1aa5116", "value": "T1E8734BC6F513C8F5E91018F52063BAB04A7AD17F613EDA82FB544426BC43A46A2372ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869403, "uuid": "c1271680-5620-45ae-b3fd-9b4de43f18bf", "value": "1536:zFpX3EpYuJwYvugoqW0Ci4LZZC6cFU4qidBx1qAa:xpH4YuJwwLdW0T4TbYlqYT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677869403, "uuid": "ebdbcf44-1240-4330-ad3d-05025e3cff18", "value": 79868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677869403, "uuid": "67860477-5575-497a-b77b-7af6cc178c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869403, "uuid": "44369230-1e6e-4ee3-914f-d285508d838a", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1b4d17-b9b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677843167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843167, "uuid": "63f13f3e-cef4-4a11-bb3f-487255626d59", "comment": "Malware payload (Mirai)", "value": "387de36b2486cc59f27331bebea6d291", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843167, "uuid": "8ae59140-3b27-4364-b786-bb6556719e8c", "comment": "Malware payload (Mirai)", "value": "1bb5f04d4da80e9c5d3860b22889c544c0b3e7aa30e3e65ae2647c5e8eb826a9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843167, "uuid": "aeb2e7ac-ea41-48f2-8b20-d6418d37b8f9", "comment": "Malware payload (Mirai)", "value": "00f90bf72b38b7f686194d76c6df1b8f3f378233", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843167, "uuid": "83c2bd0a-a809-4f7a-9cd1-53e0b96acd5b", "comment": "Malware payload (Mirai)", "value": "b8232fb6f03f91c83655ede7e14e0c3709b77529f1c2980b48695c38b2922c02d23323555b4bcae63f3d95cbe561544e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843167, "uuid": "fa3ba270-cdab-4ac9-9dab-3153b87879a4", "value": "T187632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843167, "uuid": "13540d67-2793-4560-b592-6912fc99f2a7", "value": "1536:qNSlxYmii8N1U9uO//kWEjMpikg/QA83NRuxAvjWr:qNnK7ktYpikg//29jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677843167, "uuid": "542961c6-7772-4649-80ea-f726e80d3292", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677843167, "uuid": "1527fbe8-5730-4ccc-8ab5-7e5d8a8b4d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843167, "uuid": "14a2f40b-3c04-4155-8b04-ff5bef72eeee", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6eff24-b9f5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677869950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869950, "uuid": "69d9cf3a-9f77-4397-a5e3-472123446682", "comment": "Malware payload", "value": "8d5b26e17d6f61ca6e23c9581bf0433e", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869950, "uuid": "873f91fd-39f5-479f-89cc-2b21018de84a", "comment": "Malware payload", "value": "1be5f0c707b79d988b5b5df657289159b56c2c3fe379d68160d18611790d8241", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869950, "uuid": "7fd6ed68-3863-425a-82d1-70029f5328ef", "comment": "Malware payload", "value": "4851f7e38e27830b22cf1f0b325a4bb6adef21e0", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869950, "uuid": "1d5d7dfc-abde-45c1-b54d-c46c32e7b47d", "comment": "Malware payload", "value": "37c7d355e6ce074ad70b00a05de22f8a351734f0ee26569e27e0708add15a8bc7674a9b6c316d23c7bc5ca553d35743c", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869950, "uuid": "436ab158-eaf6-4656-9c3e-84ecc2123603", "value": "T17C34393439FA502AB173EEA64BE475EADA6FB7733B03646E1051034A4723941DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869950, "uuid": "5349e930-7789-4d68-8e5f-76dbfbdec702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869950, "uuid": "a02a3aa0-382c-4194-8f07-9f6195519cd9", "value": "6144:IVL+I5QC4S82MjIrDeDnF4/Sp3nKuMhGW:Y+I5QNS82MjIrKDFgS59MhGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677869950, "uuid": "e2ed5dea-3ac1-475d-a07b-dc2768c4e410", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677869950, "uuid": "2dbe897a-8621-4064-93d5-28597fdebd97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869950, "uuid": "6811e2e7-62dd-4d7d-aea9-1f7020c0baa7", "value": "8d5b26e17d6f61ca6e23c9581bf0433e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b45fd33-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677845012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845012, "uuid": "67e3ccb3-78b0-4b6e-8617-1753b3adcea2", "comment": "Malware payload (Mirai)", "value": "1961ec7dcfc0bd32bbb7bbea5c14ccea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845012, "uuid": "bb693656-6a37-4131-888c-8dec40763d23", "comment": "Malware payload (Mirai)", "value": "1c6e884a5f434ca38c23c102987fdd5f1df7aeb28e37f17ff15a2b19accd3fae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845012, "uuid": "d507c1ff-185f-4575-a552-328484c576f7", "comment": "Malware payload (Mirai)", "value": "5bf46cb3c069ec937c290279f5120d3ebb57d42b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845012, "uuid": "7e322d11-e1e5-4e8f-91f7-8d7be8a64bf6", "comment": "Malware payload (Mirai)", "value": "600c4e1614dd507b303ebd7911e77218201e60cf4a52b1f7cdc78cb768fcd9329f184cc88ce9b5e28839d3a0f20bbcb5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845012, "uuid": "d205288f-1cea-4a85-a96d-fd3cf42b3a45", "value": "T1E803F751BC829A77C2E1137AB66E4A8D336163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845012, "uuid": "62536df3-18d4-4f79-ba49-781582127ede", "value": "768:AgA/wMCbXsG5f0OJnlUlcOlF5AdwAAb9XDWd2v+bAq77TEXoTl/NMwWt:AfWb8G5fblUlfbgeaUv+fEKHWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845012, "uuid": "42913da4-b6e8-4d51-8936-98698d02b420", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845012, "uuid": "90b01f7c-50f4-48d9-b22d-76b43010c44c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845012, "uuid": "c17472f8-7975-483e-b3be-4a1503a28e08", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4336f8f2-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677850529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850529, "uuid": "0d247312-b564-400e-b203-af8391d2bf8b", "comment": "Malware payload (Mirai)", "value": "6359dfd0f8a70713f62fc327c52a4240", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850529, "uuid": "78a5bdb5-a70d-4a39-8c35-fcfb40cfec32", "comment": "Malware payload (Mirai)", "value": "1d804ad83a47ea8f232fe05791ac3ab882f12775add0fc100ddfc6cb005aa433", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850529, "uuid": "d9098b0f-6cc2-4189-8d66-d5518157413f", "comment": "Malware payload (Mirai)", "value": "8a3a1915d4de0cbf3237757eeb7bbf8d1ab226d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850529, "uuid": "78bb02f9-80c5-4623-ba14-0ec0c40391c1", "comment": "Malware payload (Mirai)", "value": "134a666786314a1d800957b485f90ed755cf24ec307aadbdaee49a18ac4638babb9a89ac2b0427b0869f3f23f712b778", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850529, "uuid": "c3966e6c-4741-49d9-8ec8-ed6ac5271493", "value": "T128436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850529, "uuid": "83c81a40-0721-46d3-a563-5f30fa64fdb5", "value": "1536:JeESt/basV2rcZhG6ySN7na7Re9xzWOIaEjrqMls:JeESt/basVTgS7na7w9BtXESe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850529, "uuid": "731439bc-baae-4a4f-9abc-8c3f1fc42ea6", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850529, "uuid": "7cd6a0c6-fb02-431f-a272-90d5878b0505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850529, "uuid": "5b4f2e41-625c-47e3-a081-34136f33e542", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0305654-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677856698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856698, "uuid": "e29f3032-6928-4af8-a07a-2422d23f8389", "comment": "Malware payload (Loki)", "value": "3f43757bcff5fc406c132e1e7eef978d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856698, "uuid": "b08eda66-161a-4d05-84d1-0e3b4e85b2bd", "comment": "Malware payload (Loki)", "value": "1de183bc0f8accf9b226ef6f38f3cbabf4b784a32be6d7eb2dccac27b4a74c99", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856698, "uuid": "fd531f38-3f7f-4844-a8a3-2b64a2bcdfff", "comment": "Malware payload (Loki)", "value": "134adc933ee2bf6530dcbad8aee27c5daad32916", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856698, "uuid": "28d15175-b64d-4613-a38d-7fe431641c0c", "comment": "Malware payload (Loki)", "value": "7c7e444dc68b99851d880e9092690b32e83279631cd929f4b5b843e45f20a149069350527a06ef14c620f728f2f90309", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856698, "uuid": "6ca652eb-e518-4428-8ec3-b1b1c61a84c2", "value": "T1C24502034138ED4ED1A2C3BCFA3F75A5410E7C3A71D271CA6A44B76A5B32A9746BF118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856698, "uuid": "ea6fdcc5-4315-4711-bac6-39b9a069457f", "value": "24576:VLKPBbWQmmav30xkmPm2EBmFWQmmav30x5m5+O7zUeQn8lrYXXXXXXXXXXXXUXXQ:VLKPYQmmQ30fEEEQmmQ30S+EYeQNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856698, "uuid": "270225be-dd1b-4e6d-b50d-09a790a7955d", "value": 1196544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856698, "uuid": "22b5c6f5-d398-4c2c-9b54-c957e7eeaa6c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856698, "uuid": "48142195-9b14-470d-a342-66eb6b332161", "value": "Performa Invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f113d50c-b9ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677853397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853397, "uuid": "44adec39-5ee9-4344-b14a-38dffbda995a", "comment": "Malware payload (AgentTesla)", "value": "cca717460978d87931b1b93a9ea1a491", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853397, "uuid": "cb3e13d0-5b1a-4af5-8870-c61857858eb5", "comment": "Malware payload (AgentTesla)", "value": "1dfbd0bbd7edbcffac2ff6174c67cd570ed0736e72522744fdfd4265f891a037", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853397, "uuid": "88b45628-2044-4c47-ae52-187906ca9b04", "comment": "Malware payload (AgentTesla)", "value": "85d1af3101733f36aa2fd2a03745dcd74302f5f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853397, "uuid": "b5e9de4d-faba-4a62-be63-3300be8096c9", "comment": "Malware payload (AgentTesla)", "value": "c7feb276c79b0b0883457f4458f8227ae39f04a1dc4a0faf90d3f1bb8589609d54d59eeb58ff631ffc5e1ae5af2e579c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853397, "uuid": "b95d3a7e-7fd3-4eb0-827a-bb958f5e72fc", "value": "T176B428802BFD5A18E5BD1B70A8320B51EAF9F852A5B5E30E108B3DED0E567484D917E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853397, "uuid": "f22f0f47-8d9f-48cc-aa94-453fae27b824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853397, "uuid": "4338de69-5382-41c5-84e8-5e01feb1df67", "value": "12288:00Zbc/t591fX07yW2OC/BGjBN6w/VXa5FV1VmtioqI6yj4ek:00Zb691fX3OCsN6wtKMtioqIVj4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853397, "uuid": "3f885826-37a0-41f5-ba31-6e5e65249b46", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853397, "uuid": "88fed867-8605-440a-81a8-5cd7733e3705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853397, "uuid": "ad7b1e02-8a51-4a1e-97d3-a80f1546246f", "value": "transferkan\u0131t\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8ee5e7-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677845014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845014, "uuid": "243ba3c7-5320-486d-bdd3-e41cb844798e", "comment": "Malware payload (Mirai)", "value": "85ea1adedcddac0192690487b8dbf6f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845014, "uuid": "d7661217-9fde-4387-8eeb-27344461fe83", "comment": "Malware payload (Mirai)", "value": "1e0c2accdd7aaf8e548cad8ff5a9f82c6d3d17dcfa82c53026627ea032ba1ccf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845014, "uuid": "509f3b70-a112-4ee4-9ce7-3b3edfcfe852", "comment": "Malware payload (Mirai)", "value": "7726cf3b97379ea70f174820799b4d6282f0a11e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845014, "uuid": "058b3aed-d943-4634-87d9-8737a0b4b8c7", "comment": "Malware payload (Mirai)", "value": "5040ce48660cf5f05c334c33c6e2675b5e45e5d8fdea982c1714556957aaf4fb2127489ae24e4a1ef422f561e6af4810", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845014, "uuid": "69ffe93d-cba1-4f1c-9786-6c65dd06f763", "value": "T1A2730856B8814B12C5D5127AFA2E118E332317FCE3DFB2129E106B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845014, "uuid": "23cfbe43-3bf4-43bc-8d1a-a049f60ee1d3", "value": "1536:2ln25xPBXk1wnnkL7+KE007IQRMqai90DIyiUNbsvHTGcV5GYIW1:7xpXCMkM/zTaFNbsvHqcVERo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845014, "uuid": "b9bc6ff5-bdc2-48d2-9dab-b2e371fd0454", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845014, "uuid": "a257ec1f-5043-4702-89fb-cee36a7a1030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845014, "uuid": "9a9c93f8-c879-4244-8e64-7818787a339c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c28b88f-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677844960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844960, "uuid": "5ca629f8-e89f-45f7-a480-83ef0482cba3", "comment": "Malware payload (Formbook)", "value": "32cf764997f93cc491ac8cd2b576994d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844960, "uuid": "f80ddfae-7757-4598-b815-e7a780b2f9d5", "comment": "Malware payload (Formbook)", "value": "1e3fa3f813abd850f49e38154337442d6d3f3bab1b76b339a3e4b45c5897e956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844960, "uuid": "e5593585-4efe-4d19-95a9-c52b93bc9869", "comment": "Malware payload (Formbook)", "value": "be45e11a8837dcefd7d0e9ad2170ce410bb28c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844960, "uuid": "9f1c825f-655d-47d9-a609-9b3d880ff97a", "comment": "Malware payload (Formbook)", "value": "5f0643d2480cf7ed7d1bb46b8bd89064cc7e0fcc63465a54df7c20dfe750c961276b2b4c6dd09d89566d5348bcd1e1a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844960, "uuid": "524785cc-aeaa-4612-9229-b1f2376943b6", "value": "T173E4E1831EF7976AD97C0B30F5B929B433F059772021E753BDEC21E8D9966491E222C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844960, "uuid": "741d98cb-2b14-44c7-b2ce-7354c1c0cd7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844960, "uuid": "8fe02944-783a-49cc-8c54-2a7bab4311b9", "value": "12288:UKFQmymXknLaxx0TD14wNQOUbJ3XVkHvxJz5QOf2L:UKbs4yE02pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677844960, "uuid": "cacb2654-a60f-4773-9c9b-6b51f3a390d5", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677844960, "uuid": "4b1061c9-d7a4-496d-a82c-518883e487a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844960, "uuid": "590d42bc-b532-42a6-b6d0-023aaa0fc1a1", "value": "1e3fa3f813abd850f49e38154337442d6d3f3bab1b76b339a3e4b45c5897e956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3714e6c6-b9f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677869406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869406, "uuid": "b68b9275-ec5d-4d1b-9a14-3b8154e8b6be", "comment": "Malware payload (Mirai)", "value": "3324aa581cdf031115c95649bbf272eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869406, "uuid": "c41298d5-8a1f-4015-b525-9c0ebb43493b", "comment": "Malware payload (Mirai)", "value": "1f39641d6a0ca0f2a2b60474f050a106ebd38a8292a2661511a3f86e9a0bdfec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869406, "uuid": "00e4aedc-468e-4647-8774-9a3dcc6600d0", "comment": "Malware payload (Mirai)", "value": "1dbaa7d09571ff85e7a295ce3edb7bcc7b60179b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869406, "uuid": "c8521a98-1702-4c11-a5e5-77742df88a1b", "comment": "Malware payload (Mirai)", "value": "024e643d8a27176cfb2751711aa910c0314c3e3297a54dfd572522a2b919d8efc488df403c2edf9ab5da772481350561", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869406, "uuid": "267e09fe-7d8b-4230-8dbc-381cec9c067a", "value": "T1D6B2D1B17015B8B6C7E200779EEDCA53FB810EFC90E8B3291479099DAAD5952BAF1107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869406, "uuid": "c1bef0f8-7193-42e6-90bf-51fd285a5b56", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3pkps3Uozb:5tn+o9wjfBAZTzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677869406, "uuid": "cc9bd682-5f64-46db-8910-bd7f418cbb19", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677869406, "uuid": "3f7037dc-be10-4e0a-802f-1701e5aad512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869406, "uuid": "0ef6ade5-8356-463a-9822-2489fdd5c65d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eda926a-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677850494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850494, "uuid": "aba19c58-957d-4097-97fa-3820ff452e15", "comment": "Malware payload (AgentTesla)", "value": "9b4d3c97d58f1b074686a654fd699092", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850494, "uuid": "d558d2a5-cfa3-4cf1-890e-da5910b19969", "comment": "Malware payload (AgentTesla)", "value": "20010ddcdb214e3471add9575b86ef4935bb2216dbed1c778711aaf7ff3801b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850494, "uuid": "5c774dc3-728f-4bb1-a7b0-4f24880ce86b", "comment": "Malware payload (AgentTesla)", "value": "e0cf90f71bb224bbdb21182fa50cc35cd58cd729", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850494, "uuid": "f0325d20-6b0f-4869-9371-b9dd9b76ebeb", "comment": "Malware payload (AgentTesla)", "value": "b555f44bd08667413cc41dd46c934bff4afdf5f3b8f2df49d0749e516da00499f58226697944d00e490f03af95008c05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850494, "uuid": "b9927084-d90b-4580-a7fc-af0d8488055f", "value": "T15D05F2167ECEEF1AD81EC635D4228A4457F1CC112027DE4B3DCB30AA6BFA786970265D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850494, "uuid": "eb735ad6-cf3b-43ba-bb80-3e20d820df0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850494, "uuid": "52a9d6e7-38ef-4424-9b7c-b77c70019d6f", "value": "12288:65KFQmymXknLaxx0O+5k3F0uWf+XE6GUZmfED6DzezbAdYpGFW5:iKbiUFpfZ6XzqkdYpKW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850494, "uuid": "2762c53e-b559-4bd5-ac73-7dd9bef3e241", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850494, "uuid": "1902a6ce-ddf7-44a4-8609-a5a003d9d9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850494, "uuid": "e6e1b2b1-e6fa-4636-870d-d681f2a2ab62", "value": "20010ddcdb214e3471add9575b86ef4935bb2216dbed1c778711aaf7ff3801b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76a4dcb-b9fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677873541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873541, "uuid": "abda52d0-cd8b-4351-aee4-60f157cce9a2", "comment": "Malware payload (Mirai)", "value": "e19c60b12f5aed214e729fe9d1c93e9a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873541, "uuid": "0b0fa03c-6533-4b83-8cc6-d3dbcaa28691", "comment": "Malware payload (Mirai)", "value": "21490220fbd31cd32c82d85bc6e402455dd7d20147a70e572dfe7a6c1c7f355c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873541, "uuid": "a2c94708-fa83-43c9-95c4-75625c611b9c", "comment": "Malware payload (Mirai)", "value": "3386c42c534f8e155886e1b4d55c5c280f8d3805", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873541, "uuid": "b2188db3-4cd1-4dc1-8b7d-8e66c7ede621", "comment": "Malware payload (Mirai)", "value": "38e4632446a6aec000bbc44152fe588065f7741b2df8d24e8926d474719a7bdf5115975ce72fb724ef821e0ebdb709b6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873541, "uuid": "5bf9253e-9964-4214-9943-e63ea80c34a2", "value": "T115534B17B54280FDC49AC1744B2BBA3AD93775FD0378B2A67BD0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873541, "uuid": "ac282d93-a4f3-4326-8473-6fe7bda7f289", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQQLiKimfFoktCe3fYRMI:WShU3q7cEDlCK/0D49i8Fok06fYRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677873541, "uuid": "312d2b28-3db2-4f9e-bb2e-84bf117b90c7", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677873541, "uuid": "2ed9f3e3-9d75-49b0-b553-95218628e56c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873541, "uuid": "81e8540b-5e1b-4a9e-a60e-1e2c4c4a9200", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4288e08-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677857590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857590, "uuid": "7f9f6d6c-9712-4167-b3df-25c5e8e03503", "comment": "Malware payload (Mirai)", "value": "6190285fcb1a90c6816b59b8adbdd07d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857590, "uuid": "e89b95b7-e7bc-4217-aa60-cce3d45299ec", "comment": "Malware payload (Mirai)", "value": "227d918da37f1261ce05313687bca0bcfb65caf085275be971b560eceed0d555", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857590, "uuid": "64f686b9-a159-40a3-8fc4-3434b65130fb", "comment": "Malware payload (Mirai)", "value": "d3a51532a4cf5318a076585e59d06534e747b8f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857590, "uuid": "c4dcbd51-cc03-4dc4-bb6b-0e02a894da88", "comment": "Malware payload (Mirai)", "value": "c9863abad5f90e5dcb4615043d34415af4dedb8f55b0d6a9925d825ef932ddd9c319112f3b92ce329ae6b63af08e209a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857590, "uuid": "659e34ad-9b48-4de7-93eb-a98a79e958eb", "value": "T18E438D36E96E1E74C08641B074748EB56F23A5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857590, "uuid": "9448d644-50e1-4f67-bc1e-c971695cbf55", "value": "1536:Naa0brW/Od9hlCRbKrf7KwXQCcpvDCM12+WL:Nv0brWGd9X9rf+wapvDM+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857590, "uuid": "3a2a06af-7bbb-41c2-a51f-2736cb2e1cda", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857590, "uuid": "0f350cec-94c2-4199-a74b-31386454d4b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857590, "uuid": "a47ed851-9d08-4f0b-9b8c-626317b805e0", "value": "6190285fcb1a90c6816b59b8adbdd07d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a95b2d4-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857359, "uuid": "c9b32817-0217-47cb-95af-5008e32d810f", "comment": "Malware payload", "value": "cb1d5e8870b8d54f398bb0f719733369", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857359, "uuid": "5265cc7e-0763-40e8-8406-6f7ef37d54c0", "comment": "Malware payload", "value": "232f16f4bfbc96274b266a3e8e9a80fb10721dc0f932a9c92f51e0930cdd0d3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857359, "uuid": "fce8c149-5ee7-42fa-aff1-cd085581c7cf", "comment": "Malware payload", "value": "1b192edcd257c66952087dcd55e09e261322a3ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857359, "uuid": "9f64f18a-7e06-4bef-9e06-674af3a4bd74", "comment": "Malware payload", "value": "74e893336af5ac9031006d5cba52a4779bb8d0423e4e9c204883f6647560c4ec6b1a255fc4fabd844f2cc1a441de2903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857359, "uuid": "da5a09ca-5f09-45a4-80d5-b9a3531916a3", "value": "T15445239BF8EE247DEFD3C53C8FC9D930945AF99A2D90EC7A56BCC0396A518004B96740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857359, "uuid": "e2e4238c-0667-4f5c-9c09-4224b8ac2869", "value": "24576:mYbWIp/ZIXujyaqe7hs2yPuQwn+fxWZ/H8quhqSUoQ:mY68/ly5eVvXjoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857359, "uuid": "d2f4ac16-2e3f-4d65-9fbc-7667f827f847", "value": 1175555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857359, "uuid": "b0ce0568-7571-4d5d-acc1-21cd90484d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857359, "uuid": "c28705a0-b145-4d96-983b-664948e8d71a", "value": "cb1d5e8870b8d54f398bb0f719733369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5268052c-b95a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677803309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677803309, "uuid": "fdab0742-9d8f-4271-84b8-a2cdd88452c8", "comment": "Malware payload (Mirai)", "value": "9a75c044d14ed7027c1ff2c80240eb4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677803309, "uuid": "b61d3394-ded2-41d7-94f1-a06630a33f26", "comment": "Malware payload (Mirai)", "value": "23d35523106d43ea08fb07c263e35a123d50f9148681e219e5a6bc0284c4ad4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677803309, "uuid": "d2f9c074-f029-4807-8e59-a8955d9fe802", "comment": "Malware payload (Mirai)", "value": "8bfcc51d3b572503b66262523bc1f15241a21541", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677803309, "uuid": "2224d528-3c97-408c-a96f-90388f609e0e", "comment": "Malware payload (Mirai)", "value": "d077efedb9e6941b389ec0a06cc0d304ca9753d84402967d99c35a0da9bf713a4ba3e845bb046f0f7717d0bab6a2b74b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677803309, "uuid": "299be99a-adc5-4c80-b8dc-06cdf2ea15c5", "value": "T124539E63C4641DA4C1544AB0B9288FB61763E60087637FF6426ACBA99057EFCF60A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677803309, "uuid": "371d5001-3872-4f12-98a9-23161f84e1c1", "value": "1536:oagv1AOp/umClcqse/yYGsYhSSSijKmR7GrxhCKkdV8:ox11KmqsIIS9iGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677803309, "uuid": "bf436ed2-ca86-4725-b000-ccf1b84fd5a9", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677803309, "uuid": "8bac48cc-0bfd-4c2e-bdb6-5a99b833e546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677803309, "uuid": "6999ee30-a8b9-4de5-b5e0-4b50fdd2bd35", "value": "9a75c044d14ed7027c1ff2c80240eb4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c737a6-b958-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677802703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677802703, "uuid": "7435f789-4aee-4f94-9b96-37033c77fa3d", "comment": "Malware payload (Mirai)", "value": "d49e260887499ca9519c2edec9d8bef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677802703, "uuid": "a2a680b6-a901-4d65-95b9-ced128bae32a", "comment": "Malware payload (Mirai)", "value": "2594bb4ed078a59fbb4d6a64a7aa82d7a665fa48851cc911a49d20ec394589f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677802703, "uuid": "f547c460-961a-48c0-ba2a-36aaa48c6b27", "comment": "Malware payload (Mirai)", "value": "9fda1c3e95e7c43955bba378542defb5bdc6cd1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677802703, "uuid": "a88742f9-2985-43f3-9019-1660d841e981", "comment": "Malware payload (Mirai)", "value": "cf527ef921fe7b0c8c16b982f9bc1947efc1990b619ed5e8dee44041170511a2d96b8a7f9156be1df5b201e1ac7f3de4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677802703, "uuid": "218a26f3-d4f5-448d-9eb5-333e1ee7174d", "value": "T14C232A96BC91DA0AC6D023B6BD6F64EE330163DAC2DE3247DC145F147ACA90F0DA7645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677802703, "uuid": "8f6cceb2-a69b-427b-be27-2b0c321d1bad", "value": "768:NbWwllagxc3POLzfSSTEuV617qZgFmErnoLlauGycSpwpYQw5OAsp1Quu9ub2BN:DUg+3+TSSssZ0rnamCpwqnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677802703, "uuid": "dfdd5aa7-2fc8-4ea5-8514-200be5201f03", "value": 48252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677802703, "uuid": "eb340511-04ee-4d97-a569-916adddcb564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677802703, "uuid": "2de136bc-3b2f-493f-a9c5-95c970cd3ee8", "value": "d49e260887499ca9519c2edec9d8bef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624e5dfd-b99b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677831253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831253, "uuid": "17e41fd8-bf24-41de-8a96-1b4887c2ebea", "comment": "Malware payload (Mirai)", "value": "1a3121afbc2ceed5744a4e06f6bcd552", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831253, "uuid": "d15a673f-c5be-4110-9f16-da6fca64e671", "comment": "Malware payload (Mirai)", "value": "25f99d617db789623238ea39c02e1754926d46ea9227b7c5d5e184ab5d0098fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831253, "uuid": "55c8a2f2-4842-455b-b197-c3075afd55fe", "comment": "Malware payload (Mirai)", "value": "f7fdae4e42e30cf25537d1cc1bd5aa88be92f41a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831253, "uuid": "839f3192-168a-4f3d-9114-589bb1d7fe87", "comment": "Malware payload (Mirai)", "value": "1d456e27b9c2301cfd5af4ce9cc9127355cc82f6ee1668b69691b04d04847110113c3ae55231d96884c3065f080e2bcf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831253, "uuid": "d2d89434-30de-49e7-915e-1a9f453da657", "value": "T149E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831253, "uuid": "efeca827-3596-48f4-8443-b93f5d1806d5", "value": "3072:yJTc2PBSpmo7Oabvzj4dlRsh8ZQIld4MXkkTM/9zY:yJTcG0Oabvzj4dLsh8/4MXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831253, "uuid": "891abf0b-196d-4dda-bbcc-673e418582fc", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831253, "uuid": "66efe6cc-f413-4658-9883-06891afad4df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831253, "uuid": "745295f6-8ed3-4b30-a4e2-3c02ed99260b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396a323c-b9b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677840634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840634, "uuid": "2521ceee-8b77-40b5-803f-6e7c407e0afe", "comment": "Malware payload (DCRat)", "value": "15162904da4b6112294b2c7448a5b87d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840634, "uuid": "356e4723-467d-4276-8737-4808fbd5dcc1", "comment": "Malware payload (DCRat)", "value": "26a18e8d53dfe4bd8ad743d42ba943c44d30ec34a4214d4faa993e73408ffb0a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840634, "uuid": "1be8de8d-c6c2-4ddc-b988-ad8a3488e634", "comment": "Malware payload (DCRat)", "value": "722c5b4c90f668bf5b8fb2ea55073b0b11027fa4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840634, "uuid": "d8d1beae-3894-4647-be9b-f8369cd3b592", "comment": "Malware payload (DCRat)", "value": "88055a5c3f8dd1260e1d849cebf90e0024e200ed2a27bce2e782c15ba06b4cb8396338bad97a87d17363a4faab2584be", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840634, "uuid": "4862657c-4f8b-4198-95ff-79cd872d8b48", "value": "T12705F6027E44CE12F0081273C2EF495847B4E9516BA6E32B7DBA776D55123A7BC0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840634, "uuid": "c63601e0-91a8-43de-b33c-de8ecfda39ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840634, "uuid": "93f5a522-1a8b-48c7-98e7-291746e3144b", "value": "12288:YmWIFTqUz+7UkQwLMuaQdZVg6emIi6exWiyqdtO3:YUFTqUz+gkQwL7HW6eYWiyqvO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677840634, "uuid": "d071d9e0-9431-4488-9632-cbeb0fc0877f", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677840634, "uuid": "69ee7e25-1aef-4e5a-8bd1-efc61a7a2dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840634, "uuid": "3abbe650-768c-405c-bedc-ae6ef006c8d6", "value": "15162904da4b6112294b2c7448a5b87d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6ebb74-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677829822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829822, "uuid": "78bd808f-d8a3-4ae9-93e8-7a965479b4a8", "comment": "Malware payload (RedLineStealer)", "value": "4ec2e04f55cef3a9a3146c0caebc92ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829822, "uuid": "44173f11-67ad-443b-bd17-118cd5c0fd26", "comment": "Malware payload (RedLineStealer)", "value": "279f9ca8b7a1ee460ee5bc0ad626a7f2a3526404deff5c226d614582a044ed14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829822, "uuid": "56d208cc-de19-452a-8956-c2d7b1721a72", "comment": "Malware payload (RedLineStealer)", "value": "687df7533992f2672df8d35d5e978f8329609092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829822, "uuid": "908e2912-373c-4595-955c-bbbf4d97b592", "comment": "Malware payload (RedLineStealer)", "value": "188d4e0f3dc51ddef09c34a68f5dd9f313622243c42e1014e6e42defaaddce75cd8f370300dd030c438c2eebcc35a7bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829822, "uuid": "39fd9b47-1f57-45ad-b80f-c730e61f15b0", "value": "T197152347BBFC9122E9A5277009F502C30A397C524A78C61B234BAE1E1872774F6357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829822, "uuid": "f8c21cb6-3643-40d1-82ba-c3f0f280d545", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829822, "uuid": "81602071-7d3f-4e8d-8f9c-2936868acb3a", "value": "24576:iyVFb8QVLlGvXJ2yYw5E0XXz+Ec9UxYONMcIZO:JvHVlGlZPXjvc9+yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677829822, "uuid": "97297ad0-ae17-4622-a22e-a906d157cc4f", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677829822, "uuid": "657db7a8-ecce-40af-bf86-dc383f8219eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829822, "uuid": "6dc5d7e5-358d-4066-91e6-23a1a0529140", "value": "4ec2e04f55cef3a9a3146c0caebc92ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f532e01-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677856696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856696, "uuid": "3f4fc61c-5367-4029-bc09-0f77f64c24f7", "comment": "Malware payload (SnakeKeylogger)", "value": "19b8accdb4741b3e328f43302cee7fd2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856696, "uuid": "c6c09639-52d9-49fb-af1e-3ffe988c572f", "comment": "Malware payload (SnakeKeylogger)", "value": "2854075e8ddd5d3e85bed714509138bbad4e994ede71d5989d82bc72e20b9edb", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856696, "uuid": "4a38e666-38d7-4945-9edc-4c32c23ac41c", "comment": "Malware payload (SnakeKeylogger)", "value": "1c0a4af7132989c56cc6660ee3dae783e74f75a7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856696, "uuid": "9e741f4d-66e2-4daf-a30e-6cd69063396e", "comment": "Malware payload (SnakeKeylogger)", "value": "0c14be271ed0adbd9b37b2691a8128587f554429ec6db8deee9954df4ebfa8eeeef67068fd76409bfb675483d1a73365", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856696, "uuid": "b193c308-77ae-4751-882e-71fd36e0be23", "value": "T17224232CC24CE0DD09A11AF606F2546E9D26A70BF4EBC58508A7819F87E6E3D5EC0B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856696, "uuid": "2250034b-d57d-4481-aba0-eb7ce9a65643", "value": "6144:YCV1Zx7yq92cl4w+uaWGf83OGRmzxEQ16AdMVAT6NydcHw+u1J1IPq:YCZ4qweTbOGRI0MqU+u2Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856696, "uuid": "90054d16-5d1a-4876-b521-d9ac46bacf43", "value": 225144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856696, "uuid": "6a69f91c-f840-463d-8173-c8d484c9fccc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856696, "uuid": "77c407c7-bb2b-444e-99af-4d4c92175c6c", "value": "OHPL PROJECT ENQUIRY 332023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3eee23-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677857010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857010, "uuid": "0e0f48a6-43b9-4ed4-a8ca-f65d2ae82ad5", "comment": "Malware payload (Formbook)", "value": "5cd2f2a5766ad1ac7be8a3d3eb7c5a51", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857010, "uuid": "db1e9c11-86a9-438c-bea3-10c3233274ad", "comment": "Malware payload (Formbook)", "value": "2894544e7e6d165cbc56e9b4f096b657934f23420af9a119d72a04a122d3725b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857010, "uuid": "260ddb46-4648-48df-a9d1-b2611587b33f", "comment": "Malware payload (Formbook)", "value": "e1c05ac20d4f9f278dc48b8ae4a07cddd27c39c0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857010, "uuid": "1437d8f1-33d4-45bb-a8d0-ea6b58653a2d", "comment": "Malware payload (Formbook)", "value": "7d90fdd58a3fe285e2252deedf25fb60e654e45999d2c49aa69ed263ee2176d137a04f4cb39c1de113fbf64025f5cfe8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857010, "uuid": "ceb65f78-4bb1-4c0a-9987-835c041b4f67", "value": "T112457C61DB5A16194D1F1B9AEC814D8648FDC13E92370139FD9A238E710366CC3BEB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857010, "uuid": "2d7ac17f-9e0a-4b38-b720-6fbe9f8b8a07", "value": "24576:7euj3hp+N3Lu1hiH2rbqQGbB7I3RgAffIl7yfW:7em3h03y1hiHxls3RS7yfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857010, "uuid": "73aa9981-672d-41e1-b6a5-4fe659ec98f8", "value": 1263068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857010, "uuid": "7a8598f9-4e40-43fc-aa74-921c5c7dedc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857010, "uuid": "b215c36d-2cdd-4b21-b0b7-373b690d428c", "value": "DETALLE_TRANSFERENCIA_2023-03-03T108866.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9a3bc0-b9a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677833980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833980, "uuid": "b84bf9a2-00bb-472a-bff2-004a6c06afbf", "comment": "Malware payload (RedLineStealer)", "value": "176d52b863f3d7cedacf23588a57b7cf", "object_relation": "md5", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833980, "uuid": "fe749e42-733e-471f-a430-7061497836c5", "comment": "Malware payload (RedLineStealer)", "value": "28fd5ed9fb22c273cecc6c79f009d8ecf2358dfc472cde89f8d169b3e1c55a93", "object_relation": "sha256", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833980, "uuid": "0ece7adf-e4c7-4159-af2e-05101c6de768", "comment": "Malware payload (RedLineStealer)", "value": "917e289b6835c9a3c6b84ac8c8e1c9153fbe8a60", "object_relation": "sha1", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833980, "uuid": "12fe907d-9742-403d-8290-6055b11e5e2e", "comment": "Malware payload (RedLineStealer)", "value": "327415e9b4a1e5407570e9f1a15d1940d9712b148ed5d01a11ad9228a4d9ba379282856c742318286d37273e227de6b4", "object_relation": "sha3-384", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833980, "uuid": "6cb86730-acd8-4256-b1d3-bc953261c68e", "value": "T1139423612A7269D502BF54F1A148C98D2A48BFF2CF3D5C913FF7EB89D60842D18BC526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833980, "uuid": "dfb88a82-359e-402b-9860-965e233ac098", "value": "12288:PdmZlsnND3GBN5OvYjeVWnOlunarqpPaNA:PWWNDWsYjeVJun0qxyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677833980, "uuid": "274786b2-52dd-4f6d-879c-57eb29c389ed", "value": 439666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677833980, "uuid": "acf754d3-4ae3-4a38-800b-0f4f2b72722c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833980, "uuid": "ec5513d2-c7c0-4ac4-9e9d-5b7d43c5e277", "value": "pureland.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0feeeefe-b9c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677847436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847436, "uuid": "6c403403-334f-4487-8b1d-1f6aad529bcf", "comment": "Malware payload", "value": "f14bc690e1ab9a317a87774417728ace", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847436, "uuid": "27165180-a569-4634-9973-d2a6eb80ec9f", "comment": "Malware payload", "value": "29d4d689aaa999a1dacce1cf23471b806ccab7e64d26db330fe655680b7efc56", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847436, "uuid": "847b599e-e5d8-4397-abf0-aa91d9bc6d2f", "comment": "Malware payload", "value": "a76b029e6b55f41b671400a7739f127b34f94bba", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847436, "uuid": "46762e33-85c1-4364-a98f-18f086cf6c6f", "comment": "Malware payload", "value": "d884711d1d2ccce0d0d12108337df9d73f20d0941bfe798c3862083755220af2a43988f6a2d0514a24936231ac1b4532", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847436, "uuid": "b40619cb-5420-4ee0-b25e-c1f8a5382a00", "value": "T13093912EE34F0965DF55967B434B4E8956BCB23DB38140A138AC973437EDC2E46229BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847436, "uuid": "58ce1994-4207-46aa-abbc-a1f80eebddee", "value": "1536:cf0Xvx3EMtuQw5sMqq12rvtECWMq0BDm5xIoWlsI0DqHSMiReJNzRqgShY6IRfOY:csXvKM4Qw5sMqq12qCWMq0BDm5xIoys0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677847436, "uuid": "6e9bdaad-8958-4a2c-b24c-0be3f64bdf12", "value": 93459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677847436, "uuid": "d83db77b-a0a1-4a0b-96a2-b6ab0fe3ee96", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847436, "uuid": "8107fa44-bb28-46d0-8cdd-124107acb39a", "value": "SecuriteInfo.com.Trojan.GenericKDZ.93675.22160.12215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ca7bde-b9dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677859066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859066, "uuid": "df39099d-b568-4561-8ed7-17abcdb647ca", "comment": "Malware payload (AgentTesla)", "value": "f177e713b81c51daf862c940ea18fc87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859066, "uuid": "3577ae40-49eb-4ac5-8740-2efd779cd3df", "comment": "Malware payload (AgentTesla)", "value": "2a0bd11ef0fb54fcaf9638d7d208ff05ba7e37d11f22e3c39ae58dfb2233379d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859066, "uuid": "805728e9-a314-4e23-900c-825eab217a85", "comment": "Malware payload (AgentTesla)", "value": "c6ddafc8f8d97aace79cc3f857d16952840f9315", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859066, "uuid": "14876e83-a569-4ff7-b24e-23286cae104a", "comment": "Malware payload (AgentTesla)", "value": "33f6aa27f26d889f04a0c4b2eaca330430a04b996cc8f529e39e656d1eb0df2541369fb2d9864d9926a701818188ff59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859066, "uuid": "c1f88386-0a3a-405a-a5f8-b25753e749d0", "value": "T1E44423849B70098DDBD0F19310EE6A7572316A70C85FA29B5D61B32C516FB07EEC1C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859066, "uuid": "ceab2422-7eab-48ed-8a3f-2e48133dd1a6", "value": "6144:kSt6BuyAAyDM0JfRa2XeB/u6rSH1B9fqLtzT7CT:tt6Yni2XeB/uykB9YlT7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677859066, "uuid": "250a58ad-8e37-4adf-8904-25cef4b213fc", "value": 268513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677859066, "uuid": "4434fb13-d2f0-43df-b274-45553b0eb787", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859066, "uuid": "616c44eb-a0d3-4761-bd16-0a698032a192", "value": "PI160256.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3080b5aa-b9cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1677853504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853504, "uuid": "b4dd2054-a5f3-4803-94d7-e980c9f420f4", "comment": "Malware payload (zgRAT)", "value": "2b053b525219cd96566a58a7d4ff575f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853504, "uuid": "3977c5ea-003c-4966-a0e9-dcde3056ab3a", "comment": "Malware payload (zgRAT)", "value": "2ab02b458dfbf0b347c20515b5dfd30da6aeb663f9bfb9b13383a9bb267ed2f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853504, "uuid": "c5dc52d6-79c6-4051-a3c9-e886a579d3de", "comment": "Malware payload (zgRAT)", "value": "6cf35c5734495a59e170f3cc9c828f5778f71ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853504, "uuid": "b9589f50-50dd-4e61-a82f-5128fb081e24", "comment": "Malware payload (zgRAT)", "value": "a7e75f978f0ec45cd41563d44cb98122cff4b8f18ff19219d6aea053a372be1c57229a40903903d32a769a9db9d4af26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853504, "uuid": "37a91d61-4879-403c-b591-024605cfe694", "value": "T161D5C0F08F91FE90D3AF1E94D0EC19C05CAC2B4792A98648BC8C6456A6E5740FFDC679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853504, "uuid": "68f9a7f4-b0ab-474f-9401-f9d38595919b", "value": "24576:r2aWGoh0OndRBdvogQSP0PXAlCJztaCQoUS8s6eU1HQKVX85j5bZo//J2yLGm22Q:n3he9l8POCisCN6ZZoIygrBYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853504, "uuid": "458edc7a-05c7-439a-8437-f65371fe2304", "value": 2995200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853504, "uuid": "55cbca3e-ad19-4a38-8d04-3a3fba192176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853504, "uuid": "a6921d53-1905-4a6e-bc5d-dd4a29b89fe0", "value": "2b053b525219cd96566a58a7d4ff575f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4417b762-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677856972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856972, "uuid": "a7691a65-110a-44e9-8f70-ac22df33d085", "comment": "Malware payload (AgentTesla)", "value": "47ba745d4daece3ca4c29124321cd766", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856972, "uuid": "125d75e3-02da-4a6a-ae55-28ea3a517426", "comment": "Malware payload (AgentTesla)", "value": "2ab8dbd73ac6c0a2bfd43ee00190abbfe755bf10d9faffab19d39531e7cd1e16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856972, "uuid": "7f93d7c1-b956-4e8c-a1db-5e324fd206fb", "comment": "Malware payload (AgentTesla)", "value": "4b68b171212cb4b5276e3194f6fb66133a0944e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856972, "uuid": "48227fa5-ad3e-4fb8-b6d6-15c1ccc3f872", "comment": "Malware payload (AgentTesla)", "value": "833f19637ba7f9b42cf3140798af6006c2b342bc3a699f29ddcdaf897a6286296834f1e875379bdb9d72bc43edf83c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856972, "uuid": "2544bc55-0f2a-4b8f-8870-0344d80bfa4d", "value": "T1CA632C2EE34F0A65DF56977B430A4E4A06FCB32DB38540B139AC973437AD82E466257C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856972, "uuid": "f1eb315e-d4c6-48ba-b96b-1ecf393a4854", "value": "1536:RwAlLujE6YxBrKvRd6bxWfGubiVW45I4z58p+Y9OQJwBFcWo7Tdc/uhgmhZaXGmV:RwAlLoEpxcvRd6bxWfGubiVW45Ic58EJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856972, "uuid": "7f1a9116-df5a-4af1-943e-9bfd7186ef22", "value": 71950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856972, "uuid": "d5802f26-5cce-4a7a-a93c-5460927ff5c0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856972, "uuid": "4a80e8d8-68e3-4604-95a1-4acbd51d94b2", "value": "wire_transfer_receipt.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd8e2d7-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677857311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857311, "uuid": "32e1f4ec-f84c-4f92-8fc3-dbb8619d1bf9", "comment": "Malware payload (AgentTesla)", "value": "6c83a9bc5ae73c1338b546e3bfea6f73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857311, "uuid": "4732cf3f-a1b3-46d1-ac3a-86e54f03f4bc", "comment": "Malware payload (AgentTesla)", "value": "2ada13943b92d98911f75e2844fe9beba7659cfeef2aaa521ff9df0fb4bf7f15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857311, "uuid": "18c66195-4b57-4ed1-b38d-d0f259b5d35c", "comment": "Malware payload (AgentTesla)", "value": "052f100b19a867b1ac95a78e64eb620b7247f1f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857311, "uuid": "d4c49682-5e81-48f5-b4db-b537960c1405", "comment": "Malware payload (AgentTesla)", "value": "7c0aecbf441c523268f3a0dc55cf05ef0301737a6e4b148d8b0da856b2330b17c1256a72dc680cb8217cc89bff117fa8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857311, "uuid": "8493af30-99de-4d02-b8c0-046c4acd3741", "value": "T1F945862808FC0EF28571F1FDDFE4E753BE8088E6A6049D9A92834B89555395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857311, "uuid": "edfd0010-a920-496a-a3e5-d4b287c85d30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857311, "uuid": "8cdfaa00-2c00-4060-9b25-53de785695dd", "value": "12288:BUSz/NHa0szhlX6w1GnEq0GFPs0pXwn1W3ajBlMIDUAs0I9LNHyMj26QeYUSnNC+:p/NHm8jnEFVCgc3alllIJq9NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857311, "uuid": "5822c966-a339-405e-9f57-9de4db70dc8d", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857311, "uuid": "bdab4585-2af5-4962-ba1f-b5522657366d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857311, "uuid": "2917c48b-390c-4827-ac91-ceed19d5df95", "value": "6c83a9bc5ae73c1338b546e3bfea6f73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61942d5-b9a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677833568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833568, "uuid": "66f1c081-1ef6-4d25-861b-fe57335c51a2", "comment": "Malware payload (Formbook)", "value": "3eb09704a099f08c695fa1e94bae9536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833568, "uuid": "ed5ab83c-c547-43af-96f7-47580de2d89a", "comment": "Malware payload (Formbook)", "value": "2c20e13c644886b403df4ba49657c0d032eb34655b7f7d46aeffcf9fdfc9c1e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833568, "uuid": "9ffea464-626b-4a4a-83c6-c913ede6a083", "comment": "Malware payload (Formbook)", "value": "7db111d83400bb9c680a1aa222b749430fda2a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833568, "uuid": "25a15e43-3406-4de5-97f9-cade0b3b93f7", "comment": "Malware payload (Formbook)", "value": "8f6c04c687c1ee9120450e3f7fd0d9d8355201c238f9c609ee2a4fdf1c66c5a1ddd9b1589d1855ac83df916090c57ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833568, "uuid": "76c51f4e-986a-4d0d-af5f-9280f4c34cf7", "value": "T1D605053D39B796D6C234FA3386E7E520B5BD81923303D959D9EA1AC04F42182BDCE95C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833568, "uuid": "cefaed6b-77f0-4fbd-a486-58f6e0dc2656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833568, "uuid": "e6717a26-439a-4bbb-9787-5e52e03986e9", "value": "24576:InyxqeSTsIBMNjnNNOhAe/S0oCMU2Z9JbzWAj6iahONajQOBzzR:FyAfVzf2i3Yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677833568, "uuid": "51b0184d-50d4-4e21-ae78-a66771fc7cec", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677833568, "uuid": "4f3171f1-821e-445e-96b6-0bbf492b811e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833568, "uuid": "f3709a51-14d2-4675-a54c-19cee6dda355", "value": "ORDER_DETAILS.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db049059-b9fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677873547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873547, "uuid": "c913bc72-d56c-427b-85a0-dba959f4ee8c", "comment": "Malware payload (Mirai)", "value": "d5ce1789d687ec693407af6224c81042", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873547, "uuid": "60003ad0-8dff-4c08-984f-93661f7c51c0", "comment": "Malware payload (Mirai)", "value": "2e4dbd7b626e35da1f545749fe141f1939a07e886cc1bc8db62010d72e2b6700", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873547, "uuid": "ce53708a-5dfd-4a43-bcda-93d26ec4b39d", "comment": "Malware payload (Mirai)", "value": "bfc09c39d3b4d8eac13a15b21c4b1c56504fd985", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873547, "uuid": "74540062-6ab0-4f0e-9e55-c81de0a06138", "comment": "Malware payload (Mirai)", "value": "a6e57b254569e6090e7a560843135b7fc76280dcd9b2d661dfa7a2782c6fb66cab119318f326264f7bf40b3d96d4cc12", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873547, "uuid": "2daba67d-2765-4c67-8e36-303898537b6f", "value": "T1ED632951BC819A13C6D1127BFA6E028D3B2623E8E3DF73179D225F2037C695B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873547, "uuid": "b9526c31-d471-456c-9144-0d75f2cc0672", "value": "1536:qNSlxYmii8N1U9uO//kWEjFBikg/QA83NRuxAvjWX:qNnK7kthBikg//29ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677873547, "uuid": "c0ca152a-914b-4c7d-877b-d06e3fefea5c", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677873547, "uuid": "092a02be-ce77-4b10-87cf-bca00f8fb419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873547, "uuid": "40f7dc95-90f5-4e98-9c35-85737e0d6715", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae29eaeb-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677856721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856721, "uuid": "803c4c90-2791-4d5e-ad5d-4b5bd23760e5", "comment": "Malware payload (SnakeKeylogger)", "value": "7dd4c4aa6b5b43956002c6e52c2b2bbd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856721, "uuid": "f1051b54-c2ac-483d-9911-d861c72fad57", "comment": "Malware payload (SnakeKeylogger)", "value": "2e55766a4f960350c33708e397f678501cc3eaa5f1c88035128e890c57868414", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856721, "uuid": "72ee52ef-70b5-4fce-999b-574f1e799eb7", "comment": "Malware payload (SnakeKeylogger)", "value": "c361dcfa08858fdcdf1c8f762aec68f443697d06", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856721, "uuid": "9cd34be5-676b-4a7e-8666-2ab467fccab1", "comment": "Malware payload (SnakeKeylogger)", "value": "a9081b72a69f72de28aff17f22fe4366db0e9143eb1b9255330c6876ec5e8d1debb105939df83bd8c3cc0c9892503bfd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856721, "uuid": "55dad4b4-f64d-4d09-8f69-73774bda5158", "value": "T10855F1039138AD8DE222C7FDBA3F755D410E7D3771CA61CA5A80B70A5632EAB55BF204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856721, "uuid": "8857238a-315e-49b4-9892-415690dfef3c", "value": "24576:2LKHWQmmav30xaBkWQmmav30xfOWQmmav30xgBPcWQmmav30xR6EJHvSHkOP1ZE:2LK2QmmQ30gjQmmQ30NDQmmQ30iFxQmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856721, "uuid": "597abd14-5849-4b88-a9a4-631a01a1e798", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856721, "uuid": "a74c5e24-b16a-463b-b6b7-3731dfef60c6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856721, "uuid": "7b4b7033-28c7-4df1-adb2-4cadec5ae3ac", "value": "SWIFT_TELEX MT 103 02.03.23.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0d57cd-b9a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677835194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835194, "uuid": "f75286b8-576a-4b2a-a385-6da5d90fb5e2", "comment": "Malware payload (SnakeKeylogger)", "value": "68baa18aa152cdfadd7e90deea9b2359", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835194, "uuid": "965a67ac-8210-4204-b8cc-4173383c8bd1", "comment": "Malware payload (SnakeKeylogger)", "value": "2fe1936747fb13f5f1e2308d2a1c795178c0876f09cc9e403acbc0345b18f1e6", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835194, "uuid": "46dc1a80-19c4-4003-aea5-8563c1b07834", "comment": "Malware payload (SnakeKeylogger)", "value": "374b09936276a8368df8ada658f117ab9084eddf", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835194, "uuid": "05e8c0ee-16f6-4ce0-9b6d-b1359af6d0d5", "comment": "Malware payload (SnakeKeylogger)", "value": "03fae2a427875e76331f4c817fff08b3f2096c558a5851abaf1e0023db6342725fd5f4bbc0ef2c120db7c9ce3af0b325", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835194, "uuid": "45ad1e53-a6c8-4b9e-80f1-571426af9c75", "value": "T153451201BB94CAA2C0991731692F1BB25F70EC53BA40470B336C765D3FB3A51B64BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835194, "uuid": "f13fcb4e-fae9-49b5-b0b2-363cc6e4a1e4", "value": "12288:0YOPOJq0bLW6PEKEFMHhkels/pUgDYuP5XKvumz8jMjN:0YOPOVWAEKwMPOUqYs5WsMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677835194, "uuid": "98176ae3-4087-47eb-ab98-69aad7ab5122", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677835194, "uuid": "20bd2454-4aad-46b6-ad84-f21efd30b4af", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835194, "uuid": "d5972536-9910-4e62-a903-1b2e89652d79", "value": "nteklif talebi.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40b222d-b9a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677833645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833645, "uuid": "5162d568-3492-462a-9251-36917625976e", "comment": "Malware payload (AgentTesla)", "value": "65c66f9180680269fc00bcf294a8ee7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833645, "uuid": "cdc9a87b-0fb5-49c9-9770-4ea0c385a6a0", "comment": "Malware payload (AgentTesla)", "value": "30e7620c14c4ff2cd4c467bc26a9524f84ac84a0111b08e614cf8782964b3a66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833645, "uuid": "44f574bf-af4c-41a3-a16e-878e6c13664c", "comment": "Malware payload (AgentTesla)", "value": "7101b6f275fce0656c3da4b852267eb8be6adedc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833645, "uuid": "0ebbed78-9339-42fc-90f5-113861358af2", "comment": "Malware payload (AgentTesla)", "value": "4e20d145f7eb13f3ec5554e171e66abe7b57b6dfbed7df341dc535aded3a3fd9dc18338bb2de32424705744ade9ce6f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833645, "uuid": "1f2efce6-7c60-40dd-a4f0-a7edd82c3f73", "value": "T19654120467F0C45BD9D192B218BE5B7A7BB0A931443D938B1F60BB1C3973242EE4A769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833645, "uuid": "f71710b5-8935-442a-a374-8876c4d942dd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833645, "uuid": "6d957f9b-b790-4e6e-867c-bbe7c89d83d7", "value": "6144:PYa63yaKAMyDQ0JfRi2LeB/qIry71pTfmLtXTeC/:PYNFj62LeB/qoipTEZTe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677833645, "uuid": "0842200f-2032-4cd0-9ce9-24fab049c53b", "value": 283317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677833645, "uuid": "f8ed8467-4f17-40a4-a5ee-1f4d6d4d1448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833645, "uuid": "f73e16b5-9f86-4823-bcf6-63902b9966fb", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5dc220-b99e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677832802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832802, "uuid": "74a5be5d-d3be-4dae-9c90-638f2a1f5826", "comment": "Malware payload (RedLineStealer)", "value": "e9689545610327d8fdd86d3277461de8", "object_relation": "md5", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832802, "uuid": "15b1997b-ee8d-4df0-9d9d-b56e7ada4e47", "comment": "Malware payload (RedLineStealer)", "value": "30e7e8b04fbdd2e6a0abb502d6308c67fc0c42549f05e89198bd2ac0c719334b", "object_relation": "sha256", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832802, "uuid": "065dec33-6876-44b8-a5ce-e53845e09ab2", "comment": "Malware payload (RedLineStealer)", "value": "9f31aa3d9c806e31284d4912073063e78bde00ef", "object_relation": "sha1", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832802, "uuid": "56208dae-1ce8-4ccc-b876-835056d3659f", "comment": "Malware payload (RedLineStealer)", "value": "953b4be4076b0daca4b88ae819e84993d860de35f354a23c16d9b205d35c36e0d04b6872f0d7b6d09f069dc17bd6ac14", "object_relation": "sha3-384", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland", "colour": "#D4E15F", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832802, "uuid": "0cc3d109-e462-4b8e-8376-f59ff15f6ef8", "value": "T1F37423CF18BEB95A79B831D0334BEC89D4D161DBD6186F5768064F8F931AD2428AF234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832802, "uuid": "c6f8a662-2d37-46d4-93c6-1959978f3aa7", "value": "6144:tf5/4BhQYZr3+FIc+n1iB/WWl5jSK/SFGpPR8kyx3KC/ZhWRK8Fu:tf+r3+FIc+4B+Wl5p/3+jrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677832802, "uuid": "9fc47ab5-33d8-411d-adcf-7fcba462a191", "value": 346050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677832802, "uuid": "dc9eed87-9f15-4930-ab40-6d74a76754fd", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832802, "uuid": "eb030741-f7da-4bc9-93fe-6a18231a765e", "value": "pureland.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0233fb-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677856687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856687, "uuid": "ceaffb3d-7c14-4825-bc8f-e87993d4ebe2", "comment": "Malware payload (AgentTesla)", "value": "18834e9533434790b56cbf2579183f55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856687, "uuid": "82dcb1db-2d70-4335-a0a6-0a40a058a84b", "comment": "Malware payload (AgentTesla)", "value": "3185d8e8484338169b004da9f6ea8e66f2e95f353b9d2a0cf833ce705ca2cfb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856687, "uuid": "d249241f-5d4b-49c4-a480-44e60bd2058c", "comment": "Malware payload (AgentTesla)", "value": "4b3f698e48f70c40d705590705d9c4d6fbd5a988", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856687, "uuid": "1b910db7-56a0-4826-8c91-dbfdc913a800", "comment": "Malware payload (AgentTesla)", "value": "7874a86f7dede803c4c137490d2f9f0c9df97d0d5178b6cae4482e1793aa56515ab46c4708b9d0c468786c5c3f78fb9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856687, "uuid": "28576b9f-d810-4950-ac84-a7bd33d3a585", "value": "T11C55DFAC321079DFC817CD76CAA82C64E66174B6570BD203A05B15ACAF1DA9BCF116F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856687, "uuid": "541a0ab4-b94c-4158-b519-7e0586f55a08", "value": "24576:owwt+2McUJrdRhT5js5HE2u08wvQW0iaGTf/YeOXv:kt+XLsxRu08wYI/YNXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856687, "uuid": "f646e6f6-2e6d-4a9e-8b33-5afdd49095ca", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856687, "uuid": "e5855413-4b4d-4058-8869-a8e47dfefee0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856687, "uuid": "918ee14e-c73d-44c2-948e-b83944d4154e", "value": "Betaling.jpg_1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e492a7e-b9dd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677859701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859701, "uuid": "c8797fe4-cc84-40b9-ad0b-7f8511b95fcc", "comment": "Malware payload", "value": "2b9683d6a5ddd016e410b2238c4fc2c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859701, "uuid": "260abdd0-92b4-4a8b-b5f1-a842ae75a246", "comment": "Malware payload", "value": "32a74a5734bd6fa9fd597da62ea8c7695019847db2899ef818a94465ab031f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859701, "uuid": "464af772-2d06-4549-9f18-634f2e6287e9", "comment": "Malware payload", "value": "3c18f448a5088bd4a1e7d3fe414b292fc17315aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859701, "uuid": "2008a908-69c7-4409-af02-db904f2e6eeb", "comment": "Malware payload", "value": "f45ac8c3a7808bb58497edc1d8bbd24ad7db4390c7deffb2624288bb99054879911c3173d31682ae1eca40558c18918f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859701, "uuid": "dcf70b17-1fbd-47b9-be2b-b3d3918f8115", "value": "T13CC34A3474C1C133E592547151B5C7B1E6E8BB720BA611C773A40F6AAB702E6DE3A2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859701, "uuid": "59da601e-81f4-441b-b6aa-f3a1406fcfba", "value": "27fb5b9e0fffb467db793bfc582e5aa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859701, "uuid": "834dde26-0123-4609-90d7-e910a6667a02", "value": "3072:eQAwqZqA5e1eXTi66oPszU17YlJqnojdpWMna649kaq5:e2qZ75e1eXGXoPszU17YlJqnojXxu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677859701, "uuid": "f77d6e38-28fa-41c4-bec9-81dc3ee73522", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677859701, "uuid": "fae51b05-7d26-498c-9d61-f78a8ccb7c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859701, "uuid": "cb7002f5-a858-4ed4-be51-814aff92edf9", "value": "ymeeszq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb223b0-b9e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677862918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862918, "uuid": "670bf140-a33b-4d03-9c5f-c3c5e18af723", "comment": "Malware payload (SnakeKeylogger)", "value": "d4661425fdc8de055dcef921d02f3a21", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862918, "uuid": "e4b2114d-4237-4d32-84ff-30948ef66850", "comment": "Malware payload (SnakeKeylogger)", "value": "336bc9e961769313d1e756e8be922124e8e0154bf18fc8cae2ab7185457daf01", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862918, "uuid": "f6eefc84-5766-4f3f-8fc4-a0b87ead1061", "comment": "Malware payload (SnakeKeylogger)", "value": "ad1c6d911476f20ea426955984d0f88ab4bb6ff6", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862918, "uuid": "2fc1af82-267d-48d3-9cf6-729e77f32610", "comment": "Malware payload (SnakeKeylogger)", "value": "44723aea20bb105923bac3a56a7b44b11b74c467d743d0e54fee9060f13933a31e355a49f0d2d6342ed522819460f0c0", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862918, "uuid": "14a4e770-54c8-4adf-be2f-4ade1f22a1bd", "value": "T1252413D456D160AF236153A28D80FA0C8BA86F6B7DB397C508D3F4579CE85D0E7B4C26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862918, "uuid": "e56d75b3-0618-44d6-ae13-3becfc80d24f", "value": "6144:GpNREncQkxdtiF7ju2VJFISWVQKHN4Qa04YFZSHKnW3:GSncQ4I7VVJYQKT2USHx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677862918, "uuid": "efeff0e1-cddb-4f25-99a9-e2faacca5f21", "value": 225182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677862918, "uuid": "a3c4f325-ee77-4284-a950-0c9200e94431", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862918, "uuid": "d4e3d6ff-84fe-4fee-810b-11d8d527e428", "value": "image001.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9767b5f8-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677850670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850670, "uuid": "bd21430b-d750-4aa8-b855-0a9e4194b042", "comment": "Malware payload (GuLoader)", "value": "24dee5a9951bbccc9e7f99306fbcdb61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850670, "uuid": "1aad2838-a5fc-4c82-b37c-a6e72b84e0e2", "comment": "Malware payload (GuLoader)", "value": "33c417703326ef2732ee76a004da73867df271670c02162a44e52641a572f3f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850670, "uuid": "1661d829-8fe1-46b3-9375-a715eb562abb", "comment": "Malware payload (GuLoader)", "value": "ea61ee9f08d817c3400e84aeb9a10440b402f4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850670, "uuid": "600eb206-8180-4240-8713-84333cc6dda3", "comment": "Malware payload (GuLoader)", "value": "192b3444d54782adeb486f45e5017ab523598f42bc443ef019bbbe390469cecae707edfd79e0cf3e6337d3846a377cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850670, "uuid": "6362fdd6-a941-4657-b7ec-7064ea3bac95", "value": "T1AE741218E390D417C0266670CEFBD6FD9EF0AE16D492170F2BA83F6E3D35AD15818662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850670, "uuid": "b41625be-641a-40ac-82dc-1d29e7ba5f2d", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850670, "uuid": "0d374ae0-785f-4abe-84fe-9f3373b5dc74", "value": "6144:mM23mhV8dFmx+jQGRJKD9KMVpb/NnO9B3/ni3HsQ//UQiXv:SsV8dFlxWRKMnNnO3PnzQ//Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850670, "uuid": "cdde47b8-7308-48a8-8691-a5aabeb482e3", "value": 359244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850670, "uuid": "ddadd0d5-71ab-419a-b714-3e51041f4c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850670, "uuid": "f54606c0-edc2-4562-ad5a-10e9fca8a42f", "value": "33c417703326ef2732ee76a004da73867df271670c02162a44e52641a572f3f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41c3704-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677830129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830129, "uuid": "7a9ffe98-6693-4d33-b64c-a014f9ac4ead", "comment": "Malware payload (RedLineStealer)", "value": "e322c1b3f19ed48d5ee29c56c6409f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830129, "uuid": "6dce463a-5e07-4454-8f24-0d6f90062623", "comment": "Malware payload (RedLineStealer)", "value": "34532f862c001878203a4c5f8f2b7efa5c47084ebaf7ca26d906099d753e2471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830129, "uuid": "040c5bd4-5210-49f6-aeff-9b04d9302f5a", "comment": "Malware payload (RedLineStealer)", "value": "4f9d68de3888e8576d194d78246ca68e00850675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830129, "uuid": "855ec43d-06a7-4c72-bf1d-5867c0de1ef8", "comment": "Malware payload (RedLineStealer)", "value": "19805f65ad66ccf81668b7de156b716335f252da26bfd98de281fd99073a8eccd951aecc8e9802848e72804f82e40c4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830129, "uuid": "b2e6e635-1619-4a36-9ad8-83c0c6a0f230", "value": "T18A151203E7DC5055E8B4477029F613C70536BEE1AE39836A2769989A1C336F1B730B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830129, "uuid": "7fcda72a-737f-49ab-b576-24d2c3230332", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830129, "uuid": "2d24a837-8230-4c4e-8a2f-6795d74d4a1c", "value": "24576:PyxiP+XdtCYEdiaa8VTYXQqas+XjhOENVDLyx:a5dtCYEza8Vfqas+Xdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677830129, "uuid": "1520f649-9373-40f3-9caa-33363fbf9ec1", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677830129, "uuid": "bf6e39ed-9adf-4918-91ca-e8f158cb0463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830129, "uuid": "dd3095a6-0378-445e-bc55-29ab6424c20f", "value": "e322c1b3f19ed48d5ee29c56c6409f6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e0c72c-ba0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677878855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677878855, "uuid": "c564e269-344a-4387-9a5e-5c4a22a7be98", "comment": "Malware payload (RedLineStealer)", "value": "da2cc222dcd52041271255792d108b79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677878855, "uuid": "19067bde-2b0a-4073-850f-5aa66a8d1af3", "comment": "Malware payload (RedLineStealer)", "value": "355c0d46a3f2f7dde8639253608c1f980261f741361d5366e6263a057552158a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677878855, "uuid": "2979f2ec-8c1c-4b55-a162-b8a3028d7959", "comment": "Malware payload (RedLineStealer)", "value": "8d7728b35f1a11c19180a01fc1720b727f73e6b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677878855, "uuid": "4bc10a59-cbb3-4199-b200-d7e1111ab770", "comment": "Malware payload (RedLineStealer)", "value": "635b910339a5f87c447d06e25be6b0866eac763caf58a3a3d6b9a197fc326d1a1c935a6816545a4830bea2821952099f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677878855, "uuid": "9eca28cd-217f-49b8-ac39-643193bb8a88", "value": "T10C64F130B2E0D831E1731A31D965D7A4567AFCA26A3845DB33A43B1E5F702D09E2DB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677878855, "uuid": "5c8e0662-e749-4030-be79-68365998da36", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677878855, "uuid": "a0dcfed6-f5dd-47ea-bf65-aa78a05ee44c", "value": "6144:Rq6gUKusIS/Cxb6aWAiWnw2rQ0yxURTa/s+Zj:Rq6HtXS/Gb6fAiWnw2rt+URz+Zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677878855, "uuid": "1f59017c-ae59-4cf2-b478-0b2c7ed8dc16", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677878855, "uuid": "8a3b564a-54bb-471d-97ca-848642060a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677878855, "uuid": "27946bb6-7d38-434b-afb8-da7cef8d0cc0", "value": "SecuriteInfo.com.Win32.CrypterX-gen.11635.14023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba2eb16-ba04-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677876608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876608, "uuid": "14b888e1-f971-4ae2-bfbf-84883ca414ed", "comment": "Malware payload (RedLineStealer)", "value": "3d9a9f126cffb776dda0ffd37214f6af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876608, "uuid": "dd700db2-0b2d-498d-81f1-fdef15d467a8", "comment": "Malware payload (RedLineStealer)", "value": "35d9ebbf77018a3e27069deb7dd9742eb632da1e89f9ba8d484a49ad6ad497bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876608, "uuid": "a0d25dbd-d6a9-413c-a39a-ea366b09fbb6", "comment": "Malware payload (RedLineStealer)", "value": "d4d57221b6528816098f8e885202e5f1b26113f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876608, "uuid": "42813bf8-c385-48f2-8b59-a14e5644eb93", "comment": "Malware payload (RedLineStealer)", "value": "f9df610b80a38569b9e8ce30c54e64068824c5cacae9ed039cae070a61c5e9947855bceca9bbb5dbdeeeea6ef1374d88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876608, "uuid": "479b6f20-d4c2-4b4a-86ce-124fd8bdba7f", "value": "T16A649E0272E0BC59E9318B318F1EE7E47A1FF9508E5937761228AA5F14B01F3C9A3765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876608, "uuid": "1c74bbc5-bf9c-4a92-8682-a9bcbf1ab43e", "value": "51ceb91dba0ace98219e4727f07b1743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876608, "uuid": "28f0dad3-4258-41ee-a710-e30e75757d1f", "value": "6144:BPLIK7b9M2jOv6jjXqeeDFq9/CJTk637eQfnd57MB:Vvbm2KcGeUq9CJb7d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677876608, "uuid": "a58511f0-1308-43c7-97f9-643f3f5c0aac", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677876608, "uuid": "2c1a28e3-f0ad-4f74-850e-bb0e29ec8606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876608, "uuid": "344fb613-f3db-415f-bfc6-a8a4b76a43f7", "value": "3d9a9f126cffb776dda0ffd37214f6af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f46fab6-b9fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677871943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871943, "uuid": "4e54170b-eceb-490f-b916-981c355087e9", "comment": "Malware payload (Mirai)", "value": "1483bd81c703fc8278a50a5996606705", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871943, "uuid": "f8e913f0-9211-403b-8db7-19e5a77af8f7", "comment": "Malware payload (Mirai)", "value": "3786e8ab65bb094aa93425513265eb763575ab11731f0198814a7639bf4c6808", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871943, "uuid": "ed7c6d27-edd9-4c1f-83e3-62ac6119da18", "comment": "Malware payload (Mirai)", "value": "79867f668f208f32ae29043257f67f2fb25998d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871943, "uuid": "dec9b65b-c57f-4d0b-979d-8cd879aa8809", "comment": "Malware payload (Mirai)", "value": "53affc6f59e5bf65ed183519a5a2cf0ac5e56f0aab305908caa9a69b146fe53724c060a380cf64c2f8b25b8a549415d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871943, "uuid": "0b2f42f0-eab5-4511-a3ce-a40af043c6fe", "value": "T188C2E0DFB4967985CC1C5CBC218D56E116A9A2C3234B9B0837603DCDAAB645EB89C4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871943, "uuid": "a6fd323f-11c6-45ee-b343-34c171231967", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBWaWS:oCrJgHiOJrfwmQrctO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871943, "uuid": "d4f56341-dce6-4e8a-87da-b01de1eb7a93", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871943, "uuid": "80301f8e-2fcf-4f1a-b777-d85f97ac8937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871943, "uuid": "3e07c851-5e59-4bb5-b3d7-a20d4af82c71", "value": "1483bd81c703fc8278a50a5996606705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7149131b-b9d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677855330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855330, "uuid": "19a77c21-2e2c-4a64-acfc-b7dd4c6e1b2a", "comment": "Malware payload (Amadey)", "value": "773584dd290495d680bdc19afec633dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855330, "uuid": "b4d7f6c2-5ba5-4cb5-9139-474b1c5a5e80", "comment": "Malware payload (Amadey)", "value": "3868a70f2245c490aeadccd7a198f86a8b706c9bc7e0bca061b2cffd0e49c06f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855330, "uuid": "0e953ddd-e4aa-409e-9686-4ab4841be6d0", "comment": "Malware payload (Amadey)", "value": "bce047d845d63ff7673e67c7f3accff7da2d2368", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855330, "uuid": "f269fab5-20f6-4056-8d0b-37eaa55ce33e", "comment": "Malware payload (Amadey)", "value": "91faee9dcd47022ec2593d0ee451805ba827d2b964fcb69ddc45de8befb7964891196f60df2d1c7989a6db1b00f9e2e5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855330, "uuid": "f06a0c30-ff85-447a-abf8-e7e7ab814d4a", "value": "T14924CF31B2D0D832C0721931D865C6E5693ABC626A38999B77543B2F1FB02D1CE7E727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855330, "uuid": "97680023-e626-472e-bd59-dd6d4247517f", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855330, "uuid": "fc3dbec5-54c0-4b7a-a57c-f9bb5030feab", "value": "6144:js5zUqe8CPPSiPin3q9j4FpwUPdbvJsczj:js54Jp3SiPu34j4AoLsAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677855330, "uuid": "8ee83453-4711-4b70-8c10-b80d19471e9f", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677855330, "uuid": "966bf996-6554-4f77-9218-329ccdae77a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855330, "uuid": "2505e14a-8f6c-46af-9717-f59026219130", "value": "773584dd290495d680bdc19afec633dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8abf888-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677856712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856712, "uuid": "025345ee-7281-4e19-92c5-0eb938dadf83", "comment": "Malware payload (Loki)", "value": "acf76e28014e2a6c162045b9357749c7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856712, "uuid": "13928188-e902-4596-a505-c2e3d980e595", "comment": "Malware payload (Loki)", "value": "398ad7c596eeaaec6d4014248cd1ece02bae0f505c3ebefe9c66e2359db8e07a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856712, "uuid": "2a188bea-9ca9-4483-9c38-d023f7fd718c", "comment": "Malware payload (Loki)", "value": "31f6ffc6571bf6b3941c59f36b6999bd4d144b09", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856712, "uuid": "d7d8755f-2b1a-4de0-b6ee-e52ad7b0e0c6", "comment": "Malware payload (Loki)", "value": "8c97a54ffa3a4583337a63e8d0f5b8f8b4f00cccce3b3d3af1f0e97aebb1f3a0e77d8f2a1a5a99a91bd95d20cbd76c98", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856712, "uuid": "4762b733-3105-40d2-8cde-2f983d4f4204", "value": "T1EF55F103513CAE4EE246CBFCAABF755C410DBD7271D261CA6A40B7069633EAB55BF108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856712, "uuid": "d7ab7880-4c88-4e89-b592-4e6c152fc486", "value": "24576:FLKmWQmmav30xaBaWQmmav30xfwWQmmav30xgBj1WQmmav30x46E0Qs+/JuvRx2e:FLKbQmmQ30gNQmmQ30NFQmmQ30ix0QmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856712, "uuid": "e61adadb-52dd-4334-88fe-9233922a8318", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856712, "uuid": "0fc331ab-1107-46f2-8daf-38f544a8a55f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856712, "uuid": "30c5bf04-7c15-41ce-b08d-82a1ea9b7d71", "value": "Scan_doc_071589.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995f8fb7-b9f9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677871718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871718, "uuid": "d9cc5a0e-e509-4c70-92ea-18ff0e383759", "comment": "Malware payload", "value": "950e9d80f05039faa47017b921e6aa7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871718, "uuid": "463a3a0c-c794-4ed3-b7c1-11f557b58f11", "comment": "Malware payload", "value": "39fa953c266078174a755772175a9e5a8e95bdefe0aa5b076c59d04aade903fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871718, "uuid": "e1e69f3e-bd3a-40ed-b643-a47a53c75f89", "comment": "Malware payload", "value": "b562454eb98e63310c12b2903f9d7f53e621aa58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871718, "uuid": "bab2f206-6c25-40ca-9703-a3600192f670", "comment": "Malware payload", "value": "7dd8e677464630af2db6de1abc0ac351a4f41740ec96d137fff4425a2a6e918c01c7d5668c205d8f56e5022b41bb493a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871718, "uuid": "efcd68fc-70ff-400c-8a04-ccb5f185c5bf", "value": "T1EEA46C113790D836C26135B14A62D3B8566ABE616D3583477BF03E3FFE702929D38B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871718, "uuid": "2f09e342-c311-4782-9bd5-4037a5b7f239", "value": "72417f9b6150901502c119dbf07b386f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871718, "uuid": "8823b629-0006-4f4a-95ff-0f81de468c93", "value": "6144:CnqiAFBpq2hfBvBWMYjHapr6g0RZiQeA3DLRba6XCqjO+dnkUpgwaO7xEPe:aDoqMYjHLDReA3Dda6XCOO+Npg81EPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871718, "uuid": "10692253-82ed-4815-a61e-1c718a0d4fc8", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871718, "uuid": "0d526934-256e-49a5-b464-28ebaf3b5cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871718, "uuid": "2b8d748c-4838-419a-86f2-fca28160cb16", "value": "SecuriteInfo.com.Heur.25962.31659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3471ade-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677861561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861561, "uuid": "badc0d62-09ee-4665-a5ad-38fddcefa135", "comment": "Malware payload (Amadey)", "value": "efc2406d7304e8b88769305a8370a73c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861561, "uuid": "3c9cb4a9-fd17-4c8d-8021-6d6705dffd4e", "comment": "Malware payload (Amadey)", "value": "3aecd3da65242f0d98650235f4b81789da191353c53b4f562aa664badd656af2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861561, "uuid": "f2e1d828-212a-425a-8bbf-d1ec74cbfa70", "comment": "Malware payload (Amadey)", "value": "9cab2a278edd4aee0ac44eb0cb59a37bf269d754", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861561, "uuid": "8cd36ce8-5d1c-4ce0-9908-825b8b17b4cd", "comment": "Malware payload (Amadey)", "value": "db7bada7c117f0351b6696c047e55d5e986abb3afa28d7c2f37f1a4ca6cd6195735ec4022b4fb69e2e970456358767c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861561, "uuid": "c30d3ade-5a09-42a1-94a6-653ca3490371", "value": "T1A5151207E7D84225D9F0637418F702C30D31BE615A7856AB328B6E2D1CB36A5B63637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861561, "uuid": "2f952ebc-b195-413c-a244-260cd5824295", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861561, "uuid": "58d2394c-3025-45f4-9609-fc2dacc27745", "value": "12288:xMrsy90JkJKWmVa16/Xj/7s9cjRNFGyQYZX3y0/G99/zgu64yLyQjAMvBB8a:9y5JPNE/7w9CvFu4/G95lFyL9Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861561, "uuid": "3a337d7f-d43a-4922-aa24-af1e9b6b8587", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861561, "uuid": "55e2166c-4d44-4ae3-943d-07aafc791b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861561, "uuid": "a2c9845b-2302-4f6e-85a8-ae02b4092c4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d92ba8-b9ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677839210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839210, "uuid": "bf0bce74-de6d-4d9c-9972-a8857c44c859", "comment": "Malware payload (AsyncRAT)", "value": "691f13d5aebd90929e18b7b0ff6ddbfa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839210, "uuid": "b9fc4208-d8a1-4102-88d0-0ea3d84c3a9a", "comment": "Malware payload (AsyncRAT)", "value": "3cf2b6a02e50d078784aaaf1ea1b3473c855ad239c903fa668783bf0e0e4ebc2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839210, "uuid": "1f359a85-7ac9-4970-9dc9-89b333966c97", "comment": "Malware payload (AsyncRAT)", "value": "8a2c4fb52fc7fa2e3ae84574c1021ebfe386bcfe", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839210, "uuid": "b73cea49-1c80-4560-ab7f-0f70a637aec1", "comment": "Malware payload (AsyncRAT)", "value": "e800d6aa79f7e317b16027a3db30df05182f63604b02ffdf713accb3c5dee9d11482ef012ce21a78337c57f49172b71e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839210, "uuid": "22562374-2da1-4623-950f-442ebf364df3", "value": "T1CA151C1DFE60E401CC9A3A3BCAFA61059772A3C267319083765F6DF84B55B3648E61BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839210, "uuid": "51502ccc-ab68-4ec3-9bdd-32965e4b8e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839210, "uuid": "28203d9e-1d63-4b80-926d-4803c03c6ec5", "value": "6144:SisavtkpPpWkPXQkFyc5OzhnfJin+OFBD/9RTT7MA2xPAip5TwF7Ewj5b94YgeUH:NsaqFsrluwhAip187EwYYhDIb5UIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677839210, "uuid": "0ff19ece-e52f-4c26-beec-5363ad4bbad4", "value": 915176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677839210, "uuid": "8e138b2f-fb69-4ad1-be61-4a4bf0e25b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839210, "uuid": "bfe38575-435a-45b8-9f8c-9bcb225625ad", "value": "691f13d5aebd90929e18b7b0ff6ddbfa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185ec8e5-ba00-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677874508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677874508, "uuid": "5b35e1de-5d09-4574-850b-0e020cd71018", "comment": "Malware payload (RedLineStealer)", "value": "8771e4a71d08e5d647aca2d9a4e78640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677874508, "uuid": "0a58d64b-188b-4710-83ae-5023ee167d9e", "comment": "Malware payload (RedLineStealer)", "value": "3d0f9f89293300e70a0a0c37c5aab81be9ed97a7ec4a2f5a73e54767d4aed644", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677874508, "uuid": "8ec94fff-8661-4538-842f-73b33e18fad7", "comment": "Malware payload (RedLineStealer)", "value": "2149e01eed4f4d77cfac17c2921de59b1590ddde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677874508, "uuid": "29105119-a0c7-4bec-a025-f29635897990", "comment": "Malware payload (RedLineStealer)", "value": "bd68ff24c4b74352ac2e5055f7cf54bc060f19deda25dc16149524d992438ed8975baa3a10ec6ce9d660b05a26e8ee23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677874508, "uuid": "b2285fc3-58bb-401a-bc38-59add0bdad39", "value": "T1B845982809FC0AF245B1F1FD9FD4E753BD8488E6AB049D99C2838B89555391720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677874508, "uuid": "52b833be-f1e3-463d-9953-88dd7f52fff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677874508, "uuid": "ea6c6441-3258-4731-bfd8-579dba4647b9", "value": "12288:JlMOEAlI3MzSSV93jHFoMqP8zBnx1FQEGFm4l2WViumw1uFR7r/mYQf3mV7eK8qy:JCYdSSXFtdx12PF9ltViIuFZmbPcuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677874508, "uuid": "15d3dd18-a7af-4a59-9935-e80be9685fdb", "value": 1189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677874508, "uuid": "fe3e212b-57da-4615-b921-64d7749c139d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677874508, "uuid": "63c333c0-a235-4d0c-8994-fbcdd563ac1b", "value": "8771e4a71d08e5d647aca2d9a4e78640.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34d0e18-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677857669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857669, "uuid": "0b3334a0-3f9b-455e-95b1-82b3a851c1b3", "comment": "Malware payload (Vidar)", "value": "b7cf17c0816daba9693b5031af524e24", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857669, "uuid": "edd6ed7a-0b56-4879-879c-5d3bfc336ff9", "comment": "Malware payload (Vidar)", "value": "3d551412d8281d29c99b0578f74ce65ff7ac9d95adcfa80fd9d05c58664c5bee", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857669, "uuid": "3787a59e-57ed-4cc2-8d4c-a91e47b593a1", "comment": "Malware payload (Vidar)", "value": "6eb4c2f79a8b9683d55bc010274f7610fa3bbb25", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857669, "uuid": "90ac179c-e658-4761-bfea-6a1396dcbd24", "comment": "Malware payload (Vidar)", "value": "5df1f32ec6deca63cb45410df61b68c039d2db944f79a5e3667f8bfd5d4f371a501a07c551faedbcd3733474c850cf97", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857669, "uuid": "35839fb0-c3a0-4330-b9d4-ebaab36c64c5", "value": "T1245655D27B84C127C95719354E6793AA6B1DFCD1EA31B0877760F71E5A38AE3AC28301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857669, "uuid": "0761974a-2a5c-4259-a228-3b0e9ce433e8", "value": "98304:lp+YWkCZCio1gikuxM54j2BhLkltTvxU5tEftkzcy/CEeGfTu3eRY8wn0Kzm:xWhQpbknIXnpmtESzMCuOyx0Ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857669, "uuid": "0a9f1f0a-b979-446b-8dc5-1765fca5335d", "value": 6262784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857669, "uuid": "2e83f7b9-ace4-495f-bdbb-b1415d3fa30f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857669, "uuid": "1653f225-8600-4ba7-b86f-ff11d0ae70d4", "value": "b7cf17c0816daba9693b5031af524e24.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0274e3e-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677861556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861556, "uuid": "fc91e1c8-3e54-42c0-95e0-d47a73f1beb5", "comment": "Malware payload (RecordBreaker)", "value": "189bbbdc14886e4e1b754340095f8e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861556, "uuid": "4fa0a877-1977-4468-99e7-77159a1b6eea", "comment": "Malware payload (RecordBreaker)", "value": "3ef830b80dfde2495d9c111cee4c9b6be29c1801ea55cd15b2235ef0a9c359fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861556, "uuid": "e1676458-2b2d-40e8-99c8-2b981355a0c0", "comment": "Malware payload (RecordBreaker)", "value": "385c4a54448b532c2b0d7524e2af794a738d764c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861556, "uuid": "d9261ecf-a3e3-4a56-9810-e48d0aa74afc", "comment": "Malware payload (RecordBreaker)", "value": "bc361d18766a524c4fc839b791fa03190152dd2a31dfef75193d72ce96f3288e588455c20cdcc96723a7d12e5f31da77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861556, "uuid": "abf674f2-5991-4b86-b777-150262ddef76", "value": "T1DEE6336B31E1041AE0D6CD398633FE6531B26E774580A8F8A8CB7BD8377A578A503753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861556, "uuid": "e2742c3a-35fa-40cd-a19b-c3feae949e00", "value": "1abaf82ff0608e87a2d8be1299a2c106", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861556, "uuid": "24a9aef0-1bf6-4b91-8482-ea9d7bd7ab6d", "value": "196608:qqMAsMRq5pCgHUmQ47dYL4OzuzJvzDFwOB1cY83WwZrLQWAPYdM5ignYu19EmY:SSqt9VdYbu9vziqC7WwZHtu8M5fnz9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861556, "uuid": "7885f01f-d3dd-452e-ab36-0713b2094e5e", "value": 13925376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861556, "uuid": "2d29adf2-f156-4865-8318-72bb30a694e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861556, "uuid": "f0fdf11d-ba1f-41a9-9284-11955c93f578", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707db1b2-b9c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677848887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848887, "uuid": "e57f3289-72ea-4586-8e78-228e05d1d663", "comment": "Malware payload (Mirai)", "value": "eb13a01d2a339f27a4ef483691d5af54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848887, "uuid": "7eb522f4-6ca8-4fa7-9a77-21319027fcc5", "comment": "Malware payload (Mirai)", "value": "3f3612981c37a4816e9ed2f92873d024c058eabc89c40b6cb7e50c3fc45f2627", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848887, "uuid": "4b11597e-3e5f-4c0c-add7-c76de17f5e9b", "comment": "Malware payload (Mirai)", "value": "cf991944b994ebbfa248f606ae871663b0de526a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848887, "uuid": "4e250acb-c1c9-48e8-8a8c-e1b8a0368c44", "comment": "Malware payload (Mirai)", "value": "9dbcb548752cac951afc28235d8ad8b974f43d2e54582e3431c2886130be4c983668d6decab95eec3fd84827cd8a2ca8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848887, "uuid": "e798c4a6-6f56-4fb8-a781-3069355f930b", "value": "T144438D37E96E1E74C04641B074748EB56F23B5C883972EB61AAAC2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848887, "uuid": "ada71bdc-c552-4c64-9589-37d259558ca7", "value": "1536:Vaa0brW/Od9hlCR3KEjKYXwKEpPDCMC2+Ww:Vv0brWGd9X5EGYypPDL+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677848887, "uuid": "42c510c6-ebd8-4f69-8fb9-0c988904669b", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677848887, "uuid": "3dd6451d-9d89-4440-be36-b2f87d085388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848887, "uuid": "c4d74133-3187-466f-9296-c6d2e458b872", "value": "eb13a01d2a339f27a4ef483691d5af54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c5575f-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677861376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861376, "uuid": "51d8d7cb-41ec-4f23-b036-3b85cf107e40", "comment": "Malware payload (Formbook)", "value": "325dac8db7e6fce3d01316c693799e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861376, "uuid": "c692d1e1-07af-4f1a-ac27-aa15ac3171c8", "comment": "Malware payload (Formbook)", "value": "402c82df5bcd852868c74eb4d801ac2d33c9361a942eb56020614afe147eab21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861376, "uuid": "130ce980-11de-4558-bc16-55433f06e722", "comment": "Malware payload (Formbook)", "value": "2af2f0f379d5a11ffa6655ac8bae2a247d0bfca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861376, "uuid": "003e6786-8e88-4564-85c8-6c7132263a21", "comment": "Malware payload (Formbook)", "value": "fe9420779929df62332d42208ff3be70dd307d25ce478de265089dc68f7afd60dcb553e2ccf0042f1decda4810919944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861376, "uuid": "ab8d82c8-5ad0-4b27-bce1-5ce7ebdc84f6", "value": "T1E245872809FD0EF28571F1FD9FE4E753BE808CE6AA049D9982834B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861376, "uuid": "4f7d8e11-182a-48e2-b646-114434c07ae9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861376, "uuid": "c30efb82-21b7-46f1-8c1c-4aa3a474fb46", "value": "24576:kq0c4+2CblkbVdb3/hW6kl0fNzA9vDZ4oocVVHbcJLc:kqF4+Vhkbvb3ZW6pNUv4AVHbALc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861376, "uuid": "b67a2df9-5c74-4362-abb2-d76755f45264", "value": 1166848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861376, "uuid": "8d9c8f9e-1015-4105-8ed4-95084ba8278b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861376, "uuid": "19a4b993-e981-4bbc-bd28-e2f9a318ee44", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7067c7c3-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677845021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845021, "uuid": "e8b8c7f9-d128-4b77-8b1f-2b4aa9dc63d5", "comment": "Malware payload (Mirai)", "value": "748f3289363c41bcc1e15c9813f58344", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845021, "uuid": "bea68bb9-646d-4c40-b6b8-73bb070b4a7c", "comment": "Malware payload (Mirai)", "value": "404a49e1f593645f5577f6fc2a3c952c79c743c4e534228c8f84ed8789099630", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845021, "uuid": "48532a97-548b-4e9b-b659-a220a1c2a534", "comment": "Malware payload (Mirai)", "value": "dad75dce6f14fb2595eecad69c39eaef78b72bce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845021, "uuid": "3f00e740-e7e5-41f8-98b0-b005196b9c14", "comment": "Malware payload (Mirai)", "value": "fb4e3052d296f9b2432f5f82f52955c3ee7e12f8324f326386790210b9394f021004ece8baca5a81e68ed01eb7178422", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845021, "uuid": "d8183fc0-d87d-4660-a367-51d7372ce9ec", "value": "T13E83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845021, "uuid": "1b635903-0a9e-40e8-8f12-45564376a62e", "value": "1536:iVLyu95KfJkj752dCexuV/8UZlDwfkJ4MYfW8:iVLyMgsFezxu5VD1e5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845021, "uuid": "6184b148-6a1d-4113-a3cb-cc1501d0e59b", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845021, "uuid": "496f946f-c124-4536-9aad-7a877dc6a814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845021, "uuid": "a8105643-b068-4abd-967e-4beee4e5bc6e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c86d00-b9af-11ed-88f6-42010a9c006e", "comment": "Malware payload (StormKitty)", "timestamp": 1677839738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839738, "uuid": "29d5ab98-1e3a-42f7-9f6d-08deb135d35a", "comment": "Malware payload (StormKitty)", "value": "63c05e9cefd9e149912798971d3bac59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839738, "uuid": "e05b1ea6-e5f8-4704-8399-cf28676473bb", "comment": "Malware payload (StormKitty)", "value": "4213052d1b9d7daa7ca2d2e17eded80218602122bd697c72adbb88139d60ce7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839738, "uuid": "2691dbbe-4642-4faa-a504-8e7a90783122", "comment": "Malware payload (StormKitty)", "value": "2647d01bad450859a0237da0cf8c577afea02f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839738, "uuid": "155b84dc-a5c3-47c4-b4cc-32110ed9d7ba", "comment": "Malware payload (StormKitty)", "value": "6507d8d382549b6f64ddfd8016663aa8fba73a413189cca0cb69c1e92307dd708613839b65f9185b7bce664519fd1e56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839738, "uuid": "af4c9a74-1923-4cbd-908f-4df9eb7d20ff", "value": "T14C15E019636BCD13D38A2736E4C26146D7E3598EA857F18E7449A7D28C133BBED812C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839738, "uuid": "0c2c480a-5b9f-4d49-8d0b-415c8a35e9c8", "value": "24576:kudWVLuCLQA+hhbaRVqLHiRMKiyMKrMEC1+lGuCf:/dvYLgHiRMKiyMKbC1+Iu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677839738, "uuid": "dfa25d8f-e42f-40fe-920e-db980ef85362", "value": 913480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677839738, "uuid": "e08b51ef-e932-4c49-9481-027f059e99a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839738, "uuid": "94f2c6b6-b12f-4f80-8eff-7b883a4dd3cf", "value": "Pago pendiente 01-05-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36355fad-b9f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677869405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869405, "uuid": "c669836f-4ac5-4cb5-8384-5cdbcf61dd4b", "comment": "Malware payload (Mirai)", "value": "7b42fc0d5f78d580c2e301afccba4077", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869405, "uuid": "5d907df6-e3db-4e29-8664-ea0a4afadb14", "comment": "Malware payload (Mirai)", "value": "425c49a985c5be592ac5c4237665e8cb70be3951d44dea09e4074e9f3492dcde", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869405, "uuid": "f305e8a5-0af8-49d0-8da5-1d690878bce8", "comment": "Malware payload (Mirai)", "value": "65333cb0ff44e872b4397abb45d488dd5e1a3a0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869405, "uuid": "f359cd63-efcf-4064-ae99-75a004b5892c", "comment": "Malware payload (Mirai)", "value": "84bcab088580b02fae1eefed1c0a68cbbed5da181b696f52ec07721d01f07f728941b21d32994ba78ca486aab55c2b17", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869405, "uuid": "642f051b-08cf-4323-9439-2c6705d33db9", "value": "T1232302432093BA03E4305CFA45628C8DB94EA7BDB1BF7BA725484E154C35992ECF18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869405, "uuid": "d814043c-8f56-441d-958e-044d250fd616", "value": "768:lK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFh69q3UELWt/iw+kvBGg6+fYtrBHi:N12O1LCNguovDPH7TcrfvLWhiw+kvBGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677869405, "uuid": "36e8ea12-c98d-4e9d-b15f-1cb8d671e7fe", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677869405, "uuid": "28f25a45-b928-4a0a-88f4-144e1c36715f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869405, "uuid": "1b47223c-b49b-45e1-9953-2044db0173c2", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba356c3-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677856582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856582, "uuid": "e441c486-7823-4123-9f0a-4597551ff543", "comment": "Malware payload (Smoke Loader)", "value": "c1ab7eb88407dce8839e70dabb00f956", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856582, "uuid": "926a8c85-d524-47af-a6e7-2a846b9c5d4a", "comment": "Malware payload (Smoke Loader)", "value": "435a470d314a0aaa8c57936da4855b62cdf7bed157df5966aafb49013005663e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856582, "uuid": "7bcc34ff-e262-4909-b181-879eded713b7", "comment": "Malware payload (Smoke Loader)", "value": "c41ce2841f7486ed66a2bd519c7885dacec3eb2b", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856582, "uuid": "4dc12bab-716b-4933-9357-b2a5bde5f7df", "comment": "Malware payload (Smoke Loader)", "value": "3e397b990fdedcb98266c5d58a0e8daf0a994fa5d0434fd6bcdc92d4a464b19f50aac3eaaebde517385144d313a5bca2", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856582, "uuid": "a834f70f-d4cf-4456-baa2-d9044a575e2d", "value": "T1E644D021FAE3D072D05B45748910CBB0EA7DB87165A58A9F33701BBF6E30291937A736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856582, "uuid": "85ae60c9-d1b2-4cf6-a272-45ea0d8c7002", "value": "b9edfa94b36ce86a0bd61e719fe30fb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856582, "uuid": "6059d5c5-3218-4bd7-ab34-4762bd81c295", "value": "3072:00GaurLUZ6SZ50F/a6H5HO4gOGc/m3+J/5SXb79l+1apuHYvm1wEDnUcR:/urLu6SZIPZOFFB7oaE3P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856582, "uuid": "7ce67059-57f9-448e-9188-be4ede052e17", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856582, "uuid": "a2ac3cdf-1591-4d9c-a593-cfd347eee2b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856582, "uuid": "b334800c-7816-4323-bdba-5d39db575917", "value": "c1ab7eb88407dce8839e70dabb00f956.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12868e9-b9fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677873530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873530, "uuid": "c379443b-c026-4368-b100-d9a936d87c4a", "comment": "Malware payload (Mirai)", "value": "4d0e42cfe9efa5210d6b6403d3efc2b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873530, "uuid": "0a1e0975-899d-4b9b-b018-427e971351b8", "comment": "Malware payload (Mirai)", "value": "4374fe1614dd01cd0390a754468ada3ed1df9225b950c7e86f230cd693890910", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873530, "uuid": "155d0db5-a369-47cb-8cf0-97918fedb368", "comment": "Malware payload (Mirai)", "value": "de74f975ba75b4df44cb753e9d3fa4abe89b2f06", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873530, "uuid": "b0c36cc9-189c-408b-b617-973ef0832760", "comment": "Malware payload (Mirai)", "value": "6feeb38803107eba6b14acf858a76afba71ee9551069bdde0a225a4f796d033bd9828cc269fb5c03aded30ccd52acee1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873530, "uuid": "07de48f4-7f5c-4840-8e5c-c1f840bd5b00", "value": "T1AC03E751BC829A77C2E1137AB6AE4A8D332163E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873530, "uuid": "3ebd54be-3d83-4037-a641-433a4397bb49", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTj/NYwW:svbUG5fPlUlDf4Sycv+PUcjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677873530, "uuid": "9ed4c8cb-ae32-4338-a9d4-dd8dda46179c", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677873530, "uuid": "ffcbd56f-ed9a-4031-bf19-53ddca2bbb28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873530, "uuid": "c3d81979-a616-468c-8243-248be8cb9998", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2265b5-ba0c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677879988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677879988, "uuid": "f11651ea-3f2b-4b9c-b9df-4883c6c5319c", "comment": "Malware payload", "value": "c06e51f31fb6581857671f0e1209405a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677879988, "uuid": "f02973f5-8adc-404e-ab5f-ad3d795da974", "comment": "Malware payload", "value": "47ecc394e301fe59e299d2c915898dd17c072842dd353c18aa743f4746ed60fc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677879988, "uuid": "f5da32d5-1af1-49a3-b30e-144ae97de43f", "comment": "Malware payload", "value": "c57f73af7e00d84cd1a877e4f70430bf830763a9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677879988, "uuid": "2d1c2749-8f03-4f20-95f8-1dc547be8501", "comment": "Malware payload", "value": "180a54d5fea411539fd02e59728429a9f500533a7f64c21b82a082801c525e18e87a593686b83aa9e5de2f0525253ac0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677879988, "uuid": "40f70e41-4447-41a4-9837-822262eb04f1", "value": "T11F962316A393C522D51C027BF869FE0F1579BE73573011E3BAE93D6A88F0CC161B9A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677879988, "uuid": "3aa3d707-bc8e-4880-8dcf-0ceba1b7bbcd", "value": "98304:67BbUHj+xHKAWit+7lJ4ULGx8teWQZ4DMpCjCN9E0VKQ1DLApVBmTKkRdlGYbQxv:MyM3ZGoULJLD5jG9zjLApbk/lGfxWqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677879988, "uuid": "822515ee-b1e3-4767-bb19-de958fcc9e13", "value": 9349632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677879988, "uuid": "7e046da1-fbe8-481e-b305-0e8622566976", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677879988, "uuid": "d4f70d4d-4108-4d34-b0a2-9a5971f4ea9a", "value": "rPedido-Danfe-03-03-202316872pnlc.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd872640-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677861579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861579, "uuid": "15f68140-3833-42fa-a2a3-95f1373135dd", "comment": "Malware payload (Smoke Loader)", "value": "ce9d39a4a2a02eba448d7dd7fdaced5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861579, "uuid": "95744e60-aefa-4aa2-823f-81a24a490054", "comment": "Malware payload (Smoke Loader)", "value": "4905b4d5fbc724025fa4c1820861b3f3edd68162d53a1086e27b4bbbba8e20d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861579, "uuid": "f73080e7-318b-4706-93a9-56fcde41f6e9", "comment": "Malware payload (Smoke Loader)", "value": "51fe5e316ecf980b568cd16103ff9772a22d9c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861579, "uuid": "07ded28d-066c-4f81-b167-eb26099e4289", "comment": "Malware payload (Smoke Loader)", "value": "9033fd85f35a89fe4b46dc5855a9d7aa8eaffe7bd723d4d196e28e99e8b02638f4fa810b638b98fce4b084722f9a433a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861579, "uuid": "da315dfa-7fe5-4aa0-8828-e2b12ce0d0b6", "value": "T19024BE3172D0DC32C0721931CE71D6F5163ABC62697459AB37583B2E4EB82D18A7E72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861579, "uuid": "0dc0699c-76d8-4e72-ac4e-9ea0d01dc7c0", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861579, "uuid": "007943bf-a71b-47d1-a8ad-dee712d270cc", "value": "3072:k4CTMrb5Ucr2cf0zT6moBrHLMiPqyF+zJ9bc1jAXPSQ:5iMBUy2cf0zTeMiPqG+z7b2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861579, "uuid": "404d60d0-e398-4c68-9b25-859027afbd06", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861579, "uuid": "00f51dda-b7ea-481d-a4ad-58ef821af768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861579, "uuid": "65fb8179-e091-499a-a3f8-787204c0e3bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a1e6ef-b9fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677873021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873021, "uuid": "b3ee9cec-1479-45cd-bd9b-3dd89251e234", "comment": "Malware payload (RedLineStealer)", "value": "37f8a5b5d9dbc7759a77ec351a73d4a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873021, "uuid": "bb83fd30-7dfb-4964-9aef-b533aff54c3f", "comment": "Malware payload (RedLineStealer)", "value": "491fdf6941f894f71352b376c33e5eebaa79ccb1a0335338bffd52f457b1f796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873021, "uuid": "a95598b2-f458-4f84-99a4-8efab18cdaa6", "comment": "Malware payload (RedLineStealer)", "value": "b279810111071895b2b6d763302a299c6d317474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873021, "uuid": "5bb6e7b7-6671-4488-8bda-04735d090760", "comment": "Malware payload (RedLineStealer)", "value": "8c1357fdffada252b575c09e093d083c86e4ab1b093b72466a15a01235d9b54b512d53966c398908e3f7a53968c166d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873021, "uuid": "c91b3555-c86b-4ac6-866f-d18a3e7d134f", "value": "T1BE9441A3BEC0E464D4A4D9795E925E3CC44C0196787617DF22E832B870D33641FDAEAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873021, "uuid": "1dd7396e-383d-401a-91a8-86b93a48bc0c", "value": "60e548caf08a49b383f95d28d5b1adf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873021, "uuid": "259b8d84-7b58-4aec-92c9-3b55e3003e78", "value": "6144:3IN9yjI5yE23d3zq5FQ6woKdHjWcjfjSjDj6s9aOWSbRjKjKj4jbjrW6zE4y9jUM:3IN9pyRNzLm9MRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677873021, "uuid": "480beac8-310f-4094-b533-76127f7623a3", "value": 428008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677873021, "uuid": "a17ea16b-07fc-4fac-acde-9f6bd1aaeb30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873021, "uuid": "cf556240-dadf-473f-bc72-acc1fdb2ba63", "value": "37f8a5b5d9dbc7759a77ec351a73d4a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19abc8c9-b9e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677862055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862055, "uuid": "26467c78-4f4b-4636-bfef-c0fcdcc8d37b", "comment": "Malware payload (RecordBreaker)", "value": "3c34bd43d5a2d008c982a47480291f84", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "goldsoftware.vip", "colour": "#C7DDE8", "exportable": true, "hide_tag": false }, { "name": "pass=goldsoftware", "colour": "#0FF04D", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862055, "uuid": "ba21aef1-1cf1-4e75-9c0e-1f58fc3dc23a", "comment": "Malware payload (RecordBreaker)", "value": "4a0dcfc37ebb6c6cdd848ef96e8bd5079b256d0b869f2398bb5246e0c7bac569", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "goldsoftware.vip", "colour": "#C7DDE8", "exportable": true, "hide_tag": false }, { "name": "pass=goldsoftware", "colour": "#0FF04D", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862055, "uuid": "85a140af-9aaa-412b-a3ce-785d54423e41", "comment": "Malware payload (RecordBreaker)", "value": "0b0114a91a4a21e5ad4263bdd7469275915c330c", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "goldsoftware.vip", "colour": "#C7DDE8", "exportable": true, "hide_tag": false }, { "name": "pass=goldsoftware", "colour": "#0FF04D", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862055, "uuid": "1750d6b8-7bfa-45a1-8b4e-875b67aba110", "comment": "Malware payload (RecordBreaker)", "value": "72b6127ac9d5096f01e2e80270fd7bd1c01e94301740c45a24b9f5f8034efd38e4c77963f7dc8298384095ea58c44368", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "goldsoftware.vip", "colour": "#C7DDE8", "exportable": true, "hide_tag": false }, { "name": "pass=goldsoftware", "colour": "#0FF04D", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862055, "uuid": "2eec6d17-24e7-4e52-b065-d6562470dad6", "value": "T15C863353206F50B8C8F2E23BA4D51E2ED6761AF04C66A91FA392C0C54D87D25FD8A71F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862055, "uuid": "2553922c-a77d-474e-8675-40073e3c9903", "value": "98304:oDz54od2jOfPpOOSYWXYllUfbkMK0uXP+9y2C6wik0i+STKI4jDWPfclg3/bP7i:ocOSGLhW9e6wJ+SV4jSfzPbji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677862055, "uuid": "783f1107-220b-413f-9a76-c2b93e1df7d3", "value": 7849726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677862055, "uuid": "288fa038-e045-40d9-9e76-405c6b7451ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862055, "uuid": "af6d5f2a-5e50-4d15-b194-90a3c1526a81", "value": "setupsoftapp (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9823d4ce-b9ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677853248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853248, "uuid": "083af275-b837-4748-8585-a57f3d06ae41", "comment": "Malware payload (AgentTesla)", "value": "4411c71967c0d903d5b1cb888f55ccce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853248, "uuid": "191ae546-b4f5-46e9-8259-86d8d02e0c8b", "comment": "Malware payload (AgentTesla)", "value": "4c43fc57a4a6eb2322da7dd45c871873648a4cafb4c5bebd1390a895006e104b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853248, "uuid": "838e92f2-2c84-4efa-8fcc-866ec5544313", "comment": "Malware payload (AgentTesla)", "value": "9d538e9cffc2025da619af1efd461633166d0ecc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853248, "uuid": "2df62d25-14cc-484f-b799-62d51527d585", "comment": "Malware payload (AgentTesla)", "value": "6db5f37be9388576316461711cba69477793b0c7481c4a48f9d4fb0079994f2f36536a530ef2347d282ef30fcd7b4263", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853248, "uuid": "79618876-59c2-4fff-908f-ffcbaf2337d4", "value": "T1DFD41205529E537AC6F89FB728B874A21375332E7402E38F1D4A39D9192BB060591BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853248, "uuid": "3df5c316-80cc-4e88-a913-0c5b90e92b50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853248, "uuid": "4abf83ff-6e17-40eb-a1d7-3fd53a5ed993", "value": "12288:oFFZ6AnZ63nbpNHOv5F4nURceN2DA+WGJdKNGCjBhbNgF1XeWG:K6YQ3nbbHOZOekfJdSTBgbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853248, "uuid": "d952e9ed-353b-4ee2-9108-83d4f72f94c4", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853248, "uuid": "712ba2ea-13de-4709-b9ac-2afdc8eafeda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853248, "uuid": "36e833f7-8581-41f2-bf37-e55dd8ace94c", "value": "4c43fc57a4a6eb2322da7dd45c871873648a4cafb4c5bebd1390a895006e104b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8d2de1-b9e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677862949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862949, "uuid": "48d55a63-5cee-4db7-9db0-85d35fad2d63", "comment": "Malware payload (RedLineStealer)", "value": "a290c51cbdf310530898ba69a430e0f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862949, "uuid": "276fca9e-2021-4d96-85f5-7e3bb321368e", "comment": "Malware payload (RedLineStealer)", "value": "4c5004484ceebcbe45581f63810177bb1a008c4fdf33a57c173757a183d2477c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862949, "uuid": "78ae84de-5507-46b5-a5bf-f076fb7e059b", "comment": "Malware payload (RedLineStealer)", "value": "e9a2da4b426be3fa8f5b83194e67ee5ab36814ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677862949, "uuid": "c7d6c05e-6de0-4a75-8e42-31a8fbe1c098", "comment": "Malware payload (RedLineStealer)", "value": "75c4be694460ae698255223ce9a67fc816631f3595277f32de7d47588d9a0f20838295ca15c4565cf5c72bbc6f74e1bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862949, "uuid": "d3253fca-cb91-453a-9a48-f66265ad87cb", "value": "T1B7151347ABDCC032E8B94770A8F242C3253ABD606B7CC35A268F5D5D1C735A4A93176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862949, "uuid": "329abc0b-55a0-4348-8662-df88da5cf3ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862949, "uuid": "8d64cce7-5cc4-40a7-b9a4-22c56cca71b8", "value": "12288:dMrpy90/GKkOllxfF6NbYbFz1LZMC0xQvCx4G7hlrLlgxxwqKPGzqbrw:YyYkOJfFvDuU6T7vH+xiGz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677862949, "uuid": "289e6421-4ebb-4738-9826-c04571f4cb3a", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677862949, "uuid": "ff947956-c759-4444-8b2d-a98ccce04b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677862949, "uuid": "11215c81-e163-464d-b9be-278f5397ccea", "value": "a290c51cbdf310530898ba69a430e0f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567a6581-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677857433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857433, "uuid": "44314b09-3e4e-4081-98c1-4b56a07af0ac", "comment": "Malware payload (RedLineStealer)", "value": "8c2506fef155bd72ee5100610aebc9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857433, "uuid": "6fc201c6-93db-4a8c-874b-ba7181c478ea", "comment": "Malware payload (RedLineStealer)", "value": "4dc27dc6049bc102a6dd9ea4c12cc26a31d53655d702ee69a001d794e8008e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857433, "uuid": "268f0fee-c8c0-4ffb-b144-2ac9353b8694", "comment": "Malware payload (RedLineStealer)", "value": "13067fec38a031c3eb365e96a797768c1249bf96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857433, "uuid": "8df1417a-f8ef-4ea0-9ed4-9369d0922723", "comment": "Malware payload (RedLineStealer)", "value": "ceadf91c8bc9b21b4a05f596317f011695b560a0c40b12baf3ac999f437cccc1083140cf02a65f650e2e0c048362d53d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857433, "uuid": "33207de3-77f3-43d1-b8e3-12e687ee01a0", "value": "T16E446D32A3E07C50D5224E32DE1AB6E46A1DFD528D27F65B2E38FB1F09B21E1C166711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857433, "uuid": "e2b1a8d4-66a1-47e3-ad7e-fd109e9ffe93", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857433, "uuid": "74145864-a8cb-4125-894a-645b8d52cbbf", "value": "3072:e4C5oq7lwHUZZu0Po6gtmNqs8OGWHGij/Moxr0KSlkMsg67IaOqcnD53pjAXPSQo:D4ocuU7u0Po6gRw7HGQCmOqcDzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857433, "uuid": "c3bca62e-bc2f-49ee-ae74-380fd79db1ae", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857433, "uuid": "2d0a994d-f305-4ba1-99e5-2feae1f67cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857433, "uuid": "376d281f-ad91-401b-a0b4-498b0db65308", "value": "4dc27dc6049bc102a6dd9ea4c12cc26a31d53655d702e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210dff0e-b9bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677846606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846606, "uuid": "bd7cbe55-1209-4d3e-b69b-1a79fb684980", "comment": "Malware payload (GuLoader)", "value": "66b459ed28736f8ecbe87f2f099eff55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846606, "uuid": "42bd4807-8a4b-4585-90bd-99553cf0c77b", "comment": "Malware payload (GuLoader)", "value": "50601c3a8746f3e1fd01cdddfbba82a1888ea6a36c1242c55dcacf2128183f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846606, "uuid": "bfa0a082-0680-457b-aed6-37106a85651a", "comment": "Malware payload (GuLoader)", "value": "54da3c5e67817d958cf769ca21d3653628ff09ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846606, "uuid": "531300f2-cf84-44a3-8a2a-4c2fcde0e340", "comment": "Malware payload (GuLoader)", "value": "3b6c8fddfbdc278c38056561d3b0e8c5a15acd56f6e67c010e2f2f0a4ee598b8004bd811c16ab8629be56db4fa9ee594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846606, "uuid": "c6bf5eb8-7666-4efc-a2f5-e368c10d9c88", "value": "T1B454230152F060F7E6D60A7110F66272B2B59BC102266FCFDB841AB93F709D9DB136B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846606, "uuid": "d964f3ec-9214-4469-bfe1-1d36e2959287", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846606, "uuid": "f7b9af79-5e95-4bee-a5a2-72fab48e4aa3", "value": "6144:nzAJ6+JpEuhPK47/U5h8sMdSQoOYaYPK2dLR/FX4tgqksCW6CaZW:zLGzhPKedsMSBi2//FIMPW6CaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677846606, "uuid": "b3f89e0f-f6ed-4061-ab1b-cd0208405203", "value": 284432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677846606, "uuid": "775b5fc8-647f-4651-81e2-868510abb8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846606, "uuid": "a596ed13-d0dd-4983-902b-4b8eed7da889", "value": "50601c3a8746f3e1fd01cdddfbba82a1888ea6a36c1242c55dcacf2128183f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cbe9ad-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857007, "uuid": "5d404499-bbb1-4f0c-a248-1b70f3a1a30b", "comment": "Malware payload", "value": "d5e78c598c5cd83e6b82896dcabd665e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857007, "uuid": "938569af-5d08-4983-bd8e-da47b7b31ebc", "comment": "Malware payload", "value": "5168f3064a0f58965109c158f0c6030b0c755064ab8f1462a611997da0e6730a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857007, "uuid": "f2910440-ee7d-4afe-9f7d-48b8ae2d7b60", "comment": "Malware payload", "value": "24877b354e0378bf350ddab24006e6a02773e2ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857007, "uuid": "17830724-b143-4cf1-ae40-51fb1e239bbb", "comment": "Malware payload", "value": "f06feb2a251b0e69e9d19d476a59dc08e90a830040f21403b4011a5f5afdd423e5326e3ca02dfd961615d430f503094c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857007, "uuid": "92b4457b-69d4-4fcb-a1c9-2c73366ca95f", "value": "T1D9746C84A5A80F26DAA4C44740FF5F3B47C4E745293CC89F65770B6FDE33A692D2608A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857007, "uuid": "29de52ed-a9d5-4ee7-88c6-b202fb1f9e50", "value": "6144:GQqCe7DlgnirYAym5NCl1Z+qvjdg7EKHWg2xlI6ClynjXWHm4DihNDMhWxe4RveG:NzU8nZ+uLlI6937/DclsRtktXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857007, "uuid": "b7042ad0-10bd-4577-8bc4-bf7405b737b5", "value": 365541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857007, "uuid": "eebfd13b-33ed-40ab-a4b6-4ffe56950316", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857007, "uuid": "3189de24-13f6-4201-ba17-c4b3f932fe88", "value": "swift _ copy168678689699.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bec7e3b-b9c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677849630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849630, "uuid": "a17931f8-4cf0-4cc6-a070-b53ae6aa7aef", "comment": "Malware payload (Amadey)", "value": "6e01cd91b0d50f7e2fad397b9f5e4709", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849630, "uuid": "fdf2497a-f007-476e-a3e8-1754c224009d", "comment": "Malware payload (Amadey)", "value": "51cfa3ac99a6a3e2fd9060c5c969147ea0dc2d6f541f020aa7724b09e0471821", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849630, "uuid": "44728aa5-4cd0-4ff0-b0f3-8b61cad77710", "comment": "Malware payload (Amadey)", "value": "24287ab1a3289793f2ebd9b10dbe47d2d82bd865", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849630, "uuid": "19a53b76-fdc2-4d68-bad4-307e92712671", "comment": "Malware payload (Amadey)", "value": "7849618d44238b732e7f833059d47e827eab24a5225553f4d86b9a58087ac7336828db1f39b861ab4a854942342731a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849630, "uuid": "811107bd-3c73-42a0-87c6-447ee52c19d9", "value": "T16315120BF7F45122DDF4677009FA43C3063A7EA25B748267234E58591EB32A8A67533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849630, "uuid": "23e9ea8a-4fbb-4457-ac49-02558e92e33f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849630, "uuid": "c685b84f-d83f-4415-b60d-0ebda4aa003a", "value": "24576:Byb6B2vN5++Wnc5yb7wP63Fg/LHkwZcoAgQ:0b6A++Wc5fLTcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677849630, "uuid": "9ea1659b-c56b-4761-a780-1fde24bb8cae", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677849630, "uuid": "ccd7e09a-214c-47c6-a01f-87e68dfa1975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849630, "uuid": "4289e026-3747-4293-b41a-5b5ac8383866", "value": "51cfa3ac99a6a3e2fd9060c5c969147ea0dc2d6f541f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce6683e-ba1e-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1677887723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677887723, "uuid": "eb8d92e8-af28-4efa-85eb-23c5d2970f82", "comment": "Malware payload (QuasarRAT)", "value": "50f2dfefc6799c96c91a7853be63112a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677887723, "uuid": "adadb9a4-b9d1-40ae-8622-40556bcd43eb", "comment": "Malware payload (QuasarRAT)", "value": "524495565677c98b45b2ef59fbdf50c6d21183645129da4965aa2099bc35b6d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677887723, "uuid": "f5a6bb06-0782-46c6-ab4c-eeab5c46b751", "comment": "Malware payload (QuasarRAT)", "value": "56e32b2fae8e2275f34a1c5b3f825c370e05459d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677887723, "uuid": "c28ec254-5c30-4ac8-a054-9a85390a05ab", "comment": "Malware payload (QuasarRAT)", "value": "de56de34daec1c2f3652d00b19c0058da1292225763677e100344016c61aff6edb0f9b61aa2308d041997e99e232103e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677887723, "uuid": "47a59dd7-a4bd-45d5-a319-d69533c49de3", "value": "T1DAF66CD67BCA35C0B0B99911456BBD1E5B6231B37D18AF4BAC0B77D3A86339184E3807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677887723, "uuid": "7a2bc8a0-db95-4f11-a52b-e70f79e002aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677887723, "uuid": "af951c0f-a9cd-4973-8d67-01e40c60ca97", "value": "49152:l6vl+Isi0mBD6p+vrQtM55YGaxJXI3Vk62qzkIuSmeHxxqIKzFbEku5zyQfy+hHV:lUsixBDk+vrQtO50raKJqoIBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677887723, "uuid": "11bd86e4-0ead-4982-bba6-a6684dbd5a45", "value": 16001024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677887723, "uuid": "884aeb0f-bba0-4260-b6d0-bb8d0d1d6c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677887723, "uuid": "7e4a5d0e-0065-4a59-94cb-5a343d1e9a88", "value": "50f2dfefc6799c96c91a7853be63112a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58eba88-b9a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677835715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835715, "uuid": "a8423340-be48-4aaa-9e75-54ac6b65412a", "comment": "Malware payload (AgentTesla)", "value": "350567ab240febc4416cd11db97e5ad8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835715, "uuid": "474d7e8f-a1c7-45e6-a840-7710cf1f702f", "comment": "Malware payload (AgentTesla)", "value": "52a4252298baab6458b9f6962769eafc8352d9828cd218493f38fa6c25cb7e90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835715, "uuid": "f3dd1262-42d2-4df4-9a74-c2ed323a4dcb", "comment": "Malware payload (AgentTesla)", "value": "4dbc7ab5e14ca287f85eb5863bf167f3fb87e3f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835715, "uuid": "0a70c2e1-51b5-43ea-9c19-68a8238613b8", "comment": "Malware payload (AgentTesla)", "value": "1e187d32fc4cb37495fabb9b38a7e6a83112212bba00d6c1c42516c5aed073ec6b477a6118735b42291544e77841c66b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835715, "uuid": "c3146b61-8650-4708-b1ea-36a5fa0114b4", "value": "T1A115F03A31ABC927D3990A72E4D68104D3F6894BE953EA4BF44A63C15D433EFE9052D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835715, "uuid": "4bd719a9-a367-47c4-8e09-21337203d364", "value": "12288:rSiThPgTQzemWqbycg4uvOcj2DMLr2+cB/1KSemqe4lcC22X7Zbq2zAVs6ezsOAk:taT5/+A32D8rSB/1bN4fDMxwsHHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677835715, "uuid": "fae25bd6-1fdd-4015-b594-bf6a50569f09", "value": 946248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677835715, "uuid": "85f621cf-7af9-483b-8881-f2aa37020870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835715, "uuid": "7c6ac6d9-0e6a-49dd-9d35-ec774e16d9bd", "value": "ANGEBOTSANFRAGE #0303202300_PDF_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1564d20-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677857263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857263, "uuid": "32e6fa71-b830-4bef-9ed0-98cb054c4828", "comment": "Malware payload (Rhadamanthys)", "value": "c9eb73319d636cbe1946a1a27a9247c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857263, "uuid": "1f8e86b0-a3a3-4883-8553-889317008d9a", "comment": "Malware payload (Rhadamanthys)", "value": "530be38cf0d967ecc5d8fd081bae4a790b653661f8247a7f5bd6b33784314aac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857263, "uuid": "5c75e151-02e4-47c4-96bb-124908aa799c", "comment": "Malware payload (Rhadamanthys)", "value": "e79f2c11071f59a166d82d7f952cc20f60e5c6e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857263, "uuid": "07d2d863-ed8f-4e0e-b2f0-f14921635ecb", "comment": "Malware payload (Rhadamanthys)", "value": "b83820138fdf9929d0298cabc16ecc772d8f7864519804e5620650d16d14894ed6e6a2c2c3688f1f1cc68ed766fdbc98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857263, "uuid": "1019a8ce-8140-49dd-a477-58b519f3694a", "value": "T19A44B03272E0A831E1725E315D39D2B46F2EBD525E2867AB3234EA2F4D712E1D572702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857263, "uuid": "677b5bef-69b0-4d6c-81b4-e61760955576", "value": "bc78aef2c4ad84e722343217c31a9a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857263, "uuid": "7c289607-6e7a-4c54-a429-28a4b248ee57", "value": "6144:rLPVKyptMdve3nOd7RHuY3vugheoqV+BN7iHBOg0:rLPVKyodve3nO7JucW87it", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857263, "uuid": "2cd6fb82-fd54-40e9-bfc5-2acdb3d6ee8a", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857263, "uuid": "b2164888-360c-407a-80d5-2f2d15d99022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857263, "uuid": "629e56e4-a232-47f4-8da7-96db5209dfeb", "value": "c9eb73319d636cbe1946a1a27a9247c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403390ba-b9c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677848376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848376, "uuid": "509e295b-d17a-4095-825c-ddde21254026", "comment": "Malware payload (Mirai)", "value": "4faf9979412880f92078763d274ca8f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848376, "uuid": "e6cd0445-f65e-4a74-bbab-2267b7b65b65", "comment": "Malware payload (Mirai)", "value": "5344e514540b068771bf63891defa7f459a38ab11b0fe311a3224c0c123f8a91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848376, "uuid": "01937607-944b-4fc6-9c71-d2ace6751469", "comment": "Malware payload (Mirai)", "value": "e4c2b818d7ac4f14433f460b234fc926b6e15982", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848376, "uuid": "61161c3b-a71a-4d3d-b826-4113d643e005", "comment": "Malware payload (Mirai)", "value": "b4813f5e79fc49d1accd1e5e30a55e096c8846405eacf6be06b7f25862b0eb5cc36714a887a44408431b9d28478466fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848376, "uuid": "9b06c6bc-2226-4779-9049-00703751ca26", "value": "T18B633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848376, "uuid": "2e844505-0009-4bb1-8f21-02e2a9e8438b", "value": "1536:lGRaTYmol/hGIAs4PNvAOQjGm75123tSt0l:lya7hJyGmVDKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677848376, "uuid": "323cd1dc-e5b8-4d77-8a55-b32b2d2a71e2", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677848376, "uuid": "5dbb3d0b-7daa-4514-a911-1416a48f0263", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848376, "uuid": "cbde5bbd-8b64-4821-8c6c-60360ba72d56", "value": "4faf9979412880f92078763d274ca8f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e75bae-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677830127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830127, "uuid": "18ed8325-dc9a-440f-a49a-06415ebb5fb8", "comment": "Malware payload (Amadey)", "value": "64b99ce5678821fc59c17cdf74dabf0d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830127, "uuid": "f8ae1559-7eba-4f86-806f-0b3b3a44991c", "comment": "Malware payload (Amadey)", "value": "53568378a6716cf8b784eb4b9110a1c3c7b1c86c77309fc231691f66bf50c3ee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830127, "uuid": "0241def7-96fa-4a93-a415-8fb4979ea815", "comment": "Malware payload (Amadey)", "value": "7abc83396eeeab0cca22d97aa7fe18389cd87f3d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830127, "uuid": "80049fbb-1e01-4252-82a2-8dcdfa33b79d", "comment": "Malware payload (Amadey)", "value": "4f8f9e0ac8085817f282227c0aa41e37fabdf99759e3535762bec6e7241ff9b73af01374a5ad5ae19183a2f5956ebbb6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830127, "uuid": "3bb40fdf-7f91-4fa0-be3f-53ccee85c5a6", "value": "T17E149E3272A0A820E5734F319D29D6E46F2EFC735A68569B3274EB2F4DB01E1C572712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830127, "uuid": "2699c9b6-afb9-4f7e-808a-388c865742d9", "value": "bc78aef2c4ad84e722343217c31a9a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830127, "uuid": "899a67f4-1cd9-4b81-8a40-cd56511de1d1", "value": "3072:VjzLurzUqmKThRRXn6Hd91yNZtXNdSERMWEmay2W1caX5k57u3:1Pur3mKTfRXu9gZt3JbEPNGO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677830127, "uuid": "dafc7edf-6933-4f5e-a620-baffa9c086b3", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677830127, "uuid": "22502a6d-392e-4d17-b646-0676d8704712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830127, "uuid": "7b5229e3-0d6b-4143-b359-4b2639a24dd6", "value": "64b99ce5678821fc59c17cdf74dabf0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa011419-ba04-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677876605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876605, "uuid": "91c4eea9-1f84-4df5-a805-428419008f50", "comment": "Malware payload (Mirai)", "value": "72381b5b5a9cf0f34d3bd9485c46461f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876605, "uuid": "7f70b28d-e557-4e8d-8acd-2c336e057a29", "comment": "Malware payload (Mirai)", "value": "54ae9b9755c96c07c41c7bc09b092da0917e664b1619f98a36047d52fc7de161", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876605, "uuid": "53a337f5-fc38-41ed-92b2-378674a3edba", "comment": "Malware payload (Mirai)", "value": "57284a90eba7b58cd1ff78082988f6c804ae6829", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876605, "uuid": "3d5ad953-1e8c-4628-9102-d7f05529e645", "comment": "Malware payload (Mirai)", "value": "16ff2037d265fe60029cf696c136582d1a4eb307d57b8c7469ef89c2d5cb4f24a4a37146cc44c1aa286a825fc7433e1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876605, "uuid": "f6cfb157-168e-4291-b5c4-0c656e887601", "value": "T103230271840E9EB124303D72DED9D793B6E12AB1C6673023D6290A382FA56531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876605, "uuid": "a485d8ad-cfd4-4f92-9235-bb0e8906882a", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3Z9q3UELbUXfi6nVMQHI4vcGpvx:gECFd+A6YHAxMLRQZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677876605, "uuid": "5b4309cd-2148-4b75-b316-57e77de5162a", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677876605, "uuid": "e1059d12-754b-4d7d-9f2b-ed061cfa8230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876605, "uuid": "71d7c988-75ee-47e3-a379-c0f9d4923cab", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe53e26-b9d5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677856053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856053, "uuid": "6d8b114e-964e-452a-8d19-392d9119858f", "comment": "Malware payload", "value": "ec7f50965cb1452b6401a51f7d763655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856053, "uuid": "80ae2977-b80d-48d6-b3ff-f9311870e147", "comment": "Malware payload", "value": "557617d88ada1bd861262710042a6e63df42e5a8d4874470aabe143327abdcab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856053, "uuid": "2fe32323-fc47-44e2-9b2e-e1302de0917a", "comment": "Malware payload", "value": "c936b6a86b76160520b2ca0bf33edd0f766b2476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856053, "uuid": "f29fdfbb-5c2e-4e5f-9be5-8261030e982b", "comment": "Malware payload", "value": "86cf964d48c44cd5e78af69053136c2c10bb993c2b8118ddba6020a6f6a7698769b59e015c9eb029f2ac36ec5348dc1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856053, "uuid": "c4356e1d-a6a7-4855-9334-fc50d2554a64", "value": "T1DD35BF11B4D0C472E4B215320AE8EB755E7EB9200B6659EF6BE40F6E4F343C1DB31A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856053, "uuid": "d5102ea9-8f39-4cdb-b3c9-155853ddc9a5", "value": "0557b2303713417ae37d446b478fb9b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856053, "uuid": "54232909-0993-4467-b50e-7c3fe23325b7", "value": "6144:TAr+rCRf455FrkSaTSfzd8KakA8AOTYbRuL62wKGVbfE4C:ARfSFAScIGtuLbwKGGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856053, "uuid": "f0148a20-077b-4477-af2f-1bc3990db630", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856053, "uuid": "d12f30c3-040c-43b7-a6b1-86a42b7e0404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856053, "uuid": "3a2126f5-8e9c-4d50-98cf-ce22475aee5d", "value": "ec7f50965cb1452b6401a51f7d763655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cabb802-b961-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677806387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806387, "uuid": "013eafc1-9adf-467c-8f97-b1d803cfe7cf", "comment": "Malware payload (njrat)", "value": "337e0c4d3773d6143c3a4bc8bf3ab7f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806387, "uuid": "e122e034-5822-4538-a19c-2cad13bc7c3a", "comment": "Malware payload (njrat)", "value": "562715e04723d243f2655243ce07accadcc3fc89ad9267f40564865cc6f3e168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806387, "uuid": "6aa3625a-c375-483f-bbbd-889ee91712b5", "comment": "Malware payload (njrat)", "value": "2e8b275a3b68f94d69913f8cd4fd4ee085fbbaaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806387, "uuid": "f6a4b2e3-c01b-46a7-b475-5728596cf187", "comment": "Malware payload (njrat)", "value": "790af0dc8941d3aab600dad927ed72079fc6403c6a7ec29f23afa98ee5881459da7b2512835760f3011b8474ed964929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806387, "uuid": "614a211f-2d0f-4235-85c7-a9135cf1df7a", "value": "T13FF5BF38A201493BD03E17755D6B937862FD7904217E7B47B38819EAEEF7394A2A4343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806387, "uuid": "6be6571d-a0b0-4961-8f82-4bb7899a2d7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806387, "uuid": "626d34dc-7ae9-4d31-af0a-c2fcf1959c7f", "value": "49152:lEcCQBd3lZsTxIRd5sD96eRPVdBhlnlg5I5Eof9b5iM9:lRCQzT4IM0yThlg5I5r/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677806387, "uuid": "0345e37e-cab8-4f36-900b-b40fcaa8a1ae", "value": 3604480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677806387, "uuid": "1df18c9c-aeda-4146-a9c3-e34ae7c19e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806387, "uuid": "8bd48431-bcb5-4744-84ad-7fb316e788ab", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37369753-b961-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677806270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806270, "uuid": "972ab24a-b678-4418-baf9-9362d6dd5b7b", "comment": "Malware payload (Rhadamanthys)", "value": "c05d093d1274562a0fa00e0b2c8bea5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806270, "uuid": "fa8d0e75-8734-458e-a67d-871a65f8e9fc", "comment": "Malware payload (Rhadamanthys)", "value": "576f2b2a8d4adb743a7e9d7c163e37411b2a5ca25011156df57d3cf54a0a7e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806270, "uuid": "a6f30111-e812-4c11-8ec2-713824122ad4", "comment": "Malware payload (Rhadamanthys)", "value": "e91b1526bb9ad0d80a785de7423baab366d5480e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806270, "uuid": "fe896b7c-9481-447a-81a8-073b7702f864", "comment": "Malware payload (Rhadamanthys)", "value": "8c99898f5eaf109f66ec34e02e1b4345cf925ee1fb9bbd7a42982c3e03d9e0243b90fe6e71489b6de4504a08f486f99c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806270, "uuid": "ff5b807b-2f50-49be-a598-0df5061cc1ab", "value": "T1EFB58CF08F51FE41D7AF1EA480EC18906C6C5B5B9BA98648BCC85492D6E1B50FFDC272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806270, "uuid": "4348a4ae-8a08-4d19-938a-d010f794c164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806270, "uuid": "897c1228-58d8-4652-90a7-b7da0169a845", "value": "24576:SR7d5Ic2Yc637ccFU/+VxjETkFqW0KbzYKVocc3Sxe31HZsGutdf7D1PGhWgOpBJ:wjIcK6hUSfchcHH1PEABhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677806270, "uuid": "89363fa8-d0a9-42d4-9623-8fd12d550c82", "value": 2439680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677806270, "uuid": "101b75c1-5e3a-480f-81dc-b5efd1083f6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806270, "uuid": "175f0122-87d8-4eaa-858e-0738af43db5a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c924e7-b995-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677828627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677828627, "uuid": "fa22e40d-2b18-4ca0-b825-4a3c46d0e21c", "comment": "Malware payload (Loki)", "value": "01027098f3feaabdeb2f69398a97099d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677828627, "uuid": "4f416070-8c2f-436d-a395-dc06549201c6", "comment": "Malware payload (Loki)", "value": "5796e0bd3872a4838b8e3a23139c16f456b8006859aedc9a6c7cbaa576969000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677828627, "uuid": "95fd24ba-7412-4216-a791-7db2780ed79d", "comment": "Malware payload (Loki)", "value": "861f7c20fbf5e3061904dd3406184938c28f1c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677828627, "uuid": "89f7da96-6814-4e72-89b3-2335535fe862", "comment": "Malware payload (Loki)", "value": "9b2de64e337294baa32c2fa912c43c3f203808656961aed72ba35036f6a5e1e22935b5327574a52feac7a9658ca487eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677828627, "uuid": "0af4abb6-b220-49d6-b003-5963313b504d", "value": "T1F435652809FD0EF285B1F1FDDFD4E753BE8088E6AA049D9982834B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677828627, "uuid": "f57f86ba-e767-4e9e-a074-b06c920a2821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677828627, "uuid": "7b0df453-e7ac-4082-91a0-47fc35a36de0", "value": "12288:ghiLI/Pdinw7wvoTxpW/wpXnIL7xEf5fPvsY04:/Ind6RvoTxM/wpXIL7uPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677828627, "uuid": "81fae5de-b85c-4339-b0b1-de23032cb74b", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677828627, "uuid": "b536ef76-3721-4be8-bd84-28c2c4fb5753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677828627, "uuid": "7d064259-2151-4cb7-b539-5759e5e55409", "value": "ArN0IVFFHGSg7b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbcc2ca-b9d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1677855620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855620, "uuid": "a7ca0259-15c8-4f1d-8a17-ad890d48d1e8", "comment": "Malware payload (Guildma)", "value": "fc8a93110486d12f71ad878ab02c9fca", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855620, "uuid": "4f55e700-ec23-4328-9d20-228790d25ccf", "comment": "Malware payload (Guildma)", "value": "58282b097633cee955f488c2bbcec620b87f9b74330be22f9db560dd24294cf1", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855620, "uuid": "7b017b37-17db-4477-81e8-70f879cdd2f7", "comment": "Malware payload (Guildma)", "value": "a55b5678f397b7627df07d24fa54f06da185b6b7", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855620, "uuid": "0d7ea3ec-6491-47e5-b92e-c2f4b0f4b421", "comment": "Malware payload (Guildma)", "value": "bd231767d1b8abd51d3d859ee9fd1953b23997672df9dd7ab11066c02a193edb9b525381314f0c4cf6e9d9023ef5b86f", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855620, "uuid": "651659b8-9148-4455-9744-2a163eef4a07", "value": "T13222A989388D481BB1696B280777C80EFB5FC16A5374C3D4F0B51AB5EEBC290E3B5568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855620, "uuid": "8189e636-959c-49e3-8636-fe6d3376e8ac", "value": "192:It2zy0i/19ErOgSsBFyKrE/ZejWCDtuGzHrC:I4zEfht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677855620, "uuid": "ab9e587a-5218-44e9-9cca-476a654b0c99", "value": 10620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677855620, "uuid": "2290c81c-c14c-44bd-8438-c0c977ed70b6", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855620, "uuid": "e1fe254f-41d1-489b-adec-e4b7baf2d873", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689002df-b9ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677839424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839424, "uuid": "299ec249-7238-4230-9ede-6c1f49ba8717", "comment": "Malware payload (RedLineStealer)", "value": "afe5980b74fce3b1b8b4c4c0dcf1eb0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839424, "uuid": "0f146bad-7a75-410b-9b26-317187a77b0e", "comment": "Malware payload (RedLineStealer)", "value": "58cf3176c772441906155e88a40caa990157516f333f8bfd0724c269a7825484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839424, "uuid": "4314acbc-b3e6-41b8-b585-c446bb7e4280", "comment": "Malware payload (RedLineStealer)", "value": "ea8bc29093a2944695ffdc9535bee3150f3e9403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839424, "uuid": "b48fed57-a1a9-47d1-9cd5-bed5c333d718", "comment": "Malware payload (RedLineStealer)", "value": "e4c7ad8b68c32d475c8bdc2635cb68f024b780f2aa15a72d6b2adcff91d5ab93771f95ddc49f1e0e5f676cbcdb815084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839424, "uuid": "20701a77-cbc1-4ddc-a122-14f0f58ffc90", "value": "T18C151207FBFC4421E5746334ADF642C31A36BD605A38835A778A6D4F28B3678A635336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839424, "uuid": "3bf98b80-8899-4a76-9638-0c80f7b4ef57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839424, "uuid": "17979a20-7b44-4ade-8a98-d8b1e95f3ccb", "value": "12288:xMrqy903vRr44oGtAcOzQMaQmUvGnjrWC8+3Oqe0wCZZwA9ZTgxN/P6YiGr:Hy6JztAXzZ3tvGjrWtjCwAPTgxN36YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677839424, "uuid": "b0d1f603-0f59-45c6-a8c3-f6f02c168467", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677839424, "uuid": "c8b414b0-d2a7-49a8-8b04-a8f720e2b86e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839424, "uuid": "63d83980-5e08-442d-9d8b-c8c588291f54", "value": "afe5980b74fce3b1b8b4c4c0dcf1eb0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f775e4a4-b9c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677847824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847824, "uuid": "66935d7d-1945-4dca-b113-1ca67f49647a", "comment": "Malware payload (Amadey)", "value": "7fd1dbd81377a01ec0d825ec15b0174f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847824, "uuid": "1f2ae649-0542-4f68-9009-fa034473f111", "comment": "Malware payload (Amadey)", "value": "5948d44f6db487b7688fa38258fec5bae99e7c2b3e7c5c19c19234831c5842a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847824, "uuid": "c464ff7c-f49e-4901-ad17-b77ed4575fda", "comment": "Malware payload (Amadey)", "value": "052026e7741a772e2b2167cab0ff43f98d3a09fa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847824, "uuid": "e9f689bf-9889-40d5-94b9-f4838cd35544", "comment": "Malware payload (Amadey)", "value": "1431af7833ec698a0e3f48b82c80d1214325788006a999ba35f457b0cd494a050723fbe414bf6aa4153fb0c4051276a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847824, "uuid": "31fcd147-8654-4442-9ebc-eb35438bdb59", "value": "T166151347F7EC4073E8B1677118FB47C3063ABE608A788797638E596909B32689631727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847824, "uuid": "da134482-3cab-456e-928f-a1cf3fc1adb4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847824, "uuid": "4f86552a-cb19-4b57-a73f-d2ab0984a9ab", "value": "24576:yyrx+WUDETa5sWZc9uSd55ptg7H+l32/7Y2:ZriDETOsG0uibvLg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677847824, "uuid": "468c0622-a374-4528-8838-c59fd2b2e059", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677847824, "uuid": "4d0ec7d3-6199-4283-8453-73d90baafc6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847824, "uuid": "183dc5f0-a188-4d63-be53-497091678232", "value": "5948d44f6db487b7688fa38258fec5bae99e7c2b3e7c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89602bbd-b9b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677844204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844204, "uuid": "b011870e-58b4-46a8-9ebd-5f8e83c23bbb", "comment": "Malware payload (Mirai)", "value": "11ee5d8c89dbe24dcd5650491ca92334", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844204, "uuid": "08a3f2dd-abea-464a-8f48-4ea28b2dc52d", "comment": "Malware payload (Mirai)", "value": "59a397e0dfd6c0f95dc719daf96fa5bad30941af010fa5b3a87550e6fbe9999a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844204, "uuid": "01d3a559-e0ce-4806-866c-27f9b0c0c2f6", "comment": "Malware payload (Mirai)", "value": "fe61e947084e0e0a23c06c4dfd189af523924be6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844204, "uuid": "2629b893-1206-44e4-ad15-138bef03b37e", "comment": "Malware payload (Mirai)", "value": "3331737e7640793c637201aff4b26f34eaa84a4dad20de9a0892e6a4b01f4f72af0f9aef56ae4c7493715eeb66f337ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844204, "uuid": "0e253eb2-a678-4f3c-a415-f51661a5e73a", "value": "T117C32B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844204, "uuid": "5e28b7ab-7424-48e2-bde1-afdd578a857a", "value": "3072:5QK3qOASqKUUoev+YPaOS6cMs+EuNM/9oE:5QK3JjUUoevbCOMl+E4M/9oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677844204, "uuid": "ee014077-b0c4-4a5f-b6c6-e4d7e9e379d9", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677844204, "uuid": "04c3ca27-e74c-4e83-bcec-9896a31eb381", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844204, "uuid": "ec39df16-5036-4869-8d53-dcf123538bd8", "value": "arm7-20230303-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53c5d41-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677830131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830131, "uuid": "0379622a-e124-4e99-8d8d-d2e1590821a4", "comment": "Malware payload (Amadey)", "value": "e6e68c169e5c0d75789adbf11a586f52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830131, "uuid": "a5eafcfe-f9c7-4d76-937a-b235f7713354", "comment": "Malware payload (Amadey)", "value": "59d932837802c1b81d5194008c7fdd6cef59c78a83aef291ca4af4e5e6a16f9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830131, "uuid": "d865f1f3-ad09-40e0-8f29-346de1042ab7", "comment": "Malware payload (Amadey)", "value": "5bbf91cf31295830e141fe03804f96cca07fda31", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830131, "uuid": "384b23aa-3d84-4653-bdfa-41d8c3a8a6c5", "comment": "Malware payload (Amadey)", "value": "51da31c7dc36544cfd6c2aefd795ec7e77247ab24ebed112a2f8fdd06d6223aaf6327d68600aae1b3ef22316916412c5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830131, "uuid": "1ee81882-aadd-4bca-a81c-3ca8278dac4d", "value": "T109151213FBE84522E9B1673429FA03D301363E625E3482F7735B6C5A19B36A8707477A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830131, "uuid": "4ec99e34-3961-484a-a8f6-f716430e0901", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830131, "uuid": "d8e31b78-f08f-4259-ac0e-2c6acc845ac5", "value": "24576:6ypVhe4EVoJwWfbxA5MrVZnmqNQ3KRGLnbIMoKbm:BpDe4ESfbaqrV5mqNpecqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677830131, "uuid": "29fdd9ca-73d6-477c-9047-14e5a5ace29e", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677830131, "uuid": "b9d767aa-fd50-4f4d-902c-fb70627f9cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830131, "uuid": "078a2e72-9d8f-4cbe-8590-aed77e59d10b", "value": "e6e68c169e5c0d75789adbf11a586f52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb35958-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677857203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857203, "uuid": "19fdbc53-7bbf-4121-ab93-ac2bfe6305d8", "comment": "Malware payload (Rhadamanthys)", "value": "b4a3cbffc09b0c0a0b2d0e61d96fc0e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857203, "uuid": "ad6f4906-fdbf-4470-a03a-41068dce7777", "comment": "Malware payload (Rhadamanthys)", "value": "5a38445a0b99ce4032e9514dfeac87cfbf492c3f1325b442c775cf8bc079abcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857203, "uuid": "c8a9f16a-7001-4596-aab6-cf485d043a2e", "comment": "Malware payload (Rhadamanthys)", "value": "7eb1e19dbe290b48a139eb65dac23c71704440d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857203, "uuid": "e85c0361-dc11-4d72-a98c-997c72dc74e9", "comment": "Malware payload (Rhadamanthys)", "value": "801aff0465da4f3d3acb9258fe9eec11ea7e2fd35b5eb583b22200580b862ae44a019b810d6bfa2f45434984a5ab8cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857203, "uuid": "85bcbaed-6403-4caf-a047-a43edf8f4f71", "value": "T115C59EF04E91FE52D3AF2E7080DC0A805D6C9B5B96698749FCC85552EAE1740EEDC3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857203, "uuid": "009486ef-9485-4457-b151-04c34930b273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857203, "uuid": "51f30053-efb4-4ac8-a1ff-64e9125b58ac", "value": "24576:PSSyj6XsGD1xFNrCxE3t9UhvF3nHebXes3pkDVPY003Wr/H0ciMjyAQ1vqIv5QD:5nnFsE3g9NXDVImrP0ciMjyAQ1vqIv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857203, "uuid": "0c8f9f44-4c1d-450c-9d30-5cc08427610e", "value": 2539008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857203, "uuid": "0a40a9d0-626d-49a8-8815-5f836970ae2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857203, "uuid": "7c699684-9829-4025-9c74-a65897da249d", "value": "b4a3cbffc09b0c0a0b2d0e61d96fc0e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2864e3-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1677857654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857654, "uuid": "6f8a8e55-c2f5-406a-a953-001f581af954", "comment": "Malware payload (Vidar)", "value": "bed203574b1a55acc2efbbaa80c8d1b4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857654, "uuid": "5493179f-6292-40ae-a96c-f463f71e3593", "comment": "Malware payload (Vidar)", "value": "5a5658bc137fdc643bb474f824a2a59c46f29d4b3732d34acb0ca1523881bca5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857654, "uuid": "d6751c17-2bef-4fca-b4aa-7bc23ceca175", "comment": "Malware payload (Vidar)", "value": "7d9056fa9e1618a66318b0a2d627f5172d05b990", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857654, "uuid": "dbef85e1-fd1a-4fba-ac2a-18495dd97f2c", "comment": "Malware payload (Vidar)", "value": "39db4ad30fd2a4594c17e82379beb8638ae5e0ca8f09d57501256561af20db9b0975f5c3d0e668c69098f8ba4a33144b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857654, "uuid": "1aedc762-b377-49ce-917b-de192429f73b", "value": "T1336535D03744C027E95B09314E67C79AA759FCA0AE30B0877760FB5E5B3A9D36E68702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857654, "uuid": "ea640046-12a0-4b80-82a2-5cd4ab1957bf", "value": "12288:vtvRQ+gjpjegGdo8RoauDEtLkCSRhu2A4nDTvz9wzzu:vtncpVGPRohdX5vGzzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857654, "uuid": "6df9151e-74af-4b7d-aa97-68209e46754d", "value": 1474560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857654, "uuid": "5d6789bd-141d-4c3e-afff-aa2ee113b1b4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857654, "uuid": "7060b77e-9dfc-4258-a096-2171331a4be8", "value": "bed203574b1a55acc2efbbaa80c8d1b4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ce6bb6-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677857378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857378, "uuid": "ca8433cc-f2a0-4bcd-a37f-269d4bba251d", "comment": "Malware payload (Rhadamanthys)", "value": "03a5065cb8f383349ce9f862ba6d77e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857378, "uuid": "59bd839e-4863-4d35-bf7a-aade352ee834", "comment": "Malware payload (Rhadamanthys)", "value": "5b5f0a7fbb04f5979eb19c342d4b81f1525584c6780d728ad57a33f469b6584a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857378, "uuid": "7833ea71-d73e-4b3a-b1a9-a13c90148b84", "comment": "Malware payload (Rhadamanthys)", "value": "28bf3e78d3b2efd468dd9179a5be8ad755afd3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857378, "uuid": "03db2b0d-e887-4360-8c0a-762a0c48eee6", "comment": "Malware payload (Rhadamanthys)", "value": "ecfee4a587e02cdb9b2f29916928b8b7c561b800121c9456989c58a08e973e65117abd0549cdc46257a3dd5b0a89dd5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857378, "uuid": "414e68f2-ce1c-443d-83c0-c1ab118f06c1", "value": "T158956BF08E93FD956BEB0C8480CC2AC05C5C2B9B52A98598FCDC2512E2E5564FFDD6B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857378, "uuid": "66dbd865-ad7a-411b-b107-14989849c8b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857378, "uuid": "407c5c98-7428-4f87-a4a2-106f161aae5d", "value": "24576:LkwXuOnJP0Q6nwadCspF+FsOS0MQ0+uE8N71CY8X+7GL8t:4wXual0Q2utS0MQaE+x8qE8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857378, "uuid": "f12b2dfd-f2eb-4254-9f9c-94c42cde01eb", "value": 1916416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857378, "uuid": "d80cbb63-a1a4-4274-9595-0379026800a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857378, "uuid": "247b8d8e-fffc-4a6a-82ea-59d081952aaa", "value": "03a5065cb8f383349ce9f862ba6d77e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede34b25-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857257, "uuid": "b73fd0d2-ca12-4130-b37e-57b79bd563ea", "comment": "Malware payload", "value": "78251e789fc75838a83873e8991fbd69", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857257, "uuid": "0025c343-427b-491b-a70a-38f6423edec7", "comment": "Malware payload", "value": "5c67324fc73d9af01bde959864c54d4957f83802bbf22b85d9120ecb0b091818", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857257, "uuid": "9607960d-c1d8-4f65-9bfa-6abc908904f0", "comment": "Malware payload", "value": "677aff57a278c68cceec8a1fa1bed98f0f002e8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857257, "uuid": "b41990c8-126e-4f76-a910-ea52b6330898", "comment": "Malware payload", "value": "401bd55a4ce3d016bee2d8f8fd660dc34ce4bf37a5a472e99a4afa1abc34825c0f22daa381f21cb1771256222d477c44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857257, "uuid": "310a121e-9d4b-483f-a368-0f16af112eef", "value": "T18545F15472EB85B9D223A978607EA34FEA7538440B3186CB83F81E481FB37D056F6761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857257, "uuid": "364d4735-a9f1-4278-8c29-82743abbce4d", "value": "24576:cDCaxqKneo30V2twpagBFFikcSXZfR/Y92XbxKFD8/aOJPbV:cDbhnzkV20agBFjZZ/dW87l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857257, "uuid": "bb25c5cc-ed0d-4944-83ea-44efaf92c1d9", "value": 1202688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857257, "uuid": "b51fce33-3f9a-46c6-82ae-3e307796664f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857257, "uuid": "1412f23a-4f80-4ffe-974c-747b92738e3c", "value": "78251e789fc75838a83873e8991fbd69.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449e5f0e-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677850531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850531, "uuid": "9faa2390-3d40-4bf8-ba56-e16bc5579f8f", "comment": "Malware payload (Mirai)", "value": "b9281b876d099df420d79eb4ac32c3be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850531, "uuid": "6f7fdcf8-45d7-4190-98ba-648e51024159", "comment": "Malware payload (Mirai)", "value": "5e889cc98ed9611a98fac541fba222f5d2bb689fc62c487d3e21f2162663051f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850531, "uuid": "843c1e1f-8d78-4e20-a2ac-0a135d7cdad9", "comment": "Malware payload (Mirai)", "value": "cb2504e6e543be6f04b0feef13f1cf9b6cf4c207", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850531, "uuid": "b463a8b2-9374-467c-8cc6-0043632c35af", "comment": "Malware payload (Mirai)", "value": "1a15fdb602b37b0c7865eaed2c329a8d67ea03bc4bdfa06d04d930cd78dd911081377def45d4b7cbc8a1e70850438a5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850531, "uuid": "9ed0b9a2-0dd8-4474-905c-bbe2ae816d9e", "value": "T13F730856B8814B12C5C5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850531, "uuid": "1ee63818-321d-4425-a637-94a1a74f1fad", "value": "1536:mln25xPBXk1wnnkL7+KE007kKVkyazN0bIqvikNnsvHTGsV5GYIWa:rxpXCMkM/pja4NnsvHqsVERT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850531, "uuid": "fd2abbf1-dc7c-4dcd-80a9-5459f42d8498", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850531, "uuid": "373e7cd8-b941-445b-9d64-608f69e17db3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850531, "uuid": "19f13075-9a38-4e19-ac15-54de07f7bf8b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c84022c-b9cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677853497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853497, "uuid": "e88e60ea-df6a-46a1-b024-21f8c87fe94f", "comment": "Malware payload (SnakeKeylogger)", "value": "7777058541aa47a2d15254f2ce75e6fc", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853497, "uuid": "eedb1c13-0211-4d7a-9c06-38aab2e84ec8", "comment": "Malware payload (SnakeKeylogger)", "value": "5f06140929035fe344541f46f70e19e7ebca5a0bdafed473759788fda29bf3bf", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853497, "uuid": "bbe62639-c9b1-4125-8535-04aff7bdb87f", "comment": "Malware payload (SnakeKeylogger)", "value": "259a7fe3bddeaf2a60f08610777ef096fffac36c", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853497, "uuid": "8047c7ba-8e29-484d-8779-f68a374a8f04", "comment": "Malware payload (SnakeKeylogger)", "value": "b4571af64c765096d1cc844bbc95ac2695a3557fa33f193c172ef6c2c4ea0baab54daf1ac466eadaad22d084a262fc00", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853497, "uuid": "f69dde44-2db6-48bc-ac15-8b8edd17b8d4", "value": "T175B57CF08E92BE80EBBF1E4480EC19C0CC5C2F5B52B9964CBC881566E6D1754BFD96B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853497, "uuid": "dbaae9b8-66cf-4ad6-89c4-a166cf697768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853497, "uuid": "886cd534-dfb3-4869-b319-f073a1c69fc8", "value": "24576:33slHf1S1WVliujnF6pJRQDJr5UR9nxDCgm9DVps2z3xYhLaA+/V6h39KCQTjMj:33sl/gu4ng5Og1/kJQTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853497, "uuid": "2feae368-0e0d-4b25-92fe-ec46a8a5b908", "value": 2354176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853497, "uuid": "5ddd8cf4-425c-482e-8d17-02d587d18815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853497, "uuid": "98023065-3c37-45c5-834e-c07a7ce96e56", "value": "RFQ 0029203.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6095b6d7-b956-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677801615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801615, "uuid": "0946421a-68ef-46fa-8af1-7069dfddb269", "comment": "Malware payload (Mirai)", "value": "8db490bfff700456668ff36ad4383eb3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801615, "uuid": "f3cf5c1a-45f4-454d-943a-a29060f807fb", "comment": "Malware payload (Mirai)", "value": "5fe74e231db457c9f906a46b3a49451c3e9c98d5992564b09b29754610c19d70", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801615, "uuid": "c1ba2543-6586-4f11-887c-95745503803b", "comment": "Malware payload (Mirai)", "value": "a1500517f25c12d52751876b47e24d0930ac9eae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801615, "uuid": "222827ef-2d16-4e0c-81a2-69e807c3ee24", "comment": "Malware payload (Mirai)", "value": "bfdcd11042690bf576cfba1cc677a652a72c569796a76996aced813dd3fb37331d9b9851e3ed147fd7cfcfbe1836f26f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677801615, "uuid": "c54518df-f201-454c-981b-abeb93339319", "value": "T16A536CC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677801615, "uuid": "d614b678-0d82-469c-905e-95d6307fc471", "value": "1536:Z7qARubgzY/bEJy2RcpF80LDHhklv4JQC9DSW:NP+eY/bEJs/XBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677801615, "uuid": "bb93393f-5a0e-4832-ba79-977855fc83d0", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677801615, "uuid": "2b45ee5c-59a8-4718-9e1a-ce49982423e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677801615, "uuid": "e19c7159-b8b8-4e6a-8ddf-232a1862b68f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517b1fc8-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677856995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856995, "uuid": "fde0f133-6297-43d6-82be-63e69c66544c", "comment": "Malware payload (AgentTesla)", "value": "9c0d42907b201d44c1f846aba47733ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856995, "uuid": "283d1fa5-9f43-4255-8376-c92f38a73d62", "comment": "Malware payload (AgentTesla)", "value": "608f2b6ff7a63894e03a8e669e78625603ce67e0e137a6bbcdde0291f710a151", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856995, "uuid": "c4915875-dcac-401c-bf91-f918aa1835ba", "comment": "Malware payload (AgentTesla)", "value": "8d54c1d5a2f4aef7741b4f0991ad183a4db80452", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856995, "uuid": "69c567c4-ec39-4a22-8515-cd16e36946ca", "comment": "Malware payload (AgentTesla)", "value": "caf834e6ae392748e4353be553c277a69c1bd552ef8bbb56424f48fe25a8a61de391055566ba0b62064e1cd3279aeae1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856995, "uuid": "84e08304-d318-4b8b-8d0e-6a261eb363c2", "value": "T15815E029B2B7C922C389473AD1D7810993F19A87F187FB09358527D15C433FAE94678B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856995, "uuid": "3ccca9ea-49a6-4a09-9a0c-90b5e0e8f30d", "value": "12288:B85HoHiGt8ydRQYjN71kqJN2P6UDuvp+34C9BLvckc4dqjhlvwQBBnfuzWOov:m5CiGt8ydeYV1tNER/9JsnnDnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856995, "uuid": "6dd1960a-890b-48bb-9b21-b341da09666c", "value": 960584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856995, "uuid": "87672614-6b2e-469a-9ada-0d13f5692d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856995, "uuid": "66562313-4cca-47cb-9a1d-ad3184797f05", "value": "DHL INVOICE_AWB#95149508010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a681d5-ba0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677880363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677880363, "uuid": "587f719d-5c82-47c5-ac39-90d256f7436a", "comment": "Malware payload (AgentTesla)", "value": "c40c375df4fdab891cb5a03953d68d38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677880363, "uuid": "e81015c5-54f8-48af-bf13-4d09871e6a2c", "comment": "Malware payload (AgentTesla)", "value": "60d1370a6be9757d7c17dde38c1b092d70fa3bfc4d26a2f9548b095a2c714fb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677880363, "uuid": "36c7ee49-528e-4d2d-8885-e440564bba83", "comment": "Malware payload (AgentTesla)", "value": "6af325ef6e0ed11e5799595c9b204167b6c9ae8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677880363, "uuid": "a343e8a4-f725-4ec9-af46-027fe14707d0", "comment": "Malware payload (AgentTesla)", "value": "055c9bf712c9f3c50579163d8a35f457523598a63a33906dfca235ffdbf994a4bcdef631bed206026dacdf128437890d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677880363, "uuid": "da27fc1b-50ed-463c-a43a-181f0b905c69", "value": "T16F45A82809FC0AF24571F1FD9FE4E753BE8488E6AB049D99C2838B89555385720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677880363, "uuid": "ad7209a2-d9c4-4571-b820-26e957f7d096", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677880363, "uuid": "5fe25377-7381-4939-b432-d6edeca6b174", "value": "12288:d2MOEAlI3MzSSV93762p/nVyFraLxNbZlYy88r6vrWjWTAOvaEIn3YwG6LSm:dlYdSSn62mGLxzlYL8r2XTpahaCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677880363, "uuid": "84ab8301-4ede-47fa-9200-268599e8fbf0", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677880363, "uuid": "119fdc87-83d0-4792-b38a-4d02360708db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677880363, "uuid": "17d381c3-ac87-4359-9b21-d667869421a9", "value": "IP copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0b3d95-b9df-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677860474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860474, "uuid": "f8d514a2-5fdc-4873-a690-04dcd50a9956", "comment": "Malware payload (RedLineStealer)", "value": "98736e85c65f3cb471d92f2dca70175f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860474, "uuid": "8fa625d5-3a69-4637-84f4-0d4120e8cdda", "comment": "Malware payload (RedLineStealer)", "value": "6132d0339518ab0af94fc797e90115469192e653b8e181b56411a1bc467efba3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860474, "uuid": "6f541cde-8c7d-4f1f-99ed-fc264154f50c", "comment": "Malware payload (RedLineStealer)", "value": "fe733908a67ebe9e48e025b9db1d8039ec951151", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860474, "uuid": "7fe36b14-a670-4e75-95ca-cd845ca3cb68", "comment": "Malware payload (RedLineStealer)", "value": "0f5a2824535dae356a38d8f0e7cb5bbf51d8751cede384e193ea84c745f499257cb46e61132317f3412aaa00830ae9c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860474, "uuid": "870bdbf7-9835-4cac-8fed-5b0fa3c46730", "value": "T1C864E13173E1D832D0721A30D975C2A81A3AFC92697505EB77583B2F5E702D18A7EB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860474, "uuid": "bb961152-0e2c-42a0-adb7-bdbf65842840", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860474, "uuid": "9d27081e-a5e5-419c-829d-1e3bd98e3151", "value": "6144:/pK4UFVC/9VE+eHIRUpGZzL9sSvkmVGN266bsQj:/pKfXmTE+aIZzL9sSvkYbVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860474, "uuid": "9dcbbb05-1ea9-43ba-99f3-0609013af064", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860474, "uuid": "fc917999-5c97-4c0f-9361-4723ce7391b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860474, "uuid": "6412071c-a81c-4769-8477-c72a4bf326a6", "value": "98736e85c65f3cb471d92f2dca70175f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88458e84-b9f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677871260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871260, "uuid": "0b338bd1-21bc-4a8d-b9b5-6783d48c8817", "comment": "Malware payload (Mirai)", "value": "423f92ffb1f78e891d10744d09ac2fe8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871260, "uuid": "89e84c5b-c6e3-40e6-9699-8616ae282670", "comment": "Malware payload (Mirai)", "value": "61c96cb26377b9bb43f5f3a8fecca7f30b59bcf4119109e08cf889667f2efbed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871260, "uuid": "b10b6c04-8abf-4c38-a898-af31bfbd0ce5", "comment": "Malware payload (Mirai)", "value": "643a1fa4d5b470eeda9db842dc68e59326d57a07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871260, "uuid": "880d048b-dc3f-461e-a507-f6eb438cd9d6", "comment": "Malware payload (Mirai)", "value": "2afcb7ce228fcc10f6f1c4cef92a893095c0591be82f2e3bcbfd72ef5a49e48c4e7aac8c65d575ae7d7fbdf82fcd557e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871260, "uuid": "aa2495b0-e685-4777-9adb-cabf7e213f1c", "value": "T158338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871260, "uuid": "0fedd594-fbcf-4876-9d11-28af7cd1e58b", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvz:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871260, "uuid": "78546e1b-f30c-43f5-8605-5909a52c89e0", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871260, "uuid": "f7420782-5ff5-4cfe-83f4-69fb096c1edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871260, "uuid": "b6ffe26e-9d33-401d-b1cb-24dc588b1c08", "value": "423f92ffb1f78e891d10744d09ac2fe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d7437f-b9ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677853031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853031, "uuid": "ac73d053-06ed-4158-a7f0-786d4e2e48bf", "comment": "Malware payload (SnakeKeylogger)", "value": "eaae9891442d0c106d948bcbee4141c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853031, "uuid": "bfa16da6-cefb-4e64-ac42-fa7532293c88", "comment": "Malware payload (SnakeKeylogger)", "value": "61ece69c7d3abf50d508d618a236e3a864f784967362c61c074d5eb4b857cbfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853031, "uuid": "aa7e8ba2-de41-458a-8f71-f84d786a5310", "comment": "Malware payload (SnakeKeylogger)", "value": "30eb80ae5b466089a129f684d2f043766a852da1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853031, "uuid": "702ee9e8-d33e-4c1b-9189-75c945e1b9d4", "comment": "Malware payload (SnakeKeylogger)", "value": "fea8d4c178d794dadbf66b3e96313a3fbb4edf43dff3e2d657783d35e379e617ccbdb52c81b8ab41adc164681b2fe35f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853031, "uuid": "e9f23bdf-bb50-415b-b61d-a23299c00b86", "value": "T16D341204BBA9C037E9B35A328F366780EFF5692308B6E61B23A0579C7D754A0154D7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853031, "uuid": "e6eb5abc-6fef-4615-83fa-26c7740f1328", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853031, "uuid": "47475713-1e9f-4370-ad80-30aab7306467", "value": "6144:PYa6J6HBjo5YMHzqj5E8F1nUPyLlZejIq:PYT6W5THzqlEY1CyLlZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853031, "uuid": "6da2a8c4-8cdf-41f0-ab8a-5d7ea05fe2c7", "value": 240784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853031, "uuid": "549f5246-3ca8-4492-849c-a4ee861f6284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853031, "uuid": "908c5d01-1c23-46d4-b755-a0168e49590d", "value": "image001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53f4b5b-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677856813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856813, "uuid": "994f8252-7226-41fa-bd91-a19ebcfbc440", "comment": "Malware payload (Mirai)", "value": "672b5d3a544a7f58795d227decf96100", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856813, "uuid": "4a799b4b-bb52-4056-8b58-fff28786a96e", "comment": "Malware payload (Mirai)", "value": "634ecd452c56407bd18cef056113252fba2129f67e3674d59484ebfe20417f1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856813, "uuid": "e6be72fd-982d-421b-aa00-720a411bec4d", "comment": "Malware payload (Mirai)", "value": "d6405692bdb1e4f2edfc586da86fb07bfa4f0c98", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856813, "uuid": "5c029741-6cc1-4723-acc5-b00ae8b69201", "comment": "Malware payload (Mirai)", "value": "8eb9b39f25a88fa1ca6c0e8bfea4b413eac27fe1c7fe861039349087309a60b50fded8966724ecd2c017103c240f9208", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856813, "uuid": "b35492cf-ae6e-4174-ac4c-e393b86fd8c1", "value": "T1ED632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856813, "uuid": "030fea68-2af9-455e-8726-a04724e758dd", "value": "1536:qNSlxYmii8N1U9uO//kWEjMCikg/QA83NRuxAvjW/:qNnK7ktYCikg//29jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856813, "uuid": "1c0f543b-d292-4eee-b028-c2daf1055426", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856813, "uuid": "bf41c1d0-2740-489a-aa1b-0623f6524397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856813, "uuid": "8c626ad6-8e92-4712-9453-e857c86d1aa9", "value": "arm-20230303-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee34145-b9d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677854682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854682, "uuid": "27bd43be-c9cd-4179-a12e-b830bbb0b270", "comment": "Malware payload (Mirai)", "value": "16c8871e6733cc9580e94d3e9dfebe55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854682, "uuid": "5a6c39d4-ac7f-49c8-8927-7d9953a0ffd2", "comment": "Malware payload (Mirai)", "value": "64153eded99d5aa893b2841f7a177ba2e13a49a31c40e8ca6a457393fbf94325", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854682, "uuid": "eb662587-765c-4e06-9d63-66480d72a5c2", "comment": "Malware payload (Mirai)", "value": "84066ce8a3a1fde609df15ee42cc62c0fe269d9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854682, "uuid": "ae04dfe0-dd51-42bb-a00f-e323e96a2338", "comment": "Malware payload (Mirai)", "value": "5546072f2c778ab8728ec09dec3b60c191041b49fc55ecdf403cef871e13b3eb84b02d4be20ac100a51ef1924e5366b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854682, "uuid": "a93f0611-e11a-4d4f-be4d-7578db89a545", "value": "T11E534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979996B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854682, "uuid": "f575d13d-61aa-4bef-bb0f-a15c2e7b40e3", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG9UmtTy5EMBl/J9iSzEv2xRgN0L6FV+tg6wWT:+5HAdOmGyZtTAd3iSgOxRgN+e+aTWEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677854682, "uuid": "7aba50d5-e89a-4294-9d93-5f27fd8a47d6", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677854682, "uuid": "24876f36-144e-4fb2-b879-71cd0e048d49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854682, "uuid": "d54ee8f4-4338-4240-833e-6f45a75e3e81", "value": "16c8871e6733cc9580e94d3e9dfebe55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa5d195-b9c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677847051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847051, "uuid": "86b92a5d-f850-4a06-9908-92493b770692", "comment": "Malware payload (GuLoader)", "value": "bc1a9800f4c13bfcc141d8a76dc1080e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847051, "uuid": "d34970fd-1081-41a1-8ad6-86a2e8f13598", "comment": "Malware payload (GuLoader)", "value": "6578a27c9a339ad280d54a724c86f4c5a864fcd1da54b732fbbce40d861447da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847051, "uuid": "fe09b6fd-a9db-440f-9228-51649fd7e6a0", "comment": "Malware payload (GuLoader)", "value": "4d49fa464c6a3529f64ece36c2e8a40be3147a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847051, "uuid": "e0d21f78-6228-4a7c-8b95-f879ec0f6682", "comment": "Malware payload (GuLoader)", "value": "feb1337bcdb39f1130cc4ed527359967b9c3d917d9d1ec441459b5f27bcd9a0cc35efd45fa032ef2ed5a31ac8a114b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847051, "uuid": "6557c4af-3877-412d-b537-450ce6f224ff", "value": "T1B6D4F045B705C977C92A02738DABD72827B4FE09554E4F0B324CB65AADB32DE381A385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847051, "uuid": "add0c302-b33a-4fdc-853e-2119f4f0da37", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847051, "uuid": "59b79943-5951-4025-9700-8405fab9c28b", "value": "12288:/f1Pc3O4JEYX3z2PrQbikTFH8oNTY8SIsH699zgUtQ:m3O4jqrEH8oNMZIXzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677847051, "uuid": "15ea0ad7-5e7c-401b-bf82-1ac687d1bc1d", "value": 651744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677847051, "uuid": "f1b409f5-43d3-4f38-9e1c-e6f8fbbdc4c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847051, "uuid": "2af5f51f-8dd2-4ade-9df8-ddc63b162853", "value": "6578a27c9a339ad280d54a724c86f4c5a864fcd1da54b732fbbce40d861447da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4f1d5c-b9ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677853232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853232, "uuid": "7c40078e-66b8-4e0f-8479-8e62faff90d4", "comment": "Malware payload (RedLineStealer)", "value": "caf7719650dd83acc1580cb7b50af092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853232, "uuid": "e1aab3b8-4ec2-46bb-9536-2066993bb884", "comment": "Malware payload (RedLineStealer)", "value": "66a4e11b4b456161e5561e8ffb153daa896db70e6575cf167acf2338dbdf3861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853232, "uuid": "91666206-826a-4449-be93-232acdb1f439", "comment": "Malware payload (RedLineStealer)", "value": "bba0ae3548724201c19ceec57d126a606fe44ad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853232, "uuid": "92eb696d-8782-4622-bfe5-31476eb3c962", "comment": "Malware payload (RedLineStealer)", "value": "34def9b9e4e76ff29bc18ab149c1760ee6b943be47739e67c12f8e1cb8c66137883d27f4bdee48182a4c1d04ea5f51e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853232, "uuid": "1ebbe6ef-bc58-477f-9f6b-2e9f280f92d2", "value": "T130151207FAF88066E4B5437115F602C706327EA19B38C35B628D6D6E4D726B4B63273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853232, "uuid": "e8be8b12-4a5e-4f49-967b-7893c0ca7306", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853232, "uuid": "a5cf4423-5809-462b-ba1a-6a9677cfee07", "value": "12288:zMrRy90Z4Aab3THlFmdF9gsy7H3v4/7PVkjJqTWV7rZZAU6OD/SQit5srylCvc:Wy3ljF49Q3v4/7P+jQyJZAUPT058Rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853232, "uuid": "a3698961-bbe8-44d8-8661-54c58579a8b0", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853232, "uuid": "32734c31-560a-431e-80d6-0660cc0972b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853232, "uuid": "a3611ce4-96c8-460a-b119-6251e4318dd8", "value": "caf7719650dd83acc1580cb7b50af092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a59d5cd-b9b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677843159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843159, "uuid": "7cd448f7-f066-4919-9884-482d107b4392", "comment": "Malware payload (Mirai)", "value": "49d76fd5166416509e66642fd9723b33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843159, "uuid": "ce740d54-811c-4ec4-ba07-9f414c25b43a", "comment": "Malware payload (Mirai)", "value": "66aa131be0c147c583eae6f12ad557a9cdef3ac8606443b89e0f3a1f797fb3f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843159, "uuid": "356fb933-bd88-49ed-99a6-f9f45178ea82", "comment": "Malware payload (Mirai)", "value": "cb2d51fcbf1ea542fc029b2dab0ab907838b9a62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843159, "uuid": "3780d6d9-c426-4c14-80fc-eda265c6f88a", "comment": "Malware payload (Mirai)", "value": "6a9c0e0811a5011b1c9512aee020dc0ff7ef1fbcf071209962c7845fc420986b6aa06805c4fbd3fd44b081b08f4b0998", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843159, "uuid": "a2471208-c598-4cf2-bfbf-cb0028137281", "value": "T19B83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843159, "uuid": "29309f23-f1bd-4996-be94-d49edf9ff2b6", "value": "1536:iVLyu95K8Kkj752dCexuV/8UZlDwfkJ4MYfWb:iVLyMggFezxu5VD1eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677843159, "uuid": "d50fcf05-4967-4f2f-8216-09e21e731f6f", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677843159, "uuid": "14565f3f-edf1-4142-bc45-cfe5b7198290", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843159, "uuid": "76742f1a-62e5-4566-9d72-7cc3d694a4d7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a85de02-b971-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677813255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813255, "uuid": "a6fd30de-bd41-4dc1-bcde-576c41d20157", "comment": "Malware payload (Mirai)", "value": "ecda4ac16a41a01c82bd943e93840de1", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813255, "uuid": "ff2b07d7-4354-4dfe-88d3-c570a89f5ff8", "comment": "Malware payload (Mirai)", "value": "678f1bd93bd79ed3715226b6595ef8d5c91e30ff9153a2296b560a5d25b08ec8", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813255, "uuid": "dd4655c9-9964-40e4-af87-598dfc6e4f3a", "comment": "Malware payload (Mirai)", "value": "c6d4c20318f38c4b8d6709d091abdb2421247230", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813255, "uuid": "09e6aada-5306-461d-876b-33c032fc92c1", "comment": "Malware payload (Mirai)", "value": "b8474678c220ebc1e1cb52bb35b3c45a9cfd7c559fbd602e336e448b5b08b5ac446f2ad85215745f8ce04e8120961196", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813255, "uuid": "20b734d1-2f42-40c1-af80-409a9d211baa", "value": "T11853F219DB0F2980CCF66C376DCA489351514FA8F9AD337A4640C4ED2277F0749BAD96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813255, "uuid": "84d6deef-aa25-4391-b208-d0c7f031bbb3", "value": "1536:x6tNP9mIsRddbGc0qmM0FuEwdXLDtxawUK8u:AtqIsRfGDF4EuXLDvawUTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677813255, "uuid": "644f33ff-0ac9-4e1f-a745-0b8fa147729a", "value": 65632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677813255, "uuid": "daaa575f-b2fe-44d4-81a3-55a267179e9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813255, "uuid": "ba8031ad-d282-47a7-8ed7-2fe4defbf6fc", "value": "bok.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0643f4-b9cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677853499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853499, "uuid": "71e98008-96be-47d5-a707-047b4623e2d7", "comment": "Malware payload (SnakeKeylogger)", "value": "dc0c004a4ef61636ce15f8474f9c4632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853499, "uuid": "4610b398-7cdf-4935-81bd-0ccc836a7260", "comment": "Malware payload (SnakeKeylogger)", "value": "6800d39c3c141d9224c067a8fb10ae3915fe0dc79220ba2073cf6e28f98b99a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853499, "uuid": "bd10feac-fc3f-473a-bcb7-e32c062782f1", "comment": "Malware payload (SnakeKeylogger)", "value": "fc27fd840d7583dcbb2c9c63594979414c8a799d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853499, "uuid": "60587368-c2c9-4513-a463-cd97185d0be2", "comment": "Malware payload (SnakeKeylogger)", "value": "e63df3dec78c16d5aeda8a5ade4593dfb349c4c59dbf0487eef4dd5d5c5afa5a4a507ddee65d1d742977dbb16e72333d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853499, "uuid": "9648c7a2-0a1a-4fd7-86ae-e5b3f549ba28", "value": "T15835762809FC0EF285B1F1FDDFD4E753BE8088E6AA049D9982834B89555395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853499, "uuid": "7cf3481c-4bb7-4a13-be91-48810b3b8df5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853499, "uuid": "6c44771f-b4e6-45b2-8644-0c64a00f548d", "value": "12288:6PO7Jl95OD2ZHn4U4LKKEiL7iSNKoQmo6R4y1qAjnEeDO:Xl955MGKE8hobiqA4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853499, "uuid": "2d5220e9-0058-4e57-bf4a-960838f821d2", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853499, "uuid": "98e07c0a-e8ec-4c48-bc7d-33c138a86d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853499, "uuid": "e11e47e7-f836-4e47-9018-d7e376728ee2", "value": "dc0c004a4ef61636ce15f8474f9c4632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a11481d-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677861331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861331, "uuid": "d5448af3-8572-401a-b2aa-569519ca40e4", "comment": "Malware payload (Amadey)", "value": "3971624dcd4a891de0dfe7cfa93cd27a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861331, "uuid": "d735ca18-3472-42f8-a93e-ab9d7ef71efe", "comment": "Malware payload (Amadey)", "value": "69601561e647b4b3479cd3217e06479b8dda1ec238951da1989bd5773307984f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861331, "uuid": "74964cc3-66e7-45c4-9be1-211e8022bb76", "comment": "Malware payload (Amadey)", "value": "3496e79e20496946a7f7e40c5b1003dc1c08684f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861331, "uuid": "aa5c95c1-486e-4595-b726-7c54f95bb9a3", "comment": "Malware payload (Amadey)", "value": "004e8a65e55502015041d4be44ae43ca3462c429b0ac67ca256dbfb72026daa7b4e7015aa771d53d3c96e054d0f7cb77", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861331, "uuid": "6010d55f-11ce-45f5-b42b-07fa2dff3106", "value": "T11915230BB7F85027D9F15BB028FE83C3053ABF914A3487AB638B6C6615721B4A275357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861331, "uuid": "26ad10d4-0193-4ae1-9a83-d79d9a94bbae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861331, "uuid": "e8f91b63-05bb-478e-83d3-0bd124b2cb52", "value": "12288:PMrjy90zeFHtxVd01FaMzxedWKZcOXeVZ5k4an6EQ8R7XUtAOH13tP2YQNnq4xg:AySeFHVuSVcEeVZ5e6E57W913tODfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861331, "uuid": "aed34b3b-a4a7-411e-b5e1-3e20288a3f17", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861331, "uuid": "7bf3ac81-6343-4672-970b-d289fa5f0a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861331, "uuid": "081fedc7-1e37-4e22-98d0-cad39ef60800", "value": "69601561e647b4b3479cd3217e06479b8dda1ec238951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1fc3eb-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677856991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856991, "uuid": "b9ed0152-b71e-4011-ac85-4f6599f7bc72", "comment": "Malware payload (Formbook)", "value": "8c269e6c1a7d2da9913fd86a690128bf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856991, "uuid": "219b7549-579b-4157-b7ad-de60fc565481", "comment": "Malware payload (Formbook)", "value": "6a2b03fbb0278c305d7da840dfb6a5baf4a39bc306adbbb95a9014bbdeb76f2d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856991, "uuid": "b35cee8f-6e25-4bfa-a8f2-de862732e6b7", "comment": "Malware payload (Formbook)", "value": "87d9cdf49bb7c198d4f9f429fef8b206312f840c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856991, "uuid": "1c3376b0-61af-48ae-a531-3313128a98f8", "comment": "Malware payload (Formbook)", "value": "31682163e484c023d48941234cf62bb58e78a0597e076abb98877a77ebb059c8cd99e073a76e88c48666c8cd79ce858f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856991, "uuid": "14f6ab00-cdc4-45cb-ae80-343613e1a39e", "value": "T17044122503B5D42BD8D223320DB96F167AE3EE1668A5CB1BB7808F5D793A201E40F7D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856991, "uuid": "7c8af1f6-6575-4b3f-a01c-1d5351da1679", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856991, "uuid": "8bcd1c4f-6b2b-4efb-85ba-146d568f9c3d", "value": "6144:PYa67ijxMA14d9Yigio4WvPpxHA/PyZnr7WY8:PYxijxn4d9YUW5FA3yZ3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856991, "uuid": "fa42466d-bb5f-4ac1-9a8b-68b9a6ce281e", "value": 262942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856991, "uuid": "9f3d7932-beb9-4c63-acfd-cfdeab91f9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856991, "uuid": "1808c070-5e94-49c6-a40c-1c3534797f70", "value": "DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9087a07-b9cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1677853840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853840, "uuid": "7ef96e71-0484-4196-a7c6-fc63a459a844", "comment": "Malware payload (CobaltStrike)", "value": "1116935c6e67faa46ae25a87eaaacf5f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853840, "uuid": "058b7006-73e0-4dcb-913d-39bfefd27be7", "comment": "Malware payload (CobaltStrike)", "value": "6a78c66b2a1ef44584c3b1bac11649275cac70dd5768bcdeeb3c439420354c01", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853840, "uuid": "546aebf2-b74b-4ce5-a69a-0e33252f4980", "comment": "Malware payload (CobaltStrike)", "value": "3b838306497ed4a68bba3caa775ba3d24e3b5997", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853840, "uuid": "ec056840-1986-4931-bbe5-496c86fa21b6", "comment": "Malware payload (CobaltStrike)", "value": "422d9d711edc806bdd8acd0278d06b16e75ebcbb9ff5cc6007b8b815b59d5b19ee4793771392c9844318ebda3f3f2387", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853840, "uuid": "4d71148c-d655-4006-b788-6c8c1b699113", "value": "T17C548C0ADA2F3D88E868D730B8120A2E387CD59DF1A5185FD4E9C854E5D43660BCFAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853840, "uuid": "7620dd0b-bebf-49ce-b969-63766c4a071b", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853840, "uuid": "c3ff38d1-6766-4b9a-9e26-773daa76968a", "value": "6144:A88TdwB/p4HVIfv33cN7QXwXXkGTFqrJerp3pK3R+nveAa:A88JapG+P3cBCwXphqrJe9Zcsn2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853840, "uuid": "5a4a1515-1f28-4b29-b5b5-57e710bb9691", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853840, "uuid": "c921b071-ed5f-468c-8600-5e2fd57e27f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853840, "uuid": "a9516bdb-235f-40c3-a1dd-12185743ef5f", "value": "1116935c6e67faa46ae25a87eaaacf5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fa5875-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677856816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856816, "uuid": "ffcb5d75-fc9b-4de7-a412-ec3b84f11cac", "comment": "Malware payload (Mirai)", "value": "49f973b37882fa542e0a1b8421c9803b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856816, "uuid": "36aec088-0309-4c61-af71-7720ff88161b", "comment": "Malware payload (Mirai)", "value": "6a8860e09aea065cf7f2e10b100ced3251bfd032ec9e0b852fd54c2365b0a154", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856816, "uuid": "6bfc898f-ac00-4451-8740-c2d87431b860", "comment": "Malware payload (Mirai)", "value": "7b660b6a24152f5638b43fd8e9dc6be45311f2a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856816, "uuid": "1e2930a7-7a87-4d20-b421-b751e487bcd2", "comment": "Malware payload (Mirai)", "value": "34ea674c01c3fde3561d9b02adda782f3a5c2404fd573b64acb5395a9e75ff4641fb2be0e143995a5d18b05c50119e92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856816, "uuid": "213e771f-5684-4763-bee9-bc745884fb64", "value": "T17383D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856816, "uuid": "0dcf41df-2776-4f6e-ab80-dfd14f7eee72", "value": "1536:iVLyu95K89kj752dCexuV/8UZlDwfkJ4MYfWX:iVLyMgHFezxu5VD1eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856816, "uuid": "0b15b957-2ae4-487d-a748-5ce1ef225273", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856816, "uuid": "b73c58f5-4a4d-4ec5-8ba3-e6cb828a196a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856816, "uuid": "8cc5b841-b107-47bc-8535-08053b9ea3b7", "value": "mpsl-20230303-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5bd158-b971-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677813257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813257, "uuid": "9f4fdefc-cd44-42d4-a5f1-da5b7498fd6f", "comment": "Malware payload (Mirai)", "value": "c9a1af5a967b069e7b8508541c63d767", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813257, "uuid": "dc31710f-1a5a-419f-add7-18d00c78d688", "comment": "Malware payload (Mirai)", "value": "6ac224eab4a9c8de7b6e758d8610af488af37ebc03629b4b1a2c753c71affdfa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813257, "uuid": "b2263b43-6b15-4eeb-a520-f1c0b321908a", "comment": "Malware payload (Mirai)", "value": "7997075b4aa68747d70ce75b72e1beb8818addcd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813257, "uuid": "68f1714f-ce43-4261-b727-e1e5d72b4e9a", "comment": "Malware payload (Mirai)", "value": "e229d957d5c8458a3676ef2611e06f1fdc91e2a4e7475c410719fd2a062cc281d4b9685ba3a6d5ea1fa3e3d46a5d039c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813257, "uuid": "6b383474-c1a3-493b-9ecd-4206c349b884", "value": "T1FB13021357C2C463C8740C7BF85A098417A11BFAC2CAB9FF03BA575DADC6502A63D18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813257, "uuid": "5b444445-87b5-48f4-b05d-b6b667b9ef5a", "value": "768:7SmTMZJzfpU6kFVaSiOfPrmbTmHvF9AIghd/xKRYhnUD/LwuAvdq8SyN9q3UELQH:ewqhUd8S53rmcvPE8Yhy/kuAvdDS9LS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677813257, "uuid": "ac9c3cf4-7b55-44e8-abdd-d9ef0de95d22", "value": 45536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677813257, "uuid": "18845275-0f17-4579-8ea3-edcffd7c8641", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813257, "uuid": "63b238b0-3457-482a-9287-150d80d4bca2", "value": "bok.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30377dac-b9d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677853933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853933, "uuid": "00403d8e-2fe6-4235-880d-29b5fbac9684", "comment": "Malware payload (RedLineStealer)", "value": "c09130f0bd052f7df7fef30c99507389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853933, "uuid": "dabeeb2a-29a7-4f5f-a4e0-48fd52e8d33b", "comment": "Malware payload (RedLineStealer)", "value": "6ae8c9290e9f59643b6dbfa13b62dc4d6cc4e0ff9aa57412b164ca689409833e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853933, "uuid": "250ff4c9-ba4f-4654-9597-c0200d5b1385", "comment": "Malware payload (RedLineStealer)", "value": "6e21bdebac3d8dce6fd2035715f72ebc5281dda0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853933, "uuid": "243bc810-8348-47c9-a755-eaaec64ba209", "comment": "Malware payload (RedLineStealer)", "value": "8086598c450c5d659792bd0bd3660412adc754e9615aba5ada744da8cfc6292ff2d2074de659287aac984bd3d5c03621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853933, "uuid": "dbe5d024-e553-411b-a3e6-5dab2889e99c", "value": "T1FD151243F6FC4162E8B1AB704DF943D30A367CA06B2C969B165E68590832675F2317BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853933, "uuid": "b8049ebc-c02a-483d-9aa6-e0abc9d22879", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853933, "uuid": "89cf9eff-f9e1-4982-a192-3d335cad446a", "value": "12288:xMrSy90kEJcg1uOzBUBaZ8lE0Q2krczxl9j+sH5HK0wMNrrs9KtEO2vKk2nHm0Im:HykJcgfsErlcvJ+cthwMNrI9Km4HhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853933, "uuid": "94a2892f-a90e-4ff5-89c5-c7a8cd26633c", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853933, "uuid": "d0660699-16f7-4257-b7fe-56939f3c28c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853933, "uuid": "b003cfaa-ad18-4815-bf19-f7a1cd4d2592", "value": "c09130f0bd052f7df7fef30c99507389.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec7d1a8-b9fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677872721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677872721, "uuid": "76d8402d-ce3c-4032-acfe-d21f2b396591", "comment": "Malware payload (njrat)", "value": "390c26ae89729dd5b7b119b941b3d626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677872721, "uuid": "c836d0d1-2894-491d-869e-408eba54e0e9", "comment": "Malware payload (njrat)", "value": "6bbaa6a2c3169548a607bfeed0fe2f7562790c06d24ba54edb3376dbadb8a7cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677872721, "uuid": "58e5e599-ef09-4b28-bfb1-315e6de39258", "comment": "Malware payload (njrat)", "value": "e00f317aa919082fc4ff2c203acef4d0945ee93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677872721, "uuid": "1c81c8d6-b867-42bc-96e0-8cfc933e4e38", "comment": "Malware payload (njrat)", "value": "b322378bebe1bf01cbee221401c39702267b4bc1f1a94fb887836fdd0b9b41f531221f3117caeeafb90e6b65d33c5dc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677872721, "uuid": "c262f063-0d15-41af-8c62-135d2e937a7a", "value": "T1F1431F063559CBC8D82D5D72E2383DF903211CABC20B88678DD6FF45BDB55E80A199BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677872721, "uuid": "7ba1cbc6-3037-44d2-a715-80f696b6c1c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677872721, "uuid": "0ab9c7cd-6e02-41ae-a438-64d122eeb693", "value": "384:Z1MKFYuEEhERvoBG16Xuy0MHNw6Tg1Y+75JTFmRvR6JZlbw8hqIusZzZANL0MFKI:Z+W4V6+yDRpcnu9B1ot41q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677872721, "uuid": "a28c9eea-f0ff-4c6e-b881-8c6555b612f0", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677872721, "uuid": "1699ac5b-43af-4c7e-a1a8-fd60778fe304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677872721, "uuid": "d38d365f-9036-427a-b9e1-adddc2a42f0a", "value": "390c26ae89729dd5b7b119b941b3d626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67be24f-b99c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677831851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831851, "uuid": "2e6081f7-0643-4d4d-9775-ea9d503e027d", "comment": "Malware payload", "value": "87c34ca05b0b6b935568cab2721d45f3", "object_relation": "md5", "Tag": [ { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831851, "uuid": "a46169b7-1094-48c0-875a-116f7b7d5057", "comment": "Malware payload", "value": "6ca9287c5098815b1067184314a0d8865135da7821af360532f6f0bac41c64f0", "object_relation": "sha256", "Tag": [ { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831851, "uuid": "15b7e66c-e4de-4bb5-90e3-1aed1efe9f19", "comment": "Malware payload", "value": "35b3c9bf714e601b1814be6aa182c05a1ba5f643", "object_relation": "sha1", "Tag": [ { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831851, "uuid": "ec9e51d5-90ca-48e4-9bfe-512563e8be17", "comment": "Malware payload", "value": "d49f66f8c3d047a433b753af678601c7b5f5160dd3f1b0e2fad0ea7fbf135f1e19498fb5805dbf2213da59ab9c4725f5", "object_relation": "sha3-384", "Tag": [ { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false }, { "name": "PerlBot", "colour": "#20EE2B", "exportable": true, "hide_tag": false }, { "name": "pl", "colour": "#91E8FD", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831851, "uuid": "5f40b128-b804-4052-bf25-3a845c5fa8ed", "value": "T12F5310094DE3595173B3B0BA97DE945A7AA7C0C74F8B9E203C8D439AEFA103485F85D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831851, "uuid": "cee6d652-0b7b-4e25-8742-9aac2ed4b5a2", "value": "768:vsJEryYUeNMZeZr2H3iFF9J50A8XZqP99pJW3gObz/P:KEr1UeNsc2HEBGBZqNigQ/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831851, "uuid": "0130376a-6319-4c2c-914f-435047eee72d", "value": 63172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831851, "uuid": "e62c7bd5-f0a2-406a-9314-9290c232757e", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831851, "uuid": "1824b384-aae2-4a3f-9cf1-80b95b2b8388", "value": "niko1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d11bdcd-b99b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677831245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831245, "uuid": "70d37cfb-af78-4fc0-9c42-fd56d6b5cbde", "comment": "Malware payload (Mirai)", "value": "458413a121cb4e58e9d0eea005c9bf35", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831245, "uuid": "5c504fb7-b63d-4b71-9a40-d9c6a0df677a", "comment": "Malware payload (Mirai)", "value": "6cac8eafecba1241e56e23986fd0426f2b3f2a41e4b9d573b9a8ef5ec37d7eb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831245, "uuid": "e55a8293-d2f9-4811-9a8e-a8a8dcdbf5aa", "comment": "Malware payload (Mirai)", "value": "fddacdcef1b0a847a6a5ce1b71649f81983a1298", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831245, "uuid": "20fc1e9d-3f18-464f-a28d-239ce9fc9e83", "comment": "Malware payload (Mirai)", "value": "d8f7e20994e14a18664c21072ecf5fcb2ed0fc4854039f9d1a368df9b682f8e7f17df0586276326f0429ca10d72f5c9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831245, "uuid": "9d8740f7-77c1-4183-ad7e-6c0a683ee7da", "value": "T1B6632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831245, "uuid": "09c23327-4976-4b78-b4de-33c929e70eb0", "value": "1536:qNSlxYmii8N1U9uO//kWEjMEikg/QA83NRuxAvjWX:qNnK7ktYEikg//29ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831245, "uuid": "cfcad939-b070-4c76-ac79-1a8e7c025973", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831245, "uuid": "22fab332-5463-48f7-b11c-93b2ba13c964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831245, "uuid": "44dbb57c-bae1-41fe-ad10-c3b95863519c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e401e8-b9a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677835747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835747, "uuid": "0b6b719a-d27f-4143-a349-4b5fccf87409", "comment": "Malware payload (Formbook)", "value": "e43e70829f350e566468a8d7b158ecca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835747, "uuid": "8e8c5672-2992-4488-b2ff-e39f4eb26324", "comment": "Malware payload (Formbook)", "value": "6d544e1b25b2081b2c9f895d5045085820ba2087bed05f20c2c59cfbc44bea02", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835747, "uuid": "efba2110-2347-4bb4-9d27-5744f017ccd3", "comment": "Malware payload (Formbook)", "value": "57a4e905a83e715a69e107dcc63f5bf8a606f9eb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835747, "uuid": "6a600b38-3cba-4da5-ae03-13a1fb206ae9", "comment": "Malware payload (Formbook)", "value": "93b6a47d7254f72c7859d7db613c37bda0e3381444499297dc9b4bad066b7f1803911ab36aa22ccda13c608748e588ae", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835747, "uuid": "2a216ece-70ab-4d4b-813c-5b0c914e6d33", "value": "T1BF1523A2C0EB14BDD19171301A790BCC7120602B67A9FFA5DB95E2F96A4B1F1C28C56F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835747, "uuid": "32927b89-d52f-442f-90f7-b56704c22648", "value": "24576:qhBFwctvyY1KgmwJR4AHCtsDrqdVHpYx/LFOmOaWSGx9:qhBFF0Y0HwMttYGrexXWS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677835747, "uuid": "36b9c14a-699b-460e-94a1-f099304880cb", "value": 881930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677835747, "uuid": "08ac9dd1-34f9-4f87-8056-7729392c6541", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835747, "uuid": "735bc686-56dc-4f2c-b91d-2c9e6bb3d3c9", "value": "SW_030323.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a35da90-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677845011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845011, "uuid": "a87d3200-354c-4aa9-bbfd-108df0a8ee8d", "comment": "Malware payload (Mirai)", "value": "30b7f44197e22bf0040fb09c2e0fe76c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845011, "uuid": "94b80c9e-31cc-48ba-a823-9aea9410fc1d", "comment": "Malware payload (Mirai)", "value": "6d5b5c08faf6639d52b5a4a2c51c6751bfc2d37ca952ffef8ac15f196fed49e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845011, "uuid": "a4edcd1b-32ba-4031-9022-e21ea427e7da", "comment": "Malware payload (Mirai)", "value": "9f8d932401c8adca7792663388b99b52f6ac61c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845011, "uuid": "46351e9c-333e-4896-bb7a-26fc0a29c13b", "comment": "Malware payload (Mirai)", "value": "1298954e68031fb5096efdc1f0dc120c6e41266021bef7cb12adb7e9e9428e2cd38dd2d39a055c3b105d1c356b307f02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845011, "uuid": "dc0e06ac-10cf-4e75-980e-4a1b4477c9a8", "value": "T1A2534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845011, "uuid": "50a00707-4ccb-4e90-93cb-5ac013bb1ea4", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQeLiKimfFoktCe3fYRMT:WShU3q7cEDlCK/0Dm9i8Fok06fYR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845011, "uuid": "fed1e47d-c7bb-4417-83dd-639bdfe086a2", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845011, "uuid": "da2172e5-3213-4bac-bed6-b9d0cf8def73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845011, "uuid": "52ea369f-c194-4ed0-8be2-4855633664da", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace13782-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677856719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856719, "uuid": "177dd5d0-0776-4b6f-a1d3-4ba4d3fbd1bd", "comment": "Malware payload", "value": "2996598ff4b0cadeeec06e229268e902", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856719, "uuid": "ef80e30e-6b27-4d45-a94f-5f69a14b579e", "comment": "Malware payload", "value": "6d767085284a6ebabf07a16d8c0b1ff91412b5ca84033f463fbeafffd5fe998b", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856719, "uuid": "a88a66d4-be2e-4419-a600-2cbd33f42358", "comment": "Malware payload", "value": "9ea49d0494accd64e67a74c46dbbcd3d21473dff", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856719, "uuid": "f1a17f19-188d-4a24-8620-cd639486ba89", "comment": "Malware payload", "value": "0b3223a71ab67e0486900c98c05386cc35aea58efa279c5db3e51e0a9467954b767c2dcac5ca0b519b69f606d250ce57", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856719, "uuid": "e6cd2ed4-2b77-42ec-92e7-ce87025a6417", "value": "T195B40111F6868A73F10621B87AD2A5175528AC36BA16CE4B72C7331F0337F725DB2E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856719, "uuid": "224ede61-73f0-45ce-b217-99fb4da49baf", "value": "12288:MFFRQSj1vs0Fq3ZQ9hvz3Nx4bPCiqEVrp+:cFRQS1v3Fq3ZQ75O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856719, "uuid": "fac5b225-da2a-49da-a798-d86eba3badcb", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856719, "uuid": "55d290d9-b129-4312-8751-97c8caa1e72d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856719, "uuid": "1c820815-489f-4db7-9e78-f2656c779140", "value": "Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4b2a30-b9e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677860770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860770, "uuid": "76ca71af-2974-4b6c-b89d-809a6404310c", "comment": "Malware payload (AgentTesla)", "value": "7bbc78c75cce8735c2b7696b3bb629e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860770, "uuid": "8448da5a-856b-497e-8b31-0688f867dc19", "comment": "Malware payload (AgentTesla)", "value": "6dcf77904aef5ad9de32ebd9191453a59230ad22a1ac6de0064f6db0354824f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860770, "uuid": "a97e8a09-2d49-424b-9486-89b592f3f825", "comment": "Malware payload (AgentTesla)", "value": "8b6816e20b78c289ff8dac76f44207fb4677522a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860770, "uuid": "782cc85e-f15b-4f28-9c07-593b0f6632d7", "comment": "Malware payload (AgentTesla)", "value": "18ef8ce5597fe1d0a3c9457072c6a7cfe9c2c7d78f163c93c93ad3515c2d06b2b51c0d77df0613778be4766f7427d616", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860770, "uuid": "b0a1cb1b-e9ee-49c2-8fc4-450112527d01", "value": "T1C354125D32D0CCE3C8B247319EF5027D5EFED4262486961B6BC0BF1F3419691991A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860770, "uuid": "3b32eb5b-5499-48b7-b802-602adb021d40", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860770, "uuid": "99dabbf6-6933-4b4c-ad8a-4ca56847b422", "value": "6144:DYa6BdCsWLtSYljN4+E9Kmxdm3ZJUbYLAlLG0qsewOGuVtaIUSo:DYrQrSYljpH6oZSoAla0qsew4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860770, "uuid": "ff1a92eb-451f-4904-b933-be97ea4598a0", "value": 279365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860770, "uuid": "c2ac35e8-1620-4bfa-9b1d-f1d6f83209a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860770, "uuid": "81ed9659-c936-47f9-a52f-3ed6ea83fe7c", "value": "BGD 1045 Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb56804-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677857630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857630, "uuid": "f3ff7114-9210-46ca-8269-522c7e0e8be0", "comment": "Malware payload (GCleaner)", "value": "991b4e2195f816f478726186e82dd1ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857630, "uuid": "8495cd09-1f83-46a2-b8e1-e594666e4284", "comment": "Malware payload (GCleaner)", "value": "6f09a1d30715544623eab7c311813fab28fe4b31068960263ccd7ff5812edb14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857630, "uuid": "e1c35ba0-ed44-466b-9229-cb6b16f4b936", "comment": "Malware payload (GCleaner)", "value": "9ed50806a3e0a9c5f0d76457ccc7369d1fc4e09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857630, "uuid": "29cb351a-19c1-42d3-ad20-a7962294e9ce", "comment": "Malware payload (GCleaner)", "value": "e1d020ad028fd5adcf6008321e741aec7280c85545af83d9678a56e024268aacc3493cc90440eaa3a7b61ca22beaa4ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857630, "uuid": "30d9989c-540f-4f58-a547-2b68214011af", "value": "T15F84E02239D0C432DDAB71344931DFA06BBFB43166604587B3B82BBA5F307D15A7279A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857630, "uuid": "300a3380-0d9d-43c2-a537-da21be8b8491", "value": "f37943ad193a52d7b21e245b891de4bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857630, "uuid": "b24917b2-ca75-47b0-bfb9-dc5100bc9206", "value": "6144:C3vILLyDwfzf6aokbVFXH8caFnWi7iDEq/F0sJX9l:/eDwbf6aRj38ei76EqLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857630, "uuid": "d9c1545c-901a-4056-a926-277f538be77f", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857630, "uuid": "ec139d17-d07a-4ba5-9a03-8bb9a5128f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857630, "uuid": "a02a645a-f7a9-4ac4-a227-d0e7bbff6016", "value": "991b4e2195f816f478726186e82dd1ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace774d0-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677857578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857578, "uuid": "bfd5e068-d573-42b7-aea3-2b2c374244e7", "comment": "Malware payload (Amadey)", "value": "9f95aa653961e218f8421439d8359379", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857578, "uuid": "79bc6eb6-986b-46fd-83dd-a0301ddba949", "comment": "Malware payload (Amadey)", "value": "6f1b5358eb811f0fcca3b0ae1ca98e00601a813e39dd5314745c8fd9294a709d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857578, "uuid": "90a6884d-aaa2-4394-9238-e574e412e3cb", "comment": "Malware payload (Amadey)", "value": "434405388586351dbd97773158c626fde0dd6b6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857578, "uuid": "b94f626b-44eb-48d4-9d84-0f6c0ab2124d", "comment": "Malware payload (Amadey)", "value": "d61177f73ef13da282b6a00ad2aa114e8ce37d91ea68c93146a474fba3f118c77593e1202cf3b3c042b9fe4cbb86a41e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857578, "uuid": "0ff78519-22b8-4c26-95d1-1aae9c81d901", "value": "T137151207E6FCD466D87487700CF603C31A3A7D116B3987DA638AAA4A0C73568B53676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857578, "uuid": "a0c7d0b4-0227-4004-9eb7-7455aacb4768", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857578, "uuid": "6261c44f-47d3-4421-b6fb-33dfbdf72e5d", "value": "24576:8yyuYVsveYkbErkny2IZmXGa02aK/SwHXba:rxYyvp+y2IZ8Ga0aHXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857578, "uuid": "cead9fa0-b21b-4229-bdfd-41bdae487d29", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857578, "uuid": "679bf0be-61e3-420b-baef-99c5af152eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857578, "uuid": "1ded2917-c685-4b5d-8e46-5c1ed77e9f29", "value": "9f95aa653961e218f8421439d8359379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb12007c-b9ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677853414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853414, "uuid": "0bd16e15-2caa-482b-9df2-0241cc0c11bd", "comment": "Malware payload (RemcosRAT)", "value": "e91208f7cebcaa719faf36604d0f7095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853414, "uuid": "0f20272e-8c27-4e0f-a4e2-38a37d496d6a", "comment": "Malware payload (RemcosRAT)", "value": "6fd84d8f93ed3a6b37c938b22ac46dbb81b3710fc4e612e78c275c2ce69af81b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853414, "uuid": "66adc059-dd84-42c4-90cf-14a56b4f0391", "comment": "Malware payload (RemcosRAT)", "value": "4ea06385857c44cfa93916569029e5421642b4a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853414, "uuid": "6b98a60c-4ffb-4a1d-bdb5-95bd16faf895", "comment": "Malware payload (RemcosRAT)", "value": "2edeabb62a72f508e57148bf90d6045a5c2089b1a17c856fc897793f03474a11d239d07293bbee6a77a91b86a77f214e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853414, "uuid": "c27aabaa-32a5-4c65-b9c4-a33106513aaf", "value": "T167D59DF04F92FD41D3EF1E7090EC19805DA85A9B92698349BCCD65569AF2740EFCC2B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853414, "uuid": "4b089a59-0f9f-476c-8dbb-5f4d48fd63a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853414, "uuid": "63b22551-be42-4721-b696-2641d3c9c2c6", "value": "24576:ayfaCYOk1NuydV/zBMmoTHvAlSBYBQ7+GEtY5kdtvaI509iy5kHuJMAx0cDxjJHy:SNU7bYy5l/0cDxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853414, "uuid": "1fe4d9c3-1e81-482e-a2f5-20b3219266d1", "value": 2801664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853414, "uuid": "043f796a-4169-485d-8956-c31b5c6e2cc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853414, "uuid": "b919b334-07d0-485b-b474-4d29fc99f47b", "value": "562720_docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6065f5-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857364, "uuid": "82810eda-d9f1-4a05-b187-cec457f836c9", "comment": "Malware payload", "value": "837bd37f00acd9d8d32a5e28e060d445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857364, "uuid": "2ab1c8b4-be82-41c6-b4c2-f6a6ff4f8eff", "comment": "Malware payload", "value": "704578bb171542f0f919dac2b1a2efc119eb7e048ec79df993ce41c2a044f247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857364, "uuid": "f04f7c05-d10e-4e30-82fb-8f8a27e47f2e", "comment": "Malware payload", "value": "30fcd32f8eeae7f1a6806f98eb2f1af5b73a2078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857364, "uuid": "224ac23e-d64f-4fd9-b54d-ae524b521e54", "comment": "Malware payload", "value": "8d40668909f6d5326106bfd981a868ef2e645bf80a167d4bd67ce315028f7bfd0b27f3b323b660432889de4b6ce4e370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857364, "uuid": "0a6e2e9c-8a2e-4978-9d4e-be4c1f1eb72d", "value": "T1C675F069103D02C992BDC1789A46685FF3A5ADC5632CCFCF689059E613236F9B37F290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857364, "uuid": "f2e3fae7-9097-44c3-a198-a14ee8b98582", "value": "24576:VeeYql/FhIMp2uujwvTRa3j0Q2TVqck0BGy1zZDbyB68viSU:Vv08Ro21BuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857364, "uuid": "b45ed910-f85d-4dd5-be05-151c47040e65", "value": 1675850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857364, "uuid": "316de7da-a024-4eb3-8905-9b6c0c830979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857364, "uuid": "9f809d2d-f88f-4257-856d-23cef433e10d", "value": "837bd37f00acd9d8d32a5e28e060d445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21cb444-b9f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677868378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677868378, "uuid": "b702c656-4add-452f-9c93-539fc3da0f45", "comment": "Malware payload (RedLineStealer)", "value": "e719edf6c407c2e79bb94366429774fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677868378, "uuid": "e41680ab-0d4e-415e-87bc-8ae8adfe756f", "comment": "Malware payload (RedLineStealer)", "value": "70bbe3233b22e964ef757d5e58148674c2d700ee272874d288fa86274ec21756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677868378, "uuid": "7bbf59f7-339d-47c8-8e84-5ed49b890e3c", "comment": "Malware payload (RedLineStealer)", "value": "88a8f94e22b75bfcb230c9ded63c3609ef7178d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677868378, "uuid": "45e44f6a-16f2-400b-9b7f-8728c65689de", "comment": "Malware payload (RedLineStealer)", "value": "58f5fa299bb90262eb5a6fb10ac6b8964869ef876e0cd34972c717152df098c48439ae3d03ed0c4d9da0e6b0cd4ad4b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677868378, "uuid": "26b6c0ce-886a-4920-9e57-7969c86a8c4a", "value": "T10064F13072E0D435D1721531D961CBA56A3ABCA3E934449B37983B3F0EB03D19A6E7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677868378, "uuid": "2a93477f-9e68-4323-986f-ae1c0647b4e2", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677868378, "uuid": "5aecc369-31fb-4ac7-8b2e-c4b5bca75f01", "value": "6144:PuQTU8iE20fCRaYqV2beaZWlPEBQ8eC8jtdyNham50MRw6j:PuQYjp0fCRhqVowxEBjehtdqhaY0Mm6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677868378, "uuid": "a91fdb02-3011-41b3-8cec-3d1f69b6359f", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677868378, "uuid": "dd396acd-8b0f-418b-9308-e95a1b68746e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677868378, "uuid": "4e019fc4-6eb8-4a92-a9b5-8ed33ac063f0", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29983.7956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b72572-b9fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677873534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873534, "uuid": "4a3301f9-e1f2-48ba-a9f4-876e3b77efb5", "comment": "Malware payload (Mirai)", "value": "ecc921298971e4c4847f1fd843f34446", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873534, "uuid": "377ad688-b443-4326-aff0-8ed7fa00d4d8", "comment": "Malware payload (Mirai)", "value": "715b8a2d22f853c00e2720fafaeb53e697856940d5d2ced96e783647015ae809", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873534, "uuid": "935eb18e-5a27-4fc9-819f-3a8ef6ea9401", "comment": "Malware payload (Mirai)", "value": "c8562f69c09cce1e0f8991d7a23d80b9a8964bf7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873534, "uuid": "7d4151cd-197b-4f08-810a-517b4eaf5bf9", "comment": "Malware payload (Mirai)", "value": "9618357e90573326c1725e2fb4b15b5765caa32117b022bb4bd03af16191f2e2536dd7fbb436b422ac6962b83210fd26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873534, "uuid": "eb181f92-3290-4106-a1cc-37671feadb3e", "value": "T159E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873534, "uuid": "b0919165-50fd-4faf-b4e0-78c59605a1bb", "value": "3072:yJTc2PBSpmk7Oabvzj4dlRsh8ZQIldMMXkkTM/9zY:yJTcGoOabvzj4dLsh8/MMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677873534, "uuid": "16093522-f660-48d9-b877-dd2f1364441e", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677873534, "uuid": "dadb6234-43e2-40be-a80d-ff28878bf70c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873534, "uuid": "a2ff321f-fb95-48ec-bc2b-06689f092e4f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bb24b0-b9b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1677844391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844391, "uuid": "0c90ef97-746b-4f0c-86ee-547eb89c899c", "comment": "Malware payload (Quakbot)", "value": "7df3a35cb1fa408bd53024b7cd411597", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844391, "uuid": "9cd60848-b2d8-430f-b22e-098e9398e809", "comment": "Malware payload (Quakbot)", "value": "7262b71927e6dd017e316ab831a135be8d5ff64d5f8075431192a5f8781e637e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844391, "uuid": "a644d2da-4425-4d66-9b36-258758ed1ff6", "comment": "Malware payload (Quakbot)", "value": "92e75a6c17b0b83a68f61cef0a4125cd9e89528c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844391, "uuid": "07d6d643-5dde-4277-bd11-fe06da2ef06c", "comment": "Malware payload (Quakbot)", "value": "e59452ccb21d40933872659f6afa9894e55b195fec28ab579a83f1707b2bffdc29a21342d5c9ee4dbc64f8666a50412e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844391, "uuid": "f4a9c786-af40-4c89-9187-ff09d486e219", "value": "T1D0947D2BFD4F50F9ED1B04FAC047F77F6E3C53698A20CCA5D8580E59ED656A6400AB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844391, "uuid": "2c6888d6-767f-42ac-9152-f4db28728763", "value": "4160b8ad2228905966ea106c1f7681d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844391, "uuid": "b9a3e93b-9a1c-4f3f-8728-e5fd84c78abe", "value": "6144:cJZRRRe1q7wXT1BakCSLdzOr2ewln8V7zDaVtfCvVBKR7fh1TiIBNYrIIg0a2Mnn:cJZ701nXT1BaB4Irm8VGfn1N2g52MIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677844391, "uuid": "095352cf-6628-4b17-a90c-adb82869ec8a", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677844391, "uuid": "342ddfac-a3c3-41f5-af7a-2c0ea9ae4656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844391, "uuid": "ec9eacd1-54ab-4a5b-a043-97e70ca0e308", "value": "pdijo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d06a8b7-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677857336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857336, "uuid": "f0ee1dc7-63df-49af-af12-9453ab51cb66", "comment": "Malware payload (RedLineStealer)", "value": "bbd066e57f6704cea9ac928097f3c9cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857336, "uuid": "e03dea01-9ab5-4cbc-9b11-450f024a60f5", "comment": "Malware payload (RedLineStealer)", "value": "73ab8018aadf7c94b7ff2ea58f87cb2dbc48bfd5a0c0d82435267442238d27b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857336, "uuid": "90cc8762-36d0-4d65-98d9-33a6d2ceabce", "comment": "Malware payload (RedLineStealer)", "value": "a5c794968c4dd884c97588d4cc32dd71e738586a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857336, "uuid": "c742c802-5904-49d5-879f-7db6e35bddd6", "comment": "Malware payload (RedLineStealer)", "value": "a740d7cca7ad7e456c04d98ae469fefe069a9ad79ecba1c112c59a98f0e49823a056a23db5f9325410dab41325e4d68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857336, "uuid": "01aa0692-79d8-49c4-a9dd-ee28b8242d10", "value": "T101F41217FBE84436E8B0437089F216D71A35BE616F35824B238E695A0C725B4F63237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857336, "uuid": "ffdb753b-5ee2-4cba-8824-9caeed0741a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857336, "uuid": "f467a95b-dfad-4310-a055-5a531844af6f", "value": "12288:NMrwy909IMdadDoTm4Og+1BTQRlMVyvJt5JbxuoWERx/2BA8y2ij02iP5dTZ5qH:xyS5mklMVyrYobIW8y2O0zH1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857336, "uuid": "6c07f414-763e-40fd-89f1-873c885c8247", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857336, "uuid": "ae43f0a0-596b-4f88-84c3-8f340f87c621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857336, "uuid": "732f9cf9-549d-4b69-8a90-2e2d9b7adc80", "value": "bbd066e57f6704cea9ac928097f3c9cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778becb2-b9df-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1677860495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860495, "uuid": "622b3fb2-9d2c-4dbf-a98e-ef058f4c7d10", "comment": "Malware payload (LaplasClipper)", "value": "85c9a28eaa913e48744e777d28537079", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860495, "uuid": "982db84a-6c0c-440c-a90b-5cfe4f18fa3d", "comment": "Malware payload (LaplasClipper)", "value": "741c2bbda9253574e301e24d9699b433bfbe471d0f48df3b30296d023c559761", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860495, "uuid": "bcf1e689-3282-4c1d-898a-f0de6a3180e9", "comment": "Malware payload (LaplasClipper)", "value": "ffa5616be92faf41515f77a07b7a04f39d4f7a74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860495, "uuid": "01abc27b-72e9-46d6-8679-326d3cd5f58e", "comment": "Malware payload (LaplasClipper)", "value": "1e4d3317f2a98793a2b71689745269f405c2c2fc717a231373e52030a3d17aa79325277bfd75798dfab3e2365c011270", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860495, "uuid": "2b12a6e1-32bf-40f4-97d4-421b00a23084", "value": "T15D852323F5E1A451D5724E309909D3A86E26FC234E6D678B3734FB3F1D706E09A62782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860495, "uuid": "14784921-4608-43eb-9f4d-9895e9c7c9e5", "value": "31e8556425ef4035dbfc678a002ad91b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860495, "uuid": "230ca31e-73b5-4c44-8eb6-a154adeae59d", "value": "49152:OWT0JZkZ6LalLXDILGs6G2P5e/u+J7L08Gjnis+:H0g2a5ULr2BnJjn/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860495, "uuid": "e36923d6-c939-4424-957c-9cf2e27ba01a", "value": 1872384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860495, "uuid": "b1ded91c-f9cb-4657-8fb2-f87f46f692fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860495, "uuid": "6013d49d-c2fb-4427-892e-ac414abb6870", "value": "85c9a28eaa913e48744e777d28537079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe5ea47-b9d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677854147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854147, "uuid": "1353b0e8-4412-4bc5-830c-566b0df18c44", "comment": "Malware payload (Mirai)", "value": "f0229ea322e646fab2872d1093492c6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854147, "uuid": "03a023f9-7609-438e-b8cf-5f764d1203d1", "comment": "Malware payload (Mirai)", "value": "75a0bcd84e8be1677771b554fbb965e7414b3e1c46028f224b206a54ab61e76f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854147, "uuid": "39dee9d3-ed96-4ac2-875e-bba33ae5e474", "comment": "Malware payload (Mirai)", "value": "1fab1a85718d83c2b62d5e0e55ff0c19064070f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854147, "uuid": "0057112a-d525-42ae-84d7-37fac8914ddb", "comment": "Malware payload (Mirai)", "value": "384a93d6a1f5f6a7421b67fc8db16f57533c213cf34ddc510d0d72525e43db3c1ef61ccf86d566110950e8b061b9a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854147, "uuid": "a39d6339-b272-40b9-8aab-d4f5e735c685", "value": "T179438D36E96E1E74C08641B074748EB56F23A5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854147, "uuid": "4b221b79-edc5-4a4b-ad7f-ee2f3d0ca30e", "value": "1536:Naa0brW/Od9hlCRbKrfUKwXQCcpvDCM12+WL:Nv0brWGd9X9rfbwapvDM+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677854147, "uuid": "2744da13-30af-4148-827f-0b6601d83c97", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677854147, "uuid": "b08494a0-a390-4f54-b683-5e678cb76f94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854147, "uuid": "a3ac1215-9cfc-4df7-8e5c-22e6d68289ee", "value": "f0229ea322e646fab2872d1093492c6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6e3c33-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857253, "uuid": "03693187-4987-45ed-9cdc-47d5e2409dd0", "comment": "Malware payload", "value": "ba8040743dd8b9ea43a6af84f4e5e219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857253, "uuid": "b5681e45-a245-4d30-ba5e-34a867de5c0a", "comment": "Malware payload", "value": "765570a4f886c4a8d375215274e457ab165eaedb81ccc2253f04e236ccad2056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857253, "uuid": "dc6bd33e-d62c-42ca-8a1a-16805295cafe", "comment": "Malware payload", "value": "5c239bb75ab8dff362348323b26cf00d4a322775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857253, "uuid": "dd3d930c-ef11-42f0-a9bb-0b8d6a827855", "comment": "Malware payload", "value": "630d6c5d664aa0d825a27a9c1a6b463cba931114c8a809a6110f262ee4f3dd83ccdf4680b235af436af7a9728a95723b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857253, "uuid": "bf789477-04f6-4208-be55-cca428723f28", "value": "T14535121473A05CE5E977823ACC53C506E6B1B8324354C6AF03B842AA9F676E19D7FF81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857253, "uuid": "3b4911d9-0272-42e8-9a7f-9472f589fc7a", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857253, "uuid": "3787c6c0-f225-43b9-a8aa-e35228278c41", "value": "24576:1EWrw69TPt+vIxPbz9BPyJoiu3dV2AWQVL6/AGzhbFeR0h2NkMnY9:o6TP7PjaCiQLMQVG/Zz9FeR0h2NnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857253, "uuid": "23edde9b-3564-41e0-9afd-c7b45d6f95f6", "value": 1161656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857253, "uuid": "6722b85b-cd48-41fc-8534-5c2110ee364e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857253, "uuid": "46571b7c-0f64-4a05-8285-094febd515c3", "value": "ba8040743dd8b9ea43a6af84f4e5e219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371499cd-b9f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677869406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869406, "uuid": "a24eb966-0dd1-4c07-bd2a-f94210fef0a4", "comment": "Malware payload (Mirai)", "value": "7d4217c92836075110d361195839e881", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869406, "uuid": "0c6e08a3-4b0e-4d9d-8e39-c9a0b1b763fb", "comment": "Malware payload (Mirai)", "value": "76b0ae3a36fbf4c63455fd08bff9f6673fcf507ba6d05b88ff19a2a5b4d1c4d1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869406, "uuid": "7aef76fa-2b5f-40ef-a249-6c06e938db47", "comment": "Malware payload (Mirai)", "value": "abe44bd1fd84c557db4da77d3ddefaed23048725", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869406, "uuid": "24b4d86d-6e80-4e9a-bdca-06ac97658ed3", "comment": "Malware payload (Mirai)", "value": "8e0c87b2902781b2e0389c19045cc1e405c9152b147d3f69344ccea90411300c4de6e1c414385370e1cfb933dcc1e956", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869406, "uuid": "6325aed0-0814-43f7-a230-38d42da377a6", "value": "T162832A46F9628516C6C026FBB56E50D8375A53FAE2EF3203FC111F143A8A94F0E37A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869406, "uuid": "aa1c57bb-11f4-4d80-95eb-71fc3a21e971", "value": "1536:MIvcntWQ7e0ULXiWnZ9aRdP3t5XSWidEYILo0/DqIH:lvytKjUfbX/id9ILWIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677869406, "uuid": "00e21417-693c-41e9-92bf-1c7dcedf7da1", "value": 85176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677869406, "uuid": "4f5a2968-46c4-49d6-88a0-c88cd451abb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869406, "uuid": "566700c3-3e0e-4152-82a0-db8afc1f6297", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ed54c0-b99b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677831259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831259, "uuid": "de0f9110-20b3-4dee-9278-f278f77e4adc", "comment": "Malware payload (Mirai)", "value": "f22851d234bdf0ab3ab09533fd0cf2bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831259, "uuid": "a2638377-51f1-4b96-a7f8-f55dccaabf73", "comment": "Malware payload (Mirai)", "value": "77d045390748ae49090acdde5fdc3f65412d568b1e9ba0b5ecd7a6f61afc698c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831259, "uuid": "849689c6-9b53-4a6b-95ae-7b1f5774e318", "comment": "Malware payload (Mirai)", "value": "ed41ee0c8f448d2c3b61b11863ce5404a34675b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831259, "uuid": "20eb51ef-b9d4-42f2-b2d2-13d04ddd1dcd", "comment": "Malware payload (Mirai)", "value": "c532f837531c8686f3886a031275bef9d3174fe9d13ccafa9cf01a2eb12acbd802f91f8bd33589fc8c8a7bfc7682f6ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831259, "uuid": "7d96f9aa-9b95-40b4-8032-0186a1e006c4", "value": "T1A203F751BC829A77C2E1137AB6AE4A8D332163E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831259, "uuid": "1142ad25-d62c-4594-b529-f580adb7b467", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTf/NYwWY:svbUG5fPlUlDf4Sycv+PUYjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831259, "uuid": "c1e6beae-b713-4a94-a649-87d0b037a538", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831259, "uuid": "be80a22a-2e24-4c04-bdbf-94eca7dba2b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831259, "uuid": "4902200d-b6d8-4b17-b38d-171462ad1070", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93254553-b979-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677816732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816732, "uuid": "6ddc8ab6-f5ab-475f-8a15-d8303a68ac00", "comment": "Malware payload", "value": "90a727be0d8f6794cabdb96ddc248161", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816732, "uuid": "ef729c97-cd96-4f84-bba8-90c3e6ec16d7", "comment": "Malware payload", "value": "7ac709aa1616c2dfb604e2d14a2063e054356130ae04fe58ade6217c23e41a03", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816732, "uuid": "49880ec6-f8ea-4e82-b1d6-648ace6802ac", "comment": "Malware payload", "value": "8b8db14af16c309819e78c4362a5d34e071a319d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816732, "uuid": "e0800dd5-e9e0-4b4e-a58f-7aaaf2f02e58", "comment": "Malware payload", "value": "ea911f4ac9861b15341184cb25a727967bc19ff484f01f96c0a0b915bb99c63d850e1807ca0e4807dba6f1ddd48ce0c6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816732, "uuid": "63518eca-20f7-4e05-a809-7cf76cdc399c", "value": "T11316F143F348A52FD4B7C1360AB70736A1964C1A9A43D3573A58726C6EBBAC05F85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816732, "uuid": "588b43b4-166f-4b71-a61d-371fd27c3911", "value": "98304:yf0g/wEiW2OIw/62cgTTQ9Me2ePdlHAWG:oIe27c62cgfWPH3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677816732, "uuid": "75216aed-ea6e-42ca-a4cc-583c3c16d0d6", "value": 4042283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677816732, "uuid": "ccf796c7-f005-4c19-939c-33ced7afb225", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816732, "uuid": "7159f59f-c759-4c5c-bf81-2efa62451a49", "value": ".apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df12f14-b9f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677870626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677870626, "uuid": "47aba2ac-f667-4508-9a37-462e7167f0b5", "comment": "Malware payload (DCRat)", "value": "35f8c41857c63d0174ed4537474edf48", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677870626, "uuid": "30f76516-165c-43b0-aa7a-f8818fed00e8", "comment": "Malware payload (DCRat)", "value": "7c8d436fdcc4f62cd2920784ee3035ab927dffb2e586e7b121e88a50f3f9c7c5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677870626, "uuid": "8bf2523f-e41d-4faa-baaa-904db23aa569", "comment": "Malware payload (DCRat)", "value": "0feb78c767eaf488d485e30b0e050dc20468d9b2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677870626, "uuid": "dd89f822-624e-4152-a45e-47217afaa79a", "comment": "Malware payload (DCRat)", "value": "1c46e99f14aa6451ea4724854b6645f463dbaaba798aebb595b1b034cf8c99a52a4381dad2a63dea1fbe84c07093ca5b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677870626, "uuid": "4c2c7989-cb58-4edf-a95a-59f58d65dda4", "value": "T1BAE5EF027E448E11F0581233D2EF458887B4A9516AE6E32B7DFA377E56523A77C0C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677870626, "uuid": "83db0b04-c652-4cd8-b568-d608ae3f7c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677870626, "uuid": "b67ab7e4-c399-4f24-a40c-d2d3fc821206", "value": "49152:vX32jVOUZqiksQ4LCsrOuMj1uHI7A5YN/U79VTorX1gIkFp/n+WoVGSEex:v20NHsrNMjcI7ASGorXEVSEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677870626, "uuid": "662f4ff8-3fe8-45b7-b10a-2aa345f1415c", "value": 3098624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677870626, "uuid": "1971ecea-0e18-467c-a353-72078ffa5f71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677870626, "uuid": "909d0976-bbc0-45c7-81be-184afd6535f8", "value": "35f8c41857c63d0174ed4537474edf48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687ef68b-b99b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677831264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831264, "uuid": "e931939c-d24d-451a-bff7-e3fbee8ef43e", "comment": "Malware payload (Mirai)", "value": "6cef22a7ca434d07230cc2a4448982e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831264, "uuid": "53d199c6-8218-4fcc-83de-127998640a7f", "comment": "Malware payload (Mirai)", "value": "7d2a76a0c9668f2ff62db1146ad21927f4fb6f5082f6465aeb6b36db3d168220", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831264, "uuid": "e9058311-7499-42a8-b6f8-4ed5e93d1b12", "comment": "Malware payload (Mirai)", "value": "446669273f7c88710c978cad2e5d476c6fde8877", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831264, "uuid": "123b7969-7f57-4c20-8b36-82851b76c26c", "comment": "Malware payload (Mirai)", "value": "2c7f07fda3a43eccd28939dd2cd3f70acd302bb2e0eabf2b9330538f73bf6a5d1d954c263cd3d300abf81e3132350267", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831264, "uuid": "c897a70d-98a1-441f-9567-1a83b34b0bb8", "value": "T19F83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831264, "uuid": "4c99b34b-d189-4255-8639-78eaf8972f83", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTh7ZDYovZ73x/nL8y8QK:Rakdn2Eo3ePu5GThRYo99Be037Wv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831264, "uuid": "952991c3-47ee-4683-bd0b-0d4d3977cec3", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831264, "uuid": "eb4d3526-3ca1-4895-b5b1-dca8c0b5c606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831264, "uuid": "6e3a9012-f4d6-4e3b-8ce8-d1cbf0d40334", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193d700c-b9fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677871933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871933, "uuid": "7e406c75-fed2-4224-8934-5c43f7ff129a", "comment": "Malware payload (Mirai)", "value": "b0875ecf10f1b2054e07b2c337a49d14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871933, "uuid": "4b50572d-5232-4034-a3fb-6fb24f2b4d92", "comment": "Malware payload (Mirai)", "value": "807f146ab1fd3be5368cb35d7926cdcc5c0300e793907b9e6edb329e8f3d7606", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871933, "uuid": "cb47249c-e652-47dc-875e-577f89b0602f", "comment": "Malware payload (Mirai)", "value": "8cdfe0dd390752abd45b7c75520d06ca60b2c37e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871933, "uuid": "050ff163-c34c-4355-8933-295d4047bf11", "comment": "Malware payload (Mirai)", "value": "aec546bfb558ea5e97d6135e0eb76404146b7b9810f5e65c9eef851fb28272c4144e90a16b49b9e066cf0bfa1453e586", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871933, "uuid": "e65ff06e-21ac-4d5e-a60a-00d15ece220c", "value": "T1B2A2DF0925CCE971D1B0943FE23CC317EEDB43B622FA32791E0806A9A45491AD3BE945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871933, "uuid": "ea63b868-1138-4eb9-8d7a-46ad5d3bc83e", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbtpOnhymdGUop5hXD:Ypoh/DxCvhdR4IjWVFbShYs3UozJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871933, "uuid": "76281fea-da27-4b2b-9748-9a663c8ab906", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871933, "uuid": "9451d549-3fe9-4809-ad25-72ce2a30364d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871933, "uuid": "33ce1060-1c65-43b6-9e1d-c722fa2caa30", "value": "b0875ecf10f1b2054e07b2c337a49d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec67633-b97e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677818712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818712, "uuid": "3d3e409f-6ae5-4d03-be86-93c1862a034c", "comment": "Malware payload (RedLineStealer)", "value": "b6e1b6d19593be5ef7eb8a00086f81aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818712, "uuid": "62a5d983-a627-4716-9502-b978e09b585d", "comment": "Malware payload (RedLineStealer)", "value": "80d0c5dbc5c1e76b51d9e2f014a2bbc57efd93247daf75efee17c5877e52a0e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818712, "uuid": "1696503c-7fee-43e3-b1c2-70b86f316a64", "comment": "Malware payload (RedLineStealer)", "value": "94c57ba8e2794be5bc972a5542d2e35b438c807a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818712, "uuid": "e2cb1498-c87d-4545-8fab-b166d6b62d08", "comment": "Malware payload (RedLineStealer)", "value": "e9311dfa0db14858d5e2ea0eeeffb6219b6b5f6b0493810b7c4304cd74a031692a7dcfd789f6a53201a8119e73b8ab51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818712, "uuid": "fa3b5e67-1a48-4e97-9a0b-fd8b2f54333d", "value": "T181C40107F6EC8032E8B497705DF643D31A367DA06B788797234AAC5A1C726B0E63175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818712, "uuid": "711cc045-1dff-4fc7-a099-ab01a4aa0c75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818712, "uuid": "1c2963e8-97be-4774-b627-c8929e3b53d0", "value": "12288:fMrey90w4fP09Ov4v8GEBk8+9FMInHBdLrCEl2ldrgoP:py5kIJv8c9LHvCEgldr9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677818712, "uuid": "eb9b00ed-9e32-4988-90a4-123a02305f51", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677818712, "uuid": "c27c3a34-7066-463c-bb69-bcd103a4f37d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818712, "uuid": "79c4cd5f-cd9b-47b5-bf6d-21d61a779290", "value": "b6e1b6d19593be5ef7eb8a00086f81aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5367aea2-b973-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArechClient2)", "timestamp": 1677814049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677814049, "uuid": "22fa0507-9e04-4670-809d-6242c28a62aa", "comment": "Malware payload (ArechClient2)", "value": "6b3eda93e5b2fc51b6921953ec4e21d4", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677814049, "uuid": "13738cc7-0fc1-4f84-8576-c6f5d0d5aed2", "comment": "Malware payload (ArechClient2)", "value": "82b3797d5b89cdf94fb0b35af9b5504148d23b9dec19daadbedd36a9d3a89d8d", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677814049, "uuid": "d1bc6572-4bb5-4d3f-af39-7670b4885cc5", "comment": "Malware payload (ArechClient2)", "value": "c9e20ce3493b1e476914a7a6d24482a7a2c00154", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677814049, "uuid": "a0ebc24a-9999-469c-ae01-cb23b89b7d20", "comment": "Malware payload (ArechClient2)", "value": "8138a1f71142ab6cffaef67cae6ff516844f7cd0390521760e3718110e437e8143330030bf0ff4bc08beb6430e530461", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677814049, "uuid": "4c5f10c5-4576-4529-987c-44b0ed48970f", "value": "T1BC95236BFA818537D4320F3C8E46D5E47478BB203E24585BB5D51F9C9D3A183672E28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677814049, "uuid": "b344e001-1798-43dc-b80c-448741fa3e46", "value": "7e2e792007af8a2af2f9d1c4356d769a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677814049, "uuid": "b8f4cf35-8b31-4afc-9d7d-58c3fc807d14", "value": "49152:exBvC3gNpMMnpWZa0bSyfYX5pJTWm/SXFZ8BADAB:ef1LWZaegXvUmcZ87B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677814049, "uuid": "fb874fa7-5392-4b1c-bd64-e5929b3dc910", "value": 2062075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677814049, "uuid": "c3ff225a-2552-45a2-acbe-0790b6b0effb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677814049, "uuid": "aa06acb9-b044-47ba-8e7c-ee7c5f17a340", "value": "SecuriteInfo.com.Win32.Malware-gen.3518.18422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97efab5-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677861572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861572, "uuid": "1f11b5fd-e04a-4b8c-8025-bee849e7b043", "comment": "Malware payload", "value": "36cb458888c88b9517ec5cf7c641611e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861572, "uuid": "36d9e9c3-13d4-4454-b1b8-9667930ff60f", "comment": "Malware payload", "value": "8354ebffc91c278f656fbf8bb511c776b24665a55bce97289d3ece1224fa14e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861572, "uuid": "fa1b1097-40ce-41e9-abb4-7407eb363d7b", "comment": "Malware payload", "value": "863412a2c0d67ce534a26df20abbc9135a42cdc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861572, "uuid": "9c10ca04-8b25-4b29-9921-60c6f4e97db5", "comment": "Malware payload", "value": "7fa33ece3e10be3efdfdd25e133c16745dfcb6eb315117e6df688267a27209ce24856354523584190b619f033aa2485f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861572, "uuid": "44b16599-dcee-4006-84fa-5d3ef40d3f44", "value": "T15BD59D32BB049132F6D211F1881D1B6F894C953403B940D7E2D67AD969E0FE36B36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861572, "uuid": "2ac108d8-33a9-4e04-8139-33bb8238d062", "value": "4825ef56a06f7fb58d67dc608871939b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861572, "uuid": "b27eabbb-e1c2-4f8d-b063-e72a3756d37f", "value": "49152:dntHBrqP4eKtmPua5wB/kzqCUVhs32evzAGeMqII/Vh:BtH1qPJYczqCUVhs32C4MI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861572, "uuid": "ecf5b6a0-0220-4e8e-8e78-2c320536ac2b", "value": 2814976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861572, "uuid": "68d3e6e5-21eb-4a5a-8f61-110cb8a7211c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861572, "uuid": "abad1e4d-f049-4b23-835c-4d904b8f7b33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcaa91d-ba07-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677877554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877554, "uuid": "38cfc5eb-acf7-49c8-9f7c-eeab5be8720a", "comment": "Malware payload (Mirai)", "value": "c30cff600b37b184ddd89eae375be6a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877554, "uuid": "30110fb7-26af-4c03-ab05-eb85423418be", "comment": "Malware payload (Mirai)", "value": "835b82d66420dfe5c2580fde5277ed22ac991a416e8a52c49f7501a0f8ea410e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877554, "uuid": "8aedcbde-21e3-4d82-949e-17a43183ba3c", "comment": "Malware payload (Mirai)", "value": "ab1fe8004d88e8b437de8979695515c28b3a0316", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877554, "uuid": "cdab3737-b248-47b0-bcb8-d8692be1785d", "comment": "Malware payload (Mirai)", "value": "092abc4fffc57fc7d80d88d7ccaa34716ba7c8eb308eb3f6ad4fd7397a8814edd482e1644e8f4238fe641f9fff305fc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877554, "uuid": "dfa69204-76c3-418a-b53c-7ce2db2347b3", "value": "T10A336B36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877554, "uuid": "0632ed9b-c925-4243-bac4-3c50dc7ab351", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677877554, "uuid": "afee8cdb-5b2b-40fc-9805-87ecab740495", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677877554, "uuid": "97a64cd2-5497-4175-8d6c-e1537db77410", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877554, "uuid": "991f8977-fb52-4ae4-ae2e-ff31dc103fc4", "value": "c30cff600b37b184ddd89eae375be6a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d47312-b9eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677865854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865854, "uuid": "2962dfb2-b4b7-4f10-9ab7-b1e8e45b85b3", "comment": "Malware payload (RecordBreaker)", "value": "2dac34c1231506d10ea2d2e75c461af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865854, "uuid": "d70c4bb4-d748-4748-909f-5c579be35efa", "comment": "Malware payload (RecordBreaker)", "value": "84541b03e47532c939c35ce35e35c9fecaa886accaace5e34cf005646babca17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865854, "uuid": "c20b9fdc-44b9-4f70-98e2-be7a3712cfaa", "comment": "Malware payload (RecordBreaker)", "value": "78db9698a5bcea56e52e93cc5c4d1f50135d7af6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865854, "uuid": "b521c0c7-6596-49fe-8682-bd5d9f11047c", "comment": "Malware payload (RecordBreaker)", "value": "edc5814c90522e0475c49a3ee7d5592ddb031fec7e6ee1ba1f8c9b958258721e9ca7258a6d11d9a67750d53e996fcd23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865854, "uuid": "44131427-7443-41f0-9753-a8faea80f36f", "value": "T1A3672333FB4771C0D5E4887198277DF732717C6B8BC05A77A0A574810DA628BAA32A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865854, "uuid": "a5367010-8dc8-4bf6-ba27-07469f259c0b", "value": "69ced1ad11dc0af68759e861c3ff436a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865854, "uuid": "9e396812-2fc2-47f9-b45e-e89db45d0586", "value": "196608:tYjDXnOKBL+XALyBOYA9P/NPzHA60f0pLXiLMT5ygsQjRtVq5PwHa/lbFEaCkc91:4nbB6wlz9PlP79sKqK25Pw69pKkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677865854, "uuid": "872161b7-a86c-4512-a716-e624f07bcfe6", "value": 32000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677865854, "uuid": "a2614e9b-cb93-4dcd-8772-2971dfb42aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865854, "uuid": "71d8ccbd-0fd8-45df-9e5e-df5cef202972", "value": "2dac34c1231506d10ea2d2e75c461af7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b842ec-b9f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677871232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871232, "uuid": "0cbcd803-5904-4030-9bfa-96b5101d1e4a", "comment": "Malware payload (Mirai)", "value": "c049f3076263c75e9d8d5e86fc43a8b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871232, "uuid": "8ee69775-652a-4cec-b638-a3a41b6f34eb", "comment": "Malware payload (Mirai)", "value": "8583d87219a9cabb9bc9a5f2db6d3a2cb1d3104b5ad7741d55e8abf25a22e761", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871232, "uuid": "a936c06b-8870-4f0a-9b8e-e3e2beff467a", "comment": "Malware payload (Mirai)", "value": "25173f1f37c8b06ab0e1aa20455333a4a5aea230", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871232, "uuid": "fc3ccf61-842a-4ddf-b754-016828585e8d", "comment": "Malware payload (Mirai)", "value": "bee403463dddb5301bf842e6add4790442137fd92d5467fcf08709a35f85b02f0491026c9b74753fc72edec965650f3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871232, "uuid": "d121f55a-bcc9-4cab-b59c-81ed0895fb5d", "value": "T186333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871232, "uuid": "b0c62b43-3214-4aa6-92aa-f3a54b16ff7a", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380DF:dsfIBZeNlJDFj0imvppqmUJP6Lc8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871232, "uuid": "0fccaac2-6484-4260-9b92-21e0f4cb8565", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871232, "uuid": "e69bb8f9-afd3-4a01-9287-9fb9d88e1078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871232, "uuid": "fdce7e79-995a-4f7b-a104-f51805177058", "value": "c049f3076263c75e9d8d5e86fc43a8b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6417247-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677856708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856708, "uuid": "b58d9faf-85dd-4308-a842-82bd8e435b43", "comment": "Malware payload (AgentTesla)", "value": "f5735d5be8c1a28b1de7e622d8c85384", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856708, "uuid": "a8a55728-06ff-411e-bdd3-62dcc97a0b35", "comment": "Malware payload (AgentTesla)", "value": "85ccb807d6156cb031de1c9dff70ecc206dab4d812c681a2c520cccbd80aaad2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856708, "uuid": "5fd9b0be-e0dc-4354-ba80-d7e36651a4dd", "comment": "Malware payload (AgentTesla)", "value": "96732a0af04536a419585686571a625580be2a90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856708, "uuid": "eb97005b-26ec-4211-ab07-a8046bb0c16e", "comment": "Malware payload (AgentTesla)", "value": "e070dd9ab64274682e06bc47a37a13085a82d38dfcb479368755d42cee36c80a0b8e1b9935f7cea96cf4592cb1889d9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856708, "uuid": "3732e23b-b1b4-4416-ae06-0342ab1673ad", "value": "T19E046351E7A47C2BF5540778AAB29193169BBF23B915C9163287730F5B73FA06C32E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856708, "uuid": "ea172859-c6aa-47c5-a13e-96872c9c700e", "value": "3072:sckZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA1QvqpN2a8:sJZ+RwPONXoRjDhIcp0fDlavx+W26nA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856708, "uuid": "d53e66bd-1984-4f01-ae1d-160340dd8dd5", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856708, "uuid": "3d6b0914-9ea8-4e00-8424-c0ff497cacc7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856708, "uuid": "8331ec1a-21c1-40b9-a9e1-7626a9b0f069", "value": "PO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ca719d-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677857638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857638, "uuid": "ed931a01-8145-41e2-b20a-8d87c9703de8", "comment": "Malware payload (Rhadamanthys)", "value": "7a2fb3d224c82ff12df14802552ba226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857638, "uuid": "a9fac183-a39c-44ab-a11e-0291303cf789", "comment": "Malware payload (Rhadamanthys)", "value": "85dc788ef240fced8c78f1d2e75cbd4d30cf75004b4025b4472f7a36051ef475", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857638, "uuid": "adadfef9-8630-42cd-b515-81eae8d40f07", "comment": "Malware payload (Rhadamanthys)", "value": "5cac40d0e21fde0b06c2ca29a3208eea0729b1cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857638, "uuid": "9710ecdc-f3d5-4f58-8972-d32693630733", "comment": "Malware payload (Rhadamanthys)", "value": "eeeca2c70e4bda33cde1ae86c81184a7b7facf6d5b7131ded8c8fb5942559cdbf8e55f6b45eca5da4a3d50a15b7af709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857638, "uuid": "aa513bdd-52b0-41f3-a848-9c4d8c9b6cb6", "value": "T1F8C59DF04E92FD51E3EF1E7090EC0A805D6C6A9B9269C349FCC81556E9E1640AFDC2B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857638, "uuid": "0ac72c0e-fd2a-4c26-ad93-0c1a91ba74d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857638, "uuid": "50e357e0-00ef-4362-b8d9-7f5a0b614ccd", "value": "24576:r9RAN9HU7W4/TY2agAK7/YrfnDCl3zup7UQfv7nsAXJZvB0cJqjov:QU7O9XX50cJqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857638, "uuid": "0db9b16a-29c7-4692-8159-0d7befe2cf0e", "value": 2560512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857638, "uuid": "e23d9af4-3859-4d72-ab92-c8f11c8b46b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857638, "uuid": "dda825a5-bb4e-4ec2-a5c9-1fcd5684d226", "value": "7a2fb3d224c82ff12df14802552ba226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb345b0-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677856509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856509, "uuid": "3b51b2c0-a5d3-4705-a943-af654052264a", "comment": "Malware payload (GCleaner)", "value": "523183812eda6f3ac82cf028bc9b3022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856509, "uuid": "3a38dd16-02c2-4dbb-8096-ba452bb46e47", "comment": "Malware payload (GCleaner)", "value": "8618199e5b16a6850103f128f1be7a088464842039012a3b26d27fb7a7b69bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856509, "uuid": "55f78269-3f46-4920-a6c7-f8d01d4be332", "comment": "Malware payload (GCleaner)", "value": "c282f927060127042dbfd531b0eeb55f8b623a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856509, "uuid": "aa9b5cf3-33ff-4583-9ac5-33dea97443e9", "comment": "Malware payload (GCleaner)", "value": "53924db0cefa7981cccf9dd6e61d4968d411fa33834d40c1eb9f9342789e27bfdcaae883498b0e64c5e4d4c6ce87ac82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856509, "uuid": "55f162fb-0d85-42fa-8a25-d027a7281fe8", "value": "T1F354E1217DC0C431E4AF30348971DBA0AB7FB86625648A47BBB417AB5F317D16A3538B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856509, "uuid": "54c8b00c-5e7e-424d-895a-bcfa4aab02bd", "value": "b9edfa94b36ce86a0bd61e719fe30fb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856509, "uuid": "a9e46a43-b725-4fc2-b164-3a02fe83ab53", "value": "6144:X8DLyrcfQIWwot0UjwG6GY1/6NjS7o2wUOYujKyknFOXl:MUiQVyUs7dS1coAJnyQFO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856509, "uuid": "efc76092-da2a-459c-b7e8-c77fa7a8b4f2", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856509, "uuid": "ebc0425c-669f-47e2-bffa-2beb1398d75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856509, "uuid": "282401b2-59fb-4afa-8da4-85d9584e9008", "value": "523183812eda6f3ac82cf028bc9b3022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3abd25-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677829819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829819, "uuid": "d049b216-c930-4714-9a2c-75145a4c18b5", "comment": "Malware payload (RedLineStealer)", "value": "2e0b52e14e9d0e424a02c7e2b84befce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829819, "uuid": "d029472f-d335-4450-943b-8989ca4f64c4", "comment": "Malware payload (RedLineStealer)", "value": "865d8dab81c4ef05007a7582caacf83ac6832a78c7870b77f9ec04bdd2fa4f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829819, "uuid": "0aa34dfc-f9a5-42e4-b665-b15ad72c0c7f", "comment": "Malware payload (RedLineStealer)", "value": "eef5de144176ec6395884ecd2c7cac0443269964", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829819, "uuid": "10125401-9c8f-4060-95c9-3037c963f0e5", "comment": "Malware payload (RedLineStealer)", "value": "6227a711a0cf07075a98a7b4a32acec442239ff623f5fa6065c5ddb978c038dd578307409bd853d73cac0ae7a5ecc96e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829819, "uuid": "5eeb4587-ad3e-4b71-8376-3be92e2567eb", "value": "T1AE64C0227AD0C0B2C95B14745815DBA4AFBEB8306F6586C733942BBF5E307C05B7A399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829819, "uuid": "cde10da3-f1b1-4993-8d88-81018abefc5b", "value": "3dcdb6b03575fe1a857d23b1ee4d81a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829819, "uuid": "30c41d81-8114-47c0-973d-25d6f5a5ee8c", "value": "3072:xoGLTQqWLI8BhVTNTEvsdYhMU9+tE3brQvJt8qSFzH/0MD:WGLhWLzhBascMiPbrcgpFzHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677829819, "uuid": "d6fcbc6e-ae54-4415-a845-4beca26a2501", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677829819, "uuid": "2af72760-6b1a-4e4a-acb8-a9d6e93f9f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829819, "uuid": "329f1071-cebf-4824-afac-8ea5c27064c9", "value": "2e0b52e14e9d0e424a02c7e2b84befce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfb7c01-b9af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677839725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839725, "uuid": "cfdf7d4f-c423-4c68-a46e-efabd40d92fe", "comment": "Malware payload (Amadey)", "value": "0a311e14511b30f9afa4ef32097b54e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839725, "uuid": "5ecb2bb6-7d3c-42ae-8d4f-4e5c4157bbcb", "comment": "Malware payload (Amadey)", "value": "871ce137599917f69733cd72b0ff816d630cf96a77a84f1a3d99ab98b747399f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839725, "uuid": "f3bfc1e4-e61e-4596-bee2-98c2961f806e", "comment": "Malware payload (Amadey)", "value": "f5024484cd055442299a9d0b1d83067f0f014d5e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839725, "uuid": "1515d045-9f10-4b3f-ad45-4d8526728aa6", "comment": "Malware payload (Amadey)", "value": "3467d6bead527f83ff661f5179f8e8a7b29262cfc1789047a0a90fd947dea9205d588f71de6e1afac4a41ac87e8b0462", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839725, "uuid": "a6da1cdc-7d39-45a8-9a1d-62610b7a6953", "value": "T1EE54D011B990DC32C81644B49C34DAE87D7ABC725AA589DB331C3B2F6E702E2577B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839725, "uuid": "db62410f-7b0e-4f5c-b351-12839713f139", "value": "a66ab37f013146fbca029fedb3c9defb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839725, "uuid": "eeded5b3-c179-450d-8e78-8edb5040bbe0", "value": "3072:Gmi3LHsxI0zOMhRxUdF0mAI6p0sOHBsVhnfRJ02K:f+L1YI00sn9fRW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677839725, "uuid": "a72a8c92-d7f2-45bf-beb6-15303b5d2c74", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677839725, "uuid": "dbe7f361-f686-4aff-9fae-7ad76deb217f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839725, "uuid": "6a2bd680-72cb-4a4a-b7a1-5054a5f0639c", "value": "0a311e14511b30f9afa4ef32097b54e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2657104e-ba07-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677877538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877538, "uuid": "ed091037-09f0-4f67-9245-91dbb7304487", "comment": "Malware payload (Mirai)", "value": "82f7883f7592bf528545ab1580d1c3ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877538, "uuid": "9bc32902-4ca4-490a-b421-3dc114257f19", "comment": "Malware payload (Mirai)", "value": "88892d4dcdba36b634897780a80a898f07f315feab3a55a7eb9d653aa9c6e610", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877538, "uuid": "6a265163-c901-4629-a430-16bb507ed205", "comment": "Malware payload (Mirai)", "value": "4bf56aac94cec067f60323554b603a76c9214f43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877538, "uuid": "4a672f8c-0d89-4564-9cd5-9a76fd6107ee", "comment": "Malware payload (Mirai)", "value": "05d01180c468fb9280e082789a785359a5f8b1fbd6e701c27a72336fb3a557546141fce332893f661b298a11875416fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877538, "uuid": "d177c784-0573-41f3-adea-a120774e49bc", "value": "T1E6C2D0E0B726FA31C4206C3DE53B4D8A3A51167C91FF343664258C359EC169B66F84E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877538, "uuid": "1a2c7c82-a6d8-4de1-b97b-2f375a8693ba", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwrd+P9q3UELub:oKy4qfqoeJdXWgA+Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677877538, "uuid": "dab6fd71-6a16-44b4-8e4f-a7869195b24e", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677877538, "uuid": "c01226c5-2bd2-4c3d-bbfe-cb5cfa1f8d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877538, "uuid": "19462db1-2122-4613-ace2-9f7f21fb6202", "value": "82f7883f7592bf528545ab1580d1c3ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692c4fbc-b962-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1677806784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806784, "uuid": "47dcf06f-a68c-4c9b-8f8b-51e7a0d0843a", "comment": "Malware payload (RemcosRAT)", "value": "f4f51d8baace47c8a3c17bbf4cf7cf2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806784, "uuid": "80ab9145-42fa-4fa5-b16c-7d36026b0837", "comment": "Malware payload (RemcosRAT)", "value": "89307b8df7f5a1d95259be7aa5dd457ecb66c4aeeca669827a3cdf3e84c3a283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806784, "uuid": "70d993ac-5d75-49d7-8aa2-586973f25727", "comment": "Malware payload (RemcosRAT)", "value": "cd43ddf06f242d47a20fd0210a058a8ec4e17c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806784, "uuid": "c433b4a1-9d08-4fed-8acb-082536a22e46", "comment": "Malware payload (RemcosRAT)", "value": "fea0eb9411e41bcadaee60f0ff10394913f9e7ab25a9125dc205adf30579234277bb34836382c439e9006e5c90ef131a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806784, "uuid": "dfb4139f-ea82-45e6-a0f2-4abf60ba01ba", "value": "T11CB4B001BAC2C072D57524304D3AE726DAB8F9201935597BB3EA0D5EFE70191B73A7B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806784, "uuid": "3321f413-e292-4d11-834d-b1938fc6673d", "value": "6144:3jH9dY1fKmXbwxqbQWmudPOqwiXO3X2yjKCrp/5ttAAMS6NYUsAOZZgQXTc:3jdAK8wxqkXuxOqLXO3X2orpbKs/Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677806784, "uuid": "fcea26f5-8ef3-4e64-9376-9d5b6e0bebbe", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677806784, "uuid": "b05d1b7f-b4be-4781-9bd0-f769a83de856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806784, "uuid": "07096f5b-c7d5-4749-ac6f-f74366510a7e", "value": "spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7279739f-b9ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1677839011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839011, "uuid": "b84dc2dd-2f4f-4324-9ba9-559a7dab79b5", "comment": "Malware payload (Gozi)", "value": "629f3b027a84ee2dcb0d29d192caae5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839011, "uuid": "ceb4610f-ef96-4fd6-afe3-36102309d239", "comment": "Malware payload (Gozi)", "value": "896c5898ce95f078e8246f62ccd4b7da07959b2884362fa9c1933712aedeb553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839011, "uuid": "1e6c2f6e-3e61-47ba-aa6c-e74ab78fa737", "comment": "Malware payload (Gozi)", "value": "75227ab521a6d308055dacfef15f6e2fb270ee8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839011, "uuid": "9b908036-60e4-498a-9eea-f948092af578", "comment": "Malware payload (Gozi)", "value": "d53111fd194f9a3b6f8e63b0b0789bba24dcaf2c9daad857cabdd80dc433805df21e51b088dffc6b65372b8ada8ba178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839011, "uuid": "adac44a8-a0e9-4103-b91a-ec20088f1ce7", "value": "T1FD55E0D1B3A09157EC630A310E6383DA8729FDD5AE31719B33A4F75E0B7A9C25E64702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839011, "uuid": "47a78c2e-30b0-4261-9589-3ed09cf7c810", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839011, "uuid": "20bfe984-9126-42c9-8791-9868c1af1330", "value": "12288:AiAQgT3n+nqYJrHsanMmkDC61RcnfREOD3GzIkZ1sOY77Xmtw8yEdKFS:ALQYnVYxHs6MxrRcnWOVY1st7Xm1Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677839011, "uuid": "92fb8ccc-2f54-4b7b-84a1-54940e26e344", "value": 1321984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677839011, "uuid": "4b2d0049-9f72-4b2b-82c2-d75ddf9fc02a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839011, "uuid": "09b669cd-251b-437a-938d-fa3d1ed33636", "value": "Informazione_Azienda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673b62c3-b99b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677831262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831262, "uuid": "226975c0-e473-4ab0-92f0-08f9d1dd53c1", "comment": "Malware payload (Mirai)", "value": "a4371918a4dce7d93603fa464552573f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831262, "uuid": "766f2156-1d1a-44e5-a669-df8771384afc", "comment": "Malware payload (Mirai)", "value": "8ad3520f847bf52214d9d04e188bed32f144ba62d4ce8467f07c6399b1dcf61c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831262, "uuid": "c2b921f9-e6c6-45f3-9e7b-ce9def0ccb20", "comment": "Malware payload (Mirai)", "value": "0cb8bdd80a4268cc00f523181ce455fde3049de2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831262, "uuid": "69f80267-2a54-4f68-a00b-bc88f2276bac", "comment": "Malware payload (Mirai)", "value": "825779d8659dde23aaed06cceed4361aeeba1680b70ae42fc529aa26833cfc06d9cf2dd9e1e7e3e977c683f302740dc6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831262, "uuid": "3a1226f4-13e9-47b6-99f7-ae0935403102", "value": "T1B083D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831262, "uuid": "50237210-b7dc-48ff-a1bb-632f2c950f12", "value": "1536:iVLyu95K8jkj752dCexuV/8UZlDwfkJ4MYfWP:iVLyMgFFezxu5VD1eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831262, "uuid": "49b610ee-9aea-4c14-9bd8-836d2ec20989", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831262, "uuid": "f8778803-c740-4adf-9af7-bb43b463021b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831262, "uuid": "a250b780-21ae-4db1-8e43-deeb5f009044", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672b2589-b9bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1677845435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845435, "uuid": "e9556dab-0b31-472c-bd66-cad4dca0c4c1", "comment": "Malware payload (AsyncRAT)", "value": "13d5689ec02e2be9181b12ca8b02dcd9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845435, "uuid": "84aa6512-594b-4eed-ba68-83fb8b6c55a8", "comment": "Malware payload (AsyncRAT)", "value": "8b23251e7900a7d6c067231ec4858e19d94a39d007c392a5805e89fcd1271fff", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845435, "uuid": "082a70ea-f67e-48e9-ab8c-a81dc0c2baa7", "comment": "Malware payload (AsyncRAT)", "value": "db0d3b47cd0ea3e7f2640910b5235b08acd72ba2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845435, "uuid": "bf9e9424-ceed-44c4-9f8d-b423598b9044", "comment": "Malware payload (AsyncRAT)", "value": "72f5f2b6239921a3c1fb0c25c1fa05101c616b415b8313c304a2069bc92815eade0a8b2bf8a5fe50eb33f83e72eef03c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845435, "uuid": "f1826dfc-a032-4fc7-ab9d-6cb71591310c", "value": "T1B565BEF31503BD4E9B671CAAD6003732CC6E6E636665C014BEC80EE821EE558DD79DB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845435, "uuid": "f6ac07c8-33c9-471b-9115-cd36af5f8038", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845435, "uuid": "8775bbc6-fbf0-41a3-b5ed-51e0a4d8bc29", "value": "24576:x76UQhrNk2CTIILzk56DAaBNKe9KtsCjHfOpiiTwH0BnpivZTYTBlIkc6T2tBwqU:TY594iRYMztUsPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845435, "uuid": "e83b1ea1-6f56-4c6c-badf-ee91bc81171b", "value": 1537536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845435, "uuid": "103eb1d9-84f4-4336-86b3-12397449a9d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845435, "uuid": "46f98e7e-31c2-42b0-a463-5f41608ef076", "value": "13d5689ec02e2be9181b12ca8b02dcd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259e7e7b-b9eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677865511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865511, "uuid": "5d37cc2d-a143-4c55-8de0-aac4931452db", "comment": "Malware payload (Loki)", "value": "e8b4bf0bfe9d51f22728a1676f5d1701", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865511, "uuid": "852c8ff2-56bc-4835-89b4-4fa523dae1c1", "comment": "Malware payload (Loki)", "value": "8b5d2f25a3b2c3ca76ff1815a0a45442bd4e1e8b74709af37670208f397f4ad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865511, "uuid": "bc0f88ce-9ca0-49c2-a9b8-3349bed97d70", "comment": "Malware payload (Loki)", "value": "0518612eb15670a1640495f7f0e470a39d699d59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865511, "uuid": "e8de1977-e45e-4e50-b363-8f6aa573e240", "comment": "Malware payload (Loki)", "value": "994ee25e2b723487f5f9a06d711584f10363ae45b19ca84a40bfdaa7dc47b3341ea07f8d67a35044187f312099a9287c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865511, "uuid": "9ab42e37-601d-4883-8e13-fa3a47b9042e", "value": "T1EB35972809FC0AF245B1F1FD9FD4E753BD8488E6AB049D99C2838B89555385720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865511, "uuid": "c81e94e6-7f42-4013-9d8e-b266fce43ec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865511, "uuid": "70144f3e-bbb9-419b-93da-00cc06c43e2b", "value": "12288:cFMOEAlI3MzSSV93nvoWV3rP+/rQAzKSd/paciuqQyvznoU3O9umxGV1Btxol:ciYdSSToWV3rPCMMKSNpziLD3Tf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677865511, "uuid": "6edd81f4-4bc2-46b7-937a-4d61500c366d", "value": 1160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677865511, "uuid": "07d0b98f-34fd-4766-a2ac-4d3b4abd58fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865511, "uuid": "7fdafd43-4aa1-4209-af66-5d6d604953e7", "value": "e8b4bf0bfe9d51f22728a1676f5d1701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2ff741-ba13-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677882942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677882942, "uuid": "226febb4-935c-442c-864f-ead20dd7b575", "comment": "Malware payload (CoinMiner)", "value": "067f1db9fbb391bc49dc3fa18a703b94", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677882942, "uuid": "625e867e-450d-4c50-87af-7152e35b568e", "comment": "Malware payload (CoinMiner)", "value": "8b861b1428fc7b34a8845303bf0a70bcf7a97fee14cfac5ee467293eec7ff407", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677882942, "uuid": "eb03fd04-5f23-4e3b-a6b6-dca8c3d42e31", "comment": "Malware payload (CoinMiner)", "value": "b533f7effa5249b8a59074c1a841c09ee644886e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677882942, "uuid": "cb8191f8-6e24-40ef-a75a-116d5f4d3071", "comment": "Malware payload (CoinMiner)", "value": "4d37f27d3c50de64bb8e845423ffe50f1a9d219274e77edd922afd625c649e5f20271bc9d147552b2e5342186d24fca2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677882942, "uuid": "29af589c-ec5f-497e-a495-3d835c5473ab", "value": "T18136E1F08A92FE91C7AF1E7490EC18C04DAC1B4B866AC649FC8C6456D991B40FFDD2B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677882942, "uuid": "8535846f-f833-40fe-b56f-c9eaa9be60c5", "value": "49152:wX42LgSkkLyyn3NWaZGTqE7s+9p7dx60cWkYtXAmd4NNNQazPUd6birCa9YioXcu:E+p7dx60BtQmdgVYd6b7a97oXc7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677882942, "uuid": "91e6c8ac-edd8-4f27-a214-ade16e40bdbb", "value": 5175296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677882942, "uuid": "02ee279f-dc2a-4c2d-b61a-2a411f809514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677882942, "uuid": "007a5afa-ecbd-47ef-a849-2a6841a0f560", "value": "067f1db9fbb391bc49dc3fa18a703b94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f8159f-b972-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677813895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813895, "uuid": "31cc5848-1f5f-4da1-8e8f-731b7b6e525d", "comment": "Malware payload (Mirai)", "value": "eaaf109e2b1519eb6003f4f7b147cd4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813895, "uuid": "752f3d4b-63aa-4e28-a700-7551919e75ac", "comment": "Malware payload (Mirai)", "value": "8ba1c357307352916fd68748739f8130ad6e1e975bcf4e66d4aee87170fb8518", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813895, "uuid": "8a1a0138-6aa1-46ad-81c7-7fd42cbe5838", "comment": "Malware payload (Mirai)", "value": "5745fb50d5ed5b993bff9c919324748d1742b8ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813895, "uuid": "ac5aaf9f-46d2-40fa-b67b-4e6e3e44e1f5", "comment": "Malware payload (Mirai)", "value": "a2cbae952dc35316c8aab495292309ea4be470929ff784875da25ac878a81a82415502334e95dab2c60f435cf9ced28c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813895, "uuid": "1c3fefb2-63c9-4d4d-b53c-9b4c3247ba37", "value": "T11773E91E3E219FBCFB9C873547B78E219658379626E1D184E19CE9011E7034D782FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813895, "uuid": "c8cd2871-bca0-4b93-a8df-e4a360cde517", "value": "1536:pVNzbOfVDFzxJXilJHbj90OproByEALurtTgF8S1z3bqH21:pVdbSTXibbj90OproBeEtTgFl1zR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677813895, "uuid": "e563e6bb-fbd9-4e56-a616-476824548134", "value": 77348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677813895, "uuid": "6d454cca-9276-4dc3-87b8-0b965987c87c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813895, "uuid": "11f5a55d-1238-4f19-be16-924088f63c3c", "value": "eaaf109e2b1519eb6003f4f7b147cd4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecbc374-b9cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677853501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853501, "uuid": "21c13ce3-02dc-4cdc-87c8-2ce59de582c7", "comment": "Malware payload (SnakeKeylogger)", "value": "d2339201712fb74270ef917f09cc5e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853501, "uuid": "a3d386ce-c2a3-4389-a857-c4599580f8b2", "comment": "Malware payload (SnakeKeylogger)", "value": "8bb4628c5c061cdc9ed4b64c5ef73d57d882b3fc218c171b7650f1803b3545fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853501, "uuid": "1b8e41e4-e3be-42e9-9354-4cba06406a96", "comment": "Malware payload (SnakeKeylogger)", "value": "d7ae47a2fb4b585cc8440f4425b60676246e30ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853501, "uuid": "6648a77e-64da-4cd4-85f3-eb8c1ccafb8c", "comment": "Malware payload (SnakeKeylogger)", "value": "5a352de0f383a15a3cea1b3f5ac68c5263808e9ea2d99f2f4230d0a1aeb4f76a08ac70a1775af02a094b755e5ba47030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853501, "uuid": "bcde5941-88ac-4c9c-b180-397723d71f24", "value": "T12FE44B10ABE4CA17D6EE27B1E8B006182BF8F166B27AE74F194495F81C937415D903BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853501, "uuid": "bed1969a-7a28-4119-bfc7-55b2dabf7238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853501, "uuid": "d74d9b08-b82f-4a0c-b03f-6943f157ca58", "value": "6144:PlyGZzVePSloLUPxvbvY3ov5rq7V6QrQQJzt+fPO/A82Zahm/Vr0TWFjFtccasOC:uoaVtJ0fPv0sdFjFthiL2lELppSyu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853501, "uuid": "fd3128fa-640a-4cbe-abc4-aab8f2f218cc", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853501, "uuid": "a760597e-032b-44a5-9859-48eabc8af747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853501, "uuid": "6032b8d0-a01b-4467-9af4-53d8b3b10587", "value": "d2339201712fb74270ef917f09cc5e51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4209d70c-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677850527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850527, "uuid": "fb4304d3-739c-4221-b7c3-8039e37b4a79", "comment": "Malware payload (Mirai)", "value": "4e72692f8ac28260d51cbb22bf399815", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850527, "uuid": "379b40ca-3e11-493e-8621-c3db2ad04e0e", "comment": "Malware payload (Mirai)", "value": "8c152109fc1bf0eb013ce93a7b37eaf49bf7b595b9c9b0f983834cddc5760463", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850527, "uuid": "4931e116-7d69-434b-92ae-68a9402f0a83", "comment": "Malware payload (Mirai)", "value": "af9b48f7a63dc6c60e51b583d4aaa9e538d2a030", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850527, "uuid": "7bb99d94-555d-43ba-b96d-2af222fba520", "comment": "Malware payload (Mirai)", "value": "78027baf609efef0f178b1a3517ce9b09c08c7f8fabb694ecbb36e3b34891ab00d7fc60d9dcb5589e058411b5d845d5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850527, "uuid": "33c20e5c-13c4-4d70-a8bd-69c3e7c95ba3", "value": "T1C3E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850527, "uuid": "4388270f-8c6b-413f-a233-adb2c91ea8be", "value": "3072:yJTc2PBSpmr7Oabvzj4dlRsh8ZQIldUMXkkTM/9zY:yJTcGXOabvzj4dLsh8/UMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850527, "uuid": "88b94703-2aa1-413b-9a94-80276f44aef4", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850527, "uuid": "8a07b4af-22ce-4e8b-86cf-0439f432905e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850527, "uuid": "db788c11-599f-4f70-b730-ace245cc412b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c758ede2-b9b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677840442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840442, "uuid": "484d863d-0ef3-476b-b3ef-822b33847c56", "comment": "Malware payload (AgentTesla)", "value": "131ff0ef35352e56cef2893ab1260c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840442, "uuid": "bd17f6ed-96bc-4b6c-abfb-07cd0d8f6375", "comment": "Malware payload (AgentTesla)", "value": "8c428b36093ad04e27a3ad86f06c716a9de37b502428211ecc15466fda55068b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840442, "uuid": "7065916b-aa1e-4e8c-a068-f82df21194e2", "comment": "Malware payload (AgentTesla)", "value": "8cae139353e77e1e4bd08f86934160f9f23cffa9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677840442, "uuid": "9e547fc9-a88a-4398-b5c3-06d3bcac9991", "comment": "Malware payload (AgentTesla)", "value": "e0a5f9705b75dee4948f08b138c9774762c06d95a711d0f4d63f5e040c2230d3ef5c91b8cc9be3fc22fcfbf281a3141c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840442, "uuid": "1774b5cc-9667-4035-a96e-7a9bdb976fab", "value": "T11145742809FC0EF2C571F1B99FD4E753BD80C8E6AA049D9982934B8A551395720EFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840442, "uuid": "e703f2e4-db31-44c9-9e5d-893614017b0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840442, "uuid": "eefbba52-e7f4-48bb-b174-dbe74540b741", "value": "12288:h3fgj7KltlcuIr2D9qo9ggXIgxqc8vpayjts8eMrTJYSnCfKZ5YMyy:9gj7I82DwobnxqcgpayOMtnCwYMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677840442, "uuid": "d9216ad5-0bfc-48b5-9657-26173a5a8930", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677840442, "uuid": "e299a1df-6e10-4aa9-9f30-a15d5facc9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677840442, "uuid": "50508874-0697-463f-beef-3dc2f6a5ee0b", "value": "131ff0ef35352e56cef2893ab1260c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65eb78d-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677830133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830133, "uuid": "c3416254-f8fd-4d04-a1c1-69390430cc9d", "comment": "Malware payload (RedLineStealer)", "value": "94a91d8fcfc5d5b3af7edff738cc3226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830133, "uuid": "2941193a-feb9-4d1c-b4c2-8c43936ee6a3", "comment": "Malware payload (RedLineStealer)", "value": "8d16985aac3e40f8038e69aa35b81acd1accd4772c8fd6b03a2b9f96f867bcac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830133, "uuid": "e446a147-27b5-40fb-a318-da86cd64d825", "comment": "Malware payload (RedLineStealer)", "value": "0c0a26447d497919030102c0354228aea963b655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830133, "uuid": "9af737a7-9d96-4f65-b630-ee66eafbacd0", "comment": "Malware payload (RedLineStealer)", "value": "18a1b9dd50f4ad159705ef22c4596dd1964c8377d427bf56eb85255b0b5d39be9c817f33bbe13ddf414416ceb905cb46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830133, "uuid": "9ca1fa27-d108-4d34-9d0e-b35d7d20864a", "value": "T15F15234777D88021E8B5977058FA02D32A37BE51673897D7274F6C9518B32B8A23273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830133, "uuid": "7e39ea6c-505d-474f-927f-035c966421fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830133, "uuid": "505fa679-c7bd-4e3e-88c0-f66b4f3bae9b", "value": "12288:ZMrwy90uScycnjmYUQZDaysM+OknxbHg9ch8lQxhHXyckZd23eYjyv0jRVWGu2lX:ZyvSfcSMmM+Oe6lQJkZYOEy8jf+QFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677830133, "uuid": "e568084f-0766-4c33-8195-2882e301d339", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677830133, "uuid": "9f88abf2-6e60-4905-a81c-9f78a061f3a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830133, "uuid": "cfbf164e-1514-4423-a387-5c2a689e5652", "value": "94a91d8fcfc5d5b3af7edff738cc3226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b40197-ba13-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1677882935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677882935, "uuid": "50fa5c59-3a59-4e15-b857-84f88108651e", "comment": "Malware payload (Stealc)", "value": "9e330fb507151662c1bbaef5b09c1ad0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677882935, "uuid": "30f114c5-29fe-4471-923e-07d7f884347c", "comment": "Malware payload (Stealc)", "value": "8d5d3f79cd2abf2c28749b423e5a9a12c81d642d3e378f166b87ab155d92e21b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677882935, "uuid": "a33cf428-2e9b-41dc-af79-238cf2ad9a65", "comment": "Malware payload (Stealc)", "value": "f68489e995feaf6ad1e96a6ba14fc172e12ebf81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677882935, "uuid": "008985c4-81df-476d-86d7-15b6c8ee45ca", "comment": "Malware payload (Stealc)", "value": "02929239bacaa852301813aea7392e59485df354fb36ca5e29dfd805ce7bb04b03ef491ad297ca5fa099a06821bc7601", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677882935, "uuid": "63915e1a-7b56-4657-8062-35bc5ac72626", "value": "T19F64AE44B1A56876C8F6193007B8C7BB059CADB00F607AEF5B9C4A3E8E343D196367D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677882935, "uuid": "5f0949d3-5bd5-47ce-837b-0e0a09f21b2c", "value": "96471588a0ff89e8a7af662d781a6ad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677882935, "uuid": "845dacf5-9e83-462a-bc9e-0770f247852e", "value": "6144:1ngNHRw6jcz8aMCIvWFqvi1oEOdSzo6HeLAOMD:1ngNHRw0czPui10dSzWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677882935, "uuid": "7b7e55dc-e8a0-4345-9bba-1f2b79767a4e", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677882935, "uuid": "3caabe5a-7260-4178-90b9-fef95fe68390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677882935, "uuid": "49fcf8a8-fd12-49ba-88b7-4c477502c4b1", "value": "9e330fb507151662c1bbaef5b09c1ad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a02d1f4-b9e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677863103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863103, "uuid": "57668399-93b8-4f6f-926c-6f5ccd19ea44", "comment": "Malware payload (Formbook)", "value": "6b0f9cfb69941d168fef11869e4c42b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863103, "uuid": "abc6fe0a-5647-4468-bf63-2b0a0664717c", "comment": "Malware payload (Formbook)", "value": "8e4936a8044f833fa8b5e67067208e8b81c0ca55844122013afe82a0af3b6eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863103, "uuid": "9bcd278b-a758-4882-add6-6a914e7f5f39", "comment": "Malware payload (Formbook)", "value": "54d5d783279109aca3abb09354aa99f02fc0994b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863103, "uuid": "45f46dc2-03b8-4544-8d30-4dfc877353b5", "comment": "Malware payload (Formbook)", "value": "5f9ae560f9c628f2945ce02df1c9bdbf0778c122126ffc9109b3eddcf3c2761918760ee488ed1a0662390d9cec7689cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863103, "uuid": "b33b69ba-d34d-4534-b342-3213da890adc", "value": "T1A835872808FD0EF285B1F1FDDFD4E753BE8088E6AA049D9982834B89555395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863103, "uuid": "dae4c325-f024-466a-b203-054c70fb9855", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863103, "uuid": "9f1ee041-7f2a-448b-94db-fb7180af2f1f", "value": "24576:j9dh2f8JfV2CeDzuPNy3k1aBH4fxQvy4:hdh2EJfB0zuPNykwt4JWy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677863103, "uuid": "60257af4-9bc6-4f0c-a6de-2835002e7240", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677863103, "uuid": "a30fc1f1-fcdc-480d-9178-715380a73d6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863103, "uuid": "45d369f6-1d00-416d-9977-9ef5c50cd75c", "value": "sat\u0131n alma emri pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8066126e-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677861369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861369, "uuid": "2315627f-8054-4281-9ed5-27cd4d13818c", "comment": "Malware payload (Formbook)", "value": "5874433a2ffa262780d409316b85a598", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861369, "uuid": "489ee153-6de1-4724-a9e5-b9f4b580067b", "comment": "Malware payload (Formbook)", "value": "8eadf6618f60fc52a67cd48c05af8053e92fcb73541454319fa569c80b7c1ec5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861369, "uuid": "32389314-228d-42c9-88c7-089bd17876e0", "comment": "Malware payload (Formbook)", "value": "16f826d3fdf1a8d098d4946f1c6022efd21b24af", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861369, "uuid": "9eeef7e7-b001-45f8-b197-398b5c38622c", "comment": "Malware payload (Formbook)", "value": "90975d4250f116db15791d797e6f5aedbf078e7aa2a4b2409b41d96dc0493cf0cb636d83e71310d4c3d7f6f9dfd15f82", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861369, "uuid": "2a7ce456-de23-4a6c-a3d7-9ee32151936b", "value": "T1B2F4330BDE8DA55EC783BE1004ED92AB75BB1FCB9DB980B44C31FAD531429D35C0A25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861369, "uuid": "20ed01d2-44cd-475e-a777-b1aea69221ed", "value": "12288:hDT08/9nNt57fQK2DuWWdZXkhV50MFlqY7By7Mkl0Zwg1IfgavPZTCZooMMuRHAb:hsynNH74K2qrTkhVBbD7BgMkl0Zv1A9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861369, "uuid": "948ef4cb-a3cf-4335-8e3f-8e11ea9fac5b", "value": 763790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861369, "uuid": "d8904a3e-ba2f-44e1-a9e5-4b449fc14eb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861369, "uuid": "ae28e47b-e894-4a79-a33c-62cd44b81df3", "value": "Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce225b15-b9bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1677846037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846037, "uuid": "8fda1800-be33-4c74-88ad-18c495db7d3c", "comment": "Malware payload (NetSupport)", "value": "2344df683dc8295da9e132d132083a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846037, "uuid": "e1e5a359-5aaa-46d6-99b5-af83bb3af1cd", "comment": "Malware payload (NetSupport)", "value": "8ec96a074255b7e90ae95d772c3b89e23289958eec3649ee26ca4071b3e66e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846037, "uuid": "26bb0720-c3ed-4ced-9842-314ca89c81de", "comment": "Malware payload (NetSupport)", "value": "de94138ee8c7724089ef9faa80b8453c0b3986a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846037, "uuid": "43ed24f7-ad4a-4c2e-a9da-3c245a508775", "comment": "Malware payload (NetSupport)", "value": "a548fcc7a09e89a505b1a75a5cb02b95b3e7a5dfb13788ebe2895529dd293e1d4acf36cca1eb1dec6f1ee2d7f2db0d89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846037, "uuid": "c6a1469c-687f-4cd9-9b32-13d38d4e5a9a", "value": "T1AFB5EF521DA8D0A7E0D94F70CCF76EFA5C24EC79C1B40857D2403EFA3A32E526D5662A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846037, "uuid": "cb2daac6-8fe0-4944-a87b-113d46b25c29", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846037, "uuid": "766c0e55-d8f7-45c6-9d77-bbe62666a65c", "value": "49152:5ypEkkYclR4EpZeJyKn20ZvtV4RuK52Z+bm9pg6tUywG6EjXpp/7:5vkJclR4oeJy2NNt+Jpbm9aOOOr/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677846037, "uuid": "7c4f16e3-5585-4c0b-8093-16264e6167ef", "value": 2426256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677846037, "uuid": "eaff5df2-8560-4bc0-8124-96fccd5df7f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846037, "uuid": "fd4a75e9-70e6-4469-9d5c-966bbaf0f8dc", "value": "2344df683dc8295da9e132d132083a26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4587b74c-b9d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677853968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853968, "uuid": "e4182b1a-6ce9-4418-b8e9-2cda6e6635f5", "comment": "Malware payload (CryptBot)", "value": "654bec7aadcd4f11bed4abb621f39a16", "object_relation": "md5", "Tag": [ { "name": "654bec7aadcd4f11bed4abb621f39a16", "colour": "#C0A52D", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853968, "uuid": "8cb92269-8c84-4685-8c62-ddb5fb726fa0", "comment": "Malware payload (CryptBot)", "value": "8f9c89aea6dff3ff788904c54e7f750a227b42d977a97e5afd1a9f7ca9bea6fb", "object_relation": "sha256", "Tag": [ { "name": "654bec7aadcd4f11bed4abb621f39a16", "colour": "#C0A52D", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853968, "uuid": "1d451e60-8698-42b7-8848-78e5b32068ca", "comment": "Malware payload (CryptBot)", "value": "a2dc34a53e217192623f35e6b2d9d49e789d0a18", "object_relation": "sha1", "Tag": [ { "name": "654bec7aadcd4f11bed4abb621f39a16", "colour": "#C0A52D", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853968, "uuid": "1805bf35-52eb-4ac5-a51c-bb3c744bede9", "comment": "Malware payload (CryptBot)", "value": "1912b0c0bb5a1bc0706a4363c22be776ac86ed728253c32bcaa9b8ff3315f0bbade2fc71b97030ae2baa1308bdf837f5", "object_relation": "sha3-384", "Tag": [ { "name": "654bec7aadcd4f11bed4abb621f39a16", "colour": "#C0A52D", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853968, "uuid": "bfde6ced-0058-4f13-bf71-9ea9fe69cf91", "value": "T1C8050192BD949077C0212573D71D81A4662BBF7B0671884BB3C07A3EFA5C21DCB77A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853968, "uuid": "f6038ea7-01e1-434a-a24d-660362d368b2", "value": "24576:m+RJ9If4aGzabMX49JkSCtN83LsSGeDFdcH:HRk4aG2bMX4fuzUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853968, "uuid": "209a5048-6818-4514-a0fe-fb568615d60a", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853968, "uuid": "f1765c34-ec80-4112-8683-0ae71bb4c0c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853968, "uuid": "b1cf6039-97de-4295-b429-1741725ee371", "value": "654bec7aadcd4f11bed4abb621f39a16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9bcc91-b96a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677810443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677810443, "uuid": "27b67278-11a2-4072-b8f1-fc79f18eca15", "comment": "Malware payload", "value": "db398cc56df11e34b033ccc7ec977ae2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677810443, "uuid": "11d2e9a9-8fc4-40f2-a849-e78f9fb4a655", "comment": "Malware payload", "value": "8fbbdf6dd8fc5f1dbc7b1683edeb4a672f592a6eddd9057522c9143d7bf96848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677810443, "uuid": "767fccbb-9787-4284-9453-29c7016e030c", "comment": "Malware payload", "value": "bdc3723a0681fbb5176438a7f9f7388f786e4417", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677810443, "uuid": "8093c799-01cf-44c4-b491-9c20e19cbe61", "comment": "Malware payload", "value": "06bedf62c8329ec2651340fcb042f1b8470ca4d7c4b0d70c93acfe43299dfc0c55b9e6b0b33d69f92d7b3cc84e59a46d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677810443, "uuid": "bdc81ab8-ae77-4379-9615-a9425dad7c88", "value": "T125630205AF25ED46DF000C6326CD9B9D8EB96B4A4AABF07598E19C8F57E11CAAC57300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677810443, "uuid": "64e5ca39-cf71-4d92-ae5c-73e722831e17", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0U:phNlHuBafLeBtfCzpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677810443, "uuid": "5d5bb279-ab4f-46ad-8209-6b756afd4bed", "value": 70400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677810443, "uuid": "6bd3fc3c-a07f-4e7b-8596-7ee1801771b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677810443, "uuid": "17428769-2cde-47de-aff3-1e27b40672ce", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.50294160.18597.23504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7e3d7e-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677850547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850547, "uuid": "f02f9079-7b0b-4480-ada2-c6f2f6ccb007", "comment": "Malware payload (Mirai)", "value": "d66588af67351ac27b0e20cac681ee20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850547, "uuid": "ec3ede3a-783d-493e-b414-f5fc85e68af5", "comment": "Malware payload (Mirai)", "value": "903476c0894084a6d54c3028e960beb4c25ca1336d34c28eef027909e3f41ba9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850547, "uuid": "58314049-396c-44a7-bdb3-dc30d6ce6583", "comment": "Malware payload (Mirai)", "value": "4a3e873ad5700d3dcb9acd55df7835d0ab895f05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850547, "uuid": "1dc6fdd2-57be-453f-9d4b-090cda4778ae", "comment": "Malware payload (Mirai)", "value": "e5fcc50ebefb364cd56c1ce1b3d2ce8a257c89705fd8387fa5b5ea6bf92a0940a36ff5295f1ff7760a201f8e5bdd9613", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850547, "uuid": "8fd534bd-81d2-49b9-87d8-bcd0ccc13403", "value": "T15583A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850547, "uuid": "f768aab2-4526-49aa-a856-51af695d5c33", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTm7ZDYovZ73x/nL8y8Q2:Rakdn2Eo3ePu5GTmRYo99Be037W3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850547, "uuid": "9784beab-2df2-4676-952e-cd496306909c", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850547, "uuid": "1d8c1a63-2e06-4c1e-98f0-da9c96613a46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850547, "uuid": "c96937fa-1e4a-4b30-a3cf-e08bf421c80e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b963f0e-b9dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677859535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859535, "uuid": "90e11157-e5e6-4dca-acf9-4f2b06062c4c", "comment": "Malware payload (Amadey)", "value": "6c37bcf43dce2110b49e01aba3fe1b00", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859535, "uuid": "180e43d6-5f5e-4959-908a-f7835c151acd", "comment": "Malware payload (Amadey)", "value": "9062797ac1a89e6b6445b18f75953121581da3782a1bd00bf5ff06eb24c313a5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859535, "uuid": "f1f315ce-cf80-4075-a072-1aef08eb0159", "comment": "Malware payload (Amadey)", "value": "6ec76df65cf4bb7bc718ca2caa56bc6393a6540d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859535, "uuid": "a15dc259-128c-4e88-91c7-10cc2c13df42", "comment": "Malware payload (Amadey)", "value": "dc4386031f8f27a64545460b7f084dcea5cfdeca2ae5b96ec012d6ee128aba039fc740b297366251a781e0f332444dcb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859535, "uuid": "7d5da4ee-09f1-41a7-9055-19a8740527d5", "value": "T122151317F7E89122E9E5A7701CFA42C3053A7E51567887AB334F6CAD09B21B0A631377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859535, "uuid": "fb6fec8f-d211-4601-94aa-f75e3ee3cf95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859535, "uuid": "8800f3b8-9438-4eb5-a62d-9a8692d66d26", "value": "12288:zMrgy90mcAwHbMTXLIFmORbzG1ntrYRGXLbN5k4wY7vAT8DR7XapAs5CcZz99FbZ:zyuAIIMFbitrxLbN5MT07cpCcZJjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677859535, "uuid": "e1c1db70-6970-4822-82d5-1d063997428a", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677859535, "uuid": "ba0cc309-b551-4afd-9ed6-5ae90bf5ca16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859535, "uuid": "a09f0806-e4c7-4183-a092-f67a043e5a95", "value": "9062797ac1a89e6b6445b18f75953121581da3782a1bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1206f422-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677861183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861183, "uuid": "16d3e498-387b-4d55-ad28-443c42586ade", "comment": "Malware payload (AgentTesla)", "value": "5e9c85f7f31db254ae5ed1bea584c3b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861183, "uuid": "5974bad9-58a8-49f6-9231-54d6b5462379", "comment": "Malware payload (AgentTesla)", "value": "907a60cf9ae5b2bb359433c69030178f51e2eaa4f90914cd27ead39a34b94cd8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861183, "uuid": "993fa1e2-fedc-4215-a0ba-75c405ffb917", "comment": "Malware payload (AgentTesla)", "value": "fadf59bbad814fa8987aa2f9ba974fb8664dc0cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861183, "uuid": "1b70437d-d6ec-488d-9754-5c3c575d9765", "comment": "Malware payload (AgentTesla)", "value": "af775bbc033acb74e32f010d0de210bf394fb7f8bf20f97d6699385ed83d8e79bde44a4c0f7aa81cfe94dbe6c91734b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861183, "uuid": "592abb00-dc73-42ac-891e-eb3a65491506", "value": "T14835762808FD0EF285B1F1FD9FD4E753BE808CE6AA049D9992834B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861183, "uuid": "a002af21-ea93-462f-aacb-ccb0b0bf2b81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861183, "uuid": "6c624cb3-828d-470d-a395-24a9e2f0c135", "value": "12288:BJy/BCnkZyoiXYXc/Y18NmemGo09wglmnGc98toGbpyJDf9CpZ7Qv:LyXZyBb/2/0yb4oGbpYfgpZ7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861183, "uuid": "2022c2db-2bc5-4e5b-9599-128aa5465e5f", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861183, "uuid": "b24093a1-7a61-48c0-b7c7-04912448b0d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861183, "uuid": "66939e01-d87f-4165-8fb2-79958e1cfedd", "value": "bank copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561cc01e-b9c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677847554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847554, "uuid": "742ede18-5938-4dc5-a3e8-87b0a89fefb1", "comment": "Malware payload (GuLoader)", "value": "9bbf178289483eeea735601b8454e5e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847554, "uuid": "87898560-71e9-47b1-a0d2-9d276536f43f", "comment": "Malware payload (GuLoader)", "value": "92081a17d63706a837180166b90da06b83053af8e7e0b04afda26f3ac6774cfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847554, "uuid": "a13a30df-5094-4fa1-8649-6a7d53874dad", "comment": "Malware payload (GuLoader)", "value": "c7ecc65029a573573a698ef2c0ef03599a044fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847554, "uuid": "2b7c2efa-9b61-482a-af04-8386963f935b", "comment": "Malware payload (GuLoader)", "value": "b3fbb7aeeaeef010ec9bf857e9227bf3a30caffa1e563d33f259d979af99a81c50a9b5896f582d98c68c279ab7187e1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847554, "uuid": "b24d277d-3f70-4018-9955-9e68d56e65c7", "value": "T1A05413416BD4D06BDA8B52B457BFDA77CB71C3500420A607274A8F77BAA2783772B087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847554, "uuid": "358c762c-7c66-4c60-ac75-f69fd993d08f", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847554, "uuid": "56a1cb76-ce73-4627-a970-d7af663405c2", "value": "6144:EC2f60L3TOUoOMV0pLU3zDyGcHOxWoZ0CgPEDKFdhqcykGf+o:s60WU1UsLDGcHOxzZ08DKFrqcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677847554, "uuid": "9b9d8435-4e3d-4c77-a0a7-7e2c449c3a1d", "value": 285168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677847554, "uuid": "0406c73a-5cb4-43f3-98fc-d015b4d0458e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847554, "uuid": "937aad3c-d7aa-459f-8d2a-33e54d5b5cb4", "value": "92081a17d63706a837180166b90da06b83053af8e7e0b04afda26f3ac6774cfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcbd061-b98f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1677826223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677826223, "uuid": "cf7d657c-a2e2-4901-bc38-ad7284884bd0", "comment": "Malware payload (AveMariaRAT)", "value": "492b2e635f591dcccda0ed9d4ad19adf", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677826223, "uuid": "cc6f4317-ad7a-4565-85f0-58895e7eb500", "comment": "Malware payload (AveMariaRAT)", "value": "92a7ab19a5d2b088bee425ff1a8b51589ba25fcc7c95614a36a79a6c1989b4ba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677826223, "uuid": "58675cc1-6914-416d-ad2e-b5af3fc383d1", "comment": "Malware payload (AveMariaRAT)", "value": "081eb5beb1b1d4a846b262087bc44023414041d2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677826223, "uuid": "e75a1503-be5b-4f9f-8fc4-bf62113fca00", "comment": "Malware payload (AveMariaRAT)", "value": "28d96d4fea8670d6b8db6487fb9aef5d154782f1dd8722d182039659a8cab9ae0e31068f5dc7498557e8297d4ce0eeba", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677826223, "uuid": "ee73456c-c9c1-473e-994d-b9ee69b84ae5", "value": "T17A35652808FD0EF285B1F1FDDFE4E753BE8088E6A6049D9992834B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677826223, "uuid": "97a79fea-a86d-4c56-aca0-e67399e9686f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677826223, "uuid": "430281dd-1587-493e-81eb-d2691e3d3ac2", "value": "12288:NwEDHL2e/FcvepkhSCxmWy7k3WPZx80qRAycrl:N7HLTihSCxmWy7tyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677826223, "uuid": "fa8e5f55-8937-4815-a996-b0b659a4d868", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677826223, "uuid": "153185dd-c901-433e-9648-8c545299f9c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677826223, "uuid": "af73acd5-5f33-4294-9ab1-7410cee9ca34", "value": "?????? 2023?3?3?.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dcfc29-b9b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677844044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844044, "uuid": "cf023e90-c5c4-4138-8621-2f3555b8091d", "comment": "Malware payload (SnakeKeylogger)", "value": "5ce684e6f306a52137b70e99b92a2c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844044, "uuid": "a0684037-0288-419e-89f4-ea177e18d9dc", "comment": "Malware payload (SnakeKeylogger)", "value": "92ce5008c739dfea8f09903965665831a8ac4fa23c1a6060bbf26e93274e0b24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844044, "uuid": "4759fab8-d81b-4a01-aa6f-67796e68c002", "comment": "Malware payload (SnakeKeylogger)", "value": "08598c1e5827b0d56d30d07d32ea0862b5aaa66e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844044, "uuid": "0dd10dbf-a6a4-4d5d-b187-66e6ecca8cca", "comment": "Malware payload (SnakeKeylogger)", "value": "9149b10725df27b649db3e08e7afc175f10a05576454f5a7f37094c541a7fe04d46b190b984e9d0edad7219328400c29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844044, "uuid": "6e7cd048-eabb-440a-8f34-a21ed24c6f77", "value": "T19134122427F2C897D8B34771143E77672F5EA98B05A895072B8067197E37AC0AE8C771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844044, "uuid": "06c25599-5105-4fb8-b287-14dcb5f908ae", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844044, "uuid": "93f3e0e6-d62d-421e-87f1-f2cecc4b6f55", "value": "6144:/Ya60jy4qSys7geawOmD8+McBrSoJbgpBom2jBp7I4B:/YaN7gfwp8Zc9SebgEm2nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677844044, "uuid": "728adb0a-d5d2-4031-a590-e53e14d96ad5", "value": 240112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677844044, "uuid": "ff6c8e16-9aff-45cc-8ee0-cc20d3b5a5d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844044, "uuid": "a375a3d5-a1a1-4819-80e6-c3aa5fecb784", "value": "SKM_C335019110710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a3630b-b9ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677865235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865235, "uuid": "5ba920f4-f224-487b-9b65-421e12acd3a3", "comment": "Malware payload (RedLineStealer)", "value": "0a41714e22e71c225c553e006af08d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865235, "uuid": "74d3cc52-b82c-44b5-90c2-5bb096d70788", "comment": "Malware payload (RedLineStealer)", "value": "946669666cc16fe3efcdd943580b2cb17d08c978548a159f3fea4cb6f4753fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865235, "uuid": "0afcc739-cffe-4044-ad73-56e83575fdf5", "comment": "Malware payload (RedLineStealer)", "value": "3f2c0d80f9c12e460ab4ac288d75ea8d1679f4c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865235, "uuid": "4bf7aae5-4949-4dc4-9841-9a7445fc9c6b", "comment": "Malware payload (RedLineStealer)", "value": "df159804ebe89295a9ee2f6e0bbec271a00ffd19cb2dae7eb2e7aab57311b22686aa552e752932d81d341eb3c6c55561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865235, "uuid": "c78d857f-c375-477e-b90e-2fb4c13dbd30", "value": "T1B1152207A7E84072D97A47B018F703D329357E70A77CC39B224E585A0C625A4F9B5BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865235, "uuid": "6d056521-ae2b-4256-8712-576ce3e9ab35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865235, "uuid": "46209a4f-590e-415f-9fd6-c8b03451f5c1", "value": "24576:Oy2RxXW8AYZCVU4eVomPVGXxx8GQsQPfL:d2nHAY4V1w3PVOQG/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677865235, "uuid": "b7f9e2ac-c6a0-4cb6-ac96-cba55ae11544", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677865235, "uuid": "f00666ce-a397-4dd4-bac3-562db3f5311f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865235, "uuid": "5f964579-64d1-47a5-92d2-39335d32cf63", "value": "946669666cc16fe3efcdd943580b2cb17d08c978548a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b084ac13-b9a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677833532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833532, "uuid": "58d0377f-ac9d-4238-8341-016d80acf6a7", "comment": "Malware payload (AgentTesla)", "value": "52a8103aec5fad2ffcbba8062ee6a2c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833532, "uuid": "b5a63f68-9bca-4b1f-bf3a-f8b9b107b162", "comment": "Malware payload (AgentTesla)", "value": "94eb87f7e3499f7875eea1009b89bbd70aa5c99b1f82754aac3db216a88dfa58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833532, "uuid": "62e5236d-7a6a-4a89-ac46-e88641952ee1", "comment": "Malware payload (AgentTesla)", "value": "e35600cbdca1a72a590823adc44a6714eae92b2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833532, "uuid": "fe34cd84-6ffd-4323-ac0a-c4967af2497b", "comment": "Malware payload (AgentTesla)", "value": "2bb46a90ae0817eebdbe85ddd3918d8468b7a960f486d1e6fe964f67b543d4048a59dee3803afeb50d732f2cf60b1bac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833532, "uuid": "d23dea0d-138e-4b79-aa52-ac70daaef4aa", "value": "T10C35762809FC0EF28571F1FD9FD4E753BE808CE6AA049D9A92834B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833532, "uuid": "0ee14764-03ef-4151-b2f7-a31303d544da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833532, "uuid": "e4906a05-dc5e-4c11-915f-e87dd972c908", "value": "12288:eWhbSHFhGZdPpnkx6k53C3JRL+MyJd2uHErr5fr2oJ+kSlrnbA:DhbSlhUdKzZCJ4M8d2CEH5fvJj2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677833532, "uuid": "a706c5ac-70b9-4fe0-a647-fcc301a327aa", "value": 1137152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677833532, "uuid": "91ac1305-fde9-4610-96a4-5413ba000f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833532, "uuid": "620d6d4f-0baf-4c38-a265-ae2aed06b2b0", "value": "Payment Slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb8bc2b-b97e-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1677818706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818706, "uuid": "3e495a01-965b-42ef-a118-8fe544c33fa5", "comment": "Malware payload (NanoCore)", "value": "8549b70919fc9e6b8d2b03fed892b638", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818706, "uuid": "45a433de-ceb8-4e9d-b13e-f6261cb07a38", "comment": "Malware payload (NanoCore)", "value": "94f19c8d8b779beddac63f1f24faa47e4c81e1ae34a78dc253734b6326583e95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818706, "uuid": "1957a8a9-fd0f-471e-9b0b-b18c3638bd2d", "comment": "Malware payload (NanoCore)", "value": "b1fcf30b5172fb4b9a4b58bb2722e731d285b513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818706, "uuid": "f1999b80-1cad-4975-8dc8-929c9199f688", "comment": "Malware payload (NanoCore)", "value": "0f49ae066b94623c8cd9693bbb15784c2b372da1acfa215d08ca3f3be6bb9de27a3047a3afc5fb0258767e189dfbd777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818706, "uuid": "586cd5ed-a2b0-4ff1-87d4-7d9ea4c4f309", "value": "T13A74D12574E581B2DA53A5BB401DC3B84D9FF8DE0959BD8E2F8A41FA871DB81D22034F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818706, "uuid": "e2991b7d-498c-45af-853d-3eb43a717bb1", "value": "3656671b39fb07039d665176129b6c1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818706, "uuid": "a40d5a7f-4583-43f5-a510-0c754d52d8dd", "value": "6144:IMTEZW5P4nJC1Ph9cT171Vh5+tlQFtHFvclqGq9gW215KLT:IMTEZWmnJ0PvcT1xX5+fGZF0lqDh215K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677818706, "uuid": "3d1aebcf-b47c-4f23-ae6a-fb95b45a16f0", "value": 338945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677818706, "uuid": "9fef6d7f-94c1-4f27-b541-ec88a50d90e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818706, "uuid": "942adf81-bce0-4983-b4a9-f6a2ce184d39", "value": "8549b70919fc9e6b8d2b03fed892b638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12b7d08-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677856833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856833, "uuid": "fa03f21d-f1a6-4d81-b516-cad7dd64b55f", "comment": "Malware payload (RedLineStealer)", "value": "5364479847676e6cafc1b2511f12ffd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856833, "uuid": "d0717099-7b25-47a3-87d5-2782d1896e44", "comment": "Malware payload (RedLineStealer)", "value": "94f72fbf8f77ae4664efcdbb22019e9dc0b0d37e5ee3a6d70d2cde10fa5f89ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856833, "uuid": "1468bb77-dce4-4589-986e-433b226b6060", "comment": "Malware payload (RedLineStealer)", "value": "1b5d135de9a43f64dd9926271d4fa579cd7a75f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856833, "uuid": "ed06324d-828e-44c8-9e53-277b4df60aa7", "comment": "Malware payload (RedLineStealer)", "value": "74c7e98efb1ea46ac0af1684551f826ae6df0fc7556db283da353b367e9e6f640213f25a091a78cfc84f540745dbfa1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856833, "uuid": "b6f983e6-7f7c-4ee0-aeca-d605a8edccc2", "value": "T15E151317F6ECA061E8B9577104F903D30A367EA26B3583DB139FA91C08735B4A23536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856833, "uuid": "81c1670b-e485-4821-817e-23819d868b8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856833, "uuid": "7f7b3f7a-188e-4e0e-bffe-c7ec01d99a2c", "value": "24576:AymVLVbPFjLok/D1VBNo/CcgS5rTTJke4:HclPFAk/D19S5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856833, "uuid": "d577438e-06e8-4190-b073-2b796b09b934", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856833, "uuid": "e641bfb3-0498-4f0b-85d3-c0dc041729da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856833, "uuid": "cbb9e698-5481-4043-a806-7c5cbfbf58ab", "value": "5364479847676e6cafc1b2511f12ffd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d6bed4-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (1ms0rryMiner)", "timestamp": 1677829828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829828, "uuid": "f96df229-68b0-4311-a012-9f8ad24c5fd5", "comment": "Malware payload (1ms0rryMiner)", "value": "1bebd04bb79dadd20bab6c15d7015596", "object_relation": "md5", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829828, "uuid": "ab72c735-8b40-4e00-9a0a-9d705c5b2941", "comment": "Malware payload (1ms0rryMiner)", "value": "95c0a02c73590d9585983f7e9097e77b3a670243a50f1c89ae0001ad93aa822c", "object_relation": "sha256", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829828, "uuid": "12f356e4-16f9-4ea4-9df5-18c4a5fe59b2", "comment": "Malware payload (1ms0rryMiner)", "value": "ec8fe2a2e5ce653dd807417d88694926f78b9a4a", "object_relation": "sha1", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829828, "uuid": "2da836fb-6dbb-4f69-a7b0-c3c44bce9dd2", "comment": "Malware payload (1ms0rryMiner)", "value": "c48bbb3e1298b7726723a1b7209470f96f22bd4962b35945000d1ba61bcfaf1567c8f10366d44b411db31670c4444098", "object_relation": "sha3-384", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829828, "uuid": "86698ef9-6f0f-4930-8803-9d145541da0c", "value": "T1E564D021B6D0C0B2C58B45344424DBB46B7EB8326A65CECB33986BBF5E302D09B7675D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829828, "uuid": "1cab238a-df2f-43f0-8fdb-3cee50dc8801", "value": "f37943ad193a52d7b21e245b891de4bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829828, "uuid": "6d059568-f29c-4fc3-be68-e71c12b17f4f", "value": "3072:KcYADTad4LB8pjdKjLdv5D97e/oV8DxGhfy8efuaKsm0b0hd10qdGV:QADc4Lsj8h77JVWoft5aFmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677829828, "uuid": "848ac71a-95d3-4144-9669-f0ef09575e21", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677829828, "uuid": "c4c16d5a-c202-4f8a-b9b9-209358cf82ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829828, "uuid": "7c141be4-f70f-4624-8e44-a765ba2594fd", "value": "1bebd04bb79dadd20bab6c15d7015596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb5c832-b99f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1677832833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832833, "uuid": "93eca98d-ca5f-4bba-ba6e-2e95b8876600", "comment": "Malware payload (DCRat)", "value": "0e28c4a62102bea39a69edb8aa3c66d4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832833, "uuid": "7caff0f3-3d7d-453d-8c4d-07b6ae5deb08", "comment": "Malware payload (DCRat)", "value": "976455952a56cbaed90a712b91835e2c9b8537b1af0bbf67c2d094f63f8e5063", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832833, "uuid": "0461fe86-b7c7-485f-a602-94a70433b97f", "comment": "Malware payload (DCRat)", "value": "80f9540cf698c8a3001d4ffc3dd191ff2317820f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832833, "uuid": "aa2c6159-3928-42ef-8d98-c13a8ffc1232", "comment": "Malware payload (DCRat)", "value": "9c6b5fd0c1836d85aac678fb38831f04f81ba075cd29b3961744120f1deb5965b6523810b476651409034257c37332c9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832833, "uuid": "7fac3174-0735-4f22-97e5-80ec020756ae", "value": "T1FC759D017E40CE12F0192633E2FF450847B4A9112BA6E72B7EB9376D55223937D1DAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832833, "uuid": "e3d0e20e-dce8-4057-829b-17b82d1e665f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832833, "uuid": "3113e827-c5b4-42ab-b96a-43a5c10c36df", "value": "24576:B2G/nvxW3WOYnRyazl5177HHDU2fsCv+iv4uXdQRD/sFPteEQBr:BbA3nOsIr17PU6GYXq9sF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677832833, "uuid": "e1b4685b-ff90-4774-ac1f-d623a2ab2219", "value": 1625206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677832833, "uuid": "e57e4b7f-6d22-41d6-b398-c2a4e084773e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832833, "uuid": "9388a029-8d2c-4419-85c4-4723fb0d8508", "value": "0e28c4a62102bea39a69edb8aa3c66d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6061c43c-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (BazaLoader)", "timestamp": 1677844994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844994, "uuid": "11dce27d-b772-4544-9d97-dce969fd2df7", "comment": "Malware payload (BazaLoader)", "value": "4cd6d5df34e890985869429ade6a82ea", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XenoxRAT", "colour": "#9A7A6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844994, "uuid": "9793c2b0-4012-47e3-96c5-4f3082881b1f", "comment": "Malware payload (BazaLoader)", "value": "97673752a3abaa81aecd6b3296d94f436d9475b59b404241f78588965f0eced7", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XenoxRAT", "colour": "#9A7A6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844994, "uuid": "430bf128-efc5-4bc4-8c1e-ac0a7d5b2ace", "comment": "Malware payload (BazaLoader)", "value": "cee29a8cb4ef6c02ff592d40815c328b6d322caa", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XenoxRAT", "colour": "#9A7A6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844994, "uuid": "9e2dc79b-2df2-4dd5-926f-38a076c953b1", "comment": "Malware payload (BazaLoader)", "value": "cdb36beac14c2287ab457fd18456aecc8c5aa24cab781ea736c4423b38189728a7e9b0672c3ccf1d6894a91e928f6340", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XenoxRAT", "colour": "#9A7A6D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844994, "uuid": "3bea20eb-0399-44c2-a0fe-beb5ab0cc232", "value": "T18F46336E73E508F9CA975479C969824AF67AB835030191CF2BB543B1AF273C05E0B763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844994, "uuid": "b1a154f0-7b54-4c70-a5c6-751d1712efe6", "value": "6d5a80a275e05dc46eddc12818753e93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844994, "uuid": "73f02364-7c59-4972-8a3a-9d7b4d2f5b22", "value": "98304:ASorRoYwfEFPdCdcK92GtKm//qhL48AEu+N5Ykf4eNXJAjcjhLRq3eYMs3tGI:AJloYwMFPicK9vom/ShE8fu+N5p4eBJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677844994, "uuid": "ca40d28d-a97e-491e-94fd-7c38e0922496", "value": 5506504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677844994, "uuid": "ab1ce8e8-8085-4971-a756-4146a7483e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844994, "uuid": "b28625bf-a4a4-4388-b70a-bbc222b6180a", "value": "XenoxBuildAsos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c04cda-b98b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677824419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677824419, "uuid": "42603083-2138-4845-9e6a-c0b8626b18c0", "comment": "Malware payload (Amadey)", "value": "8bde5778f160ff8a1a646b7c465d2298", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677824419, "uuid": "7c27bab9-e552-4e51-941a-25e0e9d22130", "comment": "Malware payload (Amadey)", "value": "98e2adbab29c57b143ce56eebfa10e13b3f9624b98320a4168760eb46ca22209", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677824419, "uuid": "d9aaf38b-bf89-4296-8b97-0de7c51d9572", "comment": "Malware payload (Amadey)", "value": "5b7d72da8df173c20b836f45e6456aed093bc787", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677824419, "uuid": "2b9903c8-9007-48e3-8e23-ed5f9055f466", "comment": "Malware payload (Amadey)", "value": "fced6f3c4d1c6562494bfd1e26b965a489173f87b2c465c651a3018dc038113a9f15eb6be6833f34b0439fed13ee39dc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677824419, "uuid": "651641b8-690a-4d91-a40e-9286e9845b56", "value": "T16354DF11B580D3F1C84644B1B825CDF42A2EBCAD4685859B32683BAF2D7C3D15BB636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677824419, "uuid": "c35b333a-d24e-4231-9a44-524b21cdc050", "value": "02beced7c4ad92447c2c07cd28ec7c99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677824419, "uuid": "263fc783-4ce6-46db-ba4b-711ad322f2e7", "value": "3072:j6G/gFIuLRu5dscEHbmIYOrNCtQUnBTshvOkZEHvr:WGI9LRKdX3gC9+dXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677824419, "uuid": "80758481-5f2d-4e3d-ba69-6d5823611699", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677824419, "uuid": "60a12793-9660-4096-b8b5-5e17db85ddd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677824419, "uuid": "c8aadb11-b9ae-4ca8-a4ef-d78d64c00496", "value": "8bde5778f160ff8a1a646b7c465d2298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4546a02b-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677856974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856974, "uuid": "6c2371af-9960-45c0-b07d-66a61c1e4c1f", "comment": "Malware payload", "value": "8a30276441e8609ceab2aef798735777", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856974, "uuid": "bdf50feb-1bbf-4c1a-8f42-00ca08d76ebf", "comment": "Malware payload", "value": "99b1cd0f228b7264f59655ef7353cda24ecafa9f651f7fafc9a2d809f1aee1c9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856974, "uuid": "2c8319a9-4b32-4ee9-9f1e-be969629ac75", "comment": "Malware payload", "value": "fde93fa9f79121d5ab4cbc137b2cca9ad5401619", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856974, "uuid": "140a04a1-338a-4f80-a8ac-cf86d6b61133", "comment": "Malware payload", "value": "679ce01d0f5b0648a084e2a78b4234c5da42b96f31f78173a5ef73046481cd50987c1f44d194c91d00ba1daf05c25c8a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856974, "uuid": "e7059af3-6e9b-4adc-b556-dcc736211dd9", "value": "T14275BFF875047DD62A6F576BCA96ACEC13B6276399CBA4CC806477C305A3376FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856974, "uuid": "4f10863d-633e-4e1b-b046-b102ebfe7e02", "value": "24576:wLvucrNdk9mTRZQIVyceqV55ztjTV3GZfJtpAMmnl1nUwzEgkBXCBGSgu5VEo+PU:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856974, "uuid": "67e251a6-a404-40fb-83d4-b0156dca493b", "value": 1620936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856974, "uuid": "f9dba5f7-7767-4820-a700-b3d2917fd3c5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856974, "uuid": "691c53f5-2972-4671-a7da-cdb0e230500b", "value": "MARCH ORDER LIST.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b64f708-b9df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677860501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860501, "uuid": "57efe193-4884-4e7b-85d3-3866c93b5115", "comment": "Malware payload (Loki)", "value": "2217bb050416b894e5ccda35f737fd10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860501, "uuid": "5cb352db-ebfc-4988-a11a-0ac545bd7128", "comment": "Malware payload (Loki)", "value": "99e2a2ff576947884f1b3019b01893b5e1df07e20187c9de9f274bbb971118db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860501, "uuid": "e651d8c9-8c1a-4166-80e3-15d653157766", "comment": "Malware payload (Loki)", "value": "06f1feecb2915c2c33f2daefc620c463bc6afbfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860501, "uuid": "320225ee-3303-4882-b942-ae582d02ba27", "comment": "Malware payload (Loki)", "value": "c0092a035dedf2f1bce007beace806c8bdfec3e06558d2cb3c686f7bcde6785eb98d096cc504cd47ebafa7167ae590f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860501, "uuid": "c76c9b70-a0ad-4051-9c1d-bbfdeb7b6b84", "value": "T1FE35552809FC0EF285B1F1FDDFD4E753BE8088E6AA049D9992834B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860501, "uuid": "64407475-3901-4200-a7de-22f4e9b2f05b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860501, "uuid": "fd964b1b-cf02-4c61-99ca-29bd7d2aa045", "value": "12288:P+h8PidZgHyjtA48a5nVsmRwDY9HpU22ty78eF9mqJma:I8PMnjxzLsY7BTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860501, "uuid": "72972d8b-50f2-4962-992e-a9c3b842adb8", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860501, "uuid": "fabf6b5f-8bec-4d83-b1f5-a91fecc6778d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860501, "uuid": "2ad2ff24-b86b-4cee-a307-44855cc1bc5b", "value": "2217bb050416b894e5ccda35f737fd10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e9dd9d-b965-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677808119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677808119, "uuid": "bfad87e1-a150-4407-ba73-8ea3fb6aca4e", "comment": "Malware payload (RedLineStealer)", "value": "5b88a7d3c419df10a2a0aa934f878ef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677808119, "uuid": "d3ceb935-5642-4bbe-9b2a-c4abec19b3d5", "comment": "Malware payload (RedLineStealer)", "value": "9a01b1bf404479dde51650769ed7c43431cb00c618f8bf5444d9cbc60946d689", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677808119, "uuid": "5dca89db-8713-476d-85f9-b4c5c99508af", "comment": "Malware payload (RedLineStealer)", "value": "c52d59ab818f02946ee6eaf4de190bea489bd6b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677808119, "uuid": "556d3419-0743-47cf-bbbc-8f2adcf5e077", "comment": "Malware payload (RedLineStealer)", "value": "f3edf4927ab72c4f1d44fc4d6fcefb84e1d268c84fa798564d6c3bb77ab093e14ec022765db5027efa4baecfe04de854", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677808119, "uuid": "80767369-4083-41c1-8f18-52b294a6a3c6", "value": "T1DA04C41437BCCD11D5BA5A3F6961A05087BFD8026842F25B76C327CE0E36B50FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677808119, "uuid": "391b52f2-bfb6-4689-b337-21c66a6ade67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677808119, "uuid": "60866702-3527-413b-abf9-6ff122a12091", "value": "3072:TxqZWXragQx+/5qt+met5FrhPvTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOui:lqZW5qoXrhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677808119, "uuid": "4a85083e-8eb1-430e-874d-7be539de8861", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677808119, "uuid": "3902c037-d59c-4f85-8b33-74013f878b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677808119, "uuid": "c6faa58c-d68a-4883-99c5-408c199e2d1d", "value": "5b88a7d3c419df10a2a0aa934f878ef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab816e1a-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677856716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856716, "uuid": "ff616bde-b5f8-4832-86a1-eb0a2cf7198f", "comment": "Malware payload (Loki)", "value": "2fdacce07bdbbaccbc705db45811fae4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856716, "uuid": "cbf8a941-84fd-4b58-b90a-9fcf795f9aea", "comment": "Malware payload (Loki)", "value": "9a41aa400379163697ea116a1a8f108c30191cbeb4447e4e09d367321da6c8d7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856716, "uuid": "eb672ea2-34c1-41b9-b7ac-a420755e600f", "comment": "Malware payload (Loki)", "value": "03aafc3c238e0d33e99c237b3d5d9b4a6f7fa190", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856716, "uuid": "7971b130-99e0-4c01-9c22-a038ece374b9", "comment": "Malware payload (Loki)", "value": "db4095545aa9c623175737d88711905351ae3523218cdbf2e03439c18162584250280a28cc4071b5a3d248b13e366ee5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856716, "uuid": "76342b23-ecab-4e7e-85f3-e5a70e4a53bc", "value": "T1AE550103523CAE4EE242CBFCBA7F755C510D7C7671D261CA5A44B70A5632EAB52BF208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856716, "uuid": "22213e73-999d-4f9f-88e9-4bdad09401da", "value": "24576:ELKofWQmmav30xaBOfWQmmav30x/WQmmav30xMBfBWQmmav30xJ69HX36F1k7po:ELKoOQmmQ30gBQmmQ30kQmmQ30m9QQme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856716, "uuid": "1fc65c0c-84d1-4881-ae46-c926a2295726", "value": 1380352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856716, "uuid": "2751f706-816d-406d-9441-3ee840089ec2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856716, "uuid": "140b50e4-0319-414a-a5fe-db72a8ae0a19", "value": "Requisition for spare parts.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72590c46-b9d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677855332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855332, "uuid": "b5e8fb28-d6d0-4910-8e2c-573b52368f58", "comment": "Malware payload (RedLineStealer)", "value": "334c080515f3a1809dd8307212c1961a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855332, "uuid": "8bfff760-5097-47ec-9464-34cbdc60a1f0", "comment": "Malware payload (RedLineStealer)", "value": "9aa78e8428c7b1d10b7385beade2a05a7d42847d596174f8785ef5108273450a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855332, "uuid": "ae9a2b67-42cf-423a-bf9f-086ef1a4f6e3", "comment": "Malware payload (RedLineStealer)", "value": "ef2748b1b0c69060a94a235968d4493c7e028015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855332, "uuid": "9880ceb2-3929-4a5b-b6e2-fb336dd5cc2b", "comment": "Malware payload (RedLineStealer)", "value": "45d7a3e280bbb2063d7ec73cc1ed2c06c6383a397c1d60956e734863baf80109d12c4606ae82a6b8f1b79e47536c3521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855332, "uuid": "1b971126-80b9-4028-b353-74fee6b9a0fa", "value": "T15F24BF3172E0D831D0721935D970C6E55A3AFC63AD39989B37A43B2F5EB02D08A7E716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855332, "uuid": "deb9ac51-2c64-4c90-bf81-6b5876ec26d5", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855332, "uuid": "be3045bf-1bf3-4f54-9489-55424cedabd4", "value": "6144:mOb+UdYEwRWyzTT22XJk6lo15J2FjSsvGlwJHCj:mObBSLRWy3a2XJk2FgwJij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677855332, "uuid": "a0523b92-a6d8-46f8-8ee0-896b0e2e721a", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677855332, "uuid": "fc2ecb78-99aa-40af-a678-38229413a760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855332, "uuid": "19ad6565-026e-403f-bdc9-82e4e7a5d33c", "value": "334c080515f3a1809dd8307212c1961a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f90113-ba01-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677875258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677875258, "uuid": "8a6bfbf3-7706-4d24-b00d-9263c68c648a", "comment": "Malware payload", "value": "12b45fb2c92413f3ccf419d947eee377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677875258, "uuid": "b5ea543f-2900-4b80-a90f-0ed95173f041", "comment": "Malware payload", "value": "9ab1085b5fdd3308e0fc0f59b3fbffacc2d896ba0fa078cec463feae2733cffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677875258, "uuid": "b17dd2b3-ff7e-49db-b163-63cc5bd54a72", "comment": "Malware payload", "value": "e15e3f2edc4e45cc3eeb9f0e32181da0454fc824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677875258, "uuid": "85b07fef-166c-4c02-b9f9-a4405fa8b577", "comment": "Malware payload", "value": "81d481f315fdab74a9d4a851c6736414345b9198f0cc991bdebfb2f971b08e231357d64f69c6ef0609a54590886d6d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677875258, "uuid": "faca83f9-0758-4ae2-aa80-3e652f72c495", "value": "T17392C45B9DA23431C741A53B42F6B31EDBAF20199F6474F74880A8B87EB60D15C3A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677875258, "uuid": "85f2aeb1-e8b3-4497-b314-e13ea70644cf", "value": "326b2e10bf6928000ed040687b6a0130", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677875258, "uuid": "6d0616c8-19cd-424d-b1c8-e40a250df676", "value": "384:MkVD3/rbrPrqdrRrXrxCx2OVITMRmkUmmINylUX:pD3zqFB7xvOVIwmkVmOvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677875258, "uuid": "8b114e27-3fa2-439e-9128-421632f66e49", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677875258, "uuid": "1d3b96b1-1677-41a8-9646-90c36553e300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677875258, "uuid": "3e410301-4c0e-45ee-9f6c-e79c4a94e027", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29649.19850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdd65bc-b9fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1677872421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677872421, "uuid": "445dfc92-2fb0-4192-8890-9270a6dece6d", "comment": "Malware payload (Stealc)", "value": "388bba83f54dab2e8b8e9346d6a54e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677872421, "uuid": "b3647ac1-f574-433e-b6b3-81a4c451d87e", "comment": "Malware payload (Stealc)", "value": "9b10e0390c0a7f449791b2777d0d05a3a61e646a06310a40e0255840ce86a50d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677872421, "uuid": "fc50bb4c-f13d-4db1-a4fd-0fdcc231c708", "comment": "Malware payload (Stealc)", "value": "8dd58ffa2d97be21071672862fc910d3b18095b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677872421, "uuid": "45ff0fee-62f4-446c-b4d7-ad92ddca8f0c", "comment": "Malware payload (Stealc)", "value": "8d67eccb1ffc94935ad5df09ae6d541b0711fe363ce7c0f09683ff836eb1ba083ac09780052e09f08e2103232501e468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677872421, "uuid": "2168d6f1-9fd8-411f-bf44-0753444987b3", "value": "T14E14AF527EB16430D45EC6319D39C6F46A3DB921FE386A5B2338E72F0EB09A1C572721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677872421, "uuid": "1ad117e6-21d9-48ec-b2e9-f72c032c7052", "value": "27ccc1110d648cca84e0bb30f9afcab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677872421, "uuid": "64f69f52-1e99-4949-9243-0c60ea5a29d0", "value": "3072:YYnujK4MXE9ckXDOMW7b45LXiv78g1rML/:FsvmE9ckTNQ4FSj8wr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677872421, "uuid": "429d096d-9d10-4186-9675-6f89552bca50", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677872421, "uuid": "3be9a23d-81b9-4560-8fbb-388db61697ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677872421, "uuid": "1da4579c-6bf1-4df4-add8-847f98c0bef4", "value": "388bba83f54dab2e8b8e9346d6a54e70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e97c3f9-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677829824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829824, "uuid": "5b0353da-0c01-4991-82ec-57fc4bcb20d3", "comment": "Malware payload (Amadey)", "value": "829c785618dbc042bd708b2aacf0dece", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829824, "uuid": "f1679787-204c-428b-a0be-dc63772cc59f", "comment": "Malware payload (Amadey)", "value": "9b1f4025ad6964df06bcc3496c274985c44c71d4dbdc5e15f51e9c92a2493c02", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829824, "uuid": "a3505c66-dcdf-4a8d-baac-12ca480c279e", "comment": "Malware payload (Amadey)", "value": "be67347f4ec90955a2b0e853840636293d7e2365", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829824, "uuid": "d7140d15-4dcb-4ee1-9f46-445f6402e002", "comment": "Malware payload (Amadey)", "value": "5ccae5fe435497ca6ec3cd1a4eb31bdf55344151a1df98f0336be2a40734939ec39742a338ec6e82748cca60a5a70e9f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829824, "uuid": "c6cd976c-ac29-4975-99b1-533f4839af18", "value": "T13715231BBBF94031E9B01B7049F702C31633BCA15674A35B278FAD9918B1195B6363BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829824, "uuid": "fcbd657c-bcbc-4c97-83c2-d4355178d25d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829824, "uuid": "c303e956-ba45-4b42-b3f9-9d50123d5178", "value": "24576:7yvMGb9/fB1PailSmrU/JWV5Zx70Qebrsc3Ml:ur3yiQmrU/OvPensn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677829824, "uuid": "c10fbd96-88a4-4a15-a9a9-063153d36a80", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677829824, "uuid": "89c7929a-2bf8-4cce-bbf6-d4e5ab95cd40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829824, "uuid": "8cde6ee4-3358-4d35-9514-6d9af1e1c23b", "value": "829c785618dbc042bd708b2aacf0dece.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f89058e-b9ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677853234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853234, "uuid": "3aaa58f2-6a05-4bb4-8c8d-549a4f581c53", "comment": "Malware payload (Amadey)", "value": "27bc363816a91ad2074e9080ecf23dae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853234, "uuid": "f0f87baa-34a1-4a33-a751-76b43d49cdb8", "comment": "Malware payload (Amadey)", "value": "9ca7e51801c4e6739317ad90b9720d375fe076362dca54546d6bebb3e187f3d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853234, "uuid": "2fa95b1e-b710-462c-a7eb-56083dc9cd54", "comment": "Malware payload (Amadey)", "value": "9a2c174b2cd1dc1ef24df9c0211e151d9f802a58", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853234, "uuid": "6009f56d-8ca4-4015-a661-93e96c59f967", "comment": "Malware payload (Amadey)", "value": "621a7a67d9335ea8772400d7b40bde27b344f246b5f5a17ed21adf96aaef9d31deb48079e279c296e2e56edfb58496e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853234, "uuid": "8ba8f41f-9cf0-4f74-8f29-215bf5effc25", "value": "T1DE151207A6ED40A2ECB957701AFA039308367DA05A34D32B625FAC6B1D71AF47631773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853234, "uuid": "6cf79e63-821a-488c-8513-bde539e57d49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853234, "uuid": "08c96180-607c-44f6-b252-48ff372c7cfa", "value": "24576:Ky8U79R/56llVnYnMO/AoY/k/fb64WmpL9NQ3:R8U79R/Z/P+l4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853234, "uuid": "768b5db1-e58a-4631-8e2c-b21f132cd2ca", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853234, "uuid": "5d248d98-ade2-48d8-b85e-f80516692cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853234, "uuid": "da998115-9243-4ca4-87a5-cb2de70bb3f3", "value": "9ca7e51801c4e6739317ad90b9720d375fe076362dca5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fae0ad8-b9cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677853502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853502, "uuid": "7d51d3ba-21aa-4ed0-9eac-2a0e67c5ea81", "comment": "Malware payload (SnakeKeylogger)", "value": "0e5ab5deea105ec9b280fb9a6b28b86c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853502, "uuid": "e9823c73-aa92-43de-80a1-aa681b1aacfb", "comment": "Malware payload (SnakeKeylogger)", "value": "9cf253811170267c598ef711a7f56ac10a32e6aa66a97b74b6ad272cf8838593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853502, "uuid": "0e7755f2-f645-4e52-972e-ad3bc30a1dbb", "comment": "Malware payload (SnakeKeylogger)", "value": "41f57c18c53d456133ae638ed612ee9916eaf733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853502, "uuid": "ba7bfd50-3b55-40a4-9ad8-22f3ca1d4b53", "comment": "Malware payload (SnakeKeylogger)", "value": "00766c1dc74281148efd09d1b3074d043a28cc317e2d6018674b291720752d377d80b8bce667efeb5562c0b56439c555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853502, "uuid": "2dcaea87-1616-460d-afdf-0ebf91749b1d", "value": "T1EAA4F7C118CFC41EC35E3633A5A1C52A68D0CE326457532E731AAF8EF43BB4A574E699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853502, "uuid": "e8749b31-964f-4702-b05e-2315878d22ac", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853502, "uuid": "baf923cb-dad3-414b-9c79-aa035082655e", "value": "6144:cYa6dpFXx6dy7OA0zWOFdzVtA6KCeMiQQVCWJLHSXxdJeb+eUK3:cY3pFXxkrASxFdR6CECWJAxdJe/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853502, "uuid": "a949b388-69a4-4ce1-b8aa-e20c68180762", "value": 468688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853502, "uuid": "1879f1e2-fc2c-4753-9905-ef4a47f91850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853502, "uuid": "46604382-9b7a-47d2-9e1f-c6dc118a2525", "value": "scan copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64af520d-b9b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677842854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842854, "uuid": "7871fe3c-1a89-4ec8-970c-0c59bd838bcb", "comment": "Malware payload (RecordBreaker)", "value": "914961521ae1a181b030e00a57a408a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842854, "uuid": "f580ac71-52fe-46b1-98a2-ff7bbdc7b9ae", "comment": "Malware payload (RecordBreaker)", "value": "9d0089332a81e9627912712ccd55aab929e09ea27bba04f7f73cd25a706d8f03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842854, "uuid": "cd1fb3c4-2017-4dd5-ac45-df8dda263a62", "comment": "Malware payload (RecordBreaker)", "value": "039a2895eafb1f2c533db9533902368e17afec0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842854, "uuid": "09aec094-e9e4-4cb5-b78c-83f2c5386447", "comment": "Malware payload (RecordBreaker)", "value": "c9bd83b5a7f3c1ed3409afe3f1217258aea11859ead4edd445a89dbf2f74ee77520953058ab9614e065aee0fe76e204f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842854, "uuid": "614e19bb-c531-4fa0-804a-24b7b46f38b7", "value": "T155E633D921F040CBE5FA5A31BD27BE1D72F17EA68584A072B0563AC52F337419C29E4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842854, "uuid": "43808d13-c385-493f-862a-428753d30eba", "value": "16cf5db3878b2dcf0f97ac9d337625cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842854, "uuid": "9a6a20b8-8c51-4fd0-ad9c-4abcf9cbe85c", "value": "196608:38XlSUIFN7Iclak+ySx+Rf5Ab1m0qGkg0NShRgViCB1828AxAtEUo3MPk/sFFvOH:owN7Ia+yW+1HIkmRQdMbAxAHo8LFv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677842854, "uuid": "cd99b56d-97bf-4b72-a031-7a3ffa5ef848", "value": 13972992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677842854, "uuid": "9cf1ebf9-82a3-49ef-a2cb-a16a9879a2f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842854, "uuid": "020294be-34db-443b-840e-d361ec1bf1df", "value": "914961521ae1a181b030e00a57a408a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7855c528-b971-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677813251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813251, "uuid": "8cc452c4-9ef6-4b7e-af1b-42d7483b9fb6", "comment": "Malware payload (Mirai)", "value": "7d9676fc3b8f34d47094a165f335d9f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813251, "uuid": "ffd4818a-77c7-40c4-ae4f-80e05cf6a383", "comment": "Malware payload (Mirai)", "value": "9d04065dcc7ed4c39fb82683f538b730dfdc1a51c07f476313c96fd477150ced", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813251, "uuid": "5493abfe-2da1-4504-a257-740daa1ecb4a", "comment": "Malware payload (Mirai)", "value": "b7230e110f74cd72ee0578d631031427f6d01f6a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813251, "uuid": "a0cd8e13-919a-40c3-90f0-580ea451d249", "comment": "Malware payload (Mirai)", "value": "b2a3d7f106d6e4c0e762c69cb0e5bac5b831f614373534960375700f18fa402b4322608b9e1c36ab88e0a2d526ffec33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813251, "uuid": "6a7de5bb-9948-4a16-a8dd-b512c35b1014", "value": "T173D2E04794F6061DE85A60F24DCEAC093C01D1AEF92D5B967F863233CF5B392242DE96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813251, "uuid": "ec5598a2-a8a4-48e1-8bb2-ab390c5c8e0d", "value": "768:t8e1HrLhah9l4QpK0u6bWfg7ZyMS+2qanbcuyD7UKQRjM:R13sJ4QpxhZyjHnouy8Ky4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677813251, "uuid": "23d6fa90-b5ff-465d-a182-f6bf120e21cc", "value": 28628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677813251, "uuid": "7e9a3fa2-066b-447e-8d8e-dfec07a44d66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813251, "uuid": "93061fc2-50f7-4719-b074-d4c5c7b0d32c", "value": "bok.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab27312-b9d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677855346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855346, "uuid": "c524a4c5-e19a-4945-9e2a-dadca025b6a6", "comment": "Malware payload (Loki)", "value": "8e71fa5a9b33cf0a3744733e1d558598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855346, "uuid": "d01d31bc-9fde-4246-9649-7d9ec31cb2fd", "comment": "Malware payload (Loki)", "value": "9f754a38e5364593dfbf8b8c6214d139ec94be6b85be9b2b13404429eba69212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855346, "uuid": "6c324449-81b2-463c-bd7d-0f9d73e75e12", "comment": "Malware payload (Loki)", "value": "5d6e4fb7ca3e74231deee8520f90d37b4da71e91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855346, "uuid": "70663c54-6271-469c-88b7-0180982eec5d", "comment": "Malware payload (Loki)", "value": "7f658c94f7fd76165d25e3824bc121e2ab4f431488867c60835b2d2c75a5ce7bbc6728abcc7b2e6cf4422b204ecda2be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855346, "uuid": "af91a4c6-bcb1-466e-803b-2111ed2808a5", "value": "T1DE45127B6E041F2AD8BB4EB80C267777461FDC0E39950B06A265BAECBF72341C915643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855346, "uuid": "c4811b04-d63d-4670-af8d-57c4367f1f7b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855346, "uuid": "12343189-1741-4941-9234-9962d8f8e79a", "value": "24576:WlPleX/YmloZiK0w1LtMqjMayhCJD7ZeR3LtRlxpSAqWm9+q4mwuFrEt:rvdSIKTlMa0CJZehfYlejuFrEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677855346, "uuid": "feff6ed9-0131-4455-a94c-5e771f0f7198", "value": 1250952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677855346, "uuid": "c0878d1d-a19f-49ef-b456-f8ddc9f09501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855346, "uuid": "dc29192b-e905-474e-9130-892f6ce7ef9b", "value": "Pedido de Cota\u00e7\u00e3o (Tupy S.A.) 523AM - 924BR\u00b7p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c28a518-b971-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677813258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813258, "uuid": "1ea5ad75-33a1-48a1-9012-7ed67f6557e3", "comment": "Malware payload (Mirai)", "value": "4d6d368fa65774127d6b830d23b80e80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813258, "uuid": "eec9b1a1-33ab-4069-a290-d67901c25f37", "comment": "Malware payload (Mirai)", "value": "9fd4d885cc1733a11b67b82afd0f0fbb32f29e0cae103aaedae0c23a678257ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813258, "uuid": "c76ebbf9-39ae-4867-9a01-8f457ae512d0", "comment": "Malware payload (Mirai)", "value": "8335a607d30ee5bd1224a175f7d27f17db34cadd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813258, "uuid": "67e2627c-499b-46e6-8852-930912146800", "comment": "Malware payload (Mirai)", "value": "12f5f27c79040882a53c77f1051d8a36d9b8371232817a9b68381304377b00a95bbbf1740a4f9b10b109382172fffe7d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813258, "uuid": "e5efb234-4c2d-448a-90eb-faaad8dedd59", "value": "T176D2E11863956AA2E6302D7FC7B4C242FA0649FCD1F2203529114374B583D0B59FEBFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813258, "uuid": "1f39387a-20fb-42da-8061-760b10162285", "value": "768:3YQ5op/BpGwcdwINUL+HKvgCHpgM3s3UozV:I5pPajHKvgggVzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677813258, "uuid": "03e25643-4d8b-419a-b1bd-bdf8967b18ad", "value": 28916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677813258, "uuid": "16f4f450-253f-4146-a6fe-aca033aaab0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813258, "uuid": "e503b833-b9c2-458b-a72b-f66819e2f21f", "value": "bok.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf23455-b971-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677813259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813259, "uuid": "a029f97c-850a-4e22-b331-3fde4f3374f9", "comment": "Malware payload (Mirai)", "value": "346605921d01518f8d6ee92e314944a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813259, "uuid": "66453a42-8eca-4439-9ebc-2644b90dde7e", "comment": "Malware payload (Mirai)", "value": "a00f798cb88724dc3388e0ae02fa4ca95f47c97f5887a90078755ec3944c84c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813259, "uuid": "ed035f78-9347-4e5b-ac35-a5fcea7525ad", "comment": "Malware payload (Mirai)", "value": "cd46f8aee0c955a1205016cd901ee8a69025aea7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813259, "uuid": "a3e959fc-23f0-4348-9c0b-ab9b20a6d40d", "comment": "Malware payload (Mirai)", "value": "418cc5d462bb1461f76f7e6d2718650c2bca332f94402bef18cf4d61d7b243a6d10167bc057122e45485415a9d593104", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813259, "uuid": "cf60a51a-e875-467d-9155-404bf9e0d7af", "value": "T15FD2D075C39CEE30C130547AEE5E880AB34A4BBD53B67267116086417EDB50DAEF278B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813259, "uuid": "7d0ee966-5f28-4bec-9f3e-7a7235a4431b", "value": "384:rHiApXCUFo1QaaZaNt7IU5Dwy56ZtsQhVCj7JOlT9ayGROtcPpjkhymdGUop5hj:ziSonaZa4y6vJSh4R9cJks3UozB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677813259, "uuid": "79653355-093c-4185-a35d-163b66de0930", "value": 29008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677813259, "uuid": "ef49a80c-ec6a-4123-bc9c-e88e3e88176c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813259, "uuid": "0df03cf2-129e-4518-b8cf-cf3a7331bbde", "value": "bok.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86cb614-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677856819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856819, "uuid": "368c4bcf-572f-4f37-911f-31dc1803795f", "comment": "Malware payload (Mirai)", "value": "b58465bafd77aea358684473f654de70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856819, "uuid": "fc5de9d6-85f2-4050-8690-1d067f0fbd8e", "comment": "Malware payload (Mirai)", "value": "a18f55dccdc3a8d54affe1fbf95ee06b54be143e9b5d1ad962ba59fd74ad9908", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856819, "uuid": "2d893740-d531-4e13-a639-5ce74129598f", "comment": "Malware payload (Mirai)", "value": "0bd43c09a9ac3c17be24b8aebf595c93c3fc68db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856819, "uuid": "cefc3de2-a4eb-4e6e-970f-664247b76700", "comment": "Malware payload (Mirai)", "value": "bfbef0f115ac3f241d7df365b47dbc1166b0bb880f9a253117b2df9ce3d1bd261c0f715f5178dde56c929e7e5ad88513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856819, "uuid": "38e59160-8023-40d9-b6d5-c4d676a9d233", "value": "T1DB634BDAF801DDBDF81BD77A4453090AB630F3D512830B366397B9A7BC721A91D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856819, "uuid": "5e79efab-f406-4094-ad2d-0b65133bb921", "value": "1536:nYwtYY1wD8DYHJu8VBfy1MxeS3VdJTbAdhmq5QnN:nYwYYmwEHJ3y1meSV/vq5WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856819, "uuid": "c4b263a0-c5e5-4a00-ba33-f3b36e525319", "value": 69640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856819, "uuid": "b8025f94-f46e-4f1e-ae62-099d5ff3b1d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856819, "uuid": "bf6bf707-b6ac-4b03-9002-a961968f0ada", "value": "b58465bafd77aea358684473f654de70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de6bb83-b9b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677843165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843165, "uuid": "7b2f8733-caf8-4b5f-92e1-ca1204572a9c", "comment": "Malware payload (Mirai)", "value": "233fe057ad5c6b08bb8280a69b4d2a98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843165, "uuid": "a4fe317f-f75c-4e7b-9279-64b8fe578ef3", "comment": "Malware payload (Mirai)", "value": "a2303d11035af1a48f359f3f99d61525fdff30c240c16ffadaa73161d5021e4d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843165, "uuid": "22a27083-4067-4638-b37c-4c27259f9709", "comment": "Malware payload (Mirai)", "value": "688309cbec29e636ee8b576f5a3d64c7071587f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843165, "uuid": "56aaad32-753c-4c43-84b7-c2a72a83e112", "comment": "Malware payload (Mirai)", "value": "a394091951cee286a67e233f4df65665e81097099d3e2fd50fd71615b487800b38bf1165ddef88ae07c3d851ac79fbbe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843165, "uuid": "65fbda8f-a254-46aa-bbc5-d999edb36355", "value": "T1FE534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843165, "uuid": "067ac7ea-1fb9-4d77-991b-33581216f5b4", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQLLiKimfFoktCe3fYRMQ:WShU3q7cEDlCK/0Dj9i8Fok06fYRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677843165, "uuid": "39bfb334-9aa0-4af9-b064-efd7f671bbae", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677843165, "uuid": "23a0a2b1-5f2e-40e5-acc2-683c37bdead8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843165, "uuid": "34498663-206a-4830-9918-89c4fc169df8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2671210-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677856809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856809, "uuid": "74a5f9fb-8bf3-45ac-97fd-74ca6cdb9b4f", "comment": "Malware payload (Mirai)", "value": "bde3cec7889e01fcb1eb560c73bdd864", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856809, "uuid": "00a5018e-9021-4ef1-8a71-d1a97830630f", "comment": "Malware payload (Mirai)", "value": "a50773fe56a9a965c1567e77781d310dd93f6649495b9c03cfd52c3e839a53db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856809, "uuid": "7157ab3b-ee10-414b-82e0-8be406a1afb2", "comment": "Malware payload (Mirai)", "value": "fe5cca5224ff96cc6105a62ab9362e5bd09fbeee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856809, "uuid": "0a2cfcfb-a3e3-4d56-a92d-abc26d43acfd", "comment": "Malware payload (Mirai)", "value": "da44547296b6a955e83e358ac0d1c3ad632026cc99542a31e7f978cfa0ab9488eb2ee5350d9aa6140dc565b89da1f266", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856809, "uuid": "fca12877-13ed-47a8-9b88-c22cb0a711e1", "value": "T19C730856B8814B12C5C5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856809, "uuid": "4e75960d-a072-4c67-803c-83777e05685d", "value": "1536:mln25xPBXk1wnnkL7+KE007kXVkyazN0bIqvikNnsvHTGsV5GYIWa:rxpXCMkM/Mja4NnsvHqsVERT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856809, "uuid": "6125d7f4-001f-4314-aab6-4635c823fd2f", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856809, "uuid": "1e5997c0-115f-4a9a-b4e3-e0e1ae5f45b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856809, "uuid": "b8cc0bf0-3a75-4819-9b4d-04571eef53c0", "value": "arm6-20230303-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7995b7b-b9d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1677855475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855475, "uuid": "b95f475b-9190-4d86-8501-f02ef026d89b", "comment": "Malware payload (Guildma)", "value": "b657b0cf475472de18bc3a4ca80f98c6", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855475, "uuid": "4f0e88ff-2524-4aff-9aad-2dd3585105e3", "comment": "Malware payload (Guildma)", "value": "a5cc2042625cafb505ec175f5ca44019e7a5c44afaa5a7deabd313df5a36504a", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855475, "uuid": "867021b1-fb3f-4746-b12f-9b60f13995cf", "comment": "Malware payload (Guildma)", "value": "4a92829192aa9c9ea813fd4603a62b3f099e0c91", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677855475, "uuid": "af224641-873f-45f8-8b6c-4919cb374116", "comment": "Malware payload (Guildma)", "value": "5084e6f809b473f677cd7a62bb0b1a36147eb22b88aedc2f93e25a5dae9afc4c362e1e6a75abda44f34477ffea4c01bf", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855475, "uuid": "bb9edaa2-8812-4c45-9514-f30636a70a87", "value": "T177F0F14CB1301D82C025A533CC35CB794F9CB9CA0F51405342CF4A89A6A288DBB2DBA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855475, "uuid": "096b19f9-343c-4088-9a87-9d0ec8710287", "value": "12:8rflM8OBE6ZGxgkUtR6VGjdsL70Om/om7cGH0P3zwjyFppt5B:8loGxFUtwVGSL70Ozm7cGH2EOX5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677855475, "uuid": "9d4ad1c0-5884-4cff-8bb3-4e4b421edf2d", "value": 497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677855475, "uuid": "e73b23ce-3f82-4041-b57e-3c1b5499dc3b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677855475, "uuid": "4fd5a935-ce9a-4178-8bed-8c212c9810f7", "value": "b657b0cf475472de18bc3a4ca80f98c6.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1211978c-b9dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677859466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859466, "uuid": "ad363a3b-62ea-4a9a-9fac-92f43a5e65d0", "comment": "Malware payload (AgentTesla)", "value": "5dfb1ab6f0914e458b42f53b1a0ad9a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859466, "uuid": "29f12d4d-a51c-4116-8609-89967335bba6", "comment": "Malware payload (AgentTesla)", "value": "a5e5fcda217549a38b720ac0a0a6b6c8e1abc2bf61b519b747c3d059a0732384", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859466, "uuid": "1c0bfc56-8fa7-408c-81f1-b4695c63ac40", "comment": "Malware payload (AgentTesla)", "value": "002905258e05d3a6167bb5d46887eab0d6d55861", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859466, "uuid": "e10884da-445c-4e07-ad79-e9e4d9f5754b", "comment": "Malware payload (AgentTesla)", "value": "5c35fa1398df715ac54ca15c981f50e77eab8d2b0304cc6e47a216e49ccfbc67623f5e52bfe44f5eeaac3e2beb8a43a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859466, "uuid": "72841e2a-40d7-4614-b921-508b9168702a", "value": "T12E4423849B70098DDBD0F19310EE6A7572316A30C85FA29B5E61B72C516FB07EEC1DAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859466, "uuid": "73aba3c7-5056-430b-a2cb-9f97837ba368", "value": "6144:WSt6BuyAAyDM0JfRa2XeB/u6rSH1B9fqLtzT7C1:nt6Yni2XeB/uykB9YlT7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677859466, "uuid": "de2d2114-cbb2-41b4-8493-84341dac11b7", "value": 268521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677859466, "uuid": "3ef0d035-ef7d-4dd5-9db1-c56293faddf7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859466, "uuid": "4892f3c5-fa6f-4570-84b2-f5949ebf02cf", "value": "PAYMENT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e6cfeb-b9f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677868733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677868733, "uuid": "efabaa8e-a56f-4761-a883-097e2478e241", "comment": "Malware payload (Mirai)", "value": "db9e3cf7a1c1244a2786735fcca78322", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677868733, "uuid": "7f0399b7-a01b-410f-84b3-330b72742ad2", "comment": "Malware payload (Mirai)", "value": "a6514b9ab219039586292131bd576631de7886f6efc833e4631233e3b50d820c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677868733, "uuid": "ade50179-80f5-46fb-8318-a61bd831c5a0", "comment": "Malware payload (Mirai)", "value": "29d7459ab2261313763caed2484c2f9285e0dd98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677868733, "uuid": "051d951a-bb5d-4a7e-afd3-3b654e27f208", "comment": "Malware payload (Mirai)", "value": "cb4b9eb72d255ecbcf89a4d0a5a740621582e53f7d6fe9c0fd358cda6d11ebe17281577711232ca188e30056d6ac7d0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677868733, "uuid": "40405744-b83f-4063-a55e-15f6a7139f1c", "value": "T154D2E180A9EA7276D1FD3039C8FF3B5B6C24D71C1088C2B7AB44E6360C997B4550DAD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677868733, "uuid": "0e154030-a051-4af7-aef4-b3af70e35b21", "value": "768:C3LVLOacrw4LmCyPbgvMDGCyHA8Z9HgCKa+TMjnbcuyD7URQRjD:C7V7cM4LryPh3y7Z9Hgw6Mjnouy8RyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677868733, "uuid": "38bf224e-d9cb-42a3-aa2e-d12ebe19b347", "value": 28660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677868733, "uuid": "219be974-85df-4570-9ad1-7edd27204f63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677868733, "uuid": "1def88a9-30cf-45ba-9620-ea7cf1444d7e", "value": "db9e3cf7a1c1244a2786735fcca78322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194bf58f-b983-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1677820823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677820823, "uuid": "4aa2680d-2858-4c8c-b508-b04ea9d33972", "comment": "Malware payload (TeamBot)", "value": "86bd9f80c4200795cd6e9503eb4dbbe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677820823, "uuid": "3338fade-6863-49eb-a59c-de5b4e557476", "comment": "Malware payload (TeamBot)", "value": "a777c3095983c8f298af961c4414ca0d6daa942f6136f4a8c950f11cf13fb1b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677820823, "uuid": "0f90d085-34e5-45d5-9917-f7a944c399b5", "comment": "Malware payload (TeamBot)", "value": "7c8565eb6f8b676159579faea33e4b3d1dcfcb99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677820823, "uuid": "420adca2-499f-48af-a88a-7121b6dd2486", "comment": "Malware payload (TeamBot)", "value": "3bd70dbda79e6fb3a9ee41714dd1f9ce15ae9e3b6dc8d8d422f139578c0e9d0329dacd10f41ce1b621d0e2a14ee48e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677820823, "uuid": "33293d91-7f71-40c4-88d3-2ba3daa6a8e2", "value": "T13D762373629C1149D0B58C398933BD94B7FA032B8752BC7479DE65D73B360A4A233A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677820823, "uuid": "ed8f5152-29a9-4d63-862e-5de4e52d41f6", "value": "20fcca9c4f6d6a96b55e9305c9ac59ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677820823, "uuid": "0c4aaccb-0f44-4b14-8163-2684dddbfb93", "value": "196608:Mt0FhZWBSohgKnZgvpQi1z4RYlf3jfLyxQH8K:UCoxnZgJV2YdfLyxFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677820823, "uuid": "99b58443-7ebd-443a-9745-6d87d8f90024", "value": 7217152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677820823, "uuid": "00025b97-375d-44ce-9a67-c3183e801ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677820823, "uuid": "ca669db0-daaf-478f-a346-8f253f81dd94", "value": "86bd9f80c4200795cd6e9503eb4dbbe0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6e2f28-b997-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677829690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829690, "uuid": "335dbc30-fcc6-41ec-b738-af484eac972b", "comment": "Malware payload", "value": "f66f8692a28324dcd2516d3c550a782c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WScript", "colour": "#C4752E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829690, "uuid": "cf3f1c38-e908-4b03-b4e2-c378dcd0b24c", "comment": "Malware payload", "value": "a925f580d1c6c1ebb785768d660ececeeec8c85c113728b447d2ab8a9287ed14", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WScript", "colour": "#C4752E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829690, "uuid": "98665d91-7de5-44a5-8076-6cb3236460ed", "comment": "Malware payload", "value": "6a06ab68d3d4e3ae39d44f0c36a8e042fe297012", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WScript", "colour": "#C4752E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829690, "uuid": "6c364e9e-7bea-4a55-93ce-8c242591bdf6", "comment": "Malware payload", "value": "4b26f1a1d9e36b48027575289b82226a39206f72fdd3a38597b23758e594bfd35fab929d517ddea68add721c204e542b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WScript", "colour": "#C4752E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829690, "uuid": "173a1499-462c-4d89-a158-e01b149d4aff", "value": "T1D12189F90AE9ADF0A98AB3D1C40CB701A9E30042752CD4A3FD6DD9843111789E6F867F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829690, "uuid": "8e01a0a6-8693-4ce4-a665-7210f66f8ffe", "value": "24:AuUQBBXD1EeijAREV3PSWEAoJp2BVc9m7WrcBmneka5D2VmyEoz:AudB2qRdJp2ByQcCAekax+Bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677829690, "uuid": "a4c12d80-e669-4257-9a13-e8a6d7df0c54", "value": 1123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677829690, "uuid": "55c14b93-0aed-4336-b23e-6bdf96480bd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829690, "uuid": "30f79691-7e9b-448a-9039-8194cd6f2e54", "value": "Document_2_Mar-9440465.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af64ed5a-b979-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677816780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816780, "uuid": "de03d437-3418-43fa-9187-82e819d887ec", "comment": "Malware payload", "value": "ef608d5557a183d3a1f66e4734a6573d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816780, "uuid": "e06ae7dd-63cc-4355-922b-17a7a51473d7", "comment": "Malware payload", "value": "aac13c7dec7b5acb804d4b896245962c395f1cd6dfce79bc9c96edcf65ae8e68", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816780, "uuid": "ec38680a-0e95-44fa-9527-f227df123e05", "comment": "Malware payload", "value": "33f82645a75a8dbfab73f8c1f3f776aa83cea869", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816780, "uuid": "120ca135-5c08-411d-b1bb-a60969198f48", "comment": "Malware payload", "value": "bc35b1571a38272a066798abc34c2535f031c44942a20dff28f4d0a1a7d3e7cec05b5dba8e36a0274b49a49fd1ae5990", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816780, "uuid": "bcc08638-bbaf-4cb7-9a13-b7ebab875a3a", "value": "T1C1E62297B718582FCC7741B259AE1231665B4D428E839B83BC84371C29BB5D82F8DBDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816780, "uuid": "a1e0176e-3a55-46eb-8d41-a7e0d9c4eeb2", "value": "393216:vPYYtbyQi7x+cnTxv8EzJss3pqyHkLDelNwhYLxckKDWJQCrYM:YYtbzi7IcnlxHwDcLqWOCMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677816780, "uuid": "589808df-72a2-4e5e-aa3a-d30526ddfc26", "value": 14584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677816780, "uuid": "7e37fdb6-4730-4aa8-8352-6a3c44cfa847", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816780, "uuid": "29e88675-54b7-4218-bc0e-da4ff38912d2", "value": "aplicativo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28fe985-b99a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677831012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831012, "uuid": "2f6cad9f-1d15-447e-bbc8-e0c9428b50a1", "comment": "Malware payload", "value": "ecc67c9b62ffa4306f47b2f89fb48ee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nevada", "colour": "#D88494", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831012, "uuid": "0e664d50-06d7-4db7-8537-584b05fa1dd8", "comment": "Malware payload", "value": "acc31048e00d1a0f4cd5569d5d4db539da8f506cc7a6a171942d015ecc817d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nevada", "colour": "#D88494", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831012, "uuid": "2cf13cda-cf12-4983-b54e-ed4a593b806c", "comment": "Malware payload", "value": "ff9addfcf02dba5d7f7bd75b321170cfbb5ab345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nevada", "colour": "#D88494", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831012, "uuid": "a1ec018f-b88d-4547-9532-eb7df96d9cdd", "comment": "Malware payload", "value": "8d138ce4d97f34d89afd61ee6ea1fd49298a98a46cf8c4be3a23b58e56ac39a0a0886304c7d17ff2fd01fbc994d5bab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nevada", "colour": "#D88494", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831012, "uuid": "34caf9ae-83d3-4536-a28c-d0bc7665f49e", "value": "T1C6B44956BA5626FCD06AC07482464A627A317CCA0B31BEFF12D831752E3AAF15F3D714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831012, "uuid": "1ce74641-d522-4743-9f49-5405c980470a", "value": "58fabfe6bff1d6b98fac8dda7c01138e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831012, "uuid": "c4df1d80-64c6-4619-841f-266e84c83321", "value": "6144:l5BGdXpsv8yHWjRxmrkwql2yVayc4nP4jcyeO9mrmcFExcZi5:/BGQkwkwnyVZHScyz9mCcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831012, "uuid": "d3039fc5-f6d3-4ad9-9fa0-2469a9b0dc03", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831012, "uuid": "7cff9ef3-df44-4f83-b520-2402adec104d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831012, "uuid": "73cc404b-668d-4208-85ad-de745fafdf93", "value": "dca76e86bd8839c29ba483a379244a6a7687d50b5de7b5efdcb7f2e11ed77fe2_decompressed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7387d8c8-b9df-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677860488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860488, "uuid": "610521b4-7d40-4641-a24d-62547968960e", "comment": "Malware payload (AgentTesla)", "value": "2e43a6f8abc98cb954a9b1b0aa7d3e97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860488, "uuid": "64390633-8112-42b4-8e7a-797e62594bd0", "comment": "Malware payload (AgentTesla)", "value": "aced5165801c3fae21fb69b21d9dbaea768a5cc075186c660a81685ceba0dc1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860488, "uuid": "772897c8-cc57-4f74-9291-c26c352a047b", "comment": "Malware payload (AgentTesla)", "value": "bc3c34f491fd3d8879a817ea7fa1365116ff399b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860488, "uuid": "2a0d83d9-8fcd-484c-b89f-0d590dad507a", "comment": "Malware payload (AgentTesla)", "value": "29e0bca4f7985e8288da7462d4a69c9597b0a7e24369c256e39c0de9c401763389d669389664afb1ddc14173197efadb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860488, "uuid": "b53ee173-73de-4297-abde-04946939fade", "value": "T11545A82809FC0AF24571F1FD9FE4E753BD8088E6AB049D99C2838B89555395720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860488, "uuid": "519ff492-6977-4541-b9bc-41b6677ce39f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860488, "uuid": "99ae4f6a-3212-44d0-b0d5-3107a93c9267", "value": "24576:ASJYdSS+gidtZxsoWUMa929kC5MndBHv:A1dYztZaWhCcBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860488, "uuid": "33be24d3-c5e5-4ec9-8ffe-10c42a570fdc", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860488, "uuid": "8bef2085-2e22-4348-a720-549be54a3959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860488, "uuid": "1a2e2d53-4811-4137-94da-3a595ac7aad8", "value": "2e43a6f8abc98cb954a9b1b0aa7d3e97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e998a6-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1677857430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857430, "uuid": "a957a904-46c2-4038-8842-6c767f371035", "comment": "Malware payload (LaplasClipper)", "value": "b8c11d1e438c7abf33904db470deab58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857430, "uuid": "a362f54e-9a8b-42e4-a4a6-32730bd18bae", "comment": "Malware payload (LaplasClipper)", "value": "ae06808ceca81f8a6b113f6c933689b421fcb2816ab8ecfe0b52bde0a4b91911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857430, "uuid": "7a95c911-7271-4c0b-8b9a-ac5e2c1d99a7", "comment": "Malware payload (LaplasClipper)", "value": "af8ab902c26d27a6602c491848135fd852517b9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857430, "uuid": "527e522d-132c-46f7-9829-7bd9ef13b553", "comment": "Malware payload (LaplasClipper)", "value": "92dc4af2778e5f756bda1f88217274c370d895fbea4be81986dc16a13cc544923dddd04d9f82da85aa309e09db8baf63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857430, "uuid": "9ec871be-36a7-40a7-ae41-a1ca088c28c4", "value": "T171148E2232E0A860E5725F329D2982A46F2EBC535EF8579B3678EB2F4D701D1C572712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857430, "uuid": "f01b2a60-60b4-405c-a888-ea2e4b2d96f7", "value": "bc78aef2c4ad84e722343217c31a9a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857430, "uuid": "610b0594-d296-46ae-b853-dc8639b2c684", "value": "3072:nTzk1pnmFFe+1MvYSnrPHbBw/focbQgWrHTWcL4STQsrdwM3:Tg1pao+1MgSnxUoc0Pe2JNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857430, "uuid": "84f25db2-b325-4f65-9847-fc1e2a054903", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857430, "uuid": "e0f5f2ad-52c7-436f-8ba1-881653896869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857430, "uuid": "b7506984-dcef-44a4-8c77-980787a94636", "value": "b8c11d1e438c7abf33904db470deab58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd039107-b9fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677873550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873550, "uuid": "dc674758-45c0-43df-8c50-11ed0a616a8e", "comment": "Malware payload (Mirai)", "value": "7fc8f08c081ba85895af643da32fd03c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873550, "uuid": "82854385-5925-4b5c-942f-07ad77557721", "comment": "Malware payload (Mirai)", "value": "ae1744019a548e7b022b5dbc019563fe994d9338453c6ca8ec69194dcf593bf8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873550, "uuid": "6217cdfc-42b2-4638-882a-8baf210b445d", "comment": "Malware payload (Mirai)", "value": "1245c295be674b49fa5a9533d5230ddc86c275e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873550, "uuid": "9e062b65-b4b1-40b3-b06a-14c62417204f", "comment": "Malware payload (Mirai)", "value": "f813efe07ba683ab1812ceb8dfd6e5b43f906ccb47eb51412591a8c624e3ddf936c18bd9773562ce486e36253b1c228d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873550, "uuid": "4261b5ea-5fea-4110-9f36-07a6961c7d73", "value": "T17283A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873550, "uuid": "18242c60-c3b5-4cbb-a75c-4c40051abcd0", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTH7ZDYovZ73x/nL8y8QG:Rakdn2Eo3ePu5GTHRYo99Be037Wf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677873550, "uuid": "a8387796-d572-4869-beb2-b011e4a2d7c2", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677873550, "uuid": "85236c42-1b82-4973-9f8f-e77cd6fdf934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873550, "uuid": "a483e0eb-c1eb-487b-b0c9-1e8abb2da208", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288739df-b98a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677823855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677823855, "uuid": "d5e111f9-8d04-4447-ba99-9ce23d980960", "comment": "Malware payload", "value": "cdca39597011ef4a3c57326d31674b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677823855, "uuid": "a6ecaf4e-5f5c-4c93-8710-8fdf4c9a098d", "comment": "Malware payload", "value": "ae35a789f61e377dc715b0695b985d399dbcfe1650f0f10fe0ea40343fc4f0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677823855, "uuid": "6f36299c-de71-4b1a-805a-6615eb286e28", "comment": "Malware payload", "value": "2a573d617ec75e3834b82f3f0141b0c09410dee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677823855, "uuid": "94cd4cb1-01c2-4bd6-a0e8-c3bf8b4641d4", "comment": "Malware payload", "value": "818d8a82efd2000a795c6739a763800ecda9e454ec2dde253eb3250d12e9222113e1491c92621d99b9ac093ab2aaaa41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677823855, "uuid": "34629d9f-6dfc-40f9-ac19-9bf9718c2811", "value": "T161374943F788469EC690D5798AAA53923371FC651F27E3C36B05BA3D6CB27D4AE60340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677823855, "uuid": "cd4e283f-7576-4e5c-ad4c-37618fb38fcd", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677823855, "uuid": "a74b3b7b-19d2-41d1-85d4-13c024ce931b", "value": "196608:MZSKNIGm3OyBEWxJVqvHo6BbP4nIwn7u8:E9uOXwJVqVlPOrn79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677823855, "uuid": "14306090-a12f-4500-b46d-203cee8ad6cb", "value": 23345522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677823855, "uuid": "48f3b51f-74da-419c-9c2d-f814842a6ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677823855, "uuid": "9a8cb9c9-f71f-4268-922d-8b6dc9fcd41a", "value": "Swastima Khadka and husban 2 leak from camera_100009101699121651848155_1518541411111111_999354181594151213151321436554551331534545141651332331551425162413651451351130000000005224356324225121314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c1b207-b99b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677831257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831257, "uuid": "9e2e5290-1d0a-4a4a-8fbe-a71aab8587ed", "comment": "Malware payload (Mirai)", "value": "3cc863bc23dce740807d332d2ae1ee35", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831257, "uuid": "85568841-1c1d-490f-8c5e-062e0e37a785", "comment": "Malware payload (Mirai)", "value": "af860e296209f56a6af76090292939747157e29a9056b76851b85d271f2f679a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831257, "uuid": "b4aca4e0-2457-4890-a55a-44d177be3d96", "comment": "Malware payload (Mirai)", "value": "36544c998ea966f6b73d490d9f7ff21fbfe17e92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831257, "uuid": "54d361e6-ac15-45b5-90d5-5e5abef3af69", "comment": "Malware payload (Mirai)", "value": "3ce6a04e21fa53d6aabf9ad8f1e0041373a6615d9d62427068d74dc2f91891fec5d22781a77a04c673325d4d9c623da6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831257, "uuid": "3dcb76bd-ab3f-45dc-b2c5-b9740820f6d3", "value": "T121730856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E106B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831257, "uuid": "45d99666-981f-44d4-b4ba-c8efa623329b", "value": "1536:mln25xPBXk1wnnkL7+KE007k1VkyazN0bIqvikNnsvHTGsV5GYIWS:rxpXCMkM/ija4NnsvHqsVERH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831257, "uuid": "e6e7d05a-41b8-4bdd-8f60-13c96a39f714", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831257, "uuid": "f69ff895-7476-4887-9ab5-3ece94730bbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831257, "uuid": "ea7a4907-ca97-4d93-ade9-c478bdab4545", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef07c36-b9b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677842871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842871, "uuid": "2fd11b28-48f8-4bd1-85e9-202fbe09a118", "comment": "Malware payload (Amadey)", "value": "29b9780bb2992d018ae312ed4180a663", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842871, "uuid": "babb3cc5-4d94-477e-8e1e-de16b538d369", "comment": "Malware payload (Amadey)", "value": "b0308039b578ab07a5710745e5895b90a88133c669ca14a8f1943845387d223a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842871, "uuid": "9ac9eef5-36d6-49ed-ba9f-8aad08a0faee", "comment": "Malware payload (Amadey)", "value": "592a993f9518c1ceab3186a8b5007826fa204b60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842871, "uuid": "ebc4695f-d16b-4267-a2d5-0a60156cf44a", "comment": "Malware payload (Amadey)", "value": "6ed5683c4c0377ab9ca9e5f6ec8172c01573c730f3cdfeb6f0cfd5fec1f7cb7c21f48a3cc4dc600ef05624483bf7cb8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842871, "uuid": "1bb72c63-a8eb-417e-acca-0dd71eee8a96", "value": "T1AD936B1030D2C471D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842871, "uuid": "22bed5e1-976d-4d2e-abb7-35a9a43c2ba2", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842871, "uuid": "5cc3180f-2ab0-4cb7-b7bd-6c30eb48a251", "value": "1536:po4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUv1aB89p:poUCWbBNpplToUs1uNhj25LJU9aB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677842871, "uuid": "61bd5513-e44c-4e87-bb7e-00b0ac907009", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677842871, "uuid": "b57f5342-5c85-42a6-bb2e-a18dc930dbcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842871, "uuid": "a0b1c318-aab2-4926-a988-b16964151e40", "value": "29b9780bb2992d018ae312ed4180a663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4216af4d-b9a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1677835065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835065, "uuid": "3445ad2e-8111-4830-ba14-9ffefb29db82", "comment": "Malware payload (STRRAT)", "value": "356ce3c9a870e3f2d75c55ed46e44306", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835065, "uuid": "71cb7371-4f9c-482f-9e02-c28d402f9788", "comment": "Malware payload (STRRAT)", "value": "b0508e6ae94dc74829af54e590f2c3c1a6d48e5c6d035d71c2eb01021bd0133c", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835065, "uuid": "27f1abea-c6f4-49eb-9bb8-348a4666bf62", "comment": "Malware payload (STRRAT)", "value": "8670819db40bab565d06cfea13f523ce192be3e9", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677835065, "uuid": "656bbde8-9609-4b9c-87da-36934d51eadc", "comment": "Malware payload (STRRAT)", "value": "5bc2d9dea22eaac99daa2bd299076f77165b81dfbe1c2a1929f65d114a0607b9f3e514cca5f8ac4664730fc1473c7440", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835065, "uuid": "5d87b8ba-09bc-4dbb-ac06-7e2b18ac42e8", "value": "T1A624235C548597A72DC88606F06DD30198FE9CC7AC4FCB30936A9A023277B86B776BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835065, "uuid": "0d7ae608-d294-40c5-a9cf-d0f2544d44a4", "value": "6144:aRLLqydCRrKQ89wGUgohtuorRyMGhnnQPHcMjycADLDS:aRXWRGPaGvo3uorgn5kHKjjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677835065, "uuid": "6814cd9a-d646-4aef-a5f1-52c1e77d5e05", "value": 226685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677835065, "uuid": "ed5c8e01-9859-49ef-ab42-002d6a594206", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677835065, "uuid": "188cd2c4-effd-4fa8-9b30-5f8742bb10ae", "value": "nNew Order.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7925a963-b971-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677813253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813253, "uuid": "f384de7b-2c4f-4897-8194-7fe4f4b782ad", "comment": "Malware payload (Mirai)", "value": "63f5f4f462ddbf26726bfcc7655cf693", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813253, "uuid": "8b1d7a7f-cf99-41c0-b390-8693e3bb0876", "comment": "Malware payload (Mirai)", "value": "b126f44918360a5ebe23040c8601bdea753086e90d26a831b802d0bdb463ee08", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813253, "uuid": "8276c745-7751-4b7a-a3d3-b02069b35fd2", "comment": "Malware payload (Mirai)", "value": "fb3e9beacea381ff54c8284cc35b507ce59602c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813253, "uuid": "0c467b7e-dfdd-48af-a7de-6fb7c35085e4", "comment": "Malware payload (Mirai)", "value": "4a2ca51ad0424a6e36bc6f591aede314b845bc624ea02ad54cddced7103384f65cf8e06215f79cdd8e5d198873f1a0e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813253, "uuid": "7f0df80c-4c24-4aed-9bc2-1d143bf76977", "value": "T1EF03E12E7AD07C56CCDF4CBC95FC93894800B2C534494E453B631DCDABF929AB99E464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813253, "uuid": "a0d246d5-8f54-4a58-b572-f9a3921a8275", "value": "768:7iUtgE6vaBrEaaYEGMZT3+4F5DfED+HPl/1MNW++9Wp:7i06vaBEYEGMW6/1MI+++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677813253, "uuid": "1255a536-d25a-4bac-a363-136fe1cd398a", "value": 38716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677813253, "uuid": "f2b1bcc9-2f0b-4cc1-a88b-c4293ca2c916", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813253, "uuid": "fd931861-fbfb-4047-8cbc-9086529795b3", "value": "bok.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3640c3e2-b9f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677869405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869405, "uuid": "e1c1c965-2613-47af-b388-e0b7d0185e77", "comment": "Malware payload (Mirai)", "value": "5d32c89b227dc25daab817f6b44ae05a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869405, "uuid": "43ef8ca2-7e64-4639-9716-7548bf3739a4", "comment": "Malware payload (Mirai)", "value": "b14e48d1127430235b232df5c9c3d8616caccddb165f15fbc65e906fa3ec344e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869405, "uuid": "91778706-7143-4991-8a38-8fd26ec2e929", "comment": "Malware payload (Mirai)", "value": "aff2e52caa5ea61fb78a8e337d1b32d4db3a113b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677869405, "uuid": "dd8ca268-5f82-4ce7-aaab-8bd1e19c8e9a", "comment": "Malware payload (Mirai)", "value": "87e4a192ff80a256ebd53a7df8b60c776f5f34a2c20721a1e99371ddb218947bc5f17e977868074cde7647f5eea411f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869405, "uuid": "85eea229-d1c2-4962-8e46-a1aa52a3e054", "value": "T101F33C46F6518A13C5D51BBAB99B418433239766E3EB3302DD245FB43F86B9E0E33606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869405, "uuid": "1f79a094-2bc1-4f86-9c4d-d92dbb6a475d", "value": "3072:/pfdhQg4mmd4I950rZs+yKaf/YqwHcADss9M/9N1DGJ:1dhQNDd4eWrZs+yKo/ADsIM/9SJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677869405, "uuid": "e5058ead-796b-437b-a8c8-7028d8462df3", "value": 160214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677869405, "uuid": "d539e282-24dd-4c5e-ba1b-45f2aa21c049", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677869405, "uuid": "54a06257-6348-4306-aa88-585335ec62a6", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a7ced4-b9ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677839426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839426, "uuid": "5122c4df-2209-425e-aada-a01b75559bc4", "comment": "Malware payload (Amadey)", "value": "83d1407748cb1c457e40091a24b9b066", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839426, "uuid": "67a5847d-74a3-4f73-800b-d1b0d7bf641e", "comment": "Malware payload (Amadey)", "value": "b1e05029497cc03b44d6f3d10fce8867e794ad8a12be4b274c467e8c8390ace7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839426, "uuid": "b660081c-46f0-4687-bdc2-bc1f1a2319a6", "comment": "Malware payload (Amadey)", "value": "4b26f14c9cfdbf461c0635d9e23245050989240f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677839426, "uuid": "d799f697-93c9-4b05-9cb2-d13a2fee1c45", "comment": "Malware payload (Amadey)", "value": "64df1ce0b3293bf95e246e810c4b131025ee0571bf624ca461aaa0f625a3851c1de2f0d26f038453a2b749b56c6fd44b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839426, "uuid": "fb903b48-eb01-4e3e-9e6e-bb6de3d817b2", "value": "T117149D2272E0E865E5724E319E29D2E46E2EFD534E78269A2334EB2F0D703D1D572713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839426, "uuid": "21d3c126-8dbb-4fc4-8d94-0551c293bdb9", "value": "31e8556425ef4035dbfc678a002ad91b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839426, "uuid": "99822845-f933-49f3-966f-0aad6daa6e68", "value": "3072:hz/JN6mkC2igqwlapi8kiFhr/has2HTzbJDWTTDMGuUjyvfLO5i3:NRNgC2igXla4Il/2HTaTDMGujvfLO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677839426, "uuid": "814883f7-c4e1-4a33-83ba-8a27111c65f6", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677839426, "uuid": "3044defe-efb2-4773-86ef-9ace9290f5db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677839426, "uuid": "3e206ba8-2c87-4beb-a445-2118278b7a15", "value": "83d1407748cb1c457e40091a24b9b066.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25d5c37-b9fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677873532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873532, "uuid": "25dec702-daa3-43d4-a207-5a72ae639daf", "comment": "Malware payload (Mirai)", "value": "af2deeac2eefa59ec5627312889245e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873532, "uuid": "c1e0f6b4-8157-450b-be4a-84ea45aed31f", "comment": "Malware payload (Mirai)", "value": "b363894b9cf7888c320b2a397a6d54fdb86cc12121b4d986ed11980ceac2674f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873532, "uuid": "27ff93e2-6820-4022-a056-31b6913921fa", "comment": "Malware payload (Mirai)", "value": "5bff36e6919baab41a720b8c0a15d94e1188af5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873532, "uuid": "cbf2cd3a-03a4-48cd-91cb-50c804d70b22", "comment": "Malware payload (Mirai)", "value": "63bed9e0b5b7517026e1a340bad54ac94242b8ff0124b2fb685a0a21cb4713ae93173f754b3d645956aae8239780f5ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873532, "uuid": "7623e0e5-5edf-4c78-8bdc-9bec3cddbdae", "value": "T1C1436BC4F643D8F5EC8715702077FB379B72E1E622A8D603D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873532, "uuid": "ec440953-b5af-4772-92f2-8cd6eb97774a", "value": "1536:JeESt/basV2rcZhG6ySN7naltad1zWOIaEjrqMBs:JeESt/basVTgS7nalQdttXESa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677873532, "uuid": "a37859f6-b231-44cc-8968-b3c061249521", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677873532, "uuid": "1afb87f5-ee27-4d39-a663-a99a379214f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873532, "uuid": "78141c74-0384-433d-bd73-640c2c84b285", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b3ae36-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677850533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850533, "uuid": "d162bfea-f734-4c1a-9c62-3cea46473765", "comment": "Malware payload (Mirai)", "value": "7edf77b5f7797ab23915744b9049f90d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850533, "uuid": "3d9dcfb6-d076-4b6f-bfb7-be72751d080f", "comment": "Malware payload (Mirai)", "value": "b39459cac41af284e3d28ec5ba4a9b0e8fcb2d8529d2105eaaa469f7832d3159", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850533, "uuid": "4888dc7f-5f82-4dbe-a6f9-3e6a4f35df0d", "comment": "Malware payload (Mirai)", "value": "5b9a24d6c825be29db5dbde543a4f3db241b7c8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850533, "uuid": "b4bec309-db75-4925-8b10-e28fe62abe5e", "comment": "Malware payload (Mirai)", "value": "72a3e61aa6b1446f8a540ff2a4e66f013ecbff151d21f961ce4b34888c3edaa770295c1d777881b27eab0918cbb8c558", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850533, "uuid": "da32b43b-f4d0-488d-9a76-74d4afad31f4", "value": "T1F303F751BC829A77C2E1137AB6AE4A8D336163E8D2CF7217DD214B607AD611F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850533, "uuid": "91d1fa10-08d4-4fc7-b7cf-0c2826195888", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTM/NYwW:svbUG5fPlUlDf4Sycv+PU/jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850533, "uuid": "564cceaf-328e-4c1c-b79a-7878bb6aad78", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850533, "uuid": "a44c5652-d97c-474f-bf11-b87761f0f190", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850533, "uuid": "25a421d4-743f-4236-bd91-02b1f15fb5db", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb1cfc1-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677856724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856724, "uuid": "7fa4438f-dc39-416f-9b40-9ac5e4b3c645", "comment": "Malware payload", "value": "18b68c32e721976c0fa637d2b01ccdd0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856724, "uuid": "a42b87f0-485a-4da0-a215-a6ffe4405853", "comment": "Malware payload", "value": "b4bcc7fc6ba4ea14b69c5c812764486b84f2bfa4b3e2e7c24db6724073990aab", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856724, "uuid": "36c0e0df-1f61-42df-be56-5c866cd5dd6b", "comment": "Malware payload", "value": "917c214b7504b3501fe25fd51286c3fad75b55e0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856724, "uuid": "fe69fb92-ccc5-4949-87fc-e07fd186d78c", "comment": "Malware payload", "value": "0307e09268814b3a5d498422a79e39aef5f9552a23a5cc643a007e90faa8a635efaa2143b39882a3ac992725c8a30615", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856724, "uuid": "e78482a8-1940-4e96-9192-1273917350bb", "value": "T12B6501039138AD4EE302CBFDAA3F745D010DBD7675D265CA5A48B70A8633EAB55BF108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856724, "uuid": "38ef927b-7675-4b44-9779-4f171374159f", "value": "24576:5LKEuWQmmav30xuBjdWQmmav30xmdWQmmav30xUEBmGWQmmav30xW63faB29tPMa:5LKEjQmmQ30wyQmmQ30k8QmmQ30mEI7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856724, "uuid": "09bc90d2-b846-446d-a62e-1047a424b9ee", "value": 1521664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856724, "uuid": "3d191aca-4d06-4999-a309-0db478a93f2e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856724, "uuid": "d84b77b4-7bab-4178-bd63-53dec2bb12d2", "value": "Q23-02-23-REV-01.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdc6dd9-b9da-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677858200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858200, "uuid": "bee8a8e7-ebe5-4e42-85de-1cbbadfa6193", "comment": "Malware payload (AgentTesla)", "value": "0bcdb41a2c7553fded5204468d90feab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858200, "uuid": "53e7e97e-fe44-4bb6-b8a9-ea8da1f7bcce", "comment": "Malware payload (AgentTesla)", "value": "b4d0c8625605b44633789f1a34f036e1684d352fde94e03c700b9d0bf6af3650", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858200, "uuid": "9dd2de64-c122-475d-aa23-61822f5cee7e", "comment": "Malware payload (AgentTesla)", "value": "eee3ccb9268349e5c8852ed77e400421da5b29ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858200, "uuid": "588e110d-edfd-49a2-bca6-2e7491893bae", "comment": "Malware payload (AgentTesla)", "value": "53766adba59034ede769555151f2e72a68515a07a8f3032427aac843563651b561f3cc3877901512778440cbb4a03055", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858200, "uuid": "63185bef-2f72-4f2d-8a7e-cae2ebd614d5", "value": "T1F144234FA0C25114E834E9B34736ABBF02687BAD9DCD64D89FCB51B9EE741112A423C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858200, "uuid": "68b03607-b869-4fcf-be65-b2ed17e8d953", "value": "6144:o3lsoHMoQT6yWh+vZ13RJZh0ADKvDj6YIu5Zp5uEFsyntdRa:k1HMIyWhyDvz0UYvIyFuE+yt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677858200, "uuid": "24d2a91a-32cd-475b-b97b-fa0dda49c510", "value": 268733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677858200, "uuid": "9125d354-efd6-48f9-9960-8b4a1540950d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858200, "uuid": "666e1a14-fc52-491f-9f58-7cf96a6378f2", "value": "SOA 5109360.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a313792-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677856983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856983, "uuid": "600de032-47e5-407d-a6ad-724e5fa6af60", "comment": "Malware payload (GuLoader)", "value": "67ad249ee0991de1568f4ea04760691d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856983, "uuid": "4e0c3eba-b1f3-4bf9-af2e-3d44674027fd", "comment": "Malware payload (GuLoader)", "value": "b64957d913512844f3f5f86ce4e8cbe50c52d5dddb19f3960b2d04211b551364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856983, "uuid": "ab1a2775-5d4f-4d5a-95c6-071aa30957ce", "comment": "Malware payload (GuLoader)", "value": "4cfe3eace0e300644815f98deaff44b5e4f15fc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856983, "uuid": "827b399e-316c-466e-9121-ec87ff973a00", "comment": "Malware payload (GuLoader)", "value": "7a69ced94695184953bf9301dbd25917be76c555177cd475f3e5e75ad16bc6af374ca9ad93b3bef80799e13ff62dd42b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856983, "uuid": "19c3201a-2f97-49d5-a826-b9278c5af015", "value": "T1FF05DF13B945D487D3812AB602B0B7755D5F8FED39A2141FF2507E8EBAF891C6A342C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856983, "uuid": "db05d269-330c-4014-ab27-80d7e65b6071", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856983, "uuid": "4d572ea4-7da6-487c-9965-112ee62058b1", "value": "12288:kc9LiUQ+k5qil2a7uizxGYUUrIZJrWGVEHYGa+6VaavCl11wLicSQj5Wg/7LNrfh:k8kIiZStUruJrWMGx61hSQjVi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856983, "uuid": "3d2ce8a3-50fc-4a7f-92da-02777023c1e6", "value": 813544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856983, "uuid": "04a4bcbd-ecde-4fda-ab4b-bca536d4200b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856983, "uuid": "9daa8a6d-9956-49a3-9ff1-75ad7392c7ba", "value": "Halkbank_Ekstre_20230303_142635_191187.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9084e8-b9dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677859649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859649, "uuid": "40863f18-f7b9-415d-ad2c-1044df860f3b", "comment": "Malware payload (AgentTesla)", "value": "8d919384a0c8ea0bf7923600ab1f3713", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859649, "uuid": "3308a72e-75e3-49d6-b9e4-33e69ea9bb75", "comment": "Malware payload (AgentTesla)", "value": "b6db82953d1d2f93c2298356b746f11744de146184bc5793c123a314045c2a4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859649, "uuid": "1c17177f-3f29-4789-b917-00f8e9f25d6d", "comment": "Malware payload (AgentTesla)", "value": "9d5b0b6c786ff841f9fdd9f8c96fe6faf8966ef5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859649, "uuid": "a89c011f-7d66-48c2-a1cb-4f41f8a8c18f", "comment": "Malware payload (AgentTesla)", "value": "9182c33962d1bc92f8aa83559243fb6fcd9f27f831b3c0ac9a21d3d872e1c2734bdfe87777bc5bd3f22d580d868dc362", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859649, "uuid": "dbfe0b89-f51b-41eb-9d7d-3f26352cd284", "value": "T1C1C42A1067E8C61AE1BE67B0A8B509141FF9F606E7B2DB4F0944B4E91C837A0BD4537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859649, "uuid": "082b54af-4894-4b83-a490-10e6e1c5fd06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859649, "uuid": "5243f97a-9ab4-441d-9bd0-e33d395ee8cf", "value": "6144:nd/IvrijUGBph73TGEjOOz60Qu+TGlLE5Sqs7L0VO70HcBhO/dfjcebw6:pvhSOG++TooxWAO708B8Zjceb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677859649, "uuid": "ccc04c67-099b-4f4c-89d8-dbdb09e4247b", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677859649, "uuid": "bf9742ba-788c-42a3-a660-636c0efd7af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859649, "uuid": "d25ca31e-5b19-4c08-a259-7961fbc51e8b", "value": "dhl parcel information_xsxl.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec81060-b9eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677865554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865554, "uuid": "d7908b37-64df-4305-863c-f60cedded690", "comment": "Malware payload (RedLineStealer)", "value": "2db823792e011f5fdaf73cf940c116c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865554, "uuid": "e68422fa-d15c-4b7c-8df8-e21e97cad16b", "comment": "Malware payload (RedLineStealer)", "value": "b866a07c5d23b3238de1750b26ea17eb016993864ceb9c93c9283a2d58dfdcab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865554, "uuid": "69fd821f-5dd8-4978-8368-b42623d07474", "comment": "Malware payload (RedLineStealer)", "value": "ee551603865b7cf071a3302bfea3385d61f03648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865554, "uuid": "c7c2fe4c-1f00-4887-aeac-6013eb7558f2", "comment": "Malware payload (RedLineStealer)", "value": "c122e557f48801015b6edd219fa6294ecfddf263c1de68f1975dba8ffc9644462571de5aa36ecdfb705e04d35dc9a400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865554, "uuid": "b9e09959-c1e7-4310-b308-f63500a92eaa", "value": "T1A9A35D20679C9F19EAFD1B75B4B2012043F0E08A9091FB4B4DC164E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865554, "uuid": "ecbf7897-4494-45ae-a396-0a4908215164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865554, "uuid": "5abb6cb8-9c1d-4ce0-aff7-62b0f7bdea5c", "value": "1536:aqsIwqR7lbG6jejoigIL43Ywzi0Zb78ivombfexv0ujXyyed28teulgS6pw:IJmRYL+zi0ZbYe1g0ujyzdkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677865554, "uuid": "849cad81-32fd-40ce-a62f-779327c57c06", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677865554, "uuid": "11623dc6-4e57-4ce9-bcc0-a852a0172fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865554, "uuid": "1f1809dc-5561-4c8d-963f-abbf8d656501", "value": "2db823792e011f5fdaf73cf940c116c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bc1f1a-b986-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677822406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677822406, "uuid": "3907c2ea-0ba8-4520-97e6-e930b0bde874", "comment": "Malware payload (CoinMiner)", "value": "ebc78cdc3ad111c496913cbf933c588f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677822406, "uuid": "a69fa710-c685-4e5d-a006-ef8a5b7ff380", "comment": "Malware payload (CoinMiner)", "value": "b8ccecfad71195c5bd3413223608c776777ac8bb1fe6e6d924789fd980842b03", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677822406, "uuid": "f6272b00-4120-4aac-a520-107655412bb1", "comment": "Malware payload (CoinMiner)", "value": "8f0ee0bf6064fb96ad095ddbea51270aff60bb56", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677822406, "uuid": "0d1a3769-aaff-45e6-99aa-8e2e1eaefaf9", "comment": "Malware payload (CoinMiner)", "value": "e0c31e6f443101fbfe2b3b4bec0bca2203de24b1c961ef73e2490cd731ec7b293eefa9f7f5d02913ecf8bed9e3b43bcf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677822406, "uuid": "3b6fe4c2-f732-4f18-af3e-1fd1d4f8b2ab", "value": "T1161551AD7A372EBECD4E45F2C3512A895F20C4969B00D0EA165199CEBA0DD439D4FCCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677822406, "uuid": "01941d45-fb61-4c6a-bb99-8b1492bae007", "value": "12288:c3LaVlhGBUgt3ppnLUFAJNwXD24zh/DGpXkMgQveL:c3LaV/GBZ59UFAuxhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677822406, "uuid": "177db40b-d490-4427-9b34-ace20ffe58c8", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677822406, "uuid": "b00d75a6-edca-4b7a-88ca-9c03da2efd8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677822406, "uuid": "7d7afbec-24a9-4f84-a9e7-2925494a3d18", "value": "ebc78cdc3ad111c496913cbf933c588f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089daf0a-b979-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677816500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816500, "uuid": "103cf066-8ea5-4532-9c97-6e8b16df6001", "comment": "Malware payload", "value": "f1b1a69f345cbba8127facdb3e67453e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816500, "uuid": "7d814d59-3d80-49fb-ac74-53cfd86b687f", "comment": "Malware payload", "value": "b8dc9a426cc79d3a50cf8349e722dbd568326b24bc2cce3dda286176fc9e24ea", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816500, "uuid": "ab8f0110-ec33-451a-b9c5-b56cd54e3c39", "comment": "Malware payload", "value": "bb974b8d0b01096a2fe33545efe9beea7138d9d6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816500, "uuid": "6a02f331-1593-4c40-98ec-d0b09a574814", "comment": "Malware payload", "value": "71277581892c2382c16f8d0b97e01c76736823599c26b384b5a3be3e3aca0ff8476f9bf0d7d782b420f0cab518316a6a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816500, "uuid": "fa92823f-41c8-4f86-88fd-58d0f7e8c3b1", "value": "T137D61287F728592FCC7781720DAD5235666B4D928E839B437848371C29B79C82F99BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816500, "uuid": "39a55f6d-95a1-4820-bc32-a5f3ffed810a", "value": "393216:uI7e78nmwNwOSPSqpE/EvMlww5vpNL3NrjrxhZ6wcxGYPX7b6:uae4nlNwOSPSqpE/Vlp5vpNLN/d6NFvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677816500, "uuid": "3751cccc-93c2-4055-9810-c7ffc4304dbe", "value": 13616297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677816500, "uuid": "67794c37-e14f-448b-a181-c9e23952efd9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816500, "uuid": "13d2f033-8818-4414-996c-863ccbd72811", "value": "aplicativo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00cf6eca-b9a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677833237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833237, "uuid": "e0a9b1a5-be56-46ba-a259-a8922d2c5d0d", "comment": "Malware payload (RedLineStealer)", "value": "e477a76c6b6380ff656aea1f0c88d258", "object_relation": "md5", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833237, "uuid": "29586938-6060-4a25-b503-f13d75df6180", "comment": "Malware payload (RedLineStealer)", "value": "b933051320a7749c3ca109ecdf4a93e3376e2ba916e0ec9fc9b99e5ce9762669", "object_relation": "sha256", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833237, "uuid": "dfc81692-bdfe-4901-b176-2767165caa65", "comment": "Malware payload (RedLineStealer)", "value": "6cf8f18698a49563d8e50b57c6605f0db1ae1ad6", "object_relation": "sha1", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833237, "uuid": "d258e83e-13ab-4405-a1af-efa2e723881c", "comment": "Malware payload (RedLineStealer)", "value": "fcb724708fec57e503b4043d354ed78010ed6eab3940f4571201e6d2efc64e1d168447a5df501580cf168c55254cbf89", "object_relation": "sha3-384", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "pw pureland2023", "colour": "#5A54C5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833237, "uuid": "76f3eeba-32e8-45f8-8835-5e515fa09e66", "value": "T14F77336828CAE390DDAAF55F10AFE1FD9EB1F976CF603E15345E14C0E583891A1F6221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833237, "uuid": "c847df84-fcaa-4cb6-8340-eca5a8960abe", "value": "786432:n+fcj32YbjgK+NWYi+YpGw4M66V0uOfZrCFmtPE6kbeBk:+fcj31/gKqupI6UrobCBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677833237, "uuid": "9c9fd945-00e1-4f0f-823f-bc3e70ec3327", "value": 32925342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677833237, "uuid": "b415f54e-3e08-4eea-a22c-7026bb91fdc0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833237, "uuid": "586c6fe5-58f1-4c33-a214-6c43040d41ac", "value": "Pure Land Metaverse Alpha.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7e6eeb-b99f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677832992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832992, "uuid": "7051f996-d013-4390-ac83-4d96b7563324", "comment": "Malware payload (RedLineStealer)", "value": "a1a2935b1e618d810a60a222d649e3c6", "object_relation": "md5", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832992, "uuid": "dc25da80-c24a-4df1-a49c-07805db1774f", "comment": "Malware payload (RedLineStealer)", "value": "b9fc13ce9933a6b09f4d458d876b1dffc29d9f07a6d3c986d29c772207043c05", "object_relation": "sha256", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832992, "uuid": "a49ffe50-c067-4d24-a7ca-a5c5d24c83b1", "comment": "Malware payload (RedLineStealer)", "value": "d6323118969c70e046e9d76df2cab9c495a19c1a", "object_relation": "sha1", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677832992, "uuid": "3fb87d6f-e690-4227-890e-843173f5e2af", "comment": "Malware payload (RedLineStealer)", "value": "78f7af3bf187bf49db5b97c82abbbc9b33bebae846e7d271b6e479108abd4555f3c3c5983fd2604e6435e75bc5ffe903", "object_relation": "sha3-384", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832992, "uuid": "2ea5b9e7-2908-4700-8c47-024e488cdcc4", "value": "T17444F11C0B8DE622D2AE05BED8E32E924771C17BDA67E74EA98C6524141F3CF4E4161F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832992, "uuid": "c735d930-f503-41b6-8a05-6fe9b465f533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832992, "uuid": "dde840f2-0fe0-4313-91e8-886b15a3ad3a", "value": "6144:xXajEvq61XgAroVU8KDEzPl/ocWCcYMOydU7rvNZHtisOM9:xuEv7XgArW0Ep/JQjHU7JttisZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677832992, "uuid": "7897c98d-02df-44e1-bceb-497b468890a4", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677832992, "uuid": "b3b5746b-0651-4245-a2eb-adcafc097af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677832992, "uuid": "10a3b080-bfb1-4893-9a9d-3128368a57ae", "value": "pureland.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8555f8-b9f0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677867756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867756, "uuid": "1411169e-0fdc-4529-9666-886c9f5765ec", "comment": "Malware payload", "value": "1068b2c1af932ed98fd17fdd76a33f3f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867756, "uuid": "14e19335-23fe-45ec-aad6-aeff38143b03", "comment": "Malware payload", "value": "bb94893d35cd18fca49c6fc6b93d8575d7ed1289a162bd1cc762f8a6badfe9b2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867756, "uuid": "35364654-9c5f-49dd-a640-5b519eb04445", "comment": "Malware payload", "value": "f5b159d9a59e8b6b1876279cfbcdac0d86f460ed", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867756, "uuid": "b4882044-4074-4ccd-806e-cf74a513c996", "comment": "Malware payload", "value": "e0e9e559ec2b94091a63c86c8948b614a16ab76520f2228df02f62f2d2055c7fe95e50d77432045bbd35525438a14faf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867756, "uuid": "c392154d-c873-4531-ac61-4d3c499c557a", "value": "T1D5A633173E818E31E0079DF26E3B53244714FD58B656A48367587A6FDEF01C0AEA3AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867756, "uuid": "0c7a6732-e27b-4415-be4e-450c57d8c9aa", "value": "196608:NBeNTc/ulSgS+WwqpG8riXuRCnCq0EmOOvZhD/z3YxLdJd7:veAHiWzmFgdLBhDLgRT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677867756, "uuid": "869d1284-fb2b-4c54-9363-879b8b485625", "value": 10235904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677867756, "uuid": "b8ff5008-c4da-44d6-bb08-1ca5f0d7a405", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867756, "uuid": "e7d5e267-f0fa-453a-ba22-54ef675d614b", "value": "Launcher (1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bd3000-b9e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677860764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860764, "uuid": "188c9191-98d3-48f3-9769-f347be0bfd2f", "comment": "Malware payload (AgentTesla)", "value": "c315d049e87f9539ac18503fe21fbc0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860764, "uuid": "73697070-f4e5-47be-856a-06d0fad8564a", "comment": "Malware payload (AgentTesla)", "value": "bbfdcca4accaf4d7480f74437cc1cb3c1e3da79730f4dec217fadf4eca34f9a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860764, "uuid": "78e20cd7-e09c-42a3-951a-b76e9283934d", "comment": "Malware payload (AgentTesla)", "value": "8d222e56d1f0fe3c02fc41e8327ef249e0c7597c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860764, "uuid": "55658c3d-bca2-479e-8273-a56ebdbc3803", "comment": "Malware payload (AgentTesla)", "value": "570cd5ee8d53556b8232c019888bb80527e18fe5a12a0c66983c1455bfa869ba8eac5b5aae57f6efa6fbfbe9742539bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860764, "uuid": "a58c1179-3430-41a5-8c55-7c8f76832c07", "value": "T1714423EF62C14E91C651A37F9EF1003D07AB9921B68BD132EBCCFA3B100C9A94551C76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860764, "uuid": "40830a8e-f1af-4469-acdd-531fdf6df122", "value": "6144:9nn8iLtSIljN4+E9KmVdm3ZJobYtAlLG0ysewOGbVtaIUS4:9LSIljpHgoZS0Ala0ysewTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860764, "uuid": "85ed1cb7-ecab-4e08-9afe-65e765b46031", "value": 265365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860764, "uuid": "efe3b567-823e-44d0-aa0c-0c6de6eb6b45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860764, "uuid": "ae952341-0be2-447e-91be-3c7fe5299445", "value": "BGD 1045 Project.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce5cc51-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677857470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857470, "uuid": "b93020cc-a41e-417f-9c91-ab3c2dabdc24", "comment": "Malware payload (AgentTesla)", "value": "b32ca16cfa9f842a9191c73c114dac8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857470, "uuid": "cbddcdfe-98da-458c-8ea6-20cd596d8465", "comment": "Malware payload (AgentTesla)", "value": "bc547f7978f4abebf31a6659ba9715abdad0b345f725d63bfe4429b868bc5113", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857470, "uuid": "c5daa7bb-9e81-4543-ad2e-65057be9e997", "comment": "Malware payload (AgentTesla)", "value": "09959c1b8ec318ff9b9581e4ca3e19af166ec814", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857470, "uuid": "1c24b950-099e-43dd-8cce-47e81e0a0454", "comment": "Malware payload (AgentTesla)", "value": "68a674e55600dd21123057ab6c93640fc887cb7560191c265655f85882b346f8616217e7b9b00788238fa215f0676d55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857470, "uuid": "67423b7d-b964-4ca2-bbfb-e6d76960692f", "value": "T10935862809FC0EF28571F1FDDFD4E753BE8088E6AA049D9A92834B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857470, "uuid": "e658e026-518c-4074-a2b8-b5fc1dee85cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857470, "uuid": "6ed16eb5-d7ca-4c29-a251-3ad04834a4f5", "value": "12288:Tn722tKcMhE+mOQdIxcDYrtF6m2VwkqJCCiTukUGLl9dUbWEbfTtN:u2t7MhELO86tF6m2Vw/JCDu3Q9WyEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857470, "uuid": "8fc73991-9faa-4251-9b99-dac022de0a9e", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857470, "uuid": "e16babee-7541-4aa3-b8d2-467feedb9afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857470, "uuid": "b978f17f-c9ce-41f4-80a2-0165f3fe30a0", "value": "b32ca16cfa9f842a9191c73c114dac8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177d01dc-b9b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677843154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843154, "uuid": "5677ff77-2912-4654-b185-cbd2e623e5b1", "comment": "Malware payload (Mirai)", "value": "b5b73831286015bc24a9f0ff8585d5b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843154, "uuid": "1ca29920-baf4-4eeb-b4b2-5e8f6d7c0be1", "comment": "Malware payload (Mirai)", "value": "bc70c204e11d63c1512c8114722aefb16d654256265ccc6742de63fa96549539", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843154, "uuid": "e4054215-ce1b-4825-bf8e-840460533741", "comment": "Malware payload (Mirai)", "value": "d1002be9f02e560a6386e2a438c1d8e3a84e8963", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843154, "uuid": "31926512-1d18-4584-a6ad-6bf122e5bdc3", "comment": "Malware payload (Mirai)", "value": "4f71f3a38237ded0e37267164a6cc83a47e7854e4a9886b4d7f793b4bc5940f6563085e801232dd0785740a74e520e7e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843154, "uuid": "cbdcd040-f58a-443d-81ce-0902e635f6f2", "value": "T1A283A51E7E218FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843154, "uuid": "c6f3bae9-b57b-453e-8314-6d3674bff1b0", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTQ7ZDYovZ73x/nL8y8Q2:Rakdn2Eo3ePu5GTQRYo99Be037WL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677843154, "uuid": "e2087742-e6fa-499d-9b73-c54390a5ff01", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677843154, "uuid": "0445c2cb-444a-4da4-bd84-359f93cfcdb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843154, "uuid": "a78025f3-98c4-4da1-99d2-9d84e7b7c66c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc56980-b9da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1677858437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858437, "uuid": "8510b986-3edf-4ef9-92d1-eed4bb264b18", "comment": "Malware payload (Cobalt Strike)", "value": "1194f2e1e6d6e80fb8ea69905d18a77c", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858437, "uuid": "2fdb5448-7420-4cd3-a223-c328293f5333", "comment": "Malware payload (Cobalt Strike)", "value": "bc74b5b8a64345852af7d6d693558529f4aaaca0d9547aa57279b1cbe998ab70", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858437, "uuid": "30f4e1e5-a010-4495-afed-aa7a6d06512c", "comment": "Malware payload (Cobalt Strike)", "value": "b0e6784083ef003127f55ca13a3d7b21822ffc0f", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858437, "uuid": "40025085-e346-4aee-907b-7735472fc6a9", "comment": "Malware payload (Cobalt Strike)", "value": "9d2f16aab6f7d6b46766ec00fefb500626ac46034dccc7f5b15a2f0882cfb724f23b54835173a8cd26a73848bae22475", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858437, "uuid": "dc9defe7-a212-4ba3-a196-21fba73b3a7e", "value": "T168E37D47B3A51CB7F4B38576C8531A09E7767C222721DBAF0660433B6E237859E39B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858437, "uuid": "40238332-a619-47e2-9fd7-7e589f290ad4", "value": "3e713fed4424d9ef4872e4dba803d971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858437, "uuid": "13f70007-b3af-4486-a927-43dc7165f088", "value": "3072:bw7iSXOs2Se0Nca+uuWDtYb7Fu24J9jTIu4Pbl/TtSdUfr:bwFXJka+ZWDZ2oQyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677858437, "uuid": "0239b9fb-3fdb-4677-aa06-cfcad6571581", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677858437, "uuid": "9cdbd559-0bd0-445f-b04d-759806c1ae4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858437, "uuid": "c2219605-96c3-4dac-a2cc-336ef594d224", "value": "bc74b5b8a64345852af7d6d693558529f4aaaca0d9547aa57279b1cbe998ab70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c538d610-b9f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1677867927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867927, "uuid": "166011cb-95fd-4a4c-a299-a436fe1fa540", "comment": "Malware payload (CryptBot)", "value": "af92a902d7a44c35209751a6a4ea76b7", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867927, "uuid": "639de811-f304-4b40-9a74-3ff12d4b07f4", "comment": "Malware payload (CryptBot)", "value": "bc8a51ae8941791b3322fcec60bd7d450c80ad7d5625084f9e59dd580883d609", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867927, "uuid": "bc815584-b59d-4c4d-8bcb-45e10c6186db", "comment": "Malware payload (CryptBot)", "value": "84df082d9587ca24dd30da7b252cb7a37006c42a", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867927, "uuid": "43b3fbb4-a275-4210-80ef-9962eb6137a0", "comment": "Malware payload (CryptBot)", "value": "35bec6653b48f2cdc069aeb063756dce689520cbc765012809f57859ea9cae49befe37dd5b8e3bbe850541010b4a035e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867927, "uuid": "9480a495-43a2-4887-90a2-b03305eba73c", "value": "T1D105F161F3C4D8BFCD5141F19128076691BABEB20450959B33C8BD2FBD3C1A6B669FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867927, "uuid": "5f5e9aae-7387-4a6e-bdaa-1da118edaa9b", "value": "24576:v1Mxt5hLFiFMw57enjaEpWCb54PRvzQsWsWZhq8VLFH:29howkCUQDqat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677867927, "uuid": "fdf92053-9930-46f7-bd5c-fef94115c3bb", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677867927, "uuid": "3e54dc1a-645c-430d-97ea-e5770d9b0eaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867927, "uuid": "174588b6-91f9-46cd-afb1-c2181514d5ed", "value": "af92a902d7a44c35209751a6a4ea76b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476dc442-ba04-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677876305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876305, "uuid": "e9b4e924-70d9-45e6-b7a9-e223e1f8c50d", "comment": "Malware payload", "value": "8e07699676d04a57269a63f944a643da", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876305, "uuid": "07b64d33-8f84-4928-b82f-ce846e13a3e6", "comment": "Malware payload", "value": "bde7460d3722147c96f86d77a16bb308e452d127f1cddf2c0f8f722aa68450b3", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876305, "uuid": "dd732906-74a9-46a2-96c5-a1ff47432ac6", "comment": "Malware payload", "value": "cfa3dcf0aa1cec95fa39c6fc061b129582a3ef3c", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677876305, "uuid": "573e6f8d-bde7-439d-924e-a78a0d6b5849", "comment": "Malware payload", "value": "91c9ebb3d6bbe4f32182b991d8475467944804ece7d2dc27266ac8c3cb8e918d434675392b81435056ac02590238803f", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876305, "uuid": "6eac95c5-e90f-4cf6-867e-df555e68763e", "value": "T19665E100B5C28872D47215320AE4E7B55A3FB9710B654EEF67E81F6E4F343C1E632A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876305, "uuid": "2c433e73-fef7-44e2-a45f-ee195978d5ca", "value": "0557b2303713417ae37d446b478fb9b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876305, "uuid": "e8432eda-32d9-4666-9864-00e6da7c9bed", "value": "6144:Xc+YAmFPhQbf8LP9uEAOCXqYiKFtlhBH/fH/ZdA45Bq0aZcYZq7w7jSfd2Gx6/im:XFYAmF5HwU4tBHBdAoB0cFw7WVXVDfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677876305, "uuid": "3b903924-8807-4184-aef8-2a1b7ac24235", "value": 1438720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677876305, "uuid": "778e3feb-73f5-4196-abd0-5351de5e6689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677876305, "uuid": "2f40ba82-0f52-4ac6-8b93-2c4579cb6af6", "value": "8e07699676d04a57269a63f944a643da.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c391af6-b9fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677871965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871965, "uuid": "a2a041e7-ebff-436a-9e1c-67f5d583f78f", "comment": "Malware payload (Mirai)", "value": "e051b648e2bb39000aff7c503c97127d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871965, "uuid": "b2ed2926-10b1-463b-8e84-50df6f95fab5", "comment": "Malware payload (Mirai)", "value": "be303713f0cff891c3129896e6dcad4777aa394c5032aeebd301f61cbe19725f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871965, "uuid": "9c52cb2c-eaeb-4adf-9752-524f4e548d6d", "comment": "Malware payload (Mirai)", "value": "a9de2ff8f6d0e807ddb6a93e35ef830e2b89710c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871965, "uuid": "397eee1d-d50f-4716-8106-671e16539d09", "comment": "Malware payload (Mirai)", "value": "8e27566abd727f516e5bd11656e3e596ec6fa2337af7b1841e2ceb29000834f85bb1c92749f82e9e53a134dc7bc09b40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871965, "uuid": "7777dbaf-922d-4b53-9d50-02f321c8d449", "value": "T105F34C46EA518A13C5D51BB6B99B418433239766E3EF3302DD145FB43F86B9E0E33A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871965, "uuid": "2749a7ca-01e1-4762-b648-495f63f27634", "value": "3072:PpfdhQg49md4cwJ075MeSq6PfQqAHcBDss9M/9f1DGJ:ldhQNEd47m75MeSq4fxDsIM/9QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871965, "uuid": "9b75f9aa-8bba-4c92-8ee5-389a28dec344", "value": 160214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871965, "uuid": "b0343d7a-e42d-475c-be9f-ab3a7c3f831f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871965, "uuid": "cd425063-d7e4-43f4-bca6-fbef0920c930", "value": "e051b648e2bb39000aff7c503c97127d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a93d950-ba07-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677877546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877546, "uuid": "02607399-5306-4803-8cc6-10d614e3283d", "comment": "Malware payload (Mirai)", "value": "5ed02737b05e74149fa1e81406407479", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877546, "uuid": "b4e76fa4-a708-4ef4-94b2-d1cf9cb47263", "comment": "Malware payload (Mirai)", "value": "bedeeb480082462b87fb57be0983a6e01b11f1c61d0c4efa672d83d013626a00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877546, "uuid": "9a2c7e36-2f4b-4eca-a274-e2786fc4f9e1", "comment": "Malware payload (Mirai)", "value": "128bc66247ce66b01bfa991d9dc3794444217e78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877546, "uuid": "5b7b85b8-69da-4025-b729-d4e935114edb", "comment": "Malware payload (Mirai)", "value": "14c9a49f5ff1b0d93edb7a783f4e902cf5f62eb8747e72b1286de4a3c15dfef2c65320281e4b74d20f4b5db22792a6c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877546, "uuid": "ce446efa-1374-490f-afe4-5577d660873b", "value": "T1A282CF30619B75E5CBE14430FAEECEC697160BF9D0FC36D217586B78894250221F93DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877546, "uuid": "aa87df1d-620d-497a-94a8-59f7296a9f72", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KManw9hymdGUop5h5lI:6/V0P6+kom0tVAoNvm+to1nw9s3Uozni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677877546, "uuid": "3896c959-44ba-4803-95e5-4394d01bf87e", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677877546, "uuid": "1d38e18c-1148-453e-98e3-91c90e2f5c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877546, "uuid": "68311e1d-68dd-4252-a794-726887938a29", "value": "5ed02737b05e74149fa1e81406407479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34bfacc-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677856810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856810, "uuid": "5c0f44ef-685f-4708-880d-31f7d947aad5", "comment": "Malware payload (Mirai)", "value": "985e82d6098433710817623a9f3dd1a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856810, "uuid": "9c21af28-220f-4e00-acc0-6a7e8b6a5cee", "comment": "Malware payload (Mirai)", "value": "bf2fc9ba3c63f6268aad5f08741bc7395bc9b5da8ccb7aadb734574abc20a418", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856810, "uuid": "f310a578-9ce2-4aba-945b-94c3177e408e", "comment": "Malware payload (Mirai)", "value": "1f3ce33efba21a60ca3090a31423a0f86a2f336a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856810, "uuid": "984f0c1f-10fc-4937-9abc-dc2817d1b46f", "comment": "Malware payload (Mirai)", "value": "e7df09459f86a3d0b8752bd6db304bafbbcaff2c01beabf2e9fb1aabc8fcf07e7b2db063caaf384ffd53198860f5fd2e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856810, "uuid": "bd859468-2a0b-4cf2-9360-f83e544d21b3", "value": "T1D003F751BC829A77C2E1137AB6AE4A8D332163E8D2CF7217DD214B607AD611F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856810, "uuid": "338fe440-149b-4762-bf4d-68c979c40964", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTd/NYwW:svbUG5fPlUlDf4Sycv+PUejW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856810, "uuid": "c3ecf776-43c6-4277-af89-ed025216dcff", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856810, "uuid": "ea60e357-2f93-4739-b06c-817cd195bad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856810, "uuid": "ef79cabd-c4e2-473b-a1f0-ac57044d7fa6", "value": "arm5-20230303-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4eafeeb-b9fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677873536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873536, "uuid": "4f22d788-2c6b-481d-9066-1aa404a734a0", "comment": "Malware payload (Mirai)", "value": "55f80c8fe5c9bfcbc644ae166e8b2643", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873536, "uuid": "7a96a46c-25fb-4227-95c0-74002be8c4a1", "comment": "Malware payload (Mirai)", "value": "bf7c26f5402beba7a90bd88459fef966419fc47c5b6dd1e949dbb4d4cbad0842", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873536, "uuid": "a040b869-4454-4eab-90be-4c6d8d660841", "comment": "Malware payload (Mirai)", "value": "960664e9a62e0330e3af0029ffd5a4383a095e75", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677873536, "uuid": "abccadc9-34c1-4da8-a971-7e7c2072bd84", "comment": "Malware payload (Mirai)", "value": "2ef1bca67df6ced06aee9f8a2f1da05b8332212a5b43f9f9cd7a9bbc9a1a1e6d107a502ba478739ff179007e052e03e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873536, "uuid": "fe2890ae-752d-45fe-b463-8c012a4ebc2a", "value": "T10F730856B8814B12C5C5127AFA2E128E332357FCE3DFB2129E106B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873536, "uuid": "89abf713-7d53-4d26-a0e1-e86f254c1371", "value": "1536:mln25xPBXk1wnnkL7+KE007kxVkyazN0bIqvikNnsvHTGsV5GYIWi:rxpXCMkM/6ja4NnsvHqsVERP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677873536, "uuid": "7b0ff010-9172-4572-bbcc-5b055dfdcbbd", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677873536, "uuid": "22eb8850-1f21-4c5c-9c05-7f8b8d74cd9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677873536, "uuid": "c578d5b2-ba25-4ca5-b05d-29442fa01af0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2397ece3-b9b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677843174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843174, "uuid": "e430c8a6-365e-4950-ac64-7198f1d2eb81", "comment": "Malware payload (Mirai)", "value": "7d6ceddbcc27b68a9794e7929a30584a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843174, "uuid": "8d8008cd-6848-4559-9af2-025ead3fabbe", "comment": "Malware payload (Mirai)", "value": "bf9b0fe7e610ec09a43854abb09adf40b58a15cf4d8c7ed044926bf3ba46c1c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843174, "uuid": "07d09557-4af9-49ed-a387-7f7e0ce690a2", "comment": "Malware payload (Mirai)", "value": "0e27f0354c10ce9a15bffe36844616006538a5f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843174, "uuid": "b4056ffd-9cd6-4797-ae27-7369c10a6df0", "comment": "Malware payload (Mirai)", "value": "7b96bcdf43947e0c369d2cd6a7ccd967cb5d820c3e04d199ae6a91096e9117c557d1fdceac9bb640d018361f9bb42054", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843174, "uuid": "a3e94612-47a3-4a88-8ec4-4f2888da6aba", "value": "T13103F751BC829A77C2E1137AB6AE4A8D332163E8D2CF7217DD204B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843174, "uuid": "143b40be-a68f-473b-b8fd-21e0c2798631", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTq/NYwW:svbUG5fPlUlDf4Sycv+PUljW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677843174, "uuid": "f4ac02b6-0db0-4641-b827-7b9e202abb9c", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677843174, "uuid": "4da90ee7-6c14-4853-bf06-544ae2bde0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843174, "uuid": "49c764d6-1b6e-493c-9538-e7e9ba39f844", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e460e1d-b9ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677866036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677866036, "uuid": "bef946b6-49c8-431b-96b6-2ce09656e1ed", "comment": "Malware payload (AgentTesla)", "value": "284792f4fae75f8cea8f36d826e4f535", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677866036, "uuid": "847eb4ac-4942-4bd4-a7d7-79bc1fdcbd8d", "comment": "Malware payload (AgentTesla)", "value": "c014994396543f2298974dd47ddd46719a63b16ce6c82fd8b64ad7487781ff21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677866036, "uuid": "8549ce66-bada-4a08-a337-c9d0aac53015", "comment": "Malware payload (AgentTesla)", "value": "bdfeaed31d327bf4934bc7cfcbbe2cf080900b7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677866036, "uuid": "f76bf20f-af40-4003-babe-e29acad86efb", "comment": "Malware payload (AgentTesla)", "value": "70c7cd92fd430cf5a34794724c5742b6cd304551bb62859ef98a4d564d5d463b0b9e20b6a45744f6b3c54c05d2f3c3dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677866036, "uuid": "24518e4d-b204-41fb-a3a7-c9887814fe34", "value": "T13B35872809FD0EF28571F1FDDFE4E753BE8088E6A6049D9982834B89551395720AFD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677866036, "uuid": "e88fc4e0-afd9-407b-a00f-b9f7491771bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677866036, "uuid": "7a6fd75d-3cfc-43d4-abff-9e7666260cba", "value": "12288:FFhh2Od7zSxdTvDN0bll/ifOU8TauRBiyFj/xoWDHDWnvZXp6swQbte0u4tR:aOd7GjTvD6ll/yCauRlDKmHidbY0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677866036, "uuid": "6252dc9d-fc8d-41c8-a3f3-85cb7f6136ef", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677866036, "uuid": "dcec9752-9593-4d71-8b83-484b4a5b1577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677866036, "uuid": "6a331d21-44bd-4eba-baaa-eec2a6dca21d", "value": "ORDER SPECIFICATION#20234547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b11231-b9df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677860467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860467, "uuid": "8fb9d99d-cd9f-40e5-93f7-51930b229f9b", "comment": "Malware payload (Loki)", "value": "d16d32f55d2a83dafe140a6a58d784ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860467, "uuid": "0851c6a0-668b-43ae-b837-0909e666f92c", "comment": "Malware payload (Loki)", "value": "c0ab36b7e47fb880b196a926d3c38c6336ccff8de52bee22b845ed21e466f7a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860467, "uuid": "0ab7f491-9f38-49cc-b34f-6bede02cd616", "comment": "Malware payload (Loki)", "value": "c163c5552543e337bb10807db92953411296e144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860467, "uuid": "3ee3f348-1ca6-40e6-ae21-05db46e222d0", "comment": "Malware payload (Loki)", "value": "d749afc343aa5f561f39d5c76ac6e9c65c0ce23b76e976604c900586cd322302c56e2ef2de4f854e89d4e8d0775f909a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860467, "uuid": "26847452-2cee-4bf4-8496-ecf7c29821c6", "value": "T15864CF2276E0C0B2D48B04744924DBA46F7EB831967586FB33A44BBE5E303D18B3A756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860467, "uuid": "68087921-0cdf-43a7-ae97-ac247f0dc0a2", "value": "f37943ad193a52d7b21e245b891de4bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860467, "uuid": "8558f00e-0107-4c59-a874-e067cd043f33", "value": "3072:jKYoZXTPMvLg8dFBPqLdvIBPoUwZ5aQ0PcubLfH6xYLQFgFjR2G6:zkXAvLnFxEsPoUXlfH6JiFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860467, "uuid": "fa39da81-3c78-4d48-bb22-7f2845abd544", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860467, "uuid": "ddcd0623-8bf4-4dcf-888e-179037339d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860467, "uuid": "fd1f14e3-2488-48eb-bb6e-d9827175f08f", "value": "d16d32f55d2a83dafe140a6a58d784ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dbdcfb-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677856818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856818, "uuid": "8dce7dd4-76ca-449b-954d-dfda02b73832", "comment": "Malware payload (Mirai)", "value": "7cf0472c1230b465a6ac88562cbeda79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856818, "uuid": "7f2e5562-0ce8-4371-b84b-f119224a8778", "comment": "Malware payload (Mirai)", "value": "c241aaf287f33873f1fc94b37c4b6f20594396becd919e9c9549062ae57df765", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856818, "uuid": "63fee609-854c-4596-9116-fec1ba168b12", "comment": "Malware payload (Mirai)", "value": "66eea113b0cc673857691e1cd559911cc1896442", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856818, "uuid": "8c52f03d-bda8-4367-bf4b-828a9abee6d1", "comment": "Malware payload (Mirai)", "value": "4b8335963bc060307629734539ba7fa7daea15a28163770c073b3d2916096c38c1fe5ab0d0f0093bebb2fa5356f89d05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856818, "uuid": "50d8e726-f6fa-4728-864d-db52af983f54", "value": "T1EB83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856818, "uuid": "7b0fc778-964a-40ae-9a9c-14f7503b4367", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTb7ZDYovZ73x/nL8y8Q2:Rakdn2Eo3ePu5GTbRYo99Be037W3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856818, "uuid": "8676fa3b-b087-4db3-8f44-591d936ec982", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856818, "uuid": "c8c3e0a5-0f28-4f16-8f22-00ea1039b0f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856818, "uuid": "52a98dd2-7244-4037-9654-3c682b85913f", "value": "mips-20230303-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214ee526-b9b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677843170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843170, "uuid": "14759846-0aca-420b-a954-c8436391d65a", "comment": "Malware payload (Mirai)", "value": "199af59f801357f7cd67fbd4cf601b4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843170, "uuid": "1f066153-24c1-4d10-8049-76251e5cbee8", "comment": "Malware payload (Mirai)", "value": "c26597b7175874b89b5954605fd8a074b6ae748a1eac690314c3f9c53a14bdae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843170, "uuid": "af1242eb-9a59-4503-b9dc-395f105824b0", "comment": "Malware payload (Mirai)", "value": "d837584cab028e3baf7daa86153aac741d6da6bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843170, "uuid": "8f23c25a-35d4-4ddd-a6e8-2cf5e0500a1e", "comment": "Malware payload (Mirai)", "value": "f51550eee28d41bcbad6847b8aa1932c91716f6debe1dda609200eb271d22a56abee2d16de202623dc3fb5a4e37025ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843170, "uuid": "d2da2240-f81d-4211-9b02-c89436d8e7c6", "value": "T199E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843170, "uuid": "7b6b4721-86e0-400d-b716-dca673d48561", "value": "3072:yJTc2PBSpml7Oabvzj4dlRsh8ZQIldMMXkkTM/9zY:yJTcGROabvzj4dLsh8/MMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677843170, "uuid": "5b4f1ec2-d9d1-4480-bb36-c9083bd28178", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677843170, "uuid": "39a59e7a-d0ff-43fa-8452-691ebd91b1c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843170, "uuid": "1ee64f58-086f-4b1f-ae14-8bb9b4a3c293", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b235054-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677857333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857333, "uuid": "b478f37a-b7bd-484e-9d53-0cd9e1028a40", "comment": "Malware payload (Rhadamanthys)", "value": "0e5181326fccbc9cda96158673dcdf2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857333, "uuid": "52698b58-00d6-4f61-8a7a-c4be4ec5a598", "comment": "Malware payload (Rhadamanthys)", "value": "c36a687a10491d55dbbc5aee951f966ce66c0a32febfddac6d54d2717b9500df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857333, "uuid": "512aa8e6-831d-4e69-9219-cefd6477093e", "comment": "Malware payload (Rhadamanthys)", "value": "99e8e806123424b96f831e0eb849a259391e7510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857333, "uuid": "70ded8a7-83ab-4e90-960a-a29d73b51710", "comment": "Malware payload (Rhadamanthys)", "value": "30e71b62177f7ce7cef15f48f640b6f4b6cfcbb21f37c069396aa9a8380a19857a0b16928b6ce12109368a930f1ca0ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857333, "uuid": "b1ca9643-37a0-4b97-a2fd-75365b858397", "value": "T1B4C59DB09E92FE91D3AF1E7490EC09801DAC574B9278874ABCC85552EEE1740EFCD2B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857333, "uuid": "facaef08-2f0c-43f5-a432-475e16ed7c65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857333, "uuid": "3cd1a9e8-2c4f-447c-a98f-2610e19955a6", "value": "24576:HLT9uAEbGJFHr5dfv/Z3aKeIHOQUwUY9BMlYGsFqr+DCgo/pd0c0yjL3OH:BBvFqaXGd0c0yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857333, "uuid": "703d45bd-2cea-4e2c-88a5-42184dbfbedd", "value": 2527744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857333, "uuid": "2dc5ac9e-5314-475f-9a80-31bccf2e6003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857333, "uuid": "6f57ac91-8b62-4ae0-8957-1b342bd59d21", "value": "0e5181326fccbc9cda96158673dcdf2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fcc28e-b97e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677818702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818702, "uuid": "4413a3e9-807e-40f9-97a4-b4f38bcf7b4c", "comment": "Malware payload (RedLineStealer)", "value": "82e954f5e7584f1f92ef1bf69d5ce0f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818702, "uuid": "8a3deb35-f0ce-4c4f-9fe0-e7562f5ad492", "comment": "Malware payload (RedLineStealer)", "value": "c495e18a3f7d28b841ae7a6f7e66c41b7e317a9928d18212184393a38aa003f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818702, "uuid": "aed585d0-b122-4c87-badb-e5ed0174d5ce", "comment": "Malware payload (RedLineStealer)", "value": "665bed22f5cbbb74e518f950c8f0cfbf0e1c3ad4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818702, "uuid": "91058f8c-9973-4e18-a210-49bb41ba5a0f", "comment": "Malware payload (RedLineStealer)", "value": "7f272e03788ac639a83e432829678c3176c6314b760db2cba1310b5f08da61d107775b563bca62f4f2b243347f537984", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818702, "uuid": "08b88368-0f24-43a2-9d79-0a4358198ada", "value": "T199C4124377FC8126E8B967705CF702C31B327D716B3893AB678E6C4A28726646931727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818702, "uuid": "846a5d20-a6d1-41d1-94bc-38cee9eb363d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818702, "uuid": "7cedce64-7ded-4271-9842-394a7ac228c0", "value": "12288:yMrhy901H08H4vg67qS9l6TaJTKXJakkhLpd8/LPcJ7h8:zyz8H417qS9LJGXJEF8/zcJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677818702, "uuid": "8997ee5a-c833-4c8d-99cc-ffa0248a37ea", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677818702, "uuid": "2fbfeece-66e0-471f-8a97-b7050c10e026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818702, "uuid": "85dda84c-48c0-4a94-b5b7-4d1a236a9e32", "value": "82e954f5e7584f1f92ef1bf69d5ce0f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223d1dff-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857345, "uuid": "e9d126dc-5231-457f-b560-da7b4a315d7b", "comment": "Malware payload", "value": "ae53bfef6e7689cc3f9a3df508426fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857345, "uuid": "4bfcf710-fcbb-401c-ab31-139b1536d629", "comment": "Malware payload", "value": "c6410d60430d06e382a5e778f978da72508127d1eb489da507b93b1d35839bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857345, "uuid": "de2dcc22-411b-4947-beb0-4f9ec3323dae", "comment": "Malware payload", "value": "2814dbbea6d5a2707f5ac06ff286b8dad0aa62f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857345, "uuid": "cd4ce53e-2f67-4cc8-9cf0-b20ba73b54e9", "comment": "Malware payload", "value": "362e0f8f8f2ade8cbfdbcc40b65b8f20cf553d79cb4e51d146e997142018941000299b911672d4b8904ae1948e55eaa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857345, "uuid": "03bb1666-3f2f-4de6-a1ba-fb11b35ad488", "value": "T19FC59EF14E91FE81D3AF1E70C0DC0AD05DAC5B8BA6A98749FC885156DAE1640AFDC3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857345, "uuid": "483c76b3-1af1-4447-ab1d-2c8f86c162ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857345, "uuid": "1b156e56-a462-4ff6-ab31-58a8f6fcc0bd", "value": "24576:rcg98mJU5vVC+0EFMmJ22JX3ayZeHnDxLMjChNGl6ArMyS96vTgXf0c6ZjfP:XqvVB0GvKOGew0c6Zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857345, "uuid": "0f0b06c6-2011-4da2-8837-783d86bbb298", "value": 2607616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857345, "uuid": "52873aff-6c15-4461-bffb-f769e1f86030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857345, "uuid": "0e973a2d-2dfe-4140-8ab7-82282e9ae93d", "value": "ae53bfef6e7689cc3f9a3df508426fe7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a79c252-b9bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677846809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846809, "uuid": "5df926ce-a87c-417a-a1fa-d9143914b6b9", "comment": "Malware payload (GuLoader)", "value": "e0886edd6b70a045738a98f07c59a40a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846809, "uuid": "5d903c93-5c1d-4e38-96e6-c7c94c67abc8", "comment": "Malware payload (GuLoader)", "value": "c669765bda84590a763c618bfc8b9e694b2c841a7dea0bb950d2309a83b1b9e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846809, "uuid": "ee898ff2-5c15-4fe1-b53f-ae5af68218da", "comment": "Malware payload (GuLoader)", "value": "bf5e82fcd09e36649206cb067a34bd8f773ed525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846809, "uuid": "584b843f-ddf2-494c-a507-4ea4099ad511", "comment": "Malware payload (GuLoader)", "value": "c2e999840a9320a3c0243bb25b8ca766c332ed86454d48e6292277fa18de3c78e9f1dc2f1dba2e9f18c68f863bd726c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846809, "uuid": "d9423dd0-1784-48e7-8b0a-f0785c0c716d", "value": "T130841200B291CA6EC02241B0717997656BA2DC1365AB4E4B5BF4FE7C5C32381DF1FA6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846809, "uuid": "6d43619f-e7c8-45c8-9dca-776132516182", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846809, "uuid": "5969e4bf-bcaf-4e2b-90cc-a940aa91b7a3", "value": "12288:BbMpZKo00ECKka8Ncv4UkDd8ieM1+DMh9Pc0N:BbyZKohEtF8CvbkDd8TDM7Pc0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677846809, "uuid": "fdf72dc7-e079-4c2b-90ae-7318845ee7bc", "value": 403150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677846809, "uuid": "11c9331c-1278-4030-bd28-15cb4c6833af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846809, "uuid": "950a00af-b1e3-4dd2-bf72-9959fe4a1532", "value": "c669765bda84590a763c618bfc8b9e694b2c841a7dea0bb950d2309a83b1b9e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba37da9-b9cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677853495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853495, "uuid": "a53a1476-02c7-47de-8f37-0bbd0a6a1a30", "comment": "Malware payload (SnakeKeylogger)", "value": "016ab7cb4024585dc7956d18252b8ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853495, "uuid": "4de5e627-00fd-4eec-a326-b7ffdcb694e6", "comment": "Malware payload (SnakeKeylogger)", "value": "c6f24c1fb6934142bc9a42cfd28756c57751cbd12f42193a21f9f27506a00d99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853495, "uuid": "90c88b5e-b92c-4cc5-a668-9716f704cbc6", "comment": "Malware payload (SnakeKeylogger)", "value": "96eeb6ad9ad65f73a4b111ca0d822c99a7b7e84d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853495, "uuid": "3eeddeed-660d-4107-b402-629ba874ab9d", "comment": "Malware payload (SnakeKeylogger)", "value": "086a178f08b08f553a8b1e2eabb0883a86a92bf8cc234b71de8065cba697c154c5b07b7571f81878c12ae84007defa7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853495, "uuid": "3df831f8-b7e1-4e75-b6f0-49bd751a930a", "value": "T1D805C132E62033DBD4728EFFE812692402357BF78D89D5075E8469FA212177EA352637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853495, "uuid": "220c0f86-9c2f-4ed2-8ef1-359a8d0b998d", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853495, "uuid": "5b102890-ed79-470e-8218-b6b7a9af29e8", "value": "12288:GENN+T5xYrllrU7QY6E6zAX+0BMjGsWV92y9F/kjRV4C:K5xolYQY6E6wujGsWV92y9CjD4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853495, "uuid": "9c49911b-e514-4184-b4a6-bc1ab1c5119a", "value": 823739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853495, "uuid": "39f3456c-bc97-4c1d-ae36-f31e6cde20c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853495, "uuid": "63347ad4-4c84-4c08-8195-20a1255e13e2", "value": "SESSS0987645678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ff8f11-b9e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677861596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861596, "uuid": "cd082cf6-fffb-4335-a08e-4358203a82cb", "comment": "Malware payload (Rhadamanthys)", "value": "fb7ea1278a65ccdbbd4b3a2491d43081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861596, "uuid": "ec4a1466-12c8-4ff4-9d17-152ec76bf751", "comment": "Malware payload (Rhadamanthys)", "value": "c732e2929b06b26edb894ac000468d4b263e6284ce2c7731732a1b03bae56ad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861596, "uuid": "ba7b7921-6f72-401d-b52d-ed837ba304a9", "comment": "Malware payload (Rhadamanthys)", "value": "570f3db9a00798edfa12a61aed1dbd77241cdad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861596, "uuid": "9639f645-04ad-4448-9862-5746764b4a2d", "comment": "Malware payload (Rhadamanthys)", "value": "a401dac0b32242e0fde68c49308e7496d2047770eb7e5f6c1111d57e35e9b5fda3962c3493f1aeb81201ba1a6e91352a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861596, "uuid": "25c23e97-9052-4753-bcc6-1d3de956af0b", "value": "T1CF44E0B1B2D0D83DD0711A31C970C6A9163AFC63587854DF37583B2E2EB02D29AEE356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861596, "uuid": "4f7ab46e-ed0b-49c3-9388-2073bf023a3c", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861596, "uuid": "7d9c84ea-a67c-4017-bc1b-37c87ca01c76", "value": "6144:BDMgU3+U0mn150UcgoWm9mdcPnGMEdbdwqAdYuij:BDMH3P1n150+oFucPGMgxw0jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861596, "uuid": "69db4c3d-8313-45b1-a9e9-d03d90f7f899", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861596, "uuid": "1ca1e1bf-90a5-42b8-b0d8-b38556e57e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861596, "uuid": "954c222b-588c-4df1-9fa5-8f9ac994c950", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c4e17a-b9ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1677874093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677874093, "uuid": "e1fdd8db-437b-4635-993f-7e7b8ca5447b", "comment": "Malware payload (CoinMiner)", "value": "9d8b99c6c2f4e5079af1bfdf43ee518f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677874093, "uuid": "4bad1e86-af81-4eda-b025-b8753b61143c", "comment": "Malware payload (CoinMiner)", "value": "c7554a7609cf9428545460211a203ed575173798679198a502fe847bff3cc044", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677874093, "uuid": "dda9790c-36fa-4491-982d-143bf5f3f6e9", "comment": "Malware payload (CoinMiner)", "value": "d0616bd78860f77cbbec1a9742f486013035dddf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677874093, "uuid": "ba061224-3c0b-4166-a51d-59e2b47429d7", "comment": "Malware payload (CoinMiner)", "value": "3ad2e31f2887054d146211a233a82444f62d70359a5a802aa3a5f22c18e09fac6e2afae42c816510163c832401670db0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677874093, "uuid": "6b0556f2-b34b-42aa-b226-d410a2802a05", "value": "T1FBE5ADF04A92BE81D7EB1D6480DC3A804D9C2B578BDDC248B9CC1956DAE5790FECC6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677874093, "uuid": "48c8c65e-b7e6-4115-9d0a-3a9fc9f92e5c", "value": "49152:HsuHxWDzWk0lsyC6EZvfeTBl52qVQV7xW:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677874093, "uuid": "7162dcf1-cc1b-4b7c-b6d3-2f139a950cf8", "value": 3233104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677874093, "uuid": "60bb9769-f03e-42bb-9683-cf5b22a5d805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677874093, "uuid": "c180357b-9fde-455b-9df1-f5a8d4492e8b", "value": "9d8b99c6c2f4e5079af1bfdf43ee518f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be3c61f-b962-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1677806627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806627, "uuid": "8be1b4af-c9cc-4c5a-8156-5dfab0488af6", "comment": "Malware payload (Smoke Loader)", "value": "ff87ee322890d662cabd69a777361c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806627, "uuid": "eb675944-7c0b-4730-ba95-3ccdeedf44da", "comment": "Malware payload (Smoke Loader)", "value": "c77c2a169abc41f1f7afd50c62fcd1e3b3a3998edf4ff21b1dbcb9e2412cc363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806627, "uuid": "6b7e0001-a3b0-49f4-893b-50d50e7cfbfb", "comment": "Malware payload (Smoke Loader)", "value": "03034be07490405bcbae845b706a11cd24997dbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806627, "uuid": "6ad097ba-5c57-4904-84f5-e9b356f6ab00", "comment": "Malware payload (Smoke Loader)", "value": "49a9bef26f03ff43dd3d7bc3d4a697041265e957d3d29785e942343d7c9c524d2ffb09002869d6f1e8a030b1d4cec08c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806627, "uuid": "13129296-483d-455a-973c-77dd1b55e9cf", "value": "T1B554DF21B7D1C071C45F45749526DBB06B3EB8321164BA0B3FB05BBE6E30792A76B706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806627, "uuid": "f1ee7430-7ec6-4497-9f08-56771b1b70f7", "value": "7d1287ebaf72365e39814fe87a9e44ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806627, "uuid": "a6657e46-42dd-4e4d-a043-be49916ff8e3", "value": "3072:FynGlhEu9LqTXFPY7wekUaCNTo0CkBXfmcsntKHDc0WVxmBMVCNM/Y/DnUU:symu9LqpPcpo8v364HQuBMCgan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677806627, "uuid": "dd123cf0-2ead-42a4-9416-fd9165ee5c40", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677806627, "uuid": "ee533ffd-a7e5-4fb0-96b5-b6deab497469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806627, "uuid": "f51e1b8e-fdef-4d59-878e-5ea5adb96643", "value": "setupsoft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f738900-ba07-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677877527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877527, "uuid": "8116f665-36ca-4aac-b6e7-95758b2c5a1e", "comment": "Malware payload (Mirai)", "value": "32497d55cc63e3eb13fd6d6972aa01c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877527, "uuid": "4bd9a576-1e81-4418-b2e9-c43f43f49b0c", "comment": "Malware payload (Mirai)", "value": "c7a97522936014e6e115e935b7caebda0d5b590d6cccf8bd0befd411fbc62bb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877527, "uuid": "14f5ed42-d8a8-47c1-a87e-ad8e07371829", "comment": "Malware payload (Mirai)", "value": "d3e9583315712e10104c23f54502ffd334206457", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877527, "uuid": "cd4bdee3-814a-454a-8c3b-13f231851f3f", "comment": "Malware payload (Mirai)", "value": "d2a98bc0184f71c0f8a4c1cdae7152ed16ff3d999b2efd24c76e442a83e47a8eb10b03daddfbe125db7f96b76a77fc91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877527, "uuid": "2b838e88-b1ac-48c1-9c55-86538eafce32", "value": "T1A8B2D0CD61543088C98D7C7C2B8D4B664F6CA090BAEE9B16E350CD98B3BEB4B3459079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877527, "uuid": "cc7be69d-9d19-4ed7-91ce-70f664fde678", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBp6ZqEWvY:/QlS07FUXqIYSXQKquOqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677877527, "uuid": "03a3bcbc-ab1a-42cf-91aa-a22727abc590", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677877527, "uuid": "102ab455-62d0-449d-90d3-2e646f73d4b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877527, "uuid": "03185513-66ee-46e5-bb04-5a231235303f", "value": "32497d55cc63e3eb13fd6d6972aa01c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2b3238-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677861576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861576, "uuid": "d7480c24-4228-40ae-a8c0-173292f38454", "comment": "Malware payload", "value": "dcabb15f030b120f0bbaa28cd6f18b05", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861576, "uuid": "20ff8126-4a2b-4d32-b7a4-f08886865c39", "comment": "Malware payload", "value": "c7cbc6a6984555cf9c4d50922a8e234eb2b50c94e0d216ea1d840618bfc2d00a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861576, "uuid": "1efa08d5-3aed-4b5a-9519-63007a6a0b24", "comment": "Malware payload", "value": "ee75453f4eb17dd528ab0cf5a0b45213eb2d8cdf", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861576, "uuid": "6634b498-544d-4a5d-b33d-733385d0295a", "comment": "Malware payload", "value": "cd894fb2a1230a5e8b03312c4034a7e4fb30fec393d37a9859f858e14d8a047732756731c6d4275b1556034a4e9f299e", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861576, "uuid": "fdf3bc56-d69c-4c35-808a-9e172acbeb3a", "value": "T18774128523AC477ACAFE86FFD9F1522047E5F81B6F53D79D79861020467A3CA210168F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861576, "uuid": "7df4208d-5618-436d-a992-9f07a11a0241", "value": "6144:awYMSbFtZMlOyqwATj1d0/FdaQiciqOp50yXHRwwApMv/uK9RPTikZ1TMgNo1:a77t2A/1d09dViIjyq2/uK9FNZ1JS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861576, "uuid": "bc252bfe-0f69-462e-b267-c6522e652070", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861576, "uuid": "584bbc11-95d6-45c7-97bf-46cabcfe6c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861576, "uuid": "709bb0c4-4cb3-487d-958f-0cb5e36ad000", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0399e38-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677856805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856805, "uuid": "9a7ee6fc-593a-488a-9463-ca85a736e5b8", "comment": "Malware payload (Mirai)", "value": "4be4cae321980d71cca7894da6e339e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856805, "uuid": "dcaec85b-eb80-4414-990f-6eff4affb25a", "comment": "Malware payload (Mirai)", "value": "c8af29e8f08eaedb0d6fd91f46bca58145701e845aeadd7e8fa7e84f8548189f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856805, "uuid": "23afbab2-8945-4f18-ae51-5c09d17641f9", "comment": "Malware payload (Mirai)", "value": "103bac90e43656509817e8944f310367e3432802", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856805, "uuid": "9f1f9070-aa55-41da-924c-d4f315ff6a52", "comment": "Malware payload (Mirai)", "value": "5d87cfd21ff28cb7e55335a799f8a85746f629f6d2934a729295d8f931f7f0129982a774056bb44bc9688091d2fb53a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856805, "uuid": "2f5c7c86-6c92-4404-b226-c4800da8ba4b", "value": "T13BE33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856805, "uuid": "ffb0b863-5aff-4923-aef9-fcafa30c0196", "value": "3072:yJTc2PBSpma7Oabvzj4dlRsh8ZQIldUMXkkTM/9zY:yJTcG2Oabvzj4dLsh8/UMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856805, "uuid": "ffd4f438-e0dd-49e0-b529-851d494bce10", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856805, "uuid": "abbf1836-b97c-4c0a-98eb-31014f9ff851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856805, "uuid": "bfbfb3aa-a892-40ae-af08-840096525d38", "value": "arm7-20230303-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa53f44d-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677856715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856715, "uuid": "d2612d84-4304-437a-9ab0-c24a09765b73", "comment": "Malware payload (Loki)", "value": "6fac9efd4eb61ffd9e743b63fd8c62d7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856715, "uuid": "f484b837-42d8-4b49-acd8-e67f1cb32b66", "comment": "Malware payload (Loki)", "value": "c8d9e58a03dfa83e3c0afedf734b2131f696a02e4bc242fd697179f3a3bb9d15", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856715, "uuid": "0c3222d5-8825-4726-af3a-063281f89278", "comment": "Malware payload (Loki)", "value": "ba6252281f9a12dd3e7b08335868c93608158b6b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856715, "uuid": "0592dad1-2339-4e1c-9450-2e04218eeba7", "comment": "Malware payload (Loki)", "value": "b3b63dc8cf68043faf660da3322d79c79e31318e1e2035310b60c8cb72bb171d3424a1ab1c5b4a110b773437f404a5e8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856715, "uuid": "efa8f529-325a-48c4-b430-803700c5dead", "value": "T10D65F113913CAD4AE242C7FCAA3F715D500EBD7635D361C71A44B70A9632EAB56BF208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856715, "uuid": "77ceb2be-98e3-40d3-af7e-0f0e91e34227", "value": "24576:eLKqiWQmmav30xXBTWQmmav30xfxWQmmav30xHnBLUWQmmav30xA63P080AGko4:eLKQQmmQ30JAQmmQ30NAQmmQ301nppQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856715, "uuid": "4d17e77b-9765-4c6b-a561-574a5ad2744a", "value": 1458176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856715, "uuid": "fd45c0e6-dfc1-4ebd-adb5-d58285a305fe", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856715, "uuid": "ca28d1b3-4443-481b-9400-1e70d56e4c93", "value": "Quotation form INDO - HCM 20DC.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7a5aa2-b9a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677833743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833743, "uuid": "3b856925-b473-4a63-842f-84f3418281aa", "comment": "Malware payload (AgentTesla)", "value": "bd55d8921a2cc7256924ca89291f2b31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833743, "uuid": "fb877b6e-1d8d-4199-9543-47d6d5858e65", "comment": "Malware payload (AgentTesla)", "value": "c97b59069bff6b83ade497a1a63fe67ca759cc1962342eda0e36d2222e031cf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833743, "uuid": "2114f425-4317-431b-a397-650b59a84115", "comment": "Malware payload (AgentTesla)", "value": "825a02719a5286e8f7b02eefc677b6591e990516", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677833743, "uuid": "af60018e-7f4c-4863-96b9-82e8a643f320", "comment": "Malware payload (AgentTesla)", "value": "9f0a4e14bc1295b17e41c035ba1d897f7e4c0477b3da34078d045f9e10f507980ed737d728388de64bb55b23a3d508b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833743, "uuid": "e6610d88-a4e5-40dd-acab-8b0141097aa2", "value": "T19E54120961E1C02BE87149710B376B7F4BF9AA172DC9568B4F40975CFE35252AA0F3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833743, "uuid": "9c8469ee-8949-401b-b349-5d2aecb11287", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833743, "uuid": "2d3f2b3a-8ae6-4998-ae10-6b9ac27c3dd9", "value": "6144:/Ya6mfsz8MCQT6yWh+vp15RJZh0oDKvDj6AIu5ZpPuEFsyntdR7:/Y4Uz8MayWhyz5z08Y9IyzuE+yt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677833743, "uuid": "3d5742f1-b66e-4c02-bddf-bfc79c636d94", "value": 282729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677833743, "uuid": "d316e203-ccdd-4e88-90e1-c85582624418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677833743, "uuid": "8619b190-a2e5-475f-ae68-d88fa1a24967", "value": "SOA 5109360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe9bfda-b9eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677865529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865529, "uuid": "09df2e25-5ccd-4b1c-af8a-b98e0943542b", "comment": "Malware payload (Formbook)", "value": "6e85179f93a3a1b1b98e29f61c04cd00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865529, "uuid": "8400422d-bf44-41c4-8389-daafeed9802b", "comment": "Malware payload (Formbook)", "value": "ca92353954eb428f99d73b11f26650f1ed59df39a99a04d45552c8b9ba4e1459", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865529, "uuid": "589f38fc-fb2c-4965-8289-896c0a0e92db", "comment": "Malware payload (Formbook)", "value": "2ab408f06f37e705a974f7d31e6f7dca3e8b5a21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865529, "uuid": "3a92f056-1c79-4cdd-9184-4b0dff2f0c5f", "comment": "Malware payload (Formbook)", "value": "3ea9ed1ccadaf2719f1da4010ae352a1e507ded47aa9d48ce16907fcfc8f136f285a504748653f40fad1f877d6dcff91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865529, "uuid": "5f2a70b7-e68a-43ae-9114-15366ac38472", "value": "T12A341201A3E4D473D8F39B300E795737ACA2AA23546463AF531027793A33256DE1F7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865529, "uuid": "66c5019a-bbaf-4a6b-883c-51e028dd571d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865529, "uuid": "0d57644a-1ba3-4f30-91d0-91eb64c512cc", "value": "6144:TYa6Zzl33NJppDAw+wuJ5vqkAdjTFmaUWxhG6+UsviC:TYTpNJppcwcJ5ykXaz0jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677865529, "uuid": "95a37ea5-a95e-4563-af72-a940484061fa", "value": 248831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677865529, "uuid": "b59a50f3-eb64-4377-81da-c495c89742b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865529, "uuid": "1eb7c943-0b1d-49bc-8469-6fe8382ea996", "value": "6e85179f93a3a1b1b98e29f61c04cd00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b9bcf1-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677850536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850536, "uuid": "1a7a565e-c2ad-4e62-b4e6-31f146531f33", "comment": "Malware payload (Mirai)", "value": "21c4404af5d75133e0983869f7ab783d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850536, "uuid": "3ada6321-d942-4e9e-9862-695e1be2379d", "comment": "Malware payload (Mirai)", "value": "cac58d0964886d36b2035a313af6ed85ffe0519a2239be7409e4b1057a8beee5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850536, "uuid": "8e3a1bd6-d099-495e-905b-c3b065435308", "comment": "Malware payload (Mirai)", "value": "e28ed43d2effbbdb0d621ba5e8a49d51a227d709", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850536, "uuid": "d9e16221-8d1d-4d9a-989e-8396d851d1a2", "comment": "Malware payload (Mirai)", "value": "b4682965337ce8d3ef06ca2a3aede84a2e3aa7ee7716ef1ae8a4bc7497fd41875efe9f1987fce0ff031c1016c9d5d875", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850536, "uuid": "036717c6-4641-433c-b715-5e7dbb2e736a", "value": "T1E6534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850536, "uuid": "82be0b71-d459-4a56-9650-571a9cbe45cc", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQVLiKimfFoktCe3fYRM0:WShU3q7cEDlCK/0Dt9i8Fok06fYR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850536, "uuid": "7a6bbd62-3514-4801-a1b1-4a3e4f4381cb", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850536, "uuid": "4fd2521c-dfb6-4e9e-a1d4-a10ab94332d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850536, "uuid": "092b762b-b3cb-4c9e-87c3-62991b91e272", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0bc88c-b9c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677848366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848366, "uuid": "3cde3ebe-9ecf-4e13-a70e-c8cd3a439667", "comment": "Malware payload (Mirai)", "value": "48a99976c6ea49f45aae4273e0e559fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848366, "uuid": "8e9f84bb-0ee2-4177-b09f-40465ae1d3c5", "comment": "Malware payload (Mirai)", "value": "cae1668e7bb3730310e3beb9c90f97f4cbcb50fbfc20204760821489c6fa49e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848366, "uuid": "66b191cc-4b0c-4ef3-9f55-964a02aa10da", "comment": "Malware payload (Mirai)", "value": "c1e6b0bae10c6d62da7a8342c707672c20ab5a5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848366, "uuid": "9ace9615-3deb-4297-bffe-45c6a21116c8", "comment": "Malware payload (Mirai)", "value": "10c9ec71b8e1a96454648b4453e50fec7f519e4c266488ee1e70512f0b6df42f0039fc8642495083a9712bf818c1f540", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848366, "uuid": "5e70474e-f0e1-4108-bf82-df36b085b441", "value": "T175534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A96B1E365181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848366, "uuid": "3dc7f990-c471-4db7-9451-c66088a3925c", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EM2S/p9OyDQvSFRMNYL6FV+tg6wWS:+5HAdOmGyNtTAdDOyUaFRMNae+aTWjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677848366, "uuid": "350616c9-acc8-4338-9c60-105c10c3f69f", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677848366, "uuid": "37ddf85f-a9aa-4185-9cbc-ef37c3f52b58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848366, "uuid": "55163b6a-d81b-403d-b3d2-9ce1a810a8e2", "value": "48a99976c6ea49f45aae4273e0e559fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa56375f-b996-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677829227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829227, "uuid": "54550e82-ae6f-479b-8dac-4c63c97a1c8e", "comment": "Malware payload (RedLineStealer)", "value": "a687593ca5cf9d3fee446f7925272818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829227, "uuid": "c28cd8bd-80f2-4aef-a09c-57f65b69973a", "comment": "Malware payload (RedLineStealer)", "value": "cbda14adc5ddc1c7dcaab3718dd25805b8c0b720db8678715a754754a214e05f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829227, "uuid": "a5ec638a-1ee9-41ee-a855-9b90d10b7d6b", "comment": "Malware payload (RedLineStealer)", "value": "d8ec9e79259cb12c088a668afe34c4305f187c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829227, "uuid": "80959a65-9433-4add-a417-84f1153b8970", "comment": "Malware payload (RedLineStealer)", "value": "41967c8e8878da429dcbeca4248452dcac2de54ddb35346a21b0e2e144dd91ef69bca9351c70574f0185e0360fa10500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829227, "uuid": "bff76a2e-0f7c-4b26-927c-006a13a23c59", "value": "T1BAA523027ED1C5B2D6622C336A35A720797C7D601FA5CECF6BC54A6C9F221C2D6713A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829227, "uuid": "db54a621-694f-439c-86c6-67a86208acc8", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829227, "uuid": "83bd7ff1-6f77-44e5-9d8e-cd4d4e5851e4", "value": "49152:PB0m0c8A4WdMLE8Q7P0A4iDruQzwXOhR0kLZFs7+:Z07c8r1E8rA4iDruQzwidi7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677829227, "uuid": "14be773f-d231-44ab-acd0-e0264e8fcce6", "value": 2068771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677829227, "uuid": "c658144f-6b3b-497e-9635-92f0910d3726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829227, "uuid": "979f7a9a-e787-4ec5-b841-f9e85aecb0ac", "value": "Invoice#577595955858.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6fb6b2-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1677857394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857394, "uuid": "cbdd8cad-74cd-4a03-b19b-e5f72528387c", "comment": "Malware payload (Socelars)", "value": "f48570526e4923521a63c718ea4a15d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857394, "uuid": "52ab68b7-f043-4ed4-bc3d-e6989f2aae42", "comment": "Malware payload (Socelars)", "value": "cbf2b6841b31eb52fc1bdc23e9559c2e0b635f4e0d1955728a2788b359caec50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857394, "uuid": "b3a1ebe4-1ba2-463e-935f-480195038e36", "comment": "Malware payload (Socelars)", "value": "ce2b2aba350b1750249a44d90e13673670348a70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857394, "uuid": "2e2f8ec8-6ea6-43f8-aef9-c16654ea60d7", "comment": "Malware payload (Socelars)", "value": "356705dcef56696f75b4e358bfb65acb486a712c0647a312cf0caa62f6b17f85aaada62065df16f58e54ced3eb4b9f1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857394, "uuid": "5ba0abd4-9979-41c5-87b2-c0c651189b05", "value": "T113658D21F7C26032E9E310B745FF66BE9D3C6A11470894D7D3C81C99AB614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857394, "uuid": "6608f140-47cd-4c06-ba8a-aefa228c73f9", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857394, "uuid": "85880bbc-5e6c-4e28-9730-7f28b96ffdb8", "value": "24576:YGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRnb5hqSY:DpEUIvU0N9jkpjweXt77b5kF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857394, "uuid": "6c3bfbb4-19f6-485a-b2a4-355dc352e193", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857394, "uuid": "f87eb69a-7ca8-4b40-a2e3-d82a0d01f29c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857394, "uuid": "1ede9896-2b3e-4164-aace-4ac39a3d0bee", "value": "f48570526e4923521a63c718ea4a15d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4f2c45-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677829821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829821, "uuid": "9d578ef8-e161-4454-b971-5553ee57f955", "comment": "Malware payload (RedLineStealer)", "value": "4807329964e6e5426a5a35ae9bd551cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829821, "uuid": "76333b0d-d7db-44ea-9f01-1e579672c889", "comment": "Malware payload (RedLineStealer)", "value": "ccfa97744f635bd17a8419758bd014f116287e824159f3d2ecdacf876f828489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829821, "uuid": "19b9d7a7-f949-49e6-919e-7474d2f9a548", "comment": "Malware payload (RedLineStealer)", "value": "a8da108248787c1a2337523fdfe473937cd4234a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677829821, "uuid": "2f4607fd-f55d-4178-831f-c1dbd2d12f01", "comment": "Malware payload (RedLineStealer)", "value": "eb5bdf8a24ddf0419563dd89faf049473de5283a49662ea35d53fd9e3bbf75e78a931dc658bd61f77a5675f03a2fc2fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829821, "uuid": "31616b25-1f36-4246-8f06-f3c1fe9849a2", "value": "T14064CF22369CC0B2C44B45748925DBAC9BBDF8F39724868733880BBE5E307D19B76756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829821, "uuid": "58a11f56-122a-41d5-9157-b0106be2de63", "value": "f37943ad193a52d7b21e245b891de4bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829821, "uuid": "a1a76304-0917-490a-9a59-859a2c93d66f", "value": "3072:lfYgjTd1ZLG8Xt1+TLdvbJalkznQkdsllLwZjQ+RNN+n0KoybG6:2gjbZLrtUxolUQk2llLCjQ+1G0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677829821, "uuid": "aad6382d-30f5-4a8a-9dc9-ca5d33071e84", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677829821, "uuid": "15b1dd1b-815c-452e-a02e-92bfcc974c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677829821, "uuid": "06f95f5d-f8f8-4119-ae0e-2cbb609e7908", "value": "4807329964e6e5426a5a35ae9bd551cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d84d558-b956-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677801610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801610, "uuid": "f13b08d6-32ef-4cb3-9fec-1f6fbdbfa836", "comment": "Malware payload (Mirai)", "value": "e48fc2b7a091ab1eec6360566e86c363", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801610, "uuid": "ee01394b-99e0-411f-bc62-57a5c915efb7", "comment": "Malware payload (Mirai)", "value": "cdfec57599ff4cbb697693b3abaa15814858b5cfd2159c260ceceb0f28a9ced9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801610, "uuid": "b2bb1ba5-7fa7-43e7-82a1-3dd5cd0f7e61", "comment": "Malware payload (Mirai)", "value": "a4304eb31c0f28e4cee250fcdbe40a249e9888c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801610, "uuid": "70ead173-a30f-439c-80d9-52db7e5573b8", "comment": "Malware payload (Mirai)", "value": "0bb5bf24d2ad76cb03c20c9cb498854ea9fc2f1cf27e01610fc39f309aa7da7f25773ca0abaa8b776ef1c22a9e1f50d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677801610, "uuid": "1a629e60-9e25-48af-9eb5-42023ec366c9", "value": "T108E35C46EA808E03C0D61776BAAF424A33239754D3DB73069D28AFB43F87B5E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677801610, "uuid": "b057453f-9f84-4331-8ec3-d38a8f2d10c9", "value": "3072:axVkUpa32KLa1Ug2uIOflkD//jts/EE38xGM/911of:kV/pa/La1Ug2u5kDRAEE38sM/91Cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677801610, "uuid": "7345646e-2391-4322-8dc9-cfc5faff5b91", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677801610, "uuid": "824a1f4c-a315-4ffd-a645-dcb23fbe1254", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677801610, "uuid": "dcb7d7a4-1b78-4319-ba1f-3f7eac4cf629", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a9252a-b9d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677856066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856066, "uuid": "b963c56a-6e5d-4ef2-8b83-4fb264c37b3f", "comment": "Malware payload (RedLineStealer)", "value": "876433e609fc3d0014e5b8f949f3d6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856066, "uuid": "fdeeb519-831c-4f3e-9f67-78001cefca92", "comment": "Malware payload (RedLineStealer)", "value": "ce6617dc3c3b3dc1def36910655ba21bcac224e427ac860115eafa6d47b486b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856066, "uuid": "d1ed79f3-9af1-479b-9d20-bb07e1140897", "comment": "Malware payload (RedLineStealer)", "value": "f1690006e10a50e030294282a80fdf7704a24acf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856066, "uuid": "b93657d8-2513-4559-9fe3-322bda95d10a", "comment": "Malware payload (RedLineStealer)", "value": "e422ded256e38215ef1cff0248ac0d8bf8981dabf6d6055197a719b51291ae12c4a4ada765d59b08331ce860dd8d6e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856066, "uuid": "300b2888-5eca-4aa3-b1d2-8dcacea83621", "value": "T12B151213E7F85537D9B52BB018F607C3063ABDA11B348687278EAC580DB22F4A17536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856066, "uuid": "78714451-a708-4bec-a850-3b17cb4f9ee0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856066, "uuid": "658843b6-7b3b-4f6b-9952-6a49ae50ee13", "value": "24576:KyFGQw0ScHlH9mxNR557WaP768p3dn2LnQAWtYe:RFI0ScHl8NHYatzuQXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856066, "uuid": "8a9b9383-9e40-4d0b-829e-a058d124345a", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856066, "uuid": "29279337-4d5e-4fa4-a4a6-0cbd0d7b02ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856066, "uuid": "dbf35c74-7b3b-4d9e-8d56-1f96c0dbd19b", "value": "876433e609fc3d0014e5b8f949f3d6fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4218cb3-b9dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677859362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859362, "uuid": "7835a5ce-e317-4c52-860b-e9b13170d09d", "comment": "Malware payload (AgentTesla)", "value": "f7a6cfbb176e4639c07a1a81ab5f8a60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859362, "uuid": "0b37f7ed-2261-4f75-a9d8-8cd1bcad37aa", "comment": "Malware payload (AgentTesla)", "value": "cf09d933f3f80f3d1959aa0744b43b7d2768824c99d31a4a26fe563ee8292f2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859362, "uuid": "cd8d265e-e430-4385-a84b-5348409bddba", "comment": "Malware payload (AgentTesla)", "value": "c5b5f044115ff543322ccb1deffca1da163004d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859362, "uuid": "321841c8-1eb3-4bc7-b2c4-b44b36137288", "comment": "Malware payload (AgentTesla)", "value": "64335370c11c5c6f0a31e5a68ac9c6c2c89409e726195df3687ea72865d3ff79cc4ce5f589b317c46d5b841b3ce36b6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859362, "uuid": "a5908bdb-3a30-40e8-99ff-acba7d3d191a", "value": "T1634423849B70098DDBD0F19310EE6A7572306A70C85FA39B5D65B32C516FB06EEC1D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859362, "uuid": "19967f39-bc28-4f82-93dd-0ccaa1493f9b", "value": "6144:dSt6BuyAAyDM0JfRa2XeB/u6rSH1B9fqLtzT7CC:Yt6Yni2XeB/uykB9YlT7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677859362, "uuid": "27d5df69-0a2d-4e6f-9259-b815838284bd", "value": 268523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677859362, "uuid": "a0111ef3-d17e-4cc1-bf8d-fbf52b464375", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859362, "uuid": "c29b0f01-4509-45e7-8e55-88c8feb4a6ea", "value": "Bank Transfer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac77f6d-b9b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677842864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842864, "uuid": "7b3c76e4-9612-4a4e-b47c-7c79fed79071", "comment": "Malware payload (Amadey)", "value": "c1ddaca25d84d05e809ffce1d2b468b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842864, "uuid": "67aa70e5-ca9e-4d3b-8e13-1ffc3a775b37", "comment": "Malware payload (Amadey)", "value": "cf2730fda38e3945795b00cfaa3074b9ec356b0ff7b2a493a318fccd34b677dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842864, "uuid": "be1c5499-c218-4e61-8ea5-956493549d83", "comment": "Malware payload (Amadey)", "value": "38f257a264e657a20aa2fb3b48adb53c4bce5c8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842864, "uuid": "59adf838-203e-4e55-b8cd-66e016f71886", "comment": "Malware payload (Amadey)", "value": "7ed44fd737b52a411b374dc26b83d5184c74f814b3dc348fac56e72ed6249f5a5922a60a179dfdd28cb48327ab84961f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842864, "uuid": "64e76096-f325-4cdc-992e-6961b2e8e529", "value": "T1D4936B1030D2C071D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842864, "uuid": "47fb5f68-ee9b-40dc-a568-e9571f5cf635", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842864, "uuid": "966d33c3-1036-4ad6-80cd-b0a088016794", "value": "1536:Go4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU0OaB89p:GoUCWbBNpplToUs1uNhj25LJUPaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677842864, "uuid": "dc2b5abb-201b-4253-a4ba-cfe02ca5db34", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677842864, "uuid": "6797345a-4f86-4019-8708-c9b9afc2f74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842864, "uuid": "8c668742-a60c-4079-8a3b-55d1f4f39a31", "value": "c1ddaca25d84d05e809ffce1d2b468b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a1f74b-b961-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1677806179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806179, "uuid": "5899e594-3da1-4e11-bfc5-b93d963dd514", "comment": "Malware payload (Cobalt Strike)", "value": "d2d68aa983be4a255ed7dccaf7b8fc82", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806179, "uuid": "1d8f0f95-4907-4760-bc8a-43a39793786b", "comment": "Malware payload (Cobalt Strike)", "value": "cf44b31d09f912c0e7c51099fdf24afd962f36cc03ccf4a1e797dcd8186d9616", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806179, "uuid": "a3c3882b-0598-4aeb-a215-04605a75a446", "comment": "Malware payload (Cobalt Strike)", "value": "ba7505abd28e2c007acd09d7f20a0813ced31274", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806179, "uuid": "eb917eed-30d4-40ce-9a2f-6706e61af8d5", "comment": "Malware payload (Cobalt Strike)", "value": "2ba7ac80aae28f3fa8d4b2c6c6eb60666ece4177f9f26c9f0f3390fa35477a82f55cb784fdf012eb7d7873ca1033fa01", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806179, "uuid": "92d52a9d-cf09-49f8-b2fa-71d7732b4e93", "value": "T1EC64CF2276D0C872F48B74744925DAB09F7AF831A764C69733A40BBF5E302C09B7A756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806179, "uuid": "98f61c38-9128-4162-862d-3528d6b71a87", "value": "f37943ad193a52d7b21e245b891de4bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806179, "uuid": "14ee1c7e-cb52-44eb-a297-ec0bf1de3189", "value": "3072:5SYZTHTwSJjLU8di9sOLdvP/nxBP0GS12cSu43a3nUYS+YDeN5PgGV:RZTHU0jL7iKQHnbP0GShF43a3U6YG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677806179, "uuid": "226035e0-59bb-4b20-a3a2-6119bcf571c7", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677806179, "uuid": "80c1a94c-f3f3-4a1c-b4e4-b8d3a439c696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806179, "uuid": "952880ed-5c0d-46b6-99a0-a9e9580a365f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3f3622-b9cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1677853498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853498, "uuid": "01ab528a-c695-44d5-8bf9-2758e8b7446e", "comment": "Malware payload (SnakeKeylogger)", "value": "7b950d85702dac125dc2e32dfdf786d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853498, "uuid": "c45c73a5-6ce0-4633-9b63-20bc618e1cb1", "comment": "Malware payload (SnakeKeylogger)", "value": "d14a454d42bccf92a05b2167fd1a8e0b122ea37edded0658c508e674f335643d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853498, "uuid": "318ada7d-d831-4652-b13f-1a7cd7a04470", "comment": "Malware payload (SnakeKeylogger)", "value": "96c5e2d8fc87c47e07d475b3ef02bda3ba5887c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853498, "uuid": "4cb5223d-a330-41f5-ab46-c27efd708f3c", "comment": "Malware payload (SnakeKeylogger)", "value": "a0047d035d2b097b1cdef8e01d7f1496c1f6118b819c3777fa955947615515f14d460db31c3b0aef63ad6a60a5ae3ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853498, "uuid": "2abde391-7fbd-4560-a532-edfb135149d4", "value": "T13405F1696C74C725C86DC2BD82E22631E33E3EF3A469E6190D8170DB1C79FD68019D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853498, "uuid": "3a18b370-bb33-45bb-bbe6-10ab49730bca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853498, "uuid": "364500e1-3585-4d55-9412-52a21143e8f0", "value": "24576:z1ADwqG/BQrDyFTRXApR08X+tkSLOVtMxUzEXzgo0QlQX:oOFTNY0kSLcUUzUzgcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853498, "uuid": "83690cfe-aecb-4918-a5d2-15a285ea4519", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853498, "uuid": "8a222a21-fd21-4ab1-a430-7cfbdedd80b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853498, "uuid": "5373d802-3801-4610-baec-4caabe823afd", "value": "7b950d85702dac125dc2e32dfdf786d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8051acb-b9de-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677860147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860147, "uuid": "65e1c3a9-788f-4203-8cdc-1d193d8f4e8c", "comment": "Malware payload (RedLineStealer)", "value": "95ae0419cb2df1670ae24bd8d80a47aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860147, "uuid": "e45cfc3f-1361-4f4a-be76-8c2cf417cdec", "comment": "Malware payload (RedLineStealer)", "value": "d173c9dbf27938bc1d6e360ac71277175c5a4efbafa862d301327c068166966b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860147, "uuid": "cdbcc254-b3f5-40be-83df-cf85aecc67d2", "comment": "Malware payload (RedLineStealer)", "value": "94f13aa8ec521fb902299ce03ca3d1ea17c855bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860147, "uuid": "00153ac5-d3c2-48e0-bdcd-2dd44e76f5ca", "comment": "Malware payload (RedLineStealer)", "value": "26fcd4363a64c9dcfb4cc6cdd1f50005b702d7750c08209c02de45e156333db92fe20eb75be461fe6500fc81082c00aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860147, "uuid": "d7c8ddcb-1691-4259-a8b1-9977d68c3761", "value": "T1C085CF73D6500DB5E4E54978B69680768FB33C56039292EB12DD722B0EB73C2893EF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860147, "uuid": "ae1c0f83-a5ce-4627-8e5a-d6c5907ed8d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860147, "uuid": "8f1bac9a-8581-4fc5-a20f-305a8f5f7c36", "value": "49152:EM6vPDRhNrqSTzluBdjOnjDmNlqKxOnjDmNlqO/UzbPZ:IvrRjrqKsBdBMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860147, "uuid": "afe54e3f-f080-4bbc-a3df-f326fc84a678", "value": 1788928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860147, "uuid": "8c9fc1df-d05c-4c93-8504-793f4b1e1185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860147, "uuid": "f1eb6973-ce53-4233-9311-4dc9f40bccc5", "value": "Project Details Advertising WallStreet Market.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eee2c29-b99b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677831248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831248, "uuid": "f73a9214-7f78-4b4a-88bb-5017a743f312", "comment": "Malware payload (Mirai)", "value": "709a4303a8a411c2614f7b88522faea9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831248, "uuid": "a279f8af-5e12-48a6-adf3-6a176c6b9a06", "comment": "Malware payload (Mirai)", "value": "d2cf2709fd13d028edfb31dfedba797d8f383eb8e9e117aa661ca5ac0cfff56f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831248, "uuid": "698c803e-20e7-48ea-85cb-35e0a8d604d1", "comment": "Malware payload (Mirai)", "value": "7ec23c1c319c1b2a2512f104c0abe57d076f8afb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677831248, "uuid": "c239e335-041f-450b-ae55-a1437fb4d0ca", "comment": "Malware payload (Mirai)", "value": "85b73c3bb98770a53e4d800b53e09c34ba9625f3ca55dfb2bf7a79e9901777720ac5b2a7948665144bdf940495369ea0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831248, "uuid": "cc46448f-a09f-44f7-ae70-64fb53311705", "value": "T1A6436BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831248, "uuid": "705dfd82-952f-4801-ba2b-46fb4ab01c24", "value": "1536:JeESt/basV2rcZhG6ySN7na8Re9xzWOIaEjrqMds:JeESt/basVTgS7na8w9BtXESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677831248, "uuid": "fab80e72-f75b-4d30-a69b-edbb5e4e0ec0", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677831248, "uuid": "f2e29b7a-9b21-4528-b198-8ba19000de47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677831248, "uuid": "56220f42-f01c-4c11-b3e7-b3b5312533f5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2702bdc9-b9fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677871956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871956, "uuid": "344b9d2f-6340-41fc-9273-3498a366e5d6", "comment": "Malware payload (Mirai)", "value": "f93ccf6ef6ef213a1ad489e7c35a1ffb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871956, "uuid": "04bc488d-ca71-4814-a734-9741bb492c6e", "comment": "Malware payload (Mirai)", "value": "d2dfd09b719c8976e0f231bc35dfff58efe955bdaea81be8f642a1af8d0146d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871956, "uuid": "53b3aca6-3461-496a-b036-57a25fa69996", "comment": "Malware payload (Mirai)", "value": "a8ea998ddb1fac4f8c6c08b9e4176c054ab72432", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871956, "uuid": "33f059f3-2533-4914-942c-9672f47e4dab", "comment": "Malware payload (Mirai)", "value": "a043223236510fd3cf6b12e525a256fe39cc9a46a7c2386f87d96a243a74c82e180639cdeaea11ae1e918a39dba0ad44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871956, "uuid": "3f3a1e61-aa66-48ee-b3ca-796bbd2ba8d1", "value": "T1EAB2D11EC0AE2EB4FDDB7E355941F2C17B615BDF3E618EC016C1AA110622D682F9C6D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871956, "uuid": "62404136-e672-4ce9-acaa-4efc6f26b3ea", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo6M4uVcqgw05VxJS:2AApCdvwJr69VJoA8FZtxCo8U4uVcqgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871956, "uuid": "c58214fc-162a-405c-8f9e-3b5488836ce5", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871956, "uuid": "aaecb266-d17b-4621-aeac-f5bd811e3d92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871956, "uuid": "88f12c09-28f0-4c7d-9e2e-10977ec7c800", "value": "f93ccf6ef6ef213a1ad489e7c35a1ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19be1afd-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677857331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857331, "uuid": "14b3196a-8e02-4326-b0bf-61016d83e8f8", "comment": "Malware payload (Rhadamanthys)", "value": "18dc42983b858d7e837972c9cc34efa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857331, "uuid": "e492c9f7-151b-4955-9b52-37a311e5c1de", "comment": "Malware payload (Rhadamanthys)", "value": "d68be51b5128911b047d9a70b55f12d5fd2bcc02216e5439d3dfde7760c5ddde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857331, "uuid": "8642c652-05cf-453d-999c-2a413d8334de", "comment": "Malware payload (Rhadamanthys)", "value": "661af08e0b4394ddf0681756571df90bbc5fea6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857331, "uuid": "73b2c001-4797-4919-b433-aec7eca6a422", "comment": "Malware payload (Rhadamanthys)", "value": "ef8fbf01ac10498a60d2d7b062bd15ffda83d02ce2cde930bcca2abdd68a0401b27a6c3f6402ecd3a6fab8f396b9d6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857331, "uuid": "330b418c-6937-4816-b5e3-7e58c147dbfd", "value": "T106B59EF04EA2FD80D7EF2DA480EC19809D68175B82A9864CBCCC5495D6E6754FFDC2B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857331, "uuid": "77ed272c-abd7-4912-af23-4305a686c134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857331, "uuid": "e1624517-bc8d-4ac2-b80c-d03be2bcd1af", "value": "24576:7dSf+Cvw2QZPt61/UTlsi5M4Rcvkh0lNDWN7xQQzGtAyExr1K46r2bWm0esaGWfT:Ef9wzO1/nPJR393BUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857331, "uuid": "9e75c309-0637-49c4-904d-6da9078f72c8", "value": 2485248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857331, "uuid": "c12707bd-c3ff-4bde-adfd-ccf865a290ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857331, "uuid": "8a8fc677-400b-400a-a519-9d9b6bd41180", "value": "18dc42983b858d7e837972c9cc34efa9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e232f9-b993-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1677827936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677827936, "uuid": "78a1091a-de0b-4f94-9e9b-4db2eecbdfdf", "comment": "Malware payload (njrat)", "value": "5912e7f90842501c6827a55c9205b572", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677827936, "uuid": "7ff2ab9b-cefe-4dba-966c-0ec4352dc199", "comment": "Malware payload (njrat)", "value": "d73a649453aa31836d525ffaa82c39ac709df90b84b1f2a16f2dc1f616bc4dea", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677827936, "uuid": "90bddd29-7d24-46d6-93a4-a35a65e72cc1", "comment": "Malware payload (njrat)", "value": "206243a6cb9552e40745a2731d6d65d97b3231e1", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677827936, "uuid": "3fa00808-b97f-4a66-8f6e-9f39f05315e8", "comment": "Malware payload (njrat)", "value": "1b98820c5abaafb50c07f8679215f08468aa3fb23c84ee34534f82cc48272ff00cb17f1794567cfc973ba291f5a440da", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677827936, "uuid": "9347340e-4849-4524-b0aa-515c326ca66b", "value": "T1FE64FE6034E9286433FBEE538F47FA5D1777A2DB88B81E6459CC8B491BDD61284B23D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677827936, "uuid": "c599ca0a-7604-4846-b862-844455ebd9c7", "value": "768:javj9PPxu9PSmOaQLEpiAnUiK8IwajcaEuFqjLcDTcsI3ug6X:WvjVPxu9PkaKEpigIREMYvT6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677827936, "uuid": "fee5468a-e9ea-402e-8f45-4286c0ec111c", "value": 314606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677827936, "uuid": "ba583f11-7e14-4530-8a3c-d6962236f6a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677827936, "uuid": "a1befe48-3c30-4e18-8be3-38908da4f379", "value": "IMAGENES DETALLADAS FOTO COMPARENDOS RADICADO #200022122-2023-0233256-PNG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8481919-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1677857248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857248, "uuid": "f1e3a142-8f14-4401-8f3f-804d6b295f0c", "comment": "Malware payload (Rhadamanthys)", "value": "f7bc4312f57749d0b99ec7cad9a24132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857248, "uuid": "6c15fafb-d8ab-47ed-b08e-011d85957f9f", "comment": "Malware payload (Rhadamanthys)", "value": "d7dab4746d4b1f0312fbef87a3d9e6c498ea3e1a7c3c093c19c9e1adbf3cf17f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857248, "uuid": "1dcbf435-950d-4550-93fb-762ebb8ab520", "comment": "Malware payload (Rhadamanthys)", "value": "e0c1099e0528b66fee4bcd978e2f77e35ca7d0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857248, "uuid": "0fa1b9ac-9584-40ec-b5b9-24ca02ee865f", "comment": "Malware payload (Rhadamanthys)", "value": "09ef25601d837fdfccba3ead0a4d05db3de0eff6dd69b2c0d4945f590aa9270d3513237311cf3929580771daa162e74a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857248, "uuid": "7270d019-3efd-489e-b99e-1d5420acb7a4", "value": "T139B57CF04F95BD80D7EB1E9490EC19C08C5C2B9B86A9825CFCCC2556D6E1758EECD2B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857248, "uuid": "7b584854-f6f5-4b1e-9922-0a14c4ef3acd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857248, "uuid": "b823604a-6434-4284-94e6-d72fffed8bcc", "value": "24576:33ynvocZvz2bciYxrGsA4cUQz0O/uA9FPFKiIDVbuBkv8PcGTFIA/nNgyOTnbg3s:33ynvHVGcm3/ZhmbQFTFDPYgoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857248, "uuid": "e3ca5e05-f997-48e0-9104-a148ff544866", "value": 2427904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857248, "uuid": "1d1978bd-f77a-442f-ac44-995b3479c4a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857248, "uuid": "db660264-c3e6-4ac0-96a7-2f561f90b61b", "value": "f7bc4312f57749d0b99ec7cad9a24132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe38f5ef-b9b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677842682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842682, "uuid": "3d947446-2c71-44b5-a182-e1c8b2ad60a5", "comment": "Malware payload (Mirai)", "value": "4656cdb0eaf93f145896752570e563cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842682, "uuid": "fabb2bbb-3672-4c2d-8e2c-cfc75afc90fd", "comment": "Malware payload (Mirai)", "value": "d881aebb612664a37539e3c8cfeb80ad3e0afa182b8f715aec57ca5ef11c660b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842682, "uuid": "b95e43cd-545a-47c5-8ffc-32c09b631d35", "comment": "Malware payload (Mirai)", "value": "7bb0d5775712381bc7ca3996f6dd4fabd457ca0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677842682, "uuid": "00ce4bc6-e243-47cb-b5ed-e8e4cbdd0c26", "comment": "Malware payload (Mirai)", "value": "a68874c5b4f6118373d754c6dd16d9ff17603bf3a858bf9a82a527d571bb19f4f2e1d62f2a65d18c7c4345cbfc19a632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842682, "uuid": "13fecd58-f289-4f7c-9166-d59551ac6f5f", "value": "T138230252E0726286CD7055B6133FB9888C00B94BD89C739EEDE4BF4328F6F99465C716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842682, "uuid": "a89874e2-7d24-4001-8abb-a0db0905787d", "value": "768:O3ywyhhmc8QuLrlVERnxOEDGCtWUBltzN4b8L4mYesWsRaepmbvk1bpqMnbcuyD1:O3V/c8QuLrl+h8EDgUBnKbxmcCVjk1b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677842682, "uuid": "150b5494-7dce-467d-88fe-1164de382d6d", "value": 46344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677842682, "uuid": "d8704298-5da4-4560-98c7-4b94b58420b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677842682, "uuid": "9f094e42-0241-4895-bbcc-2841af939444", "value": "notabotnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cb1754-b9d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1677853964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853964, "uuid": "c15eb9a9-b831-4f33-8d58-0d33c85ae2da", "comment": "Malware payload (Mekotio)", "value": "6f897d7a326965297714c8a8c73984be", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853964, "uuid": "b67e2b2f-b84d-4997-816c-8f22b2eb5dec", "comment": "Malware payload (Mekotio)", "value": "d94736610935956948c7cbc1b6356449f3814c527706ffc2800d5b2fdda48977", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853964, "uuid": "4493d856-5aee-40c9-b876-cc51e63df3bb", "comment": "Malware payload (Mekotio)", "value": "e2b60f2991a74f3f67922687c2403234c0f0705d", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853964, "uuid": "c71f06af-8597-492f-a6ad-d8f552c1fb8f", "comment": "Malware payload (Mekotio)", "value": "8bfda31cc7d6f6be1b67797d29ee0798974bd737ee5879a18f3cb4cd588e9f6aad014e5f8e588bef36861b1897d24220", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853964, "uuid": "02d5ca16-c511-4025-832b-40e0b08e4f12", "value": "T1AF962362B2D64126D4FEC6790A27BFE935F11719837200BBF6886ECA34F26D05772943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853964, "uuid": "61173a2d-3561-47b9-a708-0786d390276f", "value": "196608:5EsT/NQDnzKRzQbOEXNmYiPcgviY6OnNAObVOmhDaWwGQ3pHWAR:5E8GTzv/p0l6OCOJOpJpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853964, "uuid": "4e809331-f224-41c7-8f8b-c0f1a00150e2", "value": 9030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853964, "uuid": "c1d66430-42e2-412f-861f-6a18f8831629", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853964, "uuid": "45ee212a-0cc4-4ea6-a970-ec4e87ca11aa", "value": "FACT64010.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badf24d1-b9d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677858031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858031, "uuid": "3bbe012b-3267-4b41-be5f-5855d1d6a29b", "comment": "Malware payload (RedLineStealer)", "value": "8a45eeecc52e71e8ecf93c9ba9621db0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858031, "uuid": "552b9dc3-b839-4379-a0b5-6b0f63af318c", "comment": "Malware payload (RedLineStealer)", "value": "d94d11a11da210e62ad331998515f76f0bf21af6f75e01d72c75a18e6dc42a13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858031, "uuid": "5615d51d-c8d0-44d4-b3cb-273dde1f2e71", "comment": "Malware payload (RedLineStealer)", "value": "563df47167e12ab2a297d3c5701745788d6a712c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677858031, "uuid": "ca8a9c5f-88cc-462d-adab-c3219c846dec", "comment": "Malware payload (RedLineStealer)", "value": "1dcf5191f35f39d840dd445e36ca4cf2217cc1364b0b53d736ff0907204b876aaed7cf882de6c08dad34fbb0140bc345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858031, "uuid": "9442f907-89a0-4283-969d-2c7c460abecc", "value": "T11F15124BF7E81173DCF45BB019F647C30536BDA09A788287228A9C291AF31B4B635776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858031, "uuid": "83ad50e4-163d-4e3c-8f23-58169bd781f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858031, "uuid": "e515492c-f670-4155-83cf-44613856627e", "value": "24576:4y3E4elv3hUHVAI5/PC57djn3N4c5XC264D8:/U4e93hwVd8WWCJ4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677858031, "uuid": "16c7130d-f664-4c94-a907-ef606efc52ab", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677858031, "uuid": "1d89fba7-28ba-479b-9d26-150624e343bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677858031, "uuid": "d6409815-b17e-468b-98ca-f32851d306e9", "value": "d94d11a11da210e62ad331998515f76f0bf21af6f75e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4168b560-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1677857397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857397, "uuid": "0de26436-66b0-4670-abe3-7f27c9429f81", "comment": "Malware payload (Socelars)", "value": "18669b21194b03105d0a9145635a1ce6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857397, "uuid": "9c683421-869a-4f6e-8ef6-1e8e3ba16edc", "comment": "Malware payload (Socelars)", "value": "d9d2ad004f71ee5e3dc5f0170b74a961fc5df4e187ea03a11788ed30a1a8230a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857397, "uuid": "722e2d63-8591-4380-a7e9-33c505701674", "comment": "Malware payload (Socelars)", "value": "59d361b172cfb610aeef1e0ab6e2546b40aaf1f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857397, "uuid": "ffde61cc-e96b-4cbb-b300-74b3ce75b8a0", "comment": "Malware payload (Socelars)", "value": "cef1481f356b56b903e37be3a1fd5ff15c51cffbf8a6e9ee163eba4ebe5062993e0b3ac7d330c5bdb0962d3403c60f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857397, "uuid": "ac2f69f6-7f8a-410b-a0ce-80d25e2d0546", "value": "T186658D21F7C26032E9E310B745FF66BE9D3C6A11470894D7D3C81C99AB614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857397, "uuid": "90444d2c-486e-4f37-a0ff-de85950c960a", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857397, "uuid": "b946d7cb-902b-4ec1-94a0-d374ef85dda4", "value": "24576:PGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRfj5h6SY:OpEUIvU0N9jkpjweXt77L5MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857397, "uuid": "e02bd2b7-6a72-44aa-bbe2-6f586e409e9b", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857397, "uuid": "9d1beac9-d547-462b-909a-a921310e3cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857397, "uuid": "851b00d3-03c3-4813-8b9e-fd5182bd122f", "value": "18669b21194b03105d0a9145635a1ce6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778c971f-b971-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677813250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813250, "uuid": "161bfb6d-bb80-492f-a1db-8d57821ebf62", "comment": "Malware payload (Mirai)", "value": "b01f6ff56e75c5ddb33dbe9216d059ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813250, "uuid": "43956590-fee3-45b9-97a3-fd7a15a012a9", "comment": "Malware payload (Mirai)", "value": "daa443d8cf000c434e8349ca88e49e958f022e213e8149e01f716817c1de5adc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813250, "uuid": "71ee52c3-7be2-4b62-aa9f-e7e40c46c274", "comment": "Malware payload (Mirai)", "value": "fed954c7b0503ce8df4a7408eb26d4414884b839", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677813250, "uuid": "d6b7d205-98a1-47e6-adc0-be54076a73aa", "comment": "Malware payload (Mirai)", "value": "50cb7a34e1b3375389418dafa131d030c73b17277bef59aef6ca0f0911259b1173dd426cf22188fdf3b54b7a00f9b9ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813250, "uuid": "ff443c36-2380-40d5-bd81-aee085b4d51a", "value": "T18CF2E0253A0202CDE6BB86FC3EA143504D5643F3B853DC1BB9AAF60D746DDB8AA149C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813250, "uuid": "c2b2d74b-de3a-465d-a95e-dc4b3e3399aa", "value": "768:hssp+zRUaOG46rMXtYnoAdIV57MuJ7ELDc9jxlZROySaHJgGlzDpbuR1JgQ:em+6fG/rutYnaV57NJ7TlVJu+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677813250, "uuid": "da8d7bbd-1872-46f2-b95b-b9c26e510888", "value": 36596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677813250, "uuid": "9ff5e645-34a5-4d2e-895e-6a2f4951a2c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677813250, "uuid": "f6bb91e4-7330-4557-a0ee-9888de6518a7", "value": "bok.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47860a5b-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677857408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857408, "uuid": "5308aa7d-8498-4a36-995d-eab742957e0b", "comment": "Malware payload (Loki)", "value": "02e9a1240ebaf7c1f9c201ffe7dbb605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857408, "uuid": "f5dba730-732f-4418-9c80-9894c1ca908a", "comment": "Malware payload (Loki)", "value": "dc77fa38dcbfa8304ae07b051d7658f367286bc92005d327a34c944975719b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857408, "uuid": "6eefe5c6-2f45-4f33-bddb-f301daa0da1c", "comment": "Malware payload (Loki)", "value": "1373ebecf95c9461aa11b5ab1ba421f0a7d965c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857408, "uuid": "1883fecf-817e-4749-b385-9ad1318a34ab", "comment": "Malware payload (Loki)", "value": "31c91d316e02d42bfefaef206f367a9da7cffe7e8510c71a28b1952f4a82f4c260ce7ccb6653d1bfa98559af7d71af6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857408, "uuid": "91d7708d-37c2-4559-9aa9-cb4a0f44a4d5", "value": "T18C64CF2272D0C0B3C44B55749922DAA46B7EB8F197A486C733583BFE5E303C19B7A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857408, "uuid": "d509ad70-5265-4842-96fa-2dd47216840a", "value": "3dcdb6b03575fe1a857d23b1ee4d81a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857408, "uuid": "e645823e-25e4-4c65-83ea-56c0292d915e", "value": "3072:qoQvTkbaLo85SJIVTEvE8hwwmh0iNzy1472oMn249Q:PQv0aLbSiiKNyboM24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857408, "uuid": "be43fbff-ffe1-4019-bb14-df7443927aa5", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857408, "uuid": "58e28179-b64e-4101-8d84-18600f95d194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857408, "uuid": "735c8a52-c6f3-42a8-a347-8ac68e02806f", "value": "02e9a1240ebaf7c1f9c201ffe7dbb605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0e0083-b956-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677801636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801636, "uuid": "af8e2967-aedb-4081-abe4-3284cc84c7b9", "comment": "Malware payload (Mirai)", "value": "ee2b0006b93c22a1a5f99903fbeda0ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801636, "uuid": "4ad923d2-dd69-4c8a-9c5f-62eaa6f5cab7", "comment": "Malware payload (Mirai)", "value": "dd658e29b8180366ef67896658f7b197f30cfa627bd5d5b1f7361432efda1f94", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801636, "uuid": "6e3363a1-74fa-488c-a07a-de2b21928495", "comment": "Malware payload (Mirai)", "value": "7578c9b151019d2e4129d8b46ce6ed95cc2eee2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677801636, "uuid": "31b25534-157b-46bf-9bf4-922f3fad4b6b", "comment": "Malware payload (Mirai)", "value": "bddd2cc8481835279d52ee1bf8ff47a620f5c3fac497e8f835cfbdb83da4ef00bcb9e37071f0912666eb02d4eff61094", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677801636, "uuid": "49458c44-ec76-4c5b-a154-9b8e363c7883", "value": "T12D633992BC819612CAC413B6FE5F519E371213D9E2EA7207AD15AF2037CBD1B0E77252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677801636, "uuid": "e1776583-192f-4ea2-85a6-bdd65282bdb0", "value": "1536:zSDWsMHjmC8XrdbrtP0HZFYbwqqaxgFDvyt0X4N70RXtvz:zSPKjm5X5MYEZ02vk0wIPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677801636, "uuid": "c053c716-f1f6-4ae2-b86a-36dce49e79f1", "value": 71988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677801636, "uuid": "ac11a0f9-2595-4222-a8d0-6eaabe821ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677801636, "uuid": "5167cf4c-ff24-4315-9ccf-1cfd0602bc2c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f70231-b9cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677851869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851869, "uuid": "c57e79f4-975d-48f3-a7bf-1363a65b7a73", "comment": "Malware payload (GuLoader)", "value": "43943a872d6e9c671f4cce0e487117bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851869, "uuid": "5fff8b0a-b466-47d1-9437-5ede8061d7ef", "comment": "Malware payload (GuLoader)", "value": "de4dd25cbda820d45a05a838964e09e7d54d49752dd23f39118d237b4b3d8cde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851869, "uuid": "0da2304d-aae0-40aa-886d-f32c503cbe9d", "comment": "Malware payload (GuLoader)", "value": "660c68b24b120f1c6866b9f7c6a13f1d0b1d97e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851869, "uuid": "967cd3c5-4ef5-412e-908b-051cd9d306c4", "comment": "Malware payload (GuLoader)", "value": "e02feeb7d17f96a545d57543f69942e87b92d2281d530797f09346d39abda7c4843362ff915f7be2b134d185422237ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851869, "uuid": "32aa20b2-cdd7-4f94-ab35-136c51ae20c8", "value": "T12354121973F1967BE2E309B112B6F9BDFE3767040066450B9F300F7B5CE15866E1A18A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851869, "uuid": "3a265bb3-5833-4600-88ab-db7bce0511ec", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851869, "uuid": "c358bde4-110c-43ac-ae20-0f261ff11cc2", "value": "6144:nzAJ687QHdsbs2USfoVVtEXkviUG5hyu08xSDfN:zLXC9U2oVVgkvHMb0ESB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677851869, "uuid": "d3f6d6d9-087d-4f1b-8984-20e46af486c9", "value": 285547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677851869, "uuid": "2f057023-1bc2-4ade-bc2c-c38ad14c258e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851869, "uuid": "2c9344eb-2598-4810-be73-4a39f47f8fb1", "value": "de4dd25cbda820d45a05a838964e09e7d54d49752dd23f39118d237b4b3d8cde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adea595-b9ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (Meterpreter)", "timestamp": 1677865064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865064, "uuid": "5a11383e-39ce-43ca-bfe9-d040039ef381", "comment": "Malware payload (Meterpreter)", "value": "2cc79806701f1a6e877c29b93f06f1bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865064, "uuid": "98978d25-b443-45e3-98f2-c06d3e4e9c6a", "comment": "Malware payload (Meterpreter)", "value": "de9b3c01991e357a349083f0db6af3e782f15e981e2bf0a16ba618252585923a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865064, "uuid": "1f0adf20-c32c-4837-b949-6f81603e7cde", "comment": "Malware payload (Meterpreter)", "value": "261f2e39597ebff967e98e5a261166f9594ab632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677865064, "uuid": "22d5bde0-291f-45ea-b903-f26688d04581", "comment": "Malware payload (Meterpreter)", "value": "13325fb3a97d426d040831bd4bb3761ec2fc0e93cfa6b6ecdc707bf0649f91fcfa8a55355cae0ce1faa22350e8200dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865064, "uuid": "2d6a6aa8-d987-4f40-9799-ebd868080cd3", "value": "T120640A519E12FDB8C9E0467136657173F3223EA8803DDBA779A5FE10CF36342A96B640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865064, "uuid": "31f47547-4c4d-40e2-a1d0-72a23959b5b2", "value": "7f252ab32d95da3c51f0ac0ae737d3b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865064, "uuid": "122f0c73-2a18-497e-83a6-f3d931f52476", "value": "6144:hwGhBoTGz8Af7N1TY5837ogq3toQKLcHeAAdVr0Bm6A7wWFRKrERjGtoiea8y3fR:VhBoTGz8Af7N1TY5837ogq3toQKLcHeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677865064, "uuid": "ff411f68-2766-4659-9126-48a811138879", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677865064, "uuid": "3a83630f-3883-416e-8ffe-05d985da1581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677865064, "uuid": "bd78166d-512a-4ed5-8300-76195d11379c", "value": "de9b3c01991e357a349083f0db6af3e782f15e981e2bf0a16ba618252585923a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27509446-b979-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677816552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816552, "uuid": "db2c9ce5-fbcf-4bc6-a0db-0ef7aa53a910", "comment": "Malware payload", "value": "1dceeb7550cc867421d478fa443c5706", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816552, "uuid": "a03a0cad-5721-47ef-8d22-69fb693430c7", "comment": "Malware payload", "value": "de9e773f9c03d53aab271188c5b317bec45d1049a06e0b8c167e5527a92ad7e8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816552, "uuid": "c8cfcff7-ba09-44f0-bef6-627fa145860b", "comment": "Malware payload", "value": "ccab897c995f12733294adf9affaa483d8ac8aaf", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677816552, "uuid": "2a32e43e-ab90-4b93-b281-59b8a36e947f", "comment": "Malware payload", "value": "b0b39b4c110cd797d77688cc9030e229e9e24502a71a3db97e4fec77b1b7b5441c99da979e85fce1d5c6fa7ddc6dd5b1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816552, "uuid": "fc9bfed6-73a6-4590-b455-c36e9d61ad8a", "value": "T118171282F798D82DD47752334C5A167566AA4E259A02AAC7350C3FEC2DF36D84F0E3D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816552, "uuid": "026f8542-92b0-4c21-af42-6e09cb690018", "value": "393216:nzcKm/0C2inld9ClOdmRho6ol7VsfIc4hDCcfVpO0Y0vG9UyW:nzc5qincDaVl7VQKfO07vGPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677816552, "uuid": "cde5a374-cc7e-4ed0-8207-f5d2fa7ae91b", "value": 20219921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677816552, "uuid": "ba2e17cf-fb77-4e44-b7ed-eab031d21e91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677816552, "uuid": "6acc2020-9143-421a-97ef-5d28b060e502", "value": "tv-latest.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d21056f-b9ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677853230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853230, "uuid": "ddfc4240-9ae5-4935-a69a-0d86ee2d983e", "comment": "Malware payload (Amadey)", "value": "06c02872440c96cd9cb0208f8f1f8944", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853230, "uuid": "b5aae918-7f55-4c7c-b41a-c47fb689fdbb", "comment": "Malware payload (Amadey)", "value": "dfcfe1ebe78436f7f7a050b001d9b756475918f25c164ea3cf874143df2f08d3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853230, "uuid": "589da3f4-3677-4de4-aad3-dbf07043a83b", "comment": "Malware payload (Amadey)", "value": "76f70e5c57f3a7a7d99745bcd09c379fab6f67e9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677853230, "uuid": "ada0864f-cc21-4dce-845a-909d77bbaad5", "comment": "Malware payload (Amadey)", "value": "5e976867872ade919a4b3e03c674de82babec2eae07e37e631e13f93455aec9805e93c1d516f8d075f4853b934159894", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853230, "uuid": "779a24cb-43bb-49cf-92fc-89072c70197d", "value": "T114151207BBE984D2E9F58B3018FB46C3063ABD505634D2DB178E9C6D18637A4F53236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853230, "uuid": "e8bb42e8-f6c4-4b37-a309-c567a348795b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853230, "uuid": "e33709aa-a6ef-42dd-86c0-054be433cf4f", "value": "24576:RydhQlMtwn1uZpzuxNNQM13ZaYp+V9WYa:EdhQk2uZpzKNqM3s9WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677853230, "uuid": "1194b7dd-8f7b-48b1-818e-d2b05fa10a03", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677853230, "uuid": "d42c090a-c5cf-46ae-aaf3-01bfb823c927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677853230, "uuid": "b7633318-a6ef-43c0-9a83-7c175dd652cf", "value": "06c02872440c96cd9cb0208f8f1f8944.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06903015-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857299, "uuid": "061840e8-55dc-4f96-aac5-57bce217deeb", "comment": "Malware payload", "value": "7e22f8bf23a959bc845834e5fbb42346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857299, "uuid": "f2bb4e08-1240-4ddc-99f0-943407b8c42c", "comment": "Malware payload", "value": "e06ab4abb81d1a4cad5186b9f8ecbe2bea5670b49df10b150994ad4a3db326ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857299, "uuid": "752eb82b-b657-431c-9319-79bcb775c80d", "comment": "Malware payload", "value": "f4a0957b325a3f5d9df1f0d763fbf4a77385f16a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857299, "uuid": "e46a0914-5504-44d1-915b-73dec90bb2cf", "comment": "Malware payload", "value": "cbf13357700a53c21e8921e4041da390269dde695734182a534a866a46de7c0a09cff7cc9a4fd973f9a6a63de486728f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857299, "uuid": "91a28b79-8ccb-4ba4-901a-760f9bf53fe0", "value": "T1DAF43A13900180F2DA102BB751A66B36ADFD575578B8C953E7A4EE26EC7E302E32770D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857299, "uuid": "07396928-4e55-4a2d-b494-1fdd2d9bc81d", "value": "12288:y/B6WNjFypZbh7oePtST/CttNFR24BxEFFiWw4tv4K1:y//0pZbhHPkWtzHBqFFJwKvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857299, "uuid": "4860c99b-4d2a-4c90-92b0-fc59351729cc", "value": 766320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857299, "uuid": "d61cfab0-c7d6-43b1-b2a4-6403b76bcc61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857299, "uuid": "4b8be54d-52d1-4139-9453-2e7b3921f972", "value": "7e22f8bf23a959bc845834e5fbb42346.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2da053-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677857286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857286, "uuid": "e6029faf-55cb-4133-beae-db5fc6953956", "comment": "Malware payload (AgentTesla)", "value": "6c4e50ff29e70c064d5350ddee4b236c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857286, "uuid": "c585dce3-cda8-44ba-ab8b-70915ec2fd32", "comment": "Malware payload (AgentTesla)", "value": "e1332c9ff034ded7f31b405f082cba3f67c5bf23f679e08643907ff26679cbfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857286, "uuid": "8695d538-d5c3-4a58-bfe0-18c63e1afedc", "comment": "Malware payload (AgentTesla)", "value": "af1721edc88be852b6cb88b57d4c02ac1a8c634e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857286, "uuid": "e7e53f51-02ba-45b3-bf20-4becd1de17e7", "comment": "Malware payload (AgentTesla)", "value": "626d55974c47fc1fd2b6ae4a0d7dc1bc222f7af27ce260fb37ba31e038ccc0bdf9f66d62d6246f6f5e010b763082d6ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857286, "uuid": "f9bc238f-3471-4ad5-913c-9e5c659ba287", "value": "T1F335762809FD0EF28571F1FD9FD4E753BE8088E6AA049D9AC2834B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857286, "uuid": "3910bb6e-4ece-403d-b415-e1460a0d494f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857286, "uuid": "0ded9fee-93f4-474f-8808-818e2bfebe9a", "value": "12288:F4MBTAL2w8UUnNi13QHYvqjfxl3DCNbfCoe3l2OLxK3G8GYABRf5P/qm:7sLfUNq3QHYyl38bCT8OL0/GYAnJ/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857286, "uuid": "1cbfb9ec-7ede-4ae3-9445-70f803f3ebb7", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857286, "uuid": "42796494-db6f-4f16-8307-82c57f66f29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857286, "uuid": "e07a64dd-4e3c-4ec6-a7b9-d2daaf1dbb87", "value": "6c4e50ff29e70c064d5350ddee4b236c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d919e62-b9f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677871242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871242, "uuid": "e65daaa8-e406-4d41-aad2-713139af44c8", "comment": "Malware payload (Mirai)", "value": "635e47e6583482007dd05873fbfa4d44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871242, "uuid": "18d010d9-d75a-4be5-8fbd-c9b6371b5164", "comment": "Malware payload (Mirai)", "value": "e21a1578a49c451f5f6227531cc430eff50af652aac919d939aa80727949c718", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871242, "uuid": "14767d87-f45a-4411-9461-d9bbac141828", "comment": "Malware payload (Mirai)", "value": "44e1e380022a699595011c78f060c421e3d502da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677871242, "uuid": "ca66a18d-1ed8-4ad2-a60a-fe99660fce8c", "comment": "Malware payload (Mirai)", "value": "f39362dfffba98fb785088c4d2f306432107775d028bcdcadf103688cb5b05a5330503faa95ab99d238d83f183a47245", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871242, "uuid": "bb2558dd-bf94-424d-897c-85d457d44c41", "value": "T1EF832B56F9628517C6C026FBB66E50C8375A53BAE2EF3203EC111F143A8B94F1E33A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871242, "uuid": "08045dfe-5648-4019-9eed-a6212b3098f0", "value": "1536:/DvcjA3Q7f0fKUy5+/9aRdP3t5dyyidHYJ2h6r5jIH:bv2A6YUfbdjid4J2mIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677871242, "uuid": "0f6458f3-f1c9-4fa3-9f16-7e6d7264c98f", "value": 85224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677871242, "uuid": "df8b008c-b65a-422a-9ad8-8aab3a827616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677871242, "uuid": "d8c85db6-5bd6-40fb-a1f5-8be0409301f9", "value": "635e47e6583482007dd05873fbfa4d44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d649f65-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677856693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856693, "uuid": "b483bd93-ff70-4fbe-9f24-54e2de0b5150", "comment": "Malware payload (AgentTesla)", "value": "2a1545c3d87e97567f8b086860e5832b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856693, "uuid": "d3b2cc6d-711e-48a8-a4ec-48fec7cd8b25", "comment": "Malware payload (AgentTesla)", "value": "e2cffdf34c55f9b0975fc651a0f49db65ff59c34610221fe5efac13d72911310", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856693, "uuid": "068a2586-3c23-4780-9f13-fbe659b30719", "comment": "Malware payload (AgentTesla)", "value": "410bf6f20cb8d3815866b31c7c7d777fbccb6ea2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856693, "uuid": "a726cc43-f9c9-434b-ada5-92a5e7dbdf12", "comment": "Malware payload (AgentTesla)", "value": "2790e79a598e97094a0781923055436a57e7b141637f6ab67db8ddca571daeeb5aeca4abff2d59769844588aa24c662d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856693, "uuid": "5976e695-0f2b-4f3d-be2f-4d31e8570337", "value": "T11F05DFAC3210BADFC817CD76CAA82C64E66174B7570BD203905715ACAE1DA9BCF116F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856693, "uuid": "41ea4efe-0e59-45ca-ba2c-1d8485fd0b19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856693, "uuid": "e15b9495-6602-430a-87ef-33b71bb07a03", "value": "24576:2wwt+2McUJrdRhT5js5HE2u08wvQW0iaGTf/YeOXv:qt+XLsxRu08wYI/YNXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856693, "uuid": "3c9ad728-51e0-4576-95e4-1073347ca35a", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856693, "uuid": "2ee4f6f2-b298-46cf-8d45-121c57efde0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856693, "uuid": "4a640bd4-9231-46b3-b81b-27840a94ee4b", "value": "Betaling,jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337a7641-b97c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677817860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817860, "uuid": "de21a1bb-0ac6-473d-aa62-51d6a5f39f0a", "comment": "Malware payload (AgentTesla)", "value": "ba628c629f3472e3b57de14e3cdb05d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817860, "uuid": "62bf2c21-5f29-4588-9072-0058b832e1c3", "comment": "Malware payload (AgentTesla)", "value": "e399cdab404d5046aba55ff32346f96349d482763a3b1c633c9a8fb594f09a17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817860, "uuid": "9b215d56-a5d9-46d8-897d-48b2170febb7", "comment": "Malware payload (AgentTesla)", "value": "b492c03cb6824682d575a6b77e3c1c3b7755a331", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817860, "uuid": "a1e47ad8-23d0-4f19-9e62-41cd76fb626e", "comment": "Malware payload (AgentTesla)", "value": "180851eb84305ccd07daa219f7594077e833d3bc8fa78c0c3a057bdf8b8d27b3af465ff9bde40d2198b3e6439638aee6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817860, "uuid": "55eb916c-facd-4acb-8866-e9d196e75b08", "value": "T1D942E8511BCD95F2D328B033812A800A18BEB57B35A76AF4B88DE45277FC60D46FC5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817860, "uuid": "c529a28e-3f49-44b7-8d31-16401675bc30", "value": "384:3G0wPz8KFm+Aei4b30TwMwueS28GGmYP13kXwLhVE:3GrJJi1wok/GJRk80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677817860, "uuid": "eaa7f334-f95b-4dae-807c-fa8e97656881", "value": 13013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677817860, "uuid": "8dd9c84f-3d9d-416e-bb05-906ea6814265", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817860, "uuid": "f92f733e-94c0-402f-8d6b-a7a442e57b17", "value": "ba628c629f3472e3b57de14e3cdb05d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6607f83-b9ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1677844682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844682, "uuid": "4228dd84-3ec9-44ee-9e41-ab6116bea616", "comment": "Malware payload (Quakbot)", "value": "8f5ea01df8486893db268cca183174b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844682, "uuid": "f52b8018-995d-4bf8-8bc6-bfff46c11a8b", "comment": "Malware payload (Quakbot)", "value": "e51e46a60edd75688758927eba84bfd802b7188d4bc9b9ba97332fc879b63319", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844682, "uuid": "29473860-5b28-4c23-b0f5-6db780e1e758", "comment": "Malware payload (Quakbot)", "value": "edc235cf0abf113844d62b11931f230f9b40f3b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844682, "uuid": "deb0dcfe-e077-4d8f-845e-eaa54ab6f72b", "comment": "Malware payload (Quakbot)", "value": "ba0c9ee3be6e380ad60c8c31d9efef957625859a872c45c013f5dba32e6688b7df7308bd91ef3f5ed034359e2bf405d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844682, "uuid": "133b897c-50d2-4cdc-82a7-ef556e8287b5", "value": "T1D285AD1242CC129AF14D3B78243C1F7FD3BBB7A87B19634E9654B8A9AFAB7D34115600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844682, "uuid": "241df37d-faf7-43fe-afff-ae3ad9a4a6f9", "value": "a3432b773266dde6a100dba767517009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844682, "uuid": "94ae4c96-955f-4153-8ff7-4e9a604dc199", "value": "24576:zrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgEJ/tc1:T3nCeCiT8aHxyM18z+XatEJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677844682, "uuid": "bc9e5d34-bc17-4d05-a56d-1961fd3a0ce7", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677844682, "uuid": "99a81e9a-3563-4818-aad1-6651617bd41e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844682, "uuid": "48e7ec26-946e-483e-8b0d-a6fd2b40dd77", "value": "pdijo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd6d543-b9c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677851217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851217, "uuid": "c31188b9-0c66-44d9-bb83-3dafecf34adf", "comment": "Malware payload (GuLoader)", "value": "b6c20b17c8ff30e22b7fa4985e960411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851217, "uuid": "c5a69032-d2db-473f-b64e-6d198e617ea1", "comment": "Malware payload (GuLoader)", "value": "e531fae4d72827babcf0f4843124b44a31cddcd81454cb0c64aad6010ff9b839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851217, "uuid": "ed0bd54d-96c9-4587-b987-690ed37de672", "comment": "Malware payload (GuLoader)", "value": "90567a9a99e478ff0764dcc4b2d70986761900d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677851217, "uuid": "ced904b4-0dc0-41f2-a787-af3d777de699", "comment": "Malware payload (GuLoader)", "value": "27c4ccabbeec844f79ada17f1b189afbacb61ccca93f34bf20f9d388be7fc3bdce4e628cc5e93764d0ac1559cc20ed49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851217, "uuid": "6be61721-1ff0-4052-8aa2-847b281165d9", "value": "T19154132113F1CCBFE7A281B118A6663AF2BDEE716010160B53760E7A2D14F99E67435F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851217, "uuid": "5f2c1617-ae7d-44da-abac-60e04dba135e", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851217, "uuid": "a06d69b7-4675-48de-837a-e24a4201e802", "value": "6144:nzAJ6rGcF0xb4TUCy34oqzVVhkcBOdUBlzFoIQxJtU3H:zLrGi0xb4TUfkV5FDHQFUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677851217, "uuid": "43763cb0-299d-44b4-88f4-b9ea5469b6ed", "value": 294143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677851217, "uuid": "fdc779a8-62a8-4775-be4e-76eb6ae0768b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677851217, "uuid": "2452f3a4-a2ce-482d-b454-742cdc26f327", "value": "e531fae4d72827babcf0f4843124b44a31cddcd81454cb0c64aad6010ff9b839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd56b098-b958-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677802684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677802684, "uuid": "7df0bd99-659b-41b0-b8be-b1435c6d0c61", "comment": "Malware payload (Mirai)", "value": "fa36beedaa2703d8c6d901d149b91a19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677802684, "uuid": "4206fa4f-1278-46d8-ab5b-034b09b90b36", "comment": "Malware payload (Mirai)", "value": "e65031d4e7ea45a850cbe6041f6da98ad114d89b88b9dd6339a1d9715e5eceee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677802684, "uuid": "02599cb6-ab11-416c-b752-17d3f2e46662", "comment": "Malware payload (Mirai)", "value": "d7b9183f497637d2920146c2118d2c6cd741f490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677802684, "uuid": "057ce49a-b6a3-4ab7-9972-b2536c9f0ced", "comment": "Malware payload (Mirai)", "value": "bdaaaea90261aebd98455ad11e707342a8da449eeba51e8fe0b7068c2278af4e058ea9815077edd6cd52fa4128c6b7a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677802684, "uuid": "31fe67d3-b806-4a2b-8240-e239d76c775b", "value": "T127733ADAF800DEBCF40ADAB68527480BF531A3518E920F366627FD977D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677802684, "uuid": "e2ac0e53-9975-478a-8aca-881738155e7b", "value": "1536:Tf1Shag/IQVruz5R1rtjkUwo9uy8cWLcY4I8R6OKG7wIN2uV:T9QVyR1rtjkUF9uHiIG6BPuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677802684, "uuid": "c670dfd5-fb68-4516-83b6-8e714de89378", "value": 73520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677802684, "uuid": "49ef3c1f-2d08-4b6c-be0b-9e7d8565768d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677802684, "uuid": "85b44e9a-3d4b-44da-b1c8-909677fc1e13", "value": "fa36beedaa2703d8c6d901d149b91a19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a36958-b9c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677849627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849627, "uuid": "d53ea8d9-c9fc-48ea-949e-fa620c71f911", "comment": "Malware payload (Amadey)", "value": "204955179d7d94838970d6c8a80f5067", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849627, "uuid": "a777fb45-3ee3-4d15-9d87-6f004f8ce534", "comment": "Malware payload (Amadey)", "value": "e6b0accb87874557ba38790c25509486bc49e818c9104b7117351996dfeae7e5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849627, "uuid": "5e83637b-d22f-4446-b9cd-82c49faa627f", "comment": "Malware payload (Amadey)", "value": "2ad96764e2ae29a4136d79838cc95baf1cd37739", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677849627, "uuid": "2e84047a-c3ec-44f5-af32-8f1f8da8bcfa", "comment": "Malware payload (Amadey)", "value": "772edb8ac03f6797df95959e2a3cece5ad1d815d61ac299f0c843d3e1d12ee8a91f35e6068ed9e48565d368cb2087168", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849627, "uuid": "06fd2f86-973f-4708-908d-eaa01173b8e5", "value": "T100446D3263E07C51D5224E32DE2AF6E42A1DFD528D2BF65B2E38FA1F09702E1C566711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849627, "uuid": "073fa4fe-436d-47e2-9e1f-19ee63a79952", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849627, "uuid": "ef7b71a6-832e-4526-8bae-577184f0ebb1", "value": "3072:14CqxomnkUS8Yl8ifJma4m2RpSpTQGHPPQc0gVum0glYQB3pjAXPSQo:ODxIUel8ifJmawplgPIUt0gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677849627, "uuid": "b24b3dfb-aaad-43f2-8f94-f5fa74729341", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677849627, "uuid": "9e873f8a-5950-48fc-ad9d-dcf553597e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677849627, "uuid": "6863bc24-923d-4198-89a4-cd21b0b83b84", "value": "204955179d7d94838970d6c8a80f5067.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa56278c-b9d7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1677857278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857278, "uuid": "77c115f1-07b8-42bc-a095-ce76bf96dd70", "comment": "Malware payload (Socelars)", "value": "fca68f627312865ee001e3ae3eabcba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857278, "uuid": "5505936e-0c04-4aa3-b520-b20c79637436", "comment": "Malware payload (Socelars)", "value": "e7ad6f36ca02c7c9fe96f14a0efb6146c4a97506c65925ed3f32f0de5183a43c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857278, "uuid": "ed8b6616-21af-4d2f-84af-a2abd9688a63", "comment": "Malware payload (Socelars)", "value": "68de2e4968aac9f9901a4b41fce1c9e331d15b16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857278, "uuid": "95b8ea8c-85ec-407f-a165-5bcb0d777064", "comment": "Malware payload (Socelars)", "value": "fcfcc157c9556162a3308ea52ba1bfa509de12bfff38fbed5629e40798af34bbdf1e7f57fb15315837c686a333732db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857278, "uuid": "17ea763a-5610-462a-ba5a-00dc1ab7b087", "value": "T1C2658D21F7C26032E9E310B745FF66BE9D3C6A11470894D7D3C81C99AB614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857278, "uuid": "c4eb8e80-cd25-4228-90c6-61f28e93dc41", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857278, "uuid": "1ec342ba-3070-4ef9-9f8a-aa0bef313701", "value": "24576:dGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dR/05hqSY:ApEUIvU0N9jkpjweXt77M5MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857278, "uuid": "6af4cfb8-edf4-416c-a44a-a26998d7da6f", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857278, "uuid": "1d2a6527-1127-4ca0-90bc-a1f6b24b8144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857278, "uuid": "8f16ba31-8338-4cbd-8227-8fcfe8035216", "value": "fca68f627312865ee001e3ae3eabcba4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f0aef3-b97a-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1677817250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817250, "uuid": "654e2fff-faa8-4bf9-a526-534ddc136d89", "comment": "Malware payload (LummaStealer)", "value": "b329525d2d62f10d7a8fdb25bb9d9a43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817250, "uuid": "b09bd51f-ce0e-4780-a127-b9121df563aa", "comment": "Malware payload (LummaStealer)", "value": "e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817250, "uuid": "b00e56a5-5d78-45dc-bef4-d06abbdf5a7c", "comment": "Malware payload (LummaStealer)", "value": "43190e85312bd69cda8c094a0085ea188832bbbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677817250, "uuid": "aacd367e-e317-4185-9c5e-98395422f67c", "comment": "Malware payload (LummaStealer)", "value": "5b0b3cff520b6a42979147689800cb2b34c2eb121707c6e66d358059d49fc205e87350d4c94c4ad44e79006c1be5791f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817250, "uuid": "42872261-e67a-455d-be46-819c6f0f262b", "value": "T15E8542B0463EE85EBE15D82C8FF023355813A9877210EEB5D6CEE53A64E7E40846DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817250, "uuid": "fee5cf0c-a979-4859-9a6d-9d534d5deb07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817250, "uuid": "51895afa-592f-49bd-900d-99b5338d553b", "value": "6144:8GeEeHycW2dJDPEu0asM763jnJioXhbDJOTulPkkKeYBtEloF:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677817250, "uuid": "711f9a1e-7749-4d2d-8900-ceb6c417a833", "value": 1771520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677817250, "uuid": "bd7bf317-ac3f-4670-a000-b6ac3735e795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677817250, "uuid": "da350b4d-921e-415e-a118-53132ce3a573", "value": "b329525d2d62f10d7a8fdb25bb9d9a43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec7d78b-b9cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1677852293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677852293, "uuid": "ec15a584-49d2-4399-80ad-4c11a6568d0e", "comment": "Malware payload (Formbook)", "value": "33a0eb3de7f452f3115c5ee39894bacd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677852293, "uuid": "9e5f6cc4-c897-4d0a-b093-1d87dd8c6674", "comment": "Malware payload (Formbook)", "value": "e92f7d954c97723d975ffb5d04438494d692c6bd3b552a24d826e13ae6252ef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677852293, "uuid": "4d51a805-b469-4ce3-86ba-2501a4b4e726", "comment": "Malware payload (Formbook)", "value": "1879d2a8ce51338a729048ffe322f66047c56901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677852293, "uuid": "28607450-963b-4981-8c3b-f2add7b8e99c", "comment": "Malware payload (Formbook)", "value": "27a98514487104a4f0c19075a9009abd1126af2843cfe5efc0ff2cdc772fd3d0492423ba76f3ae979ff9e187ebf15a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677852293, "uuid": "c1f6fcf5-5ef2-48e6-8117-cde50f34c85e", "value": "T1C835872809FC0EF285B1F1FDDFD4E753BE8088E6AA049D9982834B89555395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677852293, "uuid": "af0a3f08-7b77-4839-8bc7-33b428ee9f89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677852293, "uuid": "44c8bca0-4fe5-4d7d-9be6-e816e44667b6", "value": "24576:HsR7TU4cWhyQ0d5NZhDaywmOLMbfvxB+1i:e3UahyQ0dvZJxFo02E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677852293, "uuid": "75d58f8b-efbd-45b5-b5fa-4b642b85c3bf", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677852293, "uuid": "eb416e38-ce26-47ee-b98c-907d5c39ed8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677852293, "uuid": "b6e27d80-d2f9-4dd8-ba84-312334e7bbf0", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a28d6fc-b970-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677812718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677812718, "uuid": "14fdae05-1927-461e-9ae7-8d56d9d926e8", "comment": "Malware payload (Amadey)", "value": "7e81c990211ee023d354c438b620532d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677812718, "uuid": "7acd4cfa-207b-473a-93a4-70fea88dd8b8", "comment": "Malware payload (Amadey)", "value": "e967a3126504da36a3c413216b5f29cf04a72d6e5916f9c3a7f86b9b9f3f6ff3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677812718, "uuid": "719c06f6-dd11-4ff2-87e0-c25a431a8f9e", "comment": "Malware payload (Amadey)", "value": "b33e485bea1f17d4d2db7377cc5611173a189c80", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677812718, "uuid": "b7e041cf-96ec-4a3b-b693-acd666b38a3c", "comment": "Malware payload (Amadey)", "value": "11d2ff7b137fa2742bb08f916781d322e5db21205cc5e8c0fe7ac780f429a7d09721f1112f9cc415139292f9a549e2fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677812718, "uuid": "4586cb1a-a1b1-4ecc-b90a-714b3e224d8b", "value": "T15D24D001B9D1C031C85784748834E6F56AFEBC629A95C98B32543B6F2DF33D116BAF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677812718, "uuid": "3a43caa5-2a5b-4708-8c26-b336ac28ee7b", "value": "4d3abe319a86be18efea13e549546a45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677812718, "uuid": "398d23a5-ad55-4407-88aa-e0859f127bff", "value": "3072:LFgQrMLqzxRZG4WNIY4kzYSH547AFgVYDtvdp3qC+0KXKP+HnNp/:GLqt4+VU+2R9kXKP+r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677812718, "uuid": "5669498a-d9df-4c23-8403-7aced1ff90da", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677812718, "uuid": "993afc3c-8d77-40f5-ac65-9c9d00f11f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677812718, "uuid": "75dc7e97-bca2-42cd-84d2-c3ac196aa325", "value": "7e81c990211ee023d354c438b620532d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d017368-b9e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677864638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677864638, "uuid": "483256e7-f298-48db-9c59-1bc4e9babca1", "comment": "Malware payload (RedLineStealer)", "value": "564957e1c71842e8b0086a521253a9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677864638, "uuid": "ae5a0a3c-2a42-4fe7-812a-91cc124769d9", "comment": "Malware payload (RedLineStealer)", "value": "e9fe18e34d84cfdc941664d22c656276270ab282ba9c8dd22297eb627836b340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677864638, "uuid": "3a71b9d3-f755-40b4-a165-ff128ec9b0bd", "comment": "Malware payload (RedLineStealer)", "value": "567c5410c0bc6298eb8e81f39a2d08ef6e18fbcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677864638, "uuid": "ea74a362-b17a-40ce-bcc9-458541f49c3b", "comment": "Malware payload (RedLineStealer)", "value": "6044798c605b7162dc339fe5d95d1b3e9d16645317926d661f46a7ac9ac7a5248e6f63e3f8f0b956ee55c8e63e84e6c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677864638, "uuid": "26793b72-fccd-436d-9f01-df3c0d602eb1", "value": "T16224CE31B2D0D831D0721631D875C6B5E93BBCA2A97454BB37983B2E8FB02D0563E766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677864638, "uuid": "2f13db20-839a-45e5-a408-4bc9e84d22f5", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677864638, "uuid": "ddbd20c1-a64a-410a-8bd5-0649267f7de6", "value": "6144:mI1LUwy8ZcTTWdHgd/adL2tmG3MTJqOj:mI1Q/ycTTUAlt3McOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677864638, "uuid": "f8b576ba-d1c3-436b-bfac-5a8cc47805e9", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677864638, "uuid": "84d78847-3dc2-4bdc-bfa5-e2b49039cba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677864638, "uuid": "ebe80ba9-8ecd-4110-8221-2ebdcc6ae7d4", "value": "564957e1c71842e8b0086a521253a9ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95f0b8c-ba0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677879906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677879906, "uuid": "85d09154-16ee-4533-86f7-db5073c81590", "comment": "Malware payload (Amadey)", "value": "4495780ea31862676766bce8ee4a0ffd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677879906, "uuid": "ca0749b2-87c8-43af-a607-3d3ccc63a0e4", "comment": "Malware payload (Amadey)", "value": "ea7923417b3cc0114c8c46cef7e2a797eb2ee978a0350a0d95a784ff151ca0f4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677879906, "uuid": "29efa12d-f707-460e-af54-320d5c2a6ffe", "comment": "Malware payload (Amadey)", "value": "0b19f7929f5fe1c36377e22ca66123dd45b19a3d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677879906, "uuid": "d6bb127b-2415-43a3-b7d7-b64dfdd8a976", "comment": "Malware payload (Amadey)", "value": "18df9b896be743b3132616b4e509ccffb5a497061944562a5c569b6ea5aa76d699b29b7a44f09ab6c9dc4d2fc123c1fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677879906, "uuid": "87ee2be0-cc08-4f6d-b2dc-936efea71a15", "value": "T1D934CF2175A0D071D59B81749474DAB82A3BBCB26A64C58F33183FAF2E307D257A6F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677879906, "uuid": "f74a3623-cb8d-47ea-bb5c-be784b20efdb", "value": "338c60e12bfd108b93a60e97ac446d6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677879906, "uuid": "2ccaff34-b614-42ae-8df7-e445e251df4d", "value": "3072:WuWO3eHLsBDCn4VvS+CPLGnaTgxnttSPLIoDk91sTI5Bulhio:n4Lrn4SP6p6MoDkfsTSBuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677879906, "uuid": "d612db04-3d74-44a7-b5bb-05e0ac3cf4ea", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677879906, "uuid": "26fc90e5-bf8b-46d2-841c-1d3a6a21a52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677879906, "uuid": "1433a847-dd6e-4a88-a84b-7fcd828be631", "value": "4495780ea31862676766bce8ee4a0ffd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0c72c0-b9e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677863136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863136, "uuid": "be9909e8-29f9-43e8-bab0-612f9050b267", "comment": "Malware payload (Amadey)", "value": "60ace299323eed3a7ac088224e8f0b25", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863136, "uuid": "1536c43b-f19d-4f08-b79c-13155b37c289", "comment": "Malware payload (Amadey)", "value": "ea99bbeb0e815402ef7774e23da24db4239e96da2bf4fa39be6e7305cefe2a89", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863136, "uuid": "0bd1523a-e026-40bc-aab9-a27da9ccf087", "comment": "Malware payload (Amadey)", "value": "d38f59c4f01188276303d70f1fc63cef85cbf8d2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863136, "uuid": "f8dd4c3a-f8b1-4844-9960-3cec9bb06d84", "comment": "Malware payload (Amadey)", "value": "bc87b0e44b674754441425aee17867c3fc01564dbd4a63a016b341636a9a8e452fbc6f56b02ebe61c5fe62fff92003c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863136, "uuid": "8bd78c0e-fb65-4a74-92a7-a8c3edca0f41", "value": "T19724BE31B3D0D831D0621531D97196B5663ABCB36D7498EB37983B3E4EB02D08A6E367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863136, "uuid": "b40c3e3c-ee0e-47b9-9adc-6fd27be11685", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863136, "uuid": "743b0f2a-6dbe-475a-bdc5-1cb6eff47fc5", "value": "3072:j4Cct4UOUAZsSmGr0wgmUq4xPKs08v+YFw1lbCBtgBHjsJ39jAXPSQ:sttsU4sSmE0w2otA+Uw1lbCtWHjM9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677863136, "uuid": "86c300e8-a094-449f-a719-caf07a12a67b", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677863136, "uuid": "f803a0ec-a34f-46e1-8fed-900ff4e48c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863136, "uuid": "22b1273a-ef28-4049-8d83-1e08504f59f8", "value": "60ace299323eed3a7ac088224e8f0b25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b0793f-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677845023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845023, "uuid": "eba04d76-8087-46a1-baae-0beff0a721e6", "comment": "Malware payload (Mirai)", "value": "9b3749db7ca8d208b763cd53b60f9bfc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845023, "uuid": "0a523723-dde6-4167-bfdc-a41543af3031", "comment": "Malware payload (Mirai)", "value": "eba35add414dde79f426951427527323a0b178bb888ecedf80d5c5c5d41b7022", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845023, "uuid": "af242dec-9618-4629-a869-3e4fad7f24cc", "comment": "Malware payload (Mirai)", "value": "8f39c77cb70f35a1024e8e318ee31b36a9febf81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845023, "uuid": "cdc0d0ae-62d0-48e4-967f-6fefe188f53d", "comment": "Malware payload (Mirai)", "value": "aa43ce52319dd52a5a1975bc27b44862038733d619ffb8980b6720cf7f643c64906fe68f50c0d9ff7464feebfd8cd50b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845023, "uuid": "5c90f509-62f4-46f6-8a71-b457784e3bd6", "value": "T15B632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845023, "uuid": "9af02d3f-326c-4685-9cf8-42248f966131", "value": "1536:ONKlxkmiig51kRmO//kWUzrWiAsDwY8rNRuVAvvWA:ONDWzk13WiAsDHaJv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845023, "uuid": "3b37ec3d-e7ce-420c-bdfc-520cbf5e3c4a", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845023, "uuid": "7f266a37-8fd5-47cc-87ee-78929fe8c605", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845023, "uuid": "1256d92f-31db-4107-9255-9767af8fffa7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa34be8-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677861582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861582, "uuid": "b6ec5cfa-35d9-4d67-9133-229da2bd9d7a", "comment": "Malware payload (RedLineStealer)", "value": "dc18334f283313cac17328141bd46a6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861582, "uuid": "1243f346-41e4-42ef-9573-febc78dea9b2", "comment": "Malware payload (RedLineStealer)", "value": "ec22c58ee58853b9c8093a4fc48505c00ca3da534edd942dc90615263a7a8c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861582, "uuid": "b2e19551-e1e4-4f9f-aa19-1aa4517aee4d", "comment": "Malware payload (RedLineStealer)", "value": "74b872180fa04356567fb4b4b141aa4258796f81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861582, "uuid": "24afed89-4da1-433a-9911-7e0c053bd7b6", "comment": "Malware payload (RedLineStealer)", "value": "3e496d81a35a2973683767a802d2705f10ecda1d6b7a12236199f158913f695b08c42faae029ef9592d2e3ddb528cb44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861582, "uuid": "6a9b866f-be1f-4bdd-b766-b4f7782f482c", "value": "T15A64F13072D0D431D2721A30ED74D6E46A2AFC626D78459B23A83B3F5EF02C19A7D75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861582, "uuid": "ddcc6102-6981-43a2-8dbd-479d5371e438", "value": "76cdbf777494f5c49310ced09b70cdce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861582, "uuid": "472b2bbd-941f-48a4-8ac3-0552c0a6f861", "value": "6144:+uxRUH8xaZfBoTYGXzJo5Lix+XoiXjE5H7eNqgYyDOjDawGuj:+ux6JZfSTYGDqddYDh3jGw3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861582, "uuid": "7f74cfe5-e201-4bfb-ad93-a15fdc8f04d5", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861582, "uuid": "0aaaf387-aa2b-4066-98bc-50adfa0928b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861582, "uuid": "13138c3b-581a-4f4f-a9f9-2113b05c867c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bbc2de-b9df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677860512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860512, "uuid": "2a9f83be-3ae8-42da-b39c-e4a04c447b41", "comment": "Malware payload (Amadey)", "value": "52c4efe2e9874ae007559b33196975c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860512, "uuid": "446b7113-301a-4613-b5ae-016ee2556c17", "comment": "Malware payload (Amadey)", "value": "ed18d115d0cdc3e2a1231b05e5726a80c0212bba1a7f042a19835a22d7b39f8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860512, "uuid": "3a92f425-8dfe-4a8d-bf4f-3edcd37022ea", "comment": "Malware payload (Amadey)", "value": "933969c47bd39545d9b54f1fae625f2dac43d671", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860512, "uuid": "c9ed9f90-f878-46b0-abc2-bfd8c4c694c2", "comment": "Malware payload (Amadey)", "value": "b56ec1821cee93e343b139ed59e7d1f9381e27a910971b29b3e7f7b45a1054f4f9c43d18e294509e3d85e2f548265211", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860512, "uuid": "3d2a4ecd-48b4-4fe3-8df9-5d9de87399b6", "value": "T11815120BF3E88036E5B057701CFA07D70A397E521F7413AA274E8AA52CB2764767536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860512, "uuid": "1612513c-be4a-47b7-a775-bd1c87c5a953", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860512, "uuid": "7471df65-4b47-4fb0-81f6-eda1d3198009", "value": "12288:oMrqy90fuVe4O8WaWWBQORuFUSQYZXZ5zt+SSLj5bwzz04P:iyXVejDSnEFsmB+BL9bO0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860512, "uuid": "cb2ef0c4-5266-4857-8577-c6bf321dbd63", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860512, "uuid": "d0d4b14a-f2ca-4fe4-a327-3a533760222d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860512, "uuid": "b496f4d7-b973-4b0d-90db-d064a0288085", "value": "52c4efe2e9874ae007559b33196975c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed31a4e-b9c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677847434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847434, "uuid": "814c433b-4971-40f7-bfd5-e5c7839155f4", "comment": "Malware payload", "value": "87f20d1cabcbb993baa2a4f9ee4c5faf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847434, "uuid": "22bbf126-89b7-43d1-ac22-663ce52d8739", "comment": "Malware payload", "value": "ee378454302fbafd6ec1de98d3c0bf3416caf0139498fe8999c5c05fcd7b3274", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847434, "uuid": "9e6144a5-b59d-450f-b003-5720542f960a", "comment": "Malware payload", "value": "6dba60c4dcace69f50a2af5956925652d581811f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677847434, "uuid": "ebb5316d-0414-46fd-ac2f-05da8632f64d", "comment": "Malware payload", "value": "b2b93a6ce2da3cabf0c79e17ad2bb0284141314ecf452790225b2afb2c7aa425cecb1f2a5092f2fe7171f0c811b9b1bb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847434, "uuid": "d21b0a92-3355-4573-b317-d9846a283fa9", "value": "T13F83826EE34F0528DF55977B434B4E4A56BCB22DB38140B138AC973437ADC2E46629BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847434, "uuid": "37e4fde3-b91a-46ee-9e69-4794dd0f1b58", "value": "1536:Rf0Xvx3EMcjEsq1pUIL1sqCub1jie9SChqKo8yrayKYqnsvsM6k8q68duT4n/nZj:RsXvKMcPipUAa6jiKhVo8yrkPM6k8q6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677847434, "uuid": "d4c6b3f8-5016-4178-8ffc-386aea818f89", "value": 81978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677847434, "uuid": "f37e71f4-8b98-450a-bad8-7033597448d0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677847434, "uuid": "2c8cb250-40fa-4df3-9b96-bba611b92408", "value": "SecuriteInfo.com.Exploit.RTF-ObfsStrm.Gen.25298.5031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb7941d-b9cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1677852477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677852477, "uuid": "76c6414a-49ea-453e-88bf-cc4c4b286426", "comment": "Malware payload (Loki)", "value": "e2026d3dd0eee3534d1a513e8ee851e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677852477, "uuid": "4581734b-a80d-453b-a79d-83aff7d4ac3a", "comment": "Malware payload (Loki)", "value": "ef683b83b977511f40064d0b2b35c9147c5eb3b0b54fa538be2147fef93b3089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677852477, "uuid": "ad5473d0-e696-4441-a853-63a33923c765", "comment": "Malware payload (Loki)", "value": "7b17b66e1a6d02f7d43aa3bf96efe70fc055ee96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677852477, "uuid": "5a41a734-e959-4ad3-8017-012fb18444f6", "comment": "Malware payload (Loki)", "value": "8e7eb1621d207c64375fc6f79ed3ae5b75a6457f8d49e58976bcc0904926adee97d5ef1643cb238b4e5b1132e3207af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677852477, "uuid": "3f0486ad-0ead-4692-a809-be8609770cb7", "value": "T16935652809FC0EF28571F1FDDFE4E753BE8088E6AA049D9982874B89551395720AFD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677852477, "uuid": "8a1de212-e9f1-4986-874c-3495a95ffa48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677852477, "uuid": "5246eb5e-950d-4e05-bfa2-fc430f6172f5", "value": "12288:cIK05eu/rryhj0qj4l04GgatYi+1wppSsuEkDgDSiXbnFrbsVZPKXM2u:H5ethj0q4mgMMMp1udDXiXbLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677852477, "uuid": "81a1c522-7095-4f50-82de-daa0e6920058", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677852477, "uuid": "08ef559a-aa2a-4431-9a39-066f76e6e51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677852477, "uuid": "aa05e2cf-86ff-4bee-b0ea-3901c2f8dfa4", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b69704-b9b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677843156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843156, "uuid": "3556db73-2083-427f-9e00-f186727bbc05", "comment": "Malware payload (Mirai)", "value": "64eca7251b38e7445570a226fe8218ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843156, "uuid": "bba7e777-df78-4ebf-ab62-2f8caba11690", "comment": "Malware payload (Mirai)", "value": "ef6c9135de961b9d1affa44fe29a5350fa3fd702d2913402badb7fe7cc54f2d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843156, "uuid": "4dee22fb-9f01-465d-a544-a103d44ec103", "comment": "Malware payload (Mirai)", "value": "5f5894a46b6d60d253d59ceb117e8ed57eaf7842", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677843156, "uuid": "f031d951-edd8-4ce7-a466-4c2ac935b329", "comment": "Malware payload (Mirai)", "value": "a398b64b72aa9eca6ae00acc7f738cd82a6d1557477982e783bb3eec384a89ab2b1f8dfb7fe82de31367224aae610cb3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843156, "uuid": "d4932eeb-a759-4bb8-b962-84bc7dd34781", "value": "T14D436BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843156, "uuid": "e1d91df2-650a-4a5e-a18a-8ccfa7b6c96c", "value": "1536:JeESt/basV2rcZhG6ySN7nadRe9xzWOIaEjrqMxs:JeESt/basVTgS7nadw9BtXES+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677843156, "uuid": "ce0019a3-6ed4-4d51-8369-b4960f2a3edf", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677843156, "uuid": "e36f8b14-c0e7-46ba-a0f7-9790106fbcec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677843156, "uuid": "8d877ee9-1b74-4b03-86e6-114e206e5d9e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6845aa-b9b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677844206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844206, "uuid": "e2e6221b-0b05-45ea-b5ae-0858b652c916", "comment": "Malware payload (Mirai)", "value": "9b80ebc1c88931aa24fee4560e63bb69", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844206, "uuid": "6a72dcdd-6467-4de7-bb96-0be0c667530f", "comment": "Malware payload (Mirai)", "value": "ef7fb7b581d0e62e422a8f9b806b0369500e9ae4c1856413966e8516ecf1febd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844206, "uuid": "a971c73a-44c8-4015-9ea5-0823bf3972c4", "comment": "Malware payload (Mirai)", "value": "8f220bc52bd0eeca0518ba7d0a7f8abf54399a9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844206, "uuid": "857e3f02-2723-4274-9222-8e3981023531", "comment": "Malware payload (Mirai)", "value": "46d1e988bf88f78e3dffc76cd9aa3a79f6fc13228a3c315212c3d86f9fef22e36861e03bfa3d9628d1e574150eac507a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844206, "uuid": "98262b5a-0c42-4fec-9e87-39de143674f3", "value": "T1191318C4F553D9F0EC5A06703076EB365E35F1FA222DE553D3A5DA32BC82602EA0699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844206, "uuid": "24786889-b964-4986-ac56-19cf51ac7868", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenzgq8uDOycM3U95VlVs:YYzs8ssGfrRI6aVnEeMWOrMErVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677844206, "uuid": "056b4f0c-a598-4c9a-abcb-3158665fed1c", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677844206, "uuid": "3102a574-0949-415e-b382-386c98641a67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844206, "uuid": "7a0f832d-03cd-4bfb-8fb7-68663c240e01", "value": "x86-20230303-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a0493e-b9d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677854697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854697, "uuid": "64ad1b2a-5954-4937-8c45-31bb29ac9219", "comment": "Malware payload (Mirai)", "value": "f829668e9b412ac2f3e1eaa70f098587", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854697, "uuid": "3bc043c1-0bd4-4c38-b2db-093c2dffa23c", "comment": "Malware payload (Mirai)", "value": "efb9694b4fc21234c5b2a1e93b2095f17b05253cca6a529b7edde47f0281a2a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854697, "uuid": "a2de2b38-a567-42ff-9c63-c617721ddbce", "comment": "Malware payload (Mirai)", "value": "8b7b1d94427acc4d542eff6860d837751d342f99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677854697, "uuid": "e7d37632-f19c-4abe-8755-bb69e899d45f", "comment": "Malware payload (Mirai)", "value": "d9c90c8f5b6f22b569dc44d753ba91ba85e116b11780c980610130869083d4c434e3745cb21d31dd6ef3fc08b9accd0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854697, "uuid": "65fee6f2-9b4e-4bf8-a22d-f6164a7c38c6", "value": "T13B634BDAF801DDBDF81BD77A4453090AB630F3D512830B366397B9A7BC721A91D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854697, "uuid": "2154b309-67da-4f69-a819-1697bdb0446c", "value": "1536:nYwtYY1wDVDYHJu8VBfy1MxeS3VdJTbAdhmq5QnN:nYwYYmREHJ3y1meSV/vq5WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677854697, "uuid": "0f88bffb-0fac-4ad8-bd02-ee0929631199", "value": 69640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677854697, "uuid": "116c40c5-d025-458e-a954-db03f6d1b184", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677854697, "uuid": "8a6a8039-6fb5-4c48-a6c9-428465b3b097", "value": "f829668e9b412ac2f3e1eaa70f098587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea38c39-b9a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1677837233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677837233, "uuid": "90651b38-b27a-4674-9d67-6f730e42be49", "comment": "Malware payload (RecordBreaker)", "value": "57847a6fbf5deebb1bae95059cdda7bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677837233, "uuid": "0f83be2a-441d-4554-b609-f99cbcc11c87", "comment": "Malware payload (RecordBreaker)", "value": "f0d2f53674927b3aec2328a1aa82b78d603e55a7e2e5d41bff6a195e3540b343", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677837233, "uuid": "99ac447e-a99c-4ca8-9b88-8e28ea64f884", "comment": "Malware payload (RecordBreaker)", "value": "b16412cde7260151ffd269f75aa4288b649a6468", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677837233, "uuid": "2d6a82e6-6ffe-475c-aa3e-59b9cf032613", "comment": "Malware payload (RecordBreaker)", "value": "faa1572bff8348b2ea3874703e9f852d2291c2511325300ef1082f61802c3eee985e41df4dd2cb9bcf882b4b9953e315", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677837233, "uuid": "ace62f8c-dac7-4b83-88d5-cc43c82a80f8", "value": "T147B63313B5151881E1F88D3B5127BE6431BABB7F9644B87831EB3EC91A37A90E911F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677837233, "uuid": "b2e06375-3588-4687-b882-1e88c00ef527", "value": "16cf5db3878b2dcf0f97ac9d337625cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677837233, "uuid": "8733818d-5db4-4a0c-b96d-a499e07b0efb", "value": "196608:1F9Uor/29ppdevu9XpU1HBv2Gxoz8LQnv+HGRDeQEUU3JwomFKDDm1XVSVyEb:1Z2DfevwZU1HlnOMQnv+HGD9nomFKDco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677837233, "uuid": "802a4d6f-4ec5-42a6-96aa-e56882ad3f0e", "value": 11058176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677837233, "uuid": "1f85b337-291a-4916-9f8d-a3cba0caf7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677837233, "uuid": "cce3930d-851c-43c8-99a6-8a615921d66b", "value": "57847a6fbf5deebb1bae95059cdda7bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2eb030-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677845019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845019, "uuid": "09b6210f-2bcc-4a39-9f9d-9c9d5a05d8be", "comment": "Malware payload (Mirai)", "value": "495c99ab0f6533df13addb34fd3b984d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845019, "uuid": "c43eb6d7-ae0e-46c5-9115-c459e07fb335", "comment": "Malware payload (Mirai)", "value": "f0e245c773eb874f1a42dcff7a165842794df134ccd2013664b002d6bd8937d4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845019, "uuid": "ca647b60-99e1-42ee-a1e0-ded7d50d8fc1", "comment": "Malware payload (Mirai)", "value": "ce3519dd264f66ead7b4f2378a8a22420f0d1cb7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845019, "uuid": "c2918624-8b58-4c3d-bf53-a9279ed4a019", "comment": "Malware payload (Mirai)", "value": "c8b428d89499414fee87b7bbddc5cb422750ca74ba8f0fa167ed6ea9a7ebd2907cd27b0a1109d055f9376978587ba87c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845019, "uuid": "417ee1d0-7868-4e20-985f-39cf25e7ec67", "value": "T1DCE33B56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8279B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845019, "uuid": "e5777c3b-41d1-4fb5-bd30-c789bd0dd19d", "value": "3072:CJLce3pC5mC7/abHbz4NpaIJ8VIJ1FDUXkkTM/9cHMY:CJLceu/abHbz4NUIJxHDUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845019, "uuid": "8737fb70-1454-4170-8d51-cb2aff6e06b7", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845019, "uuid": "03e95856-21b6-40b5-8b6e-13b07ae043f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845019, "uuid": "4f457134-62c0-44ee-96c3-abcc345dc59c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c879a0-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677857373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857373, "uuid": "1c2d9368-386e-4e2c-97dd-8852cd3d9a17", "comment": "Malware payload", "value": "2892a60091e442d90ead2d849d0b7109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857373, "uuid": "cafd1093-ea74-4afe-a92c-e1dd37db9891", "comment": "Malware payload", "value": "f1012d38da33a8fcc6efc14420e7f932ef148ae7c9f54f703fa6498cfa2c4616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857373, "uuid": "ac73b88c-f780-43e3-b8b3-d8e1836f9658", "comment": "Malware payload", "value": "a112be8f4959c85d4757c69aa9191a00a3a3cf8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857373, "uuid": "619c575b-b1af-4635-af75-dccebce39af0", "comment": "Malware payload", "value": "f71e9fe77f591f741de594b7aacea13f765c7d0716d9030f9f4fe819eeac495007eb47b7f63175b58acdff34b611865f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857373, "uuid": "f9c8873a-23cf-40af-bd8a-b5a1b63afeb0", "value": "T1FB56335E099EA4F1E5DC687C9207FCAEBD77CAA65DD07938F2C45E8A7013C2D401A983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857373, "uuid": "116f04d0-b72a-4503-96d4-12cc76dc5b77", "value": "98304:jJTiCStngZltU3rqWiezLkEz53aeaMLDyq5ATov6l4ps16dynmcB44Uh9GU5DuXW:jJGCb2rqWikLkEbB5ATova0s16dQmphf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857373, "uuid": "ce162d83-b5ff-4f59-a030-5774406ebb07", "value": 5953906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857373, "uuid": "f977a68b-e68e-446d-9e07-ec418ca6918d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857373, "uuid": "6d46efe4-97e8-4194-8acd-54de670b7571", "value": "2892a60091e442d90ead2d849d0b7109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30a7068-b9e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677861937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861937, "uuid": "40eacb93-2216-4a0e-b3f5-ff024d5e51ec", "comment": "Malware payload (Amadey)", "value": "13eb66bc2ffbe7745fa348ccbe36a0ed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861937, "uuid": "35341165-afd6-47dd-b0c8-c8dfba93acca", "comment": "Malware payload (Amadey)", "value": "f2e2106400dad8b3af634632348d20f603dff9b525c49433d9ff920b0eb4344d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861937, "uuid": "5bb1b9f0-474c-4fbc-8261-f8d92d954fd2", "comment": "Malware payload (Amadey)", "value": "8b5aa25964327cdc9040df766631fbf1483b67ae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861937, "uuid": "ffa0b3d0-8b92-46c9-a215-6447cbf1b2cd", "comment": "Malware payload (Amadey)", "value": "78beca96efaea5710a1d8a66441eb20ef8f58a94586e2141cb89e0d4e5539eecbba3a24adc70cdacd0a1c16f2619a9c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861937, "uuid": "f68e46cb-b2f2-4f2f-8f7d-68ee432b05a3", "value": "T1FA151217A7E88531E4F0573414F702D306367D516BB8A7AB268EBD2A1CB73A1A132737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861937, "uuid": "573477a0-5b18-4fd3-b92d-247f6a20f043", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861937, "uuid": "c68159e9-00ca-4cbc-bf5c-463ac4fa9c79", "value": "12288:kMr9y90xInjHtHdAl8zQtTDMr+OFlt8RYFbqQYZXvIH1PJKO2VlvqhyMlNcmUG:BySIDtHWmEarZYCF1oCN4OaDKsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861937, "uuid": "f2b573d5-e837-461c-bb4e-0fa6c566041a", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861937, "uuid": "266dff86-2c38-4bad-9205-9b72f347b81b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861937, "uuid": "20751cce-afe0-47cd-90a5-e2f587d609c8", "value": "13eb66bc2ffbe7745fa348ccbe36a0ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a63c551-b9dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677859641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859641, "uuid": "7de7f04e-17d7-403b-bd63-94a37f9f1924", "comment": "Malware payload (AgentTesla)", "value": "62370848316391d0345dff06b8ef8683", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859641, "uuid": "c50b14ea-02d0-4fb4-ab67-948dd7ac0aaa", "comment": "Malware payload (AgentTesla)", "value": "f397c59849d99adedf2ccdc9691ebbdc941ab65523a3a8ca43c2f75e97f857a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859641, "uuid": "64badf83-ae05-438e-b482-be00ffd7de4a", "comment": "Malware payload (AgentTesla)", "value": "b96807a697717186481c725b2dbc553ad7c2c8d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677859641, "uuid": "4c81f733-c526-48ed-808a-2604100dd58b", "comment": "Malware payload (AgentTesla)", "value": "43174d6ab443e96f66554c67f44305af4f136ff8de4a6425b93a265a091d3bc6d2dc73002f9efe6db3d6211a96bb42cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859641, "uuid": "f2cac643-aa55-4504-8cf2-cefe3e26cfca", "value": "T16B2423C8D2AA83DF38BF8A45B4521797282C561976A6D87D79933ED2296CC01C343DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859641, "uuid": "6984ebea-8927-47cd-82ff-4d1443ea0848", "value": "6144:jxyd1lQ3nfwAE+lsJVWCbBPvBY/K2zZM4UxcaEI:jURQPnlXeBPvbiqFEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677859641, "uuid": "6065edf2-4784-4db0-9bc1-83bf2278a258", "value": 217424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677859641, "uuid": "f0523909-ffc8-4019-b9e1-c0bc842b20c4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677859641, "uuid": "fb30238a-c7fd-4a42-8c10-3387ba878456", "value": "dhl parcel information_xsxl.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a235e0ed-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1677856701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856701, "uuid": "dc6107c7-c335-4d39-913b-0df89456bc87", "comment": "Malware payload (Stop)", "value": "0ef58a88d61923cb849928dacba896fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856701, "uuid": "75c875d1-ead5-40a2-9f2f-6d866bc6493f", "comment": "Malware payload (Stop)", "value": "f406729f2fd281dcd032c9f2d4df98f19364253c0beb771b62e7e72aaba6f63f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856701, "uuid": "05c54d0d-43b6-487f-9abd-343f0d5bfa32", "comment": "Malware payload (Stop)", "value": "0ec26137cb58c38270ab84322e981b5c28918f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856701, "uuid": "307f30a4-1f8b-4575-8652-cd08bd070213", "comment": "Malware payload (Stop)", "value": "7687898675abf690718a2f5e5929fd111791ff3aaccf540f6887568af8b4762f9da88e13c184dfe680aaa6778116e8ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856701, "uuid": "a8a9b313-64d4-4f73-8607-a8725ff47d47", "value": "T18F052221B9C2C032C54B0670AA21D9E59F3DBC75B5268CAF77142AFFAF70B915B5A301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856701, "uuid": "fd8dedd8-7ce8-434c-a09d-bea5bd4dedfb", "value": "0f8de239eb0453698a5eb1819d70ef21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856701, "uuid": "428faa61-abab-414e-aa4f-4c9f62885f83", "value": "12288:52JCBGPfKrcBHP77UzojgAp7o2piIKoQQ2gri3wBemdFvLu6M4u4XnO0uXt:8CBYfbxGoYYvswpekFvL5M8XOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856701, "uuid": "446fc805-94cf-4756-9d89-553ab98d0ac1", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856701, "uuid": "604460f4-c5c5-4d0a-98e0-c3449fe5de58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856701, "uuid": "065d8eab-46dd-41e3-8b7c-eddc81b30a91", "value": "0ef58a88d61923cb849928dacba896fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c898ed-b998-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677830125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830125, "uuid": "fa5e25de-fef3-4548-8f43-9adb51f95ea7", "comment": "Malware payload (Amadey)", "value": "5535eb8809a27304d4d3557710df2657", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830125, "uuid": "d8293450-fc9c-4665-949c-84d598ae3fa9", "comment": "Malware payload (Amadey)", "value": "f4689213483ad9b6641ab51755d456500e0a017390b3bb36ad0c7377f7cbeeba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830125, "uuid": "4fd3944d-658f-4844-8251-427dbd18b3c1", "comment": "Malware payload (Amadey)", "value": "771d3a4c40ad2b5af4e9ec8867fe80427fc6163c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677830125, "uuid": "4ac04a5b-785b-4604-9e3e-ae0b3d95f0be", "comment": "Malware payload (Amadey)", "value": "4f3a88948c44a2d773b90c491acc432b966aa09ae3f8c3f8fcab346ff4cac802bf7afb3f8181c335724325a858793188", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830125, "uuid": "b2b2bbcb-bd1a-4c59-9b93-8314610b53ca", "value": "T13D151303F6EC8032E5764B755DF313D31533BE740A74A38B274B69AA0CB21A4A93577A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830125, "uuid": "5ff883f4-dd0a-4df0-b01d-2724b65efcf1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830125, "uuid": "96dd7b08-2b33-4cef-8fac-6a2e42a7172f", "value": "12288:5Mrjy90EKoVxn+KORlin9wvdobDOmxtQVMT4FArr7Glf0egVffn9eW:ey/bVoB29wWGmxtQVeX7a0eWff9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677830125, "uuid": "c74135cc-9f50-43f8-b38e-3a395a259ca2", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677830125, "uuid": "cb02861a-e697-4dcf-b71a-0450ec29e230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677830125, "uuid": "77a46758-1cd4-439b-875b-76ebcf476d32", "value": "5535eb8809a27304d4d3557710df2657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ca7646-b9c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677848382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848382, "uuid": "f8e69028-31bc-447f-bd1f-a5747cc47d11", "comment": "Malware payload (Mirai)", "value": "119c6f8aee901a6bf5c4305ce3e6a03e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848382, "uuid": "65a14d7a-906e-4578-bc2e-be6ca8a31468", "comment": "Malware payload (Mirai)", "value": "f498906bcc8ee7dd0aaf043d513ffd7b65658e9acbec4eb6e33cb2d7935eaa03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848382, "uuid": "4d4866df-165c-48d3-8fc2-15fafcd70540", "comment": "Malware payload (Mirai)", "value": "197539896d98fdbd397b5d680dcd3b74a62e3e4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677848382, "uuid": "05eb98ac-05f2-41bf-afad-bf08a654be8c", "comment": "Malware payload (Mirai)", "value": "cc92a11339fedfd9ee646bc66b1e9367134924a6ff8aa02c5bfd3b36ff055dde947fc0268a32f4b0102305653e3013dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848382, "uuid": "1abf8d06-c2b7-4c83-b999-7ca0accfda63", "value": "T1A5633BDAF801DD7DF81BD77A4457090AB930B3D502831B3B6397B9A7BC721A81D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848382, "uuid": "7d318c41-f1cc-4296-9775-ce5b995f098f", "value": "1536:fAgVFJExEm8uDYrly8VhyCO1sxyWbxdJiLU11i+VQWK:fAQFJEOmvErlWCO1GySx/o+VDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677848382, "uuid": "6531aa2d-dbcd-4347-bcd1-1d2cc6509eca", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677848382, "uuid": "af7be069-3199-4595-b456-e858118a9206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677848382, "uuid": "b9ce015a-1d2b-4b6e-8da3-081c1304ff77", "value": "119c6f8aee901a6bf5c4305ce3e6a03e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c8a315-b9a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677834054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677834054, "uuid": "c5f31984-d569-4b53-9273-80b08e1b8ee7", "comment": "Malware payload (RedLineStealer)", "value": "f98df82f0afc60f34816d35c9dd75245", "object_relation": "md5", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677834054, "uuid": "8d1cfc3c-bbdb-43f3-b91e-1c8b94691b53", "comment": "Malware payload (RedLineStealer)", "value": "f4ae47d0f97a500401a1e5a068dbab57dfbd9cdf0ffebae6e730e5cc3226fc2e", "object_relation": "sha256", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677834054, "uuid": "bc8e2d15-109d-42b4-b32f-383d508b6e3c", "comment": "Malware payload (RedLineStealer)", "value": "08955f191ad3053df09d4b7f601b52e7243a4706", "object_relation": "sha1", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677834054, "uuid": "af37382e-97e5-4247-b95e-7a8972b85cfe", "comment": "Malware payload (RedLineStealer)", "value": "81b9b865dbc6008eba0dda16525b1f5d896c9c08a8fce5870a98f52bcaa204a9408c1e37b3ae37454707d8d006327185", "object_relation": "sha3-384", "Tag": [ { "name": "167-235-233-35", "colour": "#3FBD10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeRuneTeller", "colour": "#C1D9DA", "exportable": true, "hide_tag": false }, { "name": "PureLand", "colour": "#498799", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677834054, "uuid": "fb79be82-e070-461b-9a2c-49ec20f283d0", "value": "T138D46C9D2B584A55C35D29BC54E4D0083238E2FE1E458F26751A0EAAFF62FCC7F02D66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677834054, "uuid": "a1bae8fc-38de-4c8c-b907-9b552f35868a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677834054, "uuid": "25e9d825-d266-4c9d-b303-3b98d1964df7", "value": "12288:F6P7l6yr6BCInd92qFfZ0ElbvCJSPypmECG0H6aXYG:wIyr8CHElbvCJS6pmECGzaXYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677834054, "uuid": "ca1040dc-59f2-4eba-9ea9-894b9640a4d7", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677834054, "uuid": "dd558ddd-222b-472f-8b42-a6e7455b2cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677834054, "uuid": "306806e0-2ac6-49f4-8497-58b750d67a32", "value": "pureland.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea09cdae-b993-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1677828045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677828045, "uuid": "17482c0d-fa41-40a0-b9ec-f417c7154186", "comment": "Malware payload (Gozi)", "value": "05184a923b8743256e3ecd9aee4699e7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "BIG", "colour": "#84CF18", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677828045, "uuid": "905ca5c8-b178-4355-9682-6919dd07d636", "comment": "Malware payload (Gozi)", "value": "f52c313277246ccd81420797967aff0a7353fe0f6badc77817e842120072efbd", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "BIG", "colour": "#84CF18", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677828045, "uuid": "66c4a917-2a4d-4cee-b45e-9dcae53ebd9b", "comment": "Malware payload (Gozi)", "value": "bf55c4fee9e68c74d42d3c6f26c0f80fb38cd272", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "BIG", "colour": "#84CF18", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677828045, "uuid": "cb963159-fe49-4c04-9fbc-190406bfad20", "comment": "Malware payload (Gozi)", "value": "049569998271d97f58437f658e0251561256624db91f1bc381a9d2541b8105f53a86b2ed5ade9dd5629b9c682f13eee5", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "BIG", "colour": "#84CF18", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677828045, "uuid": "25e269ab-6720-42af-8ac0-a575c72228bc", "value": "T1C686335264EA0FB8C96C057D85DB0F5BBA49AF2F5106C31B6366E26B7FF32F46810409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677828045, "uuid": "88ff33fe-c869-41a4-b39b-db8b1df7ecad", "value": "196608:0N6C3K4ZTDbvQMVMdkY6kvtCNTK8v/XbvQMVMdkY6kLjNy:FCfVvQMVV66bzvQMVVEjNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677828045, "uuid": "0e1447ae-2939-4408-8dc6-87c9828372b0", "value": 7930712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677828045, "uuid": "addf1c5b-7bf9-48c9-a627-5e41770f60f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677828045, "uuid": "d68c0a4b-6358-4c68-afbe-66316aad9d40", "value": "Agenzia_Entrate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124fbbc8-b9f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677867626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867626, "uuid": "8a727d85-f5f8-4749-b211-4b1d86b26b47", "comment": "Malware payload (RedLineStealer)", "value": "66156ffc6c57526cd869dfed0359c3b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867626, "uuid": "7020d411-cec1-4d8e-8f7b-1cb307547a54", "comment": "Malware payload (RedLineStealer)", "value": "f5415218fc8f4ad302ac1fa398264047fc94a62be9baee8f57f6527136e4656b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867626, "uuid": "5d905413-91d2-4d1f-88ea-c893fc7e1846", "comment": "Malware payload (RedLineStealer)", "value": "2302a5be68a91e42f15acc4a8b99359046e4694b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677867626, "uuid": "f198cdf0-c371-488b-ad25-268d04121b0c", "comment": "Malware payload (RedLineStealer)", "value": "6b345cd686c98456722234037f4415589f9965648c346e88541750b89532544dee7e2d7496f11acc86d45affe16bf8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867626, "uuid": "087adae4-6bb2-4a5c-b5b3-c85b779fc000", "value": "T1EA45380171F183F3C9630435C9A3EDE7D468A59D46618AA7F3E21B994A38FC17E306A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867626, "uuid": "90c27089-19c2-465b-8099-be129150b4e1", "value": "20db1e79c216f1d522f5cd084231f477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867626, "uuid": "e0a82f03-1a70-4db0-9037-662a3e75c2c6", "value": "6144:gd7iTt9CEG5ze2YAOkKZ3gxSslFiMBSjpPUW/oPviM:xTt90kW26lmMBSjpPUW/oXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677867626, "uuid": "66b07121-b9e8-4fda-9875-c1ed61a16665", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677867626, "uuid": "711499fb-6ed3-460e-8e7e-1f1e14bb877b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677867626, "uuid": "c0c4a288-80f4-4e8f-8b6c-d233180350dd", "value": "66156ffc6c57526cd869dfed0359c3b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e00ec00-b9df-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1677860479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860479, "uuid": "2a55bd2d-f047-449d-b69a-afe475dd965c", "comment": "Malware payload (RedLineStealer)", "value": "b732b35a85892b10b21dc7c22ce1767a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860479, "uuid": "45224e66-3792-437c-8645-8895af280983", "comment": "Malware payload (RedLineStealer)", "value": "f5509b5c387c364d2edd977ff30615b59b54a59a7eb8e9c5e31afc0ebb5cc82c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860479, "uuid": "835e92a5-6780-441a-b5d9-c3d85c5bf50d", "comment": "Malware payload (RedLineStealer)", "value": "b6b295fe130f5a80a011d4e155ec1a10fb7a47a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677860479, "uuid": "35d59cc7-7778-45fa-a2b3-17d8643657f1", "comment": "Malware payload (RedLineStealer)", "value": "dface44b2d03c78b917fe0df88310f81c8959982d3e10382023a65bbca0cf0702389c913a14bd524b4993a865e961698", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860479, "uuid": "4efd8e46-152f-4d8e-b647-7ad6155a65b2", "value": "T1E8151257B2EC8032E59417B428F703D70A3B7DA21B7457AB378E9D591C727A0663232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860479, "uuid": "45b9d3b1-70a0-44f1-bc22-0345c76d9e8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860479, "uuid": "5aa122a0-c57e-4b23-99a2-3aa222f31ac5", "value": "12288:jMrKy90nUZEx5XxkBUyepGRzec5obLmR3FbOQYZXkIlT9hNj31BE69QQuGjIwWYF:1yWUmXKUyrRSGmCdFZ2P31vvLWYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677860479, "uuid": "efeef63c-0990-4d4f-9813-46e9093b4488", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677860479, "uuid": "defcd065-30f0-47d9-b01d-80ed16334a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677860479, "uuid": "41b38e78-79c9-4847-bcb2-1b0a614d198a", "value": "b732b35a85892b10b21dc7c22ce1767a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40ab33a-b9bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1677846933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846933, "uuid": "af17253c-6d50-4e5f-989a-09e9d746f650", "comment": "Malware payload (GuLoader)", "value": "855264477a95b8a5b200fa34cd4475de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846933, "uuid": "6dd073d2-8747-4044-a683-54fef6b7c770", "comment": "Malware payload (GuLoader)", "value": "f56366d49d34179c9e615b0baeea06a94611c30d32697c2e68418c5e30b5eef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846933, "uuid": "a209d264-b3c9-4ac9-b36b-4fe0a53e9a18", "comment": "Malware payload (GuLoader)", "value": "7cabc5ab39cc25e7ab1d95f1d11ab90858478478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677846933, "uuid": "27cf905a-d1a7-4c81-ab00-927ccea0342b", "comment": "Malware payload (GuLoader)", "value": "9ef790be7a2f9fc15314282a9b0ca36dd302fa95bfd2afeeac0e84eed45c9a338c3b5f14e3ab79f313bdcd3af3f69d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846933, "uuid": "cb9f4c2d-e797-4477-bea6-c9d623e527d8", "value": "T155D4F080B765CCB7C9160233C8AAD3256775BC55185E4F2B328DB71AAC332DF3506B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846933, "uuid": "fc7af05c-f425-4f2d-9ed4-59d58a0205f2", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846933, "uuid": "c7fa70d0-c79e-471e-ad01-c1fcb4627d58", "value": "12288:Zf1PcskhY3rRZqJ5kN72K4HqDGosba8FoGBK2+m:oskhMPYzKZaosbaknF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677846933, "uuid": "6943d5ac-61e2-4b8e-93bd-5f2de4068a47", "value": 636592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677846933, "uuid": "edf31469-8d54-4ff3-8a82-e4ed338ce978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677846933, "uuid": "4ed531fd-2842-40c8-b791-8e3ea0addd97", "value": "f56366d49d34179c9e615b0baeea06a94611c30d32697c2e68418c5e30b5eef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97908b5d-b9d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1677856254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856254, "uuid": "826a3c66-21fc-40e4-b619-31d6e6faeecc", "comment": "Malware payload (GCleaner)", "value": "1c74cb1eae8e0f6c96e52d5c99a75980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856254, "uuid": "4c0a3c20-1e8b-4d9f-914c-3660255c483b", "comment": "Malware payload (GCleaner)", "value": "f59c279d16c5ac838ca4c215d68968230f25c221d73ff2bc77b70702130af670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856254, "uuid": "86197d58-d66e-4f23-86ce-6ee448ec1496", "comment": "Malware payload (GCleaner)", "value": "9f80d2276a65418f0333ed897025fd6830640803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856254, "uuid": "65156868-154f-4b59-9573-e668b8479431", "comment": "Malware payload (GCleaner)", "value": "b5cec40d91de67272e5fd3e2877f0a9e7f5ec4151d6620073469b4aaf3baf6c5c777d930f86ece9051dd4344812eb201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856254, "uuid": "63c7c7ad-c5fa-4b77-9bb4-a42b33e392eb", "value": "T1FFC53318A3099C74E4F78F35EFAF090A0417A656CB34E93DBAED86CC175F0429998B74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856254, "uuid": "af726398-63a4-453f-9766-bd372fc57d42", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856254, "uuid": "d4f6eca7-8514-4c41-994f-a4fc6ba8820a", "value": "49152:AG/um+g2M60QEOC9K78vfseZD4g+wwaDBGylJrLbzsQ4a4oSx6Zm4PYOKz:d/uy2T06C078vftkwPcGZjn3imm4QOKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856254, "uuid": "e6aadd08-ed19-4068-99d6-db001d18d29b", "value": 2719268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856254, "uuid": "109a26c1-a9d3-45a8-8918-e9d6930904bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856254, "uuid": "6aceb60b-ff9f-4fee-afa5-7a5e1a617c99", "value": "1c74cb1eae8e0f6c96e52d5c99a75980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa84c45-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1677861582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861582, "uuid": "a474ef04-2bd8-43a8-a94b-304768651e7b", "comment": "Malware payload (OrcusRAT)", "value": "1531ddf6b03ab9f7b0c46381210d82ca", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861582, "uuid": "559bb99b-1c22-48a8-afe7-6c3e7132d2bb", "comment": "Malware payload (OrcusRAT)", "value": "f5ec9c818e5d515558f479915c1de23c803c55637825c6e8199760180bab866e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861582, "uuid": "1109f163-c124-4028-905c-8a7c74f67ca6", "comment": "Malware payload (OrcusRAT)", "value": "53f1566838a6e380e6f83e256ab7aac1e028f39f", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861582, "uuid": "168d6ba6-a761-406b-b6f2-5c3c044462c5", "comment": "Malware payload (OrcusRAT)", "value": "c83efd78ee0ecef2ec35e29de99851bd6c517e5b899df315862023f1f64824850c9f6133bf901b5aa2e4749634e1a5de", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861582, "uuid": "29c847b6-bec3-46b7-aa5d-5c1eb1a30f50", "value": "T1AC15CF013BACBD06C1BE7678B7771AC90FB8E8066052FB4F085861AD1D9B741BE1536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861582, "uuid": "1cfe1719-3c1e-42b5-8210-081fb8251002", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861582, "uuid": "68676593-5362-4544-8b35-5ac41a616320", "value": "24576:ZVWC4MROxnFD3kw8XlrrcI0AilFEvxHPMrooG:ZqMiJorrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861582, "uuid": "e10c932d-fc3b-4185-95ca-58402bf52429", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861582, "uuid": "7863580d-6cee-4b88-ac94-66641ea0ec10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861582, "uuid": "b1e2c6ac-52c8-4eed-a29e-bf4ef9a3d9f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1287d96-b9d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677856807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856807, "uuid": "4143b156-f217-436d-ba2a-6f31e06e6333", "comment": "Malware payload (Mirai)", "value": "02b641a03db39ae5ac7634074b32f482", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856807, "uuid": "2634a325-5681-4e3a-91aa-0fb44b4c182a", "comment": "Malware payload (Mirai)", "value": "f64cebef29808ecb0beb645a781a3d6ee0ca78f6147f22b81e4a9e5e9e030d50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856807, "uuid": "e4d147db-b123-4aca-b99a-b9d5c9cd198f", "comment": "Malware payload (Mirai)", "value": "27a7be2e53074a509e840ac060900bfe382c80b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677856807, "uuid": "f4e2a4a9-65ef-4dd4-b503-7d9b0a9fcd73", "comment": "Malware payload (Mirai)", "value": "8057d4d2d1e19d67053b7c356d8097d834a2940d5593f707fa732ed979691bce3dcad5be61e08ce85e0ee21a8175de62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856807, "uuid": "e191415b-076d-4ce2-9c86-8e70019760a3", "value": "T10D436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856807, "uuid": "3e4ecc34-6a4f-47b5-970e-89d391e75d0e", "value": "1536:JeESt/basV2rcZhG6ySN7naeRe9xzWOIaEjrqMls:JeESt/basVTgS7naew9BtXESe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677856807, "uuid": "1190bcba-b3cb-4d45-8124-de4595377bc1", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677856807, "uuid": "022a61ec-abdd-4925-aae1-b15b94639d04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677856807, "uuid": "0ef099d0-f149-4d21-af8f-b6705fb01d2b", "value": "x86-20230303-1520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0356fe58-b9e7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677863736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863736, "uuid": "439125c5-6635-4c5e-9fd2-99535f658e1a", "comment": "Malware payload (Amadey)", "value": "e9fa61e74c2a02293a2e283af1bd7398", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863736, "uuid": "319a3a31-ef8b-4a98-a0e3-0ec796398dbf", "comment": "Malware payload (Amadey)", "value": "f668050b3c243844ae955da370feaba2d358349d4e5b4ddec41420fb60efe98f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863736, "uuid": "aa757841-a6f3-4f61-b05c-3bcb31df309a", "comment": "Malware payload (Amadey)", "value": "c64c9bf525f9f81ff1756e634bc725d172614188", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677863736, "uuid": "4323eb00-b2f7-4027-8971-c9763fbc403d", "comment": "Malware payload (Amadey)", "value": "01c5f7575686c9b1391dd96bab558fcd3e123261052ae741c12152653e06d4a9c7c86ef387fb951d87f82b808b5b89e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863736, "uuid": "cd7d25d7-a419-4872-bacc-826fcbe48b2e", "value": "T1E215120BA6DD9026D8B15BB059F342C30B397E605B3CC39A638F9A5B4C725E4763076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863736, "uuid": "ead50212-68fd-4749-8e51-11e47956280f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863736, "uuid": "5663cb06-4539-412a-8782-17415f42400e", "value": "24576:HygYrR1LHp5O2/cjHBfzAO+1lx2m7xZq1btaeaB+sB:SgYrXLHpI2/cbhAdjxXvaaeaB+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677863736, "uuid": "7c6eddb1-695f-4781-bdae-15da01662ec3", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677863736, "uuid": "65bf44d2-a4cf-4931-8e57-dae91be8ca0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677863736, "uuid": "2d0c46f7-689a-4d6d-a56d-2d67db3c23ac", "value": "f668050b3c243844ae955da370feaba2d358349d4e5b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a892767e-b9d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1677857571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857571, "uuid": "855dec5e-2602-4436-bde0-2124e29fb6a1", "comment": "Malware payload (Fabookie)", "value": "6205d4c638c5c3434491477ca9eac840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857571, "uuid": "a51fe49a-c806-4a58-84ec-0cffee214fa7", "comment": "Malware payload (Fabookie)", "value": "f68ebaf0cd8b7f5aafa28b0f39d47f41acdb4342de973d87e189064f75d1ceec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857571, "uuid": "05bfa27e-5699-4d43-b08f-9f11021b1420", "comment": "Malware payload (Fabookie)", "value": "e830bf643a58171c2ff99b2a90290762e17158f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677857571, "uuid": "89520569-3ea8-4f69-8bcf-5677fc158f9c", "comment": "Malware payload (Fabookie)", "value": "826b2b8b5b6cad3d28c3686b1a874d4c981c7e7da3d13581be6deabd3d254686adfa304613d600df66f2b0a1daf698c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857571, "uuid": "724bb789-c52d-4211-8798-9b6b71a7ea11", "value": "T134A41819FBB448E0C196C635CDBE827BE272BD830A15930B4255FF9E3FF351069A9681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857571, "uuid": "f45eb5bf-6426-423f-9b29-893e21d802ec", "value": "7bae02ef14998d8530ddf0278301170f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857571, "uuid": "a62fe04e-62a5-4e15-ad2a-4150602eff7a", "value": "6144:C8aMyDtA083XIMxEZ/mRfhTp+e5t5kkUgRGerEhgVIXFML:C5GIuEZ/mce5ZaerLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677857571, "uuid": "6da20974-ed2c-4c16-b929-667ee4badb12", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677857571, "uuid": "c239589b-1bc4-458f-a7f9-8e3e641e852c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677857571, "uuid": "f48c71fe-9099-4d0d-99e8-7e21a772da60", "value": "6205d4c638c5c3434491477ca9eac840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf56145-b9e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677864636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677864636, "uuid": "80a2209e-483b-47ad-917b-d139a5b3972d", "comment": "Malware payload (Amadey)", "value": "6b9db657d7214fdd80e815f12100d044", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677864636, "uuid": "c75292f3-f9b5-4cf3-9e59-7d0c442cb12f", "comment": "Malware payload (Amadey)", "value": "f7cf737c50329dfdb61ba4627802b23db702414a6b651c8cbada0b7904edeff6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677864636, "uuid": "326c4d19-9d0a-4362-bbc0-8f73263b6419", "comment": "Malware payload (Amadey)", "value": "0334a0bf72a1378c06a384186a7e6a65e46835a3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677864636, "uuid": "2f0edea0-08ce-406f-b236-41a92292101f", "comment": "Malware payload (Amadey)", "value": "954aa00343ee9de1678a00112ba399d47f243c6a744069590461295c8a81189df7841c1306a884d74c0df03504ac42cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677864636, "uuid": "81b3c676-6cab-460b-a210-53732cea45b3", "value": "T10815120BB7EC8462D8B91B7018F212D319367DA19B3D93AF228FEC5618715A4B53137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677864636, "uuid": "fd0c113f-c6ad-4507-ba7f-0afb2759ab7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677864636, "uuid": "d8f2c015-b0bd-4f25-ba06-e5dc1d0ea072", "value": "24576:eyAVXAQJBzxtQyOz63mEB2VyuvxPccQ6i:tAxAYBjQya63mpVrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677864636, "uuid": "eb6462e4-f33c-4fa6-9a4a-2eac7d5e473f", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677864636, "uuid": "52052cd4-bbb5-45ed-928e-793b6fe0c033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677864636, "uuid": "9a7a15f3-f58b-4663-b21a-6311f7c1c3c3", "value": "6b9db657d7214fdd80e815f12100d044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0caacbf8-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1677861174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861174, "uuid": "4f292827-6428-480d-8166-0f9ad9d9271d", "comment": "Malware payload (AgentTesla)", "value": "35481161d8208385ddc3c621cd594390", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861174, "uuid": "98178af4-6be7-47bb-beb2-1e8c8f5a00d6", "comment": "Malware payload (AgentTesla)", "value": "faa6f86175e4114c91ed316433bf17223fe06259d58272ae16da4456d24eb913", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861174, "uuid": "cc990e89-d31e-4b31-8722-e3e07a639d10", "comment": "Malware payload (AgentTesla)", "value": "880752ff622835cb179a5eb6ba2300aa60171fc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861174, "uuid": "5a928262-b28d-41d5-ad30-776956d6607b", "comment": "Malware payload (AgentTesla)", "value": "b589b2860d8ed27e01750336d86dfcae80629bf4646ecf7c4c24a11539d3dda7e4a4d576df9ba5eb231f9c295f342866", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861174, "uuid": "efa5b9eb-5473-47fe-9da6-b1d7bcfc8d8b", "value": "T185F42393C44E0DE622E369C26B4F5BBD07339CDF8A9063C57E1FA065302B952D2CD966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861174, "uuid": "13491645-2ee6-4265-8814-0710d71448f3", "value": "12288:ISa++lno6kh+ZyoiXwXc/A1gNmQmGoo9wylm/ac9qBoGbHyJDfR4pZ7QvA/A:kROkZyBz/s/oyJYoGbHYf+pZ7Ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861174, "uuid": "e68ef18b-e3bf-4bf1-a2f5-61f5d805ee7d", "value": 729581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861174, "uuid": "1690d2db-649c-4937-85c0-3d93496bc5b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861174, "uuid": "b6310090-eac3-4b09-8026-79108cd78e97", "value": "TT PROOF(MT103).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494f1e39-b9c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677850539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850539, "uuid": "53e99a77-4521-4dfa-a9b5-5716a2a4f0eb", "comment": "Malware payload (Mirai)", "value": "b168336061f24ff343382e2670ba0e13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850539, "uuid": "acc04a52-74da-4520-afbe-11ef1bcebf60", "comment": "Malware payload (Mirai)", "value": "fb162e85e445a42517c9e5a6be0b1c266264aa500076f05e3e1403368a050045", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850539, "uuid": "b39ac382-bb14-461e-954f-d8833d9e71ae", "comment": "Malware payload (Mirai)", "value": "09ddb1371b2f597baaf530f243b5588e99791de4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677850539, "uuid": "a6bab783-9a4c-46db-a370-b64e8bef3b13", "comment": "Malware payload (Mirai)", "value": "6755246ec05b5bcf5a5214de0dba46c79bfee1dc0f266e1e2a29b5c2716744d79969ae17175fd1b2f88c986c17b743ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850539, "uuid": "4a2d2a22-f02b-46af-aca8-511ea5978e74", "value": "T195632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850539, "uuid": "251e805b-dbbf-483f-90fe-20ee379a41cf", "value": "1536:qNSlxYmii8N1U9uO//kWEjMLikg/QA83NRuxAvjW/:qNnK7ktYLikg//29jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677850539, "uuid": "453ff5fd-ed44-4560-8360-e87e5a68a248", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677850539, "uuid": "bc1c27a1-07ed-4f5b-83c3-6db1ec680c6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677850539, "uuid": "679cfec6-7a73-4327-8dc8-9dcee74d3f42", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee40f72-b960-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1677806095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806095, "uuid": "165348e9-6310-48d8-89b6-904116ddbbe9", "comment": "Malware payload (Amadey)", "value": "737ac114de404ff80e650b5a29858675", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806095, "uuid": "0a645430-46d5-4cf2-a1af-8a8f4d93ecc5", "comment": "Malware payload (Amadey)", "value": "fbb5c00c3c280cd733dd3a470bc22ca33fa961b00c3281f728a09d8172c7db11", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806095, "uuid": "e7e94a7f-c5ff-437b-811f-1919780d0abb", "comment": "Malware payload (Amadey)", "value": "611279c25d09b6b46e7230118072b182366422f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677806095, "uuid": "6d134fc7-9747-49b4-a544-090961781296", "comment": "Malware payload (Amadey)", "value": "30c7a7b6649a165aa45c107f218199dd8d81098321c87b7e0b4f465d0563f0ec45870acfac9efaa7ef4ff0601297c6cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806095, "uuid": "088b506a-bcb3-4331-adc0-222ddcd44096", "value": "T1A7151207E6FC8026D4B6577009F203D31A35BDA06F39839B669EAA5E5C73170663237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806095, "uuid": "6ff84fbf-48c8-4447-b3fb-a391bb2da417", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806095, "uuid": "3686e33f-789f-47bc-b8f3-bae8769004ca", "value": "12288:MMrdy90cckvHWbFCgD/8KCQKzsNH0+2um08DUxCr8hZEDTPFxcAaBy5G9I4Nbhuo:5yfvHCUPJUH0+vm08N8hZE3Pc7Nbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677806095, "uuid": "c7c8bfd8-12de-4497-96e4-eb911d4d55b0", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677806095, "uuid": "bbd1860f-e18b-40bf-9eeb-dc463a9fd8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677806095, "uuid": "317eb2ab-4706-4cad-a715-f8d0767b072b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178253f2-ba07-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677877514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877514, "uuid": "bf82313c-4b4c-4d54-ba8d-391081a5c71c", "comment": "Malware payload (Mirai)", "value": "36b591aa3a5dc87ee5afe410d4411a8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877514, "uuid": "9d078ef0-f591-4099-a02b-706a9805c15a", "comment": "Malware payload (Mirai)", "value": "fc16cd81885ad1a1e6ed8f427d35d0b247a8e1718f05902d2f65a52c6570fda3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877514, "uuid": "5cf9809a-c09e-4052-aabe-031fd00f2eea", "comment": "Malware payload (Mirai)", "value": "817267e3061cc575e8abfefe9a1e21376a655719", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677877514, "uuid": "b29c43b8-5d7f-49a1-a248-51518daf7962", "comment": "Malware payload (Mirai)", "value": "5ba279b4acd825abbd3ab0d7668066eaa2ecb3dbe9cf63f08b2481f384e6a4ea2f085eca81c7e0cb40e9c63822a6155e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877514, "uuid": "0d23a396-a480-4c51-a14c-821e34387add", "value": "T121A2D025D345AEF4DFEF9DA452C2C2C276F587C7278AC8E340EEAF016606046B788D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877514, "uuid": "0dafa22a-4ca2-4752-a94d-375fd40a804a", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5HM4uVcqgw05VxJO:MRxsSVsMD6xiJJE5zRWNW4uVcqgw09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677877514, "uuid": "208b4666-803b-4e88-9dba-bdc08fced802", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677877514, "uuid": "30b80121-d369-49fb-bab4-8b5986e1d833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677877514, "uuid": "ba64dc4b-6587-4991-ab2b-e4e0ed258604", "value": "36b591aa3a5dc87ee5afe410d4411a8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8f40b0-b9b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677844207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844207, "uuid": "8c4fb862-4975-4b1e-9130-7578ce39d2fd", "comment": "Malware payload (Mirai)", "value": "1477482f1dd21c8ae194be26731e7716", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844207, "uuid": "e33b5ff2-96f6-4efa-aa6a-ef564404ddbd", "comment": "Malware payload (Mirai)", "value": "fc3e74d84ce2e4b5d802ec48ba3acad8643291bab3e9be09bb5c89ca2e660eb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844207, "uuid": "542f1223-a9f0-412e-8424-c6826fd2383a", "comment": "Malware payload (Mirai)", "value": "46cb4bc8ee49c27a055daa17c668f784c1f9c7d8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677844207, "uuid": "1dec0338-5a1b-470e-aac1-459a8fe0e36c", "comment": "Malware payload (Mirai)", "value": "170dc28a8773a6a53fe01b76bbe272772dc7ec21883012a4a3f2cba532cd5d5914938a574a2cc80ddc39b021b61cba20", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844207, "uuid": "636b9e67-230a-4a98-bdfc-f0597d09cca1", "value": "T104232841B8818613C6E4137AB66E46CE3B2563E8E2DFB3179D221F503B9682F0C67F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844207, "uuid": "d0955460-f8e9-4b91-b7db-38d153f0a709", "value": "768:hRT38FvJsOvEZU3JyvqKVtn9K6/8axU/PoVg3/N+WzHn533LEw:P38Fv+Ovo089wl/p3XBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677844207, "uuid": "56c90383-9430-4ed5-85bd-37ac2fdb4b9b", "value": 46868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677844207, "uuid": "9f8bdc63-c9ec-4235-9aee-cfff3da8316a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677844207, "uuid": "5a78e14f-1de3-47a7-aa60-009cbf524139", "value": "arm-20230303-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785f61de-b97d-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1677818405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818405, "uuid": "f7ce4397-5ad8-4262-9fd0-a767a8835ee2", "comment": "Malware payload (NanoCore)", "value": "850de288371bc1258e43b49e20528231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818405, "uuid": "699711ae-68a2-4d69-84b7-b1bd8256d93f", "comment": "Malware payload (NanoCore)", "value": "fcb4a98a0dcc0ce059d8128ad713b8fda7163ccb3150a8e87b23d6a6d01be522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818405, "uuid": "82825a68-af5f-4b19-ae84-3524d7e6bd5f", "comment": "Malware payload (NanoCore)", "value": "f758a9c5a02730f2b884df51b3682726cccb3e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677818405, "uuid": "9da181eb-9961-46ec-8e48-80112790f9d2", "comment": "Malware payload (NanoCore)", "value": "1599ca5ed556435535c63dff2d39925f7920694181feb5e50855041ade46497eb92cc1512a03cc8dbddaf89bee7e6a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818405, "uuid": "d6c86b45-a327-4b6b-9cba-5e811a765000", "value": "T19974D12574E581B2DA53A5BB401DC3B84D9FF8DE0959BD8E2F8A41FA871DB81D22034F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818405, "uuid": "4bc12ce2-759d-4116-86e0-926803979951", "value": "3656671b39fb07039d665176129b6c1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818405, "uuid": "245dc021-eb4a-46fe-8a56-205707379309", "value": "6144:IMTEZW5P4nJC1Ph9cT171Vh5+tlQFtHFvclqGq9gW215KLT:IMTEZWmnJ0PvcT1xX5+fGZF0lqDh215K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677818405, "uuid": "13ff6c8a-550e-4f5c-8bd3-080ad5557f6e", "value": 338948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677818405, "uuid": "feb5a2ee-cf85-454c-b027-d32e33581f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677818405, "uuid": "55cf0923-bdda-442d-b02b-398d4ec9a603", "value": "850de288371bc1258e43b49e20528231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a38f16-b9bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1677845030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845030, "uuid": "a647a476-bb56-4a6f-bc47-b36a5759d6f3", "comment": "Malware payload (Mirai)", "value": "8a598e80efeae2a510f2a3976e08202f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845030, "uuid": "d9886c09-9fcb-4096-b4af-beeef7914abb", "comment": "Malware payload (Mirai)", "value": "fde361119bda89660d61f8576ed721b3b6ecc9e5acfae935ebc0065deb84f4b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845030, "uuid": "21519cb1-e5c3-4e34-a04f-9fc82c53db1e", "comment": "Malware payload (Mirai)", "value": "9bffdf37a6645e2291462d8328fe3ba759d78577", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677845030, "uuid": "173ccedb-e342-4599-b289-b6c50d2eadce", "comment": "Malware payload (Mirai)", "value": "732e9b14268d320cf48a62af32bdc4f390fb64c0573156c9565e0902a00894412384786b5473ed38f273c99367e3e3d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845030, "uuid": "fd628a1e-c265-4375-b156-02e6a68ee7d3", "value": "T12983A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845030, "uuid": "74611437-cdb7-4ca2-8421-31979e0c0be3", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTYp7ZDYovZ73x/nL8y8I:Rakdn2Eo3ePu5GTYpRYo99Be037Ww/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677845030, "uuid": "16c2a411-f565-4205-9bd1-069989bfb259", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677845030, "uuid": "49616fbb-831d-4bbd-9ba8-c20aa7403f25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677845030, "uuid": "09e9c3d3-a8d5-407b-bb54-05db6a95ec27", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cabe919-b9e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1677861201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861201, "uuid": "520fe185-30c9-4adc-9815-1fac98226e2d", "comment": "Malware payload", "value": "5b01be90618b129f113e8ed2c78bd8a1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861201, "uuid": "d878412c-78d2-4fba-b25a-3ea7967e904b", "comment": "Malware payload", "value": "ffeda84533f0d1201355fd1530c3ea171de9ef5e31002d2356baade47a9577a6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861201, "uuid": "f91003d9-7980-4ae4-8391-b272d7f5b876", "comment": "Malware payload", "value": "60eba03955ec07e1ff61959eccd286df8388d017", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1677861201, "uuid": "d4499ccb-5209-462f-9655-ac0d71fc512c", "comment": "Malware payload", "value": "a6f290a76cccef781c80c8bd6ead3e26ac07960f546c600f5e4b26c4b8de31eda52b2acc79615f9b9a8659f2ba93ebfe", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861201, "uuid": "5fd529a0-819e-43ce-9c4c-547872e06e1b", "value": "T10F5733F11D14C92A6A8F43FC74467996C17E77064B3C9292F82CDEAA941C5C232BB2F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861201, "uuid": "d4fa4f94-e71c-40b4-8837-946d9417ed30", "value": "393216:fyFUm7YhVH7RpCFOKOLu57nrcMIfvscMXQnfxq2zAfmRBiIdDLgXwlcFlL06VL:qFrk/7vyNn8sCfHAuiIdDLgccFx0YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1677861201, "uuid": "5651887a-71ed-4d14-bcc7-fad62ffebbf0", "value": 29648050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1677861201, "uuid": "8dc2294d-b28c-4c3b-ad91-61da93c60ae4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1677861201, "uuid": "07f1db0a-3ebc-4066-be03-ba4a121dd9d1", "value": "SUPPLY_1.JS.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }